Compare commits
9
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Tinderbox User
|
6fd3eb76b0 | ||
|
Tinderbox User
|
a30c137f31 | ||
 Michał Kępień
|
c98823cc37 | ||
|
Michał Kępień
|
3ea5882717 | ||
|
Michał Kępień
|
de5e13df0b | ||
|
Michał Kępień
|
92502ccaa6 | ||
|
Michał Kępień
|
db25359faa | ||
|
Michał Kępień
|
e1aa5d0049 | ||
 Michal NowakandMichał Kępień
|
ca51ba3c22 |
@@ -11,7 +11,6 @@ BraceWrapping:
|
||||
AfterFunction: false # should also be MultiLine, but not yet supported
|
||||
AfterExternBlock: false
|
||||
BeforeElse: false
|
||||
BeforeWhile: false
|
||||
IndentBraces: false
|
||||
SplitEmptyFunction: true
|
||||
AllowShortIfStatementsOnASingleLine: false
|
||||
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
|
||||
Cpp11BracedListStyle: false
|
||||
ColumnLimit: 80
|
||||
AlignAfterOpenBracket: Align
|
||||
AlignConsecutiveBitFields: true
|
||||
AlignConsecutiveDeclarations: false
|
||||
AlignConsecutiveMacros: true
|
||||
AlignTrailingComments: true
|
||||
@@ -64,7 +62,6 @@ IncludeCategories:
|
||||
Priority: 1
|
||||
- Regex: '.*'
|
||||
Priority: 0
|
||||
IndentExternBlock: NoIndent
|
||||
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||
MaxEmptyLinesToKeep: 1
|
||||
PenaltyBreakAssignment: 30
|
||||
|
||||
@@ -11,7 +11,6 @@ BraceWrapping:
|
||||
AfterFunction: false # should also be MultiLine, but not yet supported
|
||||
AfterExternBlock: false
|
||||
BeforeElse: false
|
||||
BeforeWhile: false
|
||||
IndentBraces: false
|
||||
SplitEmptyFunction: true
|
||||
AllowShortIfStatementsOnASingleLine: false
|
||||
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
|
||||
Cpp11BracedListStyle: false
|
||||
ColumnLimit: 80
|
||||
AlignAfterOpenBracket: Align
|
||||
AlignConsecutiveBitFields: true
|
||||
AlignConsecutiveDeclarations: true
|
||||
AlignConsecutiveMacros: true
|
||||
AlignTrailingComments: true
|
||||
@@ -52,7 +50,6 @@ IncludeCategories:
|
||||
Priority: 1
|
||||
- Regex: '".*"'
|
||||
Priority: 9
|
||||
IndentExternBlock: NoIndent
|
||||
KeepEmptyLinesAtTheStartOfBlocks: false
|
||||
MaxEmptyLinesToKeep: 1
|
||||
PenaltyBreakAssignment: 30
|
||||
|
||||
@@ -77,9 +77,6 @@
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "bin/rndc/include"))
|
||||
|
||||
(expand-file-name "/usr/include/libxml2")
|
||||
(expand-file-name "/usr/include/json-c")
|
||||
|
||||
(expand-file-name "/usr/local/opt/openssl@1.1/include")
|
||||
(expand-file-name "/usr/local/opt/libxml2/include/libxml2")
|
||||
(expand-file-name "/usr/local/opt/json-c/include/json-c/")
|
||||
@@ -109,9 +106,6 @@
|
||||
(list
|
||||
"--enable=all"
|
||||
"--suppress=missingIncludeSystem"
|
||||
"--suppress=nullPointerRedundantCheck"
|
||||
(concat "--suppressions-list=" (expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "util/suppressions.txt")))
|
||||
(concat "-include=" (expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "config.h")))
|
||||
)
|
||||
|
||||
+317
-505
File diff suppressed because it is too large
Load Diff
@@ -1,9 +1,7 @@
|
||||
[MASTER]
|
||||
disable=
|
||||
C0103, # invalid-name
|
||||
C0114, # missing-module-docstring
|
||||
C0115, # missing-class-docstring
|
||||
C0116, # missing-function-docstring
|
||||
C0209, # consider-using-f-string
|
||||
C0415, # import-outside-toplevel
|
||||
R0801, # duplicate-code
|
||||
C0103, # invalid-name
|
||||
|
||||
@@ -1,786 +1,3 @@
|
||||
5776. [bug] Add a missing isc_condition_destroy() for nmsocket
|
||||
condition variable and add missing isc_mutex_destroy()
|
||||
for nmworker lock. [GL #3051]
|
||||
|
||||
5773. [func] Change the message when accepting TCP connection has
|
||||
failed to say "Accepting TCP connection failed" and
|
||||
change the log level for ISC_R_NOTCONNECTED, ISC_R_QUOTA
|
||||
and ISC_R_SOFTQUOTA results codes from ERROR to INFO.
|
||||
[GL #2700]
|
||||
|
||||
5768. [bug] dnssec-dsfromkey failed to omit revoked keys. [GL #853]
|
||||
|
||||
5764. [bug] dns_sdlz_putrr failed to process some valid resource
|
||||
records. [GL #3021]
|
||||
|
||||
5762. [bug] Fix a "named" crash related to removing and restoring a
|
||||
`catalog-zone` entry in the configuration file and
|
||||
running `rndc reconfig`. [GL #1608]
|
||||
|
||||
5758. [bug] mdig now honors the operating system's preferred
|
||||
ephemeral port range. [GL #2374]
|
||||
|
||||
5757. [test] Replace sed in nsupdate system test with awk to
|
||||
construct the nsupdate command. The sed expression
|
||||
was not reliably changing the ttl. [GL #3003]
|
||||
|
||||
--- 9.16.23 released ---
|
||||
|
||||
5752. [bug] Fix an assertion failure caused by missing member zones
|
||||
during a reload of a catalog zone. [GL #2308]
|
||||
|
||||
5750. [bug] Fix a bug when comparing two RSA keys. There was a typo
|
||||
which caused the "p" prime factors to not being
|
||||
compared. [GL #2972]
|
||||
|
||||
5737. [bug] Address Coverity warning in lib/dns/dnssec.c.
|
||||
[GL #2935]
|
||||
|
||||
--- 9.16.22 released ---
|
||||
|
||||
5736. [security] The "lame-ttl" option is now forcibly set to 0. This
|
||||
effectively disables the lame server cache, as it could
|
||||
previously be abused by an attacker to significantly
|
||||
degrade resolver performance. (CVE-2021-25219)
|
||||
[GL #2899]
|
||||
|
||||
5724. [bug] Address a potential deadlock when checking zone content
|
||||
consistency. [GL #2908]
|
||||
|
||||
5723. [bug] Change 5709 broke backward compatibility for the
|
||||
"check-names master ..." and "check-names slave ..."
|
||||
options. This has been fixed. [GL #2911]
|
||||
|
||||
5720. [contrib] Old-style DLZ drivers that had to be enabled at
|
||||
build-time have been marked as deprecated. [GL #2814]
|
||||
|
||||
5719. [func] The "map" zone file format has been marked as
|
||||
deprecated. [GL #2882]
|
||||
|
||||
5717. [func] The "cache-file" option, which was documented as "for
|
||||
testing purposes only" and not to be used, has been
|
||||
removed. [GL #2903]
|
||||
|
||||
5716. [bug] Multiple library names were mistakenly passed to the
|
||||
krb5-config utility when ./configure was invoked with
|
||||
the --with-gssapi=[/path/to/]krb5-config option. This
|
||||
has been fixed by invoking krb5-config separately for
|
||||
each required library. [GL #2866]
|
||||
|
||||
5715. [func] Add a check for ports specified in "*-source(-v6)"
|
||||
options clashing with a global listening port. Such a
|
||||
configuration was already unsupported, but it failed
|
||||
silently; it is now treated as an error. [GL #2888]
|
||||
|
||||
5714. [bug] Remove the "adjust interface" mechanism which was
|
||||
responsible for setting up listeners on interfaces when
|
||||
the "*-source(-v6)" address and port were the same as
|
||||
the "listen-on(-v6)" address and port. Such a
|
||||
configuration is no longer supported; under certain
|
||||
timing conditions, that mechanism could prevent named
|
||||
from listening on some TCP ports. This has been fixed.
|
||||
[GL #2852]
|
||||
|
||||
5712. [doc] Add deprecation notice about removing native PKCS#11
|
||||
support in the next major BIND 9 release. [GL #2691]
|
||||
|
||||
--- 9.16.21 released ---
|
||||
|
||||
5711. [bug] "map" files exceeding 2GB in size failed to load due to
|
||||
a size comparison that incorrectly treated the file size
|
||||
as a signed integer. [GL #2878]
|
||||
|
||||
5710. [port] win32: incorrect parentheses resulted in the wrong
|
||||
sizeof() tests being used to pick the appropriate
|
||||
Windows atomic operations for the object's size.
|
||||
[GL #2891]
|
||||
|
||||
5709. [cleanup] Enum values throughout the code have been updated
|
||||
to use the terms "primary" and "secondary" instead of
|
||||
"master" and "slave", respectively. [GL #1944]
|
||||
|
||||
5708. [bug] The thread-local isc_tid_v variable was not properly
|
||||
initialized when running BIND 9 as a Windows Service,
|
||||
leading to a crash on startup. [GL #2837]
|
||||
|
||||
5705. [bug] Change #5686 altered the internal memory structure of
|
||||
zone databases, but neglected to update the MAPAPI value
|
||||
for zone files in "map" format. This caused named to
|
||||
attempt to load incompatible map files, triggering an
|
||||
assertion failure on startup. The MAPAPI value has now
|
||||
been updated, so named rejects outdated files when
|
||||
encountering them. [GL #2872]
|
||||
|
||||
5704. [bug] Change #5317 caused the EDNS TCP Keepalive option to be
|
||||
ignored inadvertently in client requests. It has now
|
||||
been fixed and this option is handled properly again.
|
||||
[GL #1927]
|
||||
|
||||
5701. [bug] named-checkconf failed to detect syntactically invalid
|
||||
values of the "key" and "tls" parameters used to define
|
||||
members of remote server lists. [GL #2461]
|
||||
|
||||
5700. [bug] When a member zone was removed from a catalog zone,
|
||||
journal files for the former were not deleted.
|
||||
[GL #2842]
|
||||
|
||||
5699. [func] Data structures holding DNSSEC signing statistics are
|
||||
now grown and shrunk as necessary upon key rollover
|
||||
events. [GL #1721]
|
||||
|
||||
5698. [bug] When a DNSSEC-signed zone which only has a single
|
||||
signing key available is migrated to use KASP, that key
|
||||
is now treated as a Combined Signing Key (CSK).
|
||||
[GL #2857]
|
||||
|
||||
5696. [protocol] Support for HTTPS and SVCB record types has been added.
|
||||
(This does not include ADDITIONAL section processing for
|
||||
these record types, only basic support for RR type
|
||||
parsing and printing.) [GL #1132]
|
||||
|
||||
5694. [bug] Stale data in the cache could cause named to send
|
||||
non-minimized queries despite QNAME minimization being
|
||||
enabled. [GL #2665]
|
||||
|
||||
5691. [bug] When a dynamic zone was made available in another view
|
||||
using the "in-view" statement, running "rndc freeze"
|
||||
always reported an "already frozen" error even though
|
||||
the zone was successfully frozen. [GL #2844]
|
||||
|
||||
5690. [func] dnssec-signzone now honors Predecessor and Successor
|
||||
metadata found in private key files: if a signature for
|
||||
an RRset generated by the inactive predecessor exists
|
||||
and does not need to be replaced, no additional
|
||||
signature is now created for that RRset using the
|
||||
successor key. This enables dnssec-signzone to gradually
|
||||
replace RRSIGs during a ZSK rollover. [GL #1551]
|
||||
|
||||
--- 9.16.20 released ---
|
||||
|
||||
5689. [security] An assertion failure occurred when named attempted to
|
||||
send a UDP packet that exceeded the MTU size, if
|
||||
Response Rate Limiting (RRL) was enabled.
|
||||
(CVE-2021-25218) [GL #2856]
|
||||
|
||||
5688. [bug] Zones using KASP and inline-signed zones failed to apply
|
||||
changes from the unsigned zone to the signed zone under
|
||||
certain circumstances. This has been fixed. [GL #2735]
|
||||
|
||||
5687. [bug] "rndc reload <zonename>" could trigger a redundant
|
||||
reload for an inline-signed zone whose zone file was not
|
||||
modified since the last "rndc reload". This has been
|
||||
fixed. [GL #2855]
|
||||
|
||||
5686. [func] The number of internal data structures allocated for
|
||||
each zone was reduced. [GL #2829]
|
||||
|
||||
5685. [bug] named failed to check the opcode of responses when
|
||||
performing zone refreshes, stub zone updates, and UPDATE
|
||||
forwarding. This has been fixed. [GL #2762]
|
||||
|
||||
5682. [bug] Some changes to "zone-statistics" settings were not
|
||||
properly processed by "rndc reconfig". This has been
|
||||
fixed. [GL #2820]
|
||||
|
||||
5681. [func] Relax the checks in the dns_zone_cdscheck() function to
|
||||
allow CDS and CDNSKEY records in the zone that do not
|
||||
match an existing DNSKEY record, as long as the
|
||||
algorithm matches. This allows a clean rollover from one
|
||||
provider to another in a multi-signer DNSSEC
|
||||
configuration. [GL #2710]
|
||||
|
||||
5679. [func] Thread affinity is no longer set. [GL #2822]
|
||||
|
||||
5678. [bug] The "check DS" code failed to release all resources upon
|
||||
named shutdown when a refresh was in progress. This has
|
||||
been fixed. [GL #2811]
|
||||
|
||||
5672. [bug] Authentication of rndc messages could fail if a
|
||||
"controls" statement was configured with multiple key
|
||||
algorithms for the same listener. This has been fixed.
|
||||
[GL #2756]
|
||||
|
||||
--- 9.16.19 released ---
|
||||
|
||||
5671. [bug] A race condition could occur where two threads were
|
||||
competing for the same set of key file locks, leading to
|
||||
a deadlock. This has been fixed. [GL #2786]
|
||||
|
||||
5670. [bug] create_keydata() created an invalid placeholder keydata
|
||||
record upon a refresh failure, which prevented the
|
||||
database of managed keys from subsequently being read
|
||||
back. This has been fixed. [GL #2686]
|
||||
|
||||
5669. [func] KASP support was extended with the "check DS" feature.
|
||||
Zones with "dnssec-policy" and "parental-agents"
|
||||
configured now check for DS presence and can perform
|
||||
automatic KSK rollovers. [GL #1126]
|
||||
|
||||
5668. [bug] Rescheduling a setnsec3param() task when a zone failed
|
||||
to load on startup caused a hang on shutdown. This has
|
||||
been fixed. [GL #2791]
|
||||
|
||||
5667. [bug] The configuration-checking code failed to account for
|
||||
the inheritance rules of the "dnssec-policy" option.
|
||||
This has been fixed. [GL #2780]
|
||||
|
||||
5666. [doc] The safe "edns-udp-size" value was tweaked to match the
|
||||
probing value from BIND 9.16 for better compatibility.
|
||||
[GL #2183]
|
||||
|
||||
5665. [bug] If nsupdate sends an SOA request and receives a REFUSED
|
||||
response, it now fails over to the next available
|
||||
server. [GL #2758]
|
||||
|
||||
5664. [func] For UDP messages larger than the path MTU, named now
|
||||
sends an empty response with the TC (TrunCated) bit set.
|
||||
In addition, setting the DF (Don't Fragment) flag on
|
||||
outgoing UDP sockets was re-enabled. [GL #2790]
|
||||
|
||||
5662. [bug] Views with recursion disabled are now configured with a
|
||||
default cache size of 2 MB unless "max-cache-size" is
|
||||
explicitly set. This prevents cache RBT hash tables from
|
||||
being needlessly preallocated for such views. [GL #2777]
|
||||
|
||||
5661. [bug] Change 5644 inadvertently introduced a deadlock: when
|
||||
locking the key file mutex for each zone structure in a
|
||||
different view, the "in-view" logic was not considered.
|
||||
This has been fixed. [GL #2783]
|
||||
|
||||
5658. [bug] Increasing "max-cache-size" for a running named instance
|
||||
(using "rndc reconfig") did not cause the hash tables
|
||||
used by cache databases to be grown accordingly. This
|
||||
has been fixed. [GL #2770]
|
||||
|
||||
5655. [bug] Signed, insecure delegation responses prepared by named
|
||||
either lacked the necessary NSEC records or contained
|
||||
duplicate NSEC records when both wildcard expansion and
|
||||
CNAME chaining were required to prepare the response.
|
||||
This has been fixed. [GL #2759]
|
||||
|
||||
5653. [bug] A bug that caused the NSEC3 salt to be changed on every
|
||||
restart for zones using KASP has been fixed. [GL #2725]
|
||||
|
||||
--- 9.16.18 released ---
|
||||
|
||||
5660. [bug] The configuration-checking code failed to account for
|
||||
the inheritance rules of the "key-directory" option.
|
||||
[GL #2778]
|
||||
|
||||
5659. [bug] When preparing DNS responses, named could replace the
|
||||
letters 'W' (uppercase) and 'w' (lowercase) with '\000'.
|
||||
This has been fixed. [GL #2779]
|
||||
|
||||
--- 9.16.17 released ---
|
||||
|
||||
5652. [bug] A copy-and-paste error in change 5584 caused the
|
||||
IP_DONTFRAG socket option to be enabled instead of
|
||||
disabled. This has been fixed. [GL #2746]
|
||||
|
||||
5651. [func] Refactor zone dumping to be processed asynchronously via
|
||||
the uv_work_t thread pool API. [GL #2732]
|
||||
|
||||
5650. [bug] Prevent a crash that could occur if serve-stale was
|
||||
enabled and a prefetch was triggered during a query
|
||||
restart. [GL #2733]
|
||||
|
||||
5649. [bug] If a query was answered with stale data on a server with
|
||||
DNS64 enabled, an assertion could occur if a non-stale
|
||||
answer arrived afterward. [GL #2731]
|
||||
|
||||
5648. [bug] The calculation of the estimated IXFR transaction size
|
||||
in dns_journal_iter_init() was invalid. [GL #2685]
|
||||
|
||||
5644. [bug] Fix a race condition in reading and writing key files
|
||||
for zones using KASP and configured in multiple views.
|
||||
[GL #1875]
|
||||
|
||||
5643. [cleanup] "make install" no longer creates an empty
|
||||
${localstatedir}/run directory. [GL #2709]
|
||||
|
||||
5642. [bug] Zones which are configured in multiple views with
|
||||
different values set for "dnssec-policy" and with
|
||||
identical values set for "key-directory" are now
|
||||
detected and treated as a configuration error.
|
||||
[GL #2463]
|
||||
|
||||
5641. [bug] Address a potential memory leak in
|
||||
dst_key_fromnamedfile(). [GL #2689]
|
||||
|
||||
5639. [bug] Check that the first and last SOA record of an AXFR are
|
||||
consistent. [GL #2528]
|
||||
|
||||
5638. [bug] Improvements related to network manager/task manager
|
||||
integration:
|
||||
- isc_managers_create() and isc_managers_destroy()
|
||||
functions were added to handle setup and teardown of
|
||||
netmgr, taskmgr, timermgr, and socketmgr, since these
|
||||
require a precise order of operations now.
|
||||
- Event queue processing is now quantized to prevent
|
||||
infinite looping.
|
||||
- The netmgr can now be paused from within a netmgr
|
||||
thread.
|
||||
- Deadlocks due to a conflict between netmgr's
|
||||
pause/resume and listen/stoplistening operations were
|
||||
fixed.
|
||||
[GL #2654]
|
||||
|
||||
5633. [doc] The "inline-signing" option was incorrectly described as
|
||||
being inherited from the "options"/"view" levels and was
|
||||
incorrectly accepted at those levels without effect.
|
||||
This has been fixed. [GL #2536]
|
||||
|
||||
5624. [func] Task manager events are now processed inside network
|
||||
manager loops. The task manager no longer needs its own
|
||||
set of worker threads, which improves resolver
|
||||
performance. [GL #2638]
|
||||
|
||||
--- 9.16.16 released ---
|
||||
|
||||
5637. [func] Change the default value of the "max-ixfr-ratio" option
|
||||
to "unlimited". [GL #2671]
|
||||
|
||||
5636. [bug] named and named-checkconf did not report an error when
|
||||
multiple zones with the "dnssec-policy" option set were
|
||||
using the same zone file. This has been fixed.
|
||||
[GL #2603]
|
||||
|
||||
5635. [bug] Journal compaction could fail when a journal with
|
||||
invalid transaction headers was not detected at startup.
|
||||
This has been fixed. [GL #2670]
|
||||
|
||||
5634. [bug] If "dnssec-policy" was active and a private key file was
|
||||
temporarily offline during a rekey event, named could
|
||||
incorrectly introduce replacement keys and break a
|
||||
signed zone. This has been fixed. [GL #2596]
|
||||
|
||||
5633. [doc] The "inline-signing" option was incorrectly described as
|
||||
being inherited from the "options"/"view" levels and was
|
||||
incorrectly accepted at those levels without effect.
|
||||
This has been fixed. [GL #2536]
|
||||
|
||||
5632. [func] Add a new built-in KASP, "insecure", which is used to
|
||||
transition a zone from a signed to an unsigned state.
|
||||
The existing built-in KASP "none" should no longer be
|
||||
used to unsign a zone. [GL #2645]
|
||||
|
||||
5631. [protocol] Update the implementation of the ZONEMD RR type to match
|
||||
RFC 8976. [GL #2658]
|
||||
|
||||
5630. [func] Treat DNSSEC responses containing NSEC3 records with
|
||||
iteration counts greater than 150 as insecure.
|
||||
[GL #2445]
|
||||
|
||||
5629. [func] Reduce the maximum supported number of NSEC3 iterations
|
||||
that can be configured for a zone to 150. [GL #2642]
|
||||
|
||||
5627. [bug] RRSIG(SOA) RRsets placed anywhere other than at the zone
|
||||
apex were triggering infinite resigning loops. This has
|
||||
been fixed. [GL #2650]
|
||||
|
||||
5626. [bug] When generating zone signing keys, KASP now also checks
|
||||
for key ID conflicts among newly created keys, rather
|
||||
than just between new and existing ones. [GL #2628]
|
||||
|
||||
5625. [bug] A deadlock could occur when multiple "rndc addzone",
|
||||
"rndc delzone", and/or "rndc modzone" commands were
|
||||
invoked simultaneously for different zones. This has
|
||||
been fixed. [GL #2626]
|
||||
|
||||
5622. [cleanup] The lib/samples/ directory has been removed, as export
|
||||
versions of libraries are no longer maintained.
|
||||
[GL !4835]
|
||||
|
||||
5619. [protocol] Implement draft-vandijk-dnsop-nsec-ttl, updating the
|
||||
protocol such that NSEC(3) TTL values are set to the
|
||||
minimum of the SOA MINIMUM value or the SOA TTL.
|
||||
[GL #2347]
|
||||
|
||||
5618. [bug] Change 5149 introduced some inconsistencies in the way
|
||||
record TTLs were presented in cache dumps. These
|
||||
inconsistencies have been eliminated. [GL #389]
|
||||
[GL #2289]
|
||||
|
||||
--- 9.16.15 released ---
|
||||
|
||||
5621. [bug] Due to a backporting mistake in change 5609, named
|
||||
binaries built against a Kerberos/GSSAPI library whose
|
||||
header files did not define the GSS_SPNEGO_MECHANISM
|
||||
preprocessor macro were not able to start if their
|
||||
configuration included the "tkey-gssapi-credential"
|
||||
option. This has been fixed. [GL #2634]
|
||||
|
||||
5620. [bug] If zone journal files written by BIND 9.16.11 or earlier
|
||||
were present when BIND was upgraded, the zone file for
|
||||
that zone could have been inadvertently rewritten with
|
||||
the current zone contents. This caused the original zone
|
||||
file structure (e.g. comments, $INCLUDE directives) to
|
||||
be lost, although the zone data itself was preserved.
|
||||
This has been fixed. [GL #2623]
|
||||
|
||||
--- 9.16.14 released ---
|
||||
|
||||
5617. [security] A specially crafted GSS-TSIG query could cause a buffer
|
||||
overflow in the ISC implementation of SPNEGO.
|
||||
(CVE-2021-25216) [GL #2604]
|
||||
|
||||
5616. [security] named crashed when a DNAME record placed in the ANSWER
|
||||
section during DNAME chasing turned out to be the final
|
||||
answer to a client query. (CVE-2021-25215) [GL #2540]
|
||||
|
||||
5615. [security] Insufficient IXFR checks could result in named serving a
|
||||
zone without an SOA record at the apex, leading to a
|
||||
RUNTIME_CHECK assertion failure when the zone was
|
||||
subsequently refreshed. This has been fixed by adding an
|
||||
owner name check for all SOA records which are included
|
||||
in a zone transfer. (CVE-2021-25214) [GL #2467]
|
||||
|
||||
5614. [bug] Ensure all resources are properly cleaned up when a call
|
||||
to gss_accept_sec_context() fails. [GL #2620]
|
||||
|
||||
5613. [bug] It was possible to write an invalid transaction header
|
||||
in the journal file for a managed-keys database after
|
||||
upgrading. This has been fixed. Invalid headers in
|
||||
existing journal files are detected and named is able
|
||||
to recover from them. [GL #2600]
|
||||
|
||||
5611. [func] Set "stale-answer-client-timeout" to "off" by default.
|
||||
[GL #2608]
|
||||
|
||||
5610. [bug] Prevent a crash which could happen when a lookup
|
||||
triggered by "stale-answer-client-timeout" was attempted
|
||||
right after recursion for a client query finished.
|
||||
[GL #2594]
|
||||
|
||||
5609. [func] The ISC implementation of SPNEGO was removed from BIND 9
|
||||
source code. It was no longer necessary as all major
|
||||
contemporary Kerberos/GSSAPI libraries include support
|
||||
for SPNEGO. [GL #2607]
|
||||
|
||||
5608. [bug] When sending queries over TCP, dig now properly handles
|
||||
"+tries=1 +retry=0" by not retrying the connection when
|
||||
the remote server closes the connection prematurely.
|
||||
[GL #2490]
|
||||
|
||||
5607. [bug] As "rndc dnssec -checkds" and "rndc dnssec -rollover"
|
||||
commands may affect the next scheduled key event,
|
||||
reconfiguration of zone keys is now triggered after
|
||||
receiving either of these commands to prevent
|
||||
unnecessary key rollover delays. [GL #2488]
|
||||
|
||||
5606. [bug] CDS/CDNSKEY DELETE records are now removed when a zone
|
||||
transitions from a secure to an insecure state.
|
||||
named-checkzone also no longer reports an error when
|
||||
such records are found in an unsigned zone. [GL #2517]
|
||||
|
||||
5605. [bug] "dig -u" now uses the CLOCK_REALTIME clock source for
|
||||
more accurate time reporting. [GL #2592]
|
||||
|
||||
5603. [bug] Fix a memory leak that occurred when named failed to
|
||||
bind a UDP socket to a network interface. [GL #2575]
|
||||
|
||||
5602. [bug] Fix TCPDNS and TLSDNS timers in Network Manager. This
|
||||
makes the "tcp-initial-timeout" and "tcp-idle-timeout"
|
||||
options work correctly again. [GL #2583]
|
||||
|
||||
5601. [bug] Zones using KASP could not be thawed after they were
|
||||
frozen using "rndc freeze". This has been fixed.
|
||||
[GL #2523]
|
||||
|
||||
--- 9.16.13 released ---
|
||||
|
||||
5597. [bug] When serve-stale was enabled and starting the recursive
|
||||
resolution process for a query failed, a named instance
|
||||
could crash if it was configured as both a recursive and
|
||||
authoritative server. This problem was introduced by
|
||||
change 5573 and has now been fixed. [GL #2565]
|
||||
|
||||
5595. [cleanup] Public header files for BIND 9 libraries no longer
|
||||
directly include third-party library headers. This
|
||||
prevents the need to include paths to third-party header
|
||||
files in CFLAGS whenever BIND 9 public header files are
|
||||
used, which could cause build-time issues on hosts with
|
||||
older versions of BIND 9 installed. [GL #2357]
|
||||
|
||||
5594. [bug] Building with --enable-dnsrps --enable-dnsrps-dl failed.
|
||||
[GL #2298]
|
||||
|
||||
5593. [bug] Journal files written by older versions of named can now
|
||||
be read when loading zones, so that journal
|
||||
incompatibility does not cause problems on upgrade.
|
||||
Outdated journals are updated to the new format after
|
||||
loading. [GL #2505]
|
||||
|
||||
5592. [bug] Prevent hazard pointer table overflows on machines with
|
||||
many cores, by allowing the thread IDs (serving as
|
||||
indices into hazard pointer tables) of finished threads
|
||||
to be reused by those created later. [GL #2396]
|
||||
|
||||
5591. [bug] Fix a crash that occurred when
|
||||
"stale-answer-client-timeout" was triggered without any
|
||||
(stale) data available in the cache to answer the query.
|
||||
[GL #2503]
|
||||
|
||||
5590. [bug] NSEC3 records were not immediately created for dynamic
|
||||
zones using NSEC3 with "dnssec-policy", resulting in
|
||||
such zones going bogus. Add code to process the
|
||||
NSEC3PARAM queue at zone load time so that NSEC3 records
|
||||
for such zones are created immediately. [GL #2498]
|
||||
|
||||
5588. [func] Add a new "purge-keys" option for "dnssec-policy". This
|
||||
option determines the period of time for which key files
|
||||
are retained after they become obsolete. [GL #2408]
|
||||
|
||||
5586. [bug] An invalid direction field in a LOC record resulted in
|
||||
an INSIST failure when a zone file containing such a
|
||||
record was loaded. [GL #2499]
|
||||
|
||||
5584. [bug] No longer set the IP_DONTFRAG option on UDP sockets, to
|
||||
prevent dropping outgoing packets exceeding
|
||||
"max-udp-size". [GL #2466]
|
||||
|
||||
5582. [bug] BIND 9 failed to build when static OpenSSL libraries
|
||||
were used and the pkg-config files for libssl and/or
|
||||
libcrypto were unavailable. This has been fixed by
|
||||
ensuring that the correct linking order for libssl and
|
||||
libcrypto is always used. [GL #2402]
|
||||
|
||||
5581. [bug] Fix a memory leak that occurred when inline-signed zones
|
||||
were added to the configuration, followed by a
|
||||
reconfiguration of named. [GL #2041]
|
||||
|
||||
5580. [test] The system test framework no longer differentiates
|
||||
between SKIPPED and UNTESTED system test results. Any
|
||||
system test which is not run is now marked as SKIPPED.
|
||||
[GL !4517]
|
||||
|
||||
5573. [func] When serve-stale is enabled and stale data is available,
|
||||
named now returns stale answers upon encountering any
|
||||
unexpected error in the query resolution process.
|
||||
However, the "stale-refresh-time" window is still only
|
||||
started upon a timeout. [GL #2434]
|
||||
|
||||
5564. [cleanup] Network manager's TLSDNS module was refactored to use
|
||||
libuv and libssl directly instead of a stack of TCP/TLS
|
||||
sockets. [GL #2335]
|
||||
|
||||
--- 9.16.12 released ---
|
||||
|
||||
5578. [protocol] Make "check-names" accept A records below "_spf",
|
||||
"_spf_rate", and "_spf_verify" labels in order to cater
|
||||
for the "exists" SPF mechanism specified in RFC 7208
|
||||
section 5.7 and appendix D.1. [GL #2377]
|
||||
|
||||
5577. [bug] Fix the "three is a crowd" key rollover bug in KASP by
|
||||
correctly implementing Equation (2) of the "Flexible and
|
||||
Robust Key Rollover" paper. [GL #2375]
|
||||
|
||||
5575. [bug] When migrating to KASP, BIND 9 considered keys with the
|
||||
"Inactive" and/or "Delete" timing metadata to be
|
||||
possible active keys. This has been fixed. [GL #2406]
|
||||
|
||||
5572. [bug] Address potential double free in generatexml().
|
||||
[GL #2420]
|
||||
|
||||
5571. [bug] named failed to start when its configuration included a
|
||||
zone with a non-builtin "allow-update" ACL attached.
|
||||
[GL #2413]
|
||||
|
||||
5570. [bug] Improve performance of the DNSSEC verification code by
|
||||
reducing the number of repeated calls to
|
||||
dns_dnssec_keyfromrdata(). [GL #2073]
|
||||
|
||||
5569. [bug] Emit useful error message when "rndc retransfer" is
|
||||
applied to a zone of inappropriate type. [GL #2342]
|
||||
|
||||
5568. [bug] Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
|
||||
keys. [GL #2178]
|
||||
|
||||
5567. [bug] Dig now reports unknown dash options while pre-parsing
|
||||
the options. This prevents "-multi" instead of "+multi"
|
||||
from reporting memory usage before ending option parsing
|
||||
with "Invalid option: -lti". [GL #2403]
|
||||
|
||||
5566. [func] Add "stale-answer-client-timeout" option, which is the
|
||||
amount of time a recursive resolver waits before
|
||||
attempting to answer the query using stale data from
|
||||
cache. [GL #2247]
|
||||
|
||||
5565. [func] The SONAMEs for BIND 9 libraries now include the current
|
||||
BIND 9 version number, in an effort to tightly couple
|
||||
internal libraries with a specific release. [GL #2387]
|
||||
|
||||
5562. [security] Fix off-by-one bug in ISC SPNEGO implementation.
|
||||
(CVE-2020-8625) [GL #2354]
|
||||
|
||||
5561. [bug] KASP incorrectly set signature validity to the value of
|
||||
the DNSKEY signature validity. This is now fixed.
|
||||
[GL #2383]
|
||||
|
||||
5560. [func] The default value of "max-stale-ttl" has been changed
|
||||
from 12 hours to 1 day and the default value of
|
||||
"stale-answer-ttl" has been changed from 1 second to 30
|
||||
seconds, following RFC 8767 recommendations. [GL #2248]
|
||||
|
||||
5456. [func] Added "primaries" as a synonym for "masters" in
|
||||
named.conf, and "primary-only" as a synonym for
|
||||
"master-only" in the parameters to "notify", to bring
|
||||
terminology up-to-date with RFC 8499. [GL #1948]
|
||||
|
||||
5362. [func] Limit the size of IXFR responses so that AXFR will
|
||||
be used instead if it would be smaller. This is
|
||||
controlled by the "max-ixfr-ratio" option, which
|
||||
is a percentage representing the ratio of IXFR size
|
||||
to the size of the entire zone. This value cannot
|
||||
exceed 100%, which is the default. [GL #1515]
|
||||
|
||||
--- 9.16.11 released ---
|
||||
|
||||
5559. [bug] The --with-maxminddb=PATH form of the build-time option
|
||||
enabling support for libmaxminddb was not working
|
||||
correctly. This has been fixed. [GL #2366]
|
||||
|
||||
5557. [bug] Prevent RBTDB instances from being destroyed by multiple
|
||||
threads at the same time. [GL #2317]
|
||||
|
||||
5556. [bug] Further tweak newline printing in dnssec-signzone and
|
||||
dnssec-verify. [GL #2359]
|
||||
|
||||
5555. [bug] server->reload_status was not properly initialized.
|
||||
[GL #2361]
|
||||
|
||||
5554. [bug] dnssec-signzone and dnssec-verify were missing newlines
|
||||
between log messages. [GL #2359]
|
||||
|
||||
5553. [bug] When reconfiguring named, removing "auto-dnssec" did not
|
||||
turn off DNSSEC maintenance. [GL #2341]
|
||||
|
||||
5552. [func] When switching to "dnssec-policy none;", named now
|
||||
permits a safe transition to insecure mode and publishes
|
||||
the CDS and CDNSKEY DELETE records, as described in RFC
|
||||
8078. [GL #1750]
|
||||
|
||||
5551. [bug] named no longer attempts to assign threads to CPUs
|
||||
outside the CPU affinity set. Thanks to Ole Bjørn
|
||||
Hessen. [GL #2245]
|
||||
|
||||
5550. [func] dnssec-signzone and named now log a warning when falling
|
||||
back to the "increment" SOA serial method. [GL #2058]
|
||||
|
||||
5545. [func] OS support for load-balanced sockets is no longer
|
||||
required to receive incoming queries in multiple netmgr
|
||||
threads. [GL #2137]
|
||||
|
||||
5543. [bug] Fix UDP performance issues caused by making netmgr
|
||||
callbacks asynchronous-only. [GL #2320]
|
||||
|
||||
5542. [bug] Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
|
||||
[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
|
||||
[GL #2321]
|
||||
|
||||
--- 9.16.10 released ---
|
||||
|
||||
5544. [func] Restore the default value of "nocookie-udp-size" to 4096
|
||||
bytes. [GL #2250]
|
||||
|
||||
5541. [func] Adjust the "max-recursion-queries" default from 75 to
|
||||
100. [GL #2305]
|
||||
|
||||
5540. [port] Fix building with native PKCS#11 support for AEP Keyper.
|
||||
[GL #2315]
|
||||
|
||||
5539. [bug] Tighten handling of missing DNS COOKIE responses over
|
||||
UDP by falling back to TCP. [GL #2275]
|
||||
|
||||
5538. [func] Add NSEC3 support to KASP. A new option for
|
||||
"dnssec-policy", "nsec3param", can be used to set the
|
||||
desired NSEC3 parameters. NSEC3 salt collisions are
|
||||
automatically prevented during resalting. Salt
|
||||
generation is now logged with zone context. [GL #1620]
|
||||
|
||||
5534. [bug] The CNAME synthesized from a DNAME was incorrectly
|
||||
followed when the QTYPE was CNAME or ANY. [GL #2280]
|
||||
|
||||
--- 9.16.9 released ---
|
||||
|
||||
5533. [func] Add the "stale-refresh-time" option, a time window that
|
||||
starts after a failed lookup, during which a stale RRset
|
||||
is served directly from cache before a new attempt to
|
||||
refresh it is made. [GL #2066]
|
||||
|
||||
5530. [bug] dnstap did not capture responses to forwarded UPDATE
|
||||
requests. [GL #2252]
|
||||
|
||||
5527. [bug] A NULL pointer dereference occurred when creating an NTA
|
||||
recheck query failed. [GL #2244]
|
||||
|
||||
5525. [bug] Change 5503 inadvertently broke cross-compilation by
|
||||
replacing a call to AC_LINK_IFELSE() with a call to
|
||||
AC_RUN_IFELSE() in configure.ac. This has been fixed,
|
||||
making cross-compilation possible again. [GL #2237]
|
||||
|
||||
5523. [bug] The initial lookup in a zone transitioning to/from a
|
||||
signed state could fail if the DNSKEY RRset was not
|
||||
found. [GL #2236]
|
||||
|
||||
5522. [bug] Fixed a race/NULL dereference in TCPDNS send. [GL #2227]
|
||||
|
||||
5520. [bug] Fixed a number of shutdown races, reference counting
|
||||
errors, and spurious log messages that could occur
|
||||
in the network manager. [GL #2221]
|
||||
|
||||
5518. [bug] Stub zones now work correctly with primary servers using
|
||||
"minimal-responses yes". [GL #1736]
|
||||
|
||||
5517. [bug] Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
|
||||
[GL #2208]
|
||||
|
||||
--- 9.16.8 released ---
|
||||
|
||||
5516. [func] The default EDNS buffer size has been changed from 4096
|
||||
to 1232 bytes. [GL #2183]
|
||||
|
||||
5515. [func] Add 'rndc dnssec -rollover' command to trigger a manual
|
||||
rollover for a specific key. [GL #1749]
|
||||
|
||||
5514. [bug] Fix KASP expected key size for Ed25519 and Ed448.
|
||||
[GL #2171]
|
||||
|
||||
5513. [doc] The ARM section describing the "rrset-order" statement
|
||||
was rewritten to make it unambiguous and up-to-date with
|
||||
the source code. [GL #2139]
|
||||
|
||||
5512. [bug] "rrset-order" rules using "order none" were causing
|
||||
named to crash despite named-checkconf treating them as
|
||||
valid. [GL #2139]
|
||||
|
||||
5511. [bug] 'dig -u +yaml' failed to display timestamps to the
|
||||
microsecond. [GL #2190]
|
||||
|
||||
5510. [bug] Implement the attach/detach semantics for dns_message_t
|
||||
to fix a data race in accessing an already-destroyed
|
||||
fctx->rmessage. [GL #2124]
|
||||
|
||||
5509. [bug] filter-aaaa: named crashed upon shutdown if it was in
|
||||
the process of recursing for A RRsets. [GL #1040]
|
||||
|
||||
5508. [func] Added new parameter "-expired" for "rndc dumpdb" that
|
||||
also prints expired RRsets (awaiting cleanup) to the
|
||||
dump file. [GL #1870]
|
||||
|
||||
5507. [bug] Named could compute incorrect SIG(0) responses.
|
||||
[GL #2109]
|
||||
|
||||
5506. [bug] Properly handle failed sysconf() calls, so we don't
|
||||
report invalid memory size. [GL #2166]
|
||||
|
||||
5505. [bug] Updating contents of a mixed-case RPZ could cause some
|
||||
rules to be ignored. [GL #2169]
|
||||
|
||||
5503. [bug] Cleaned up reference counting of network manager
|
||||
handles, now using isc_nmhandle_attach() and _detach()
|
||||
instead of _ref() and _unref(). [GL #2122]
|
||||
|
||||
--- 9.16.7 released ---
|
||||
|
||||
5501. [func] Log CDS/CDNSKEY publication. [GL #1748]
|
||||
|
||||
+11
-9
@@ -30,8 +30,8 @@ BIND is maintained by Internet Systems Consortium, a public-benefit 501(c)
|
||||
source, but only ISC employees have commit access. In the past, the source
|
||||
could only be seen once ISC had published a release; read access to the
|
||||
source repository was restricted just as commit access was. That has
|
||||
changed, as ISC now provides a public git repository of the BIND source
|
||||
tree (see below).
|
||||
changed, as ISC now provides a public git mirror to the BIND source tree
|
||||
(see below).
|
||||
|
||||
At ISC, we're committed to building communities that are welcoming and
|
||||
inclusive: environments where people are encouraged to share ideas, treat
|
||||
@@ -44,11 +44,13 @@ Access to source code
|
||||
|
||||
Public BIND releases are always available from the ISC FTP site.
|
||||
|
||||
A public-access git repository is also available at https://gitlab.isc.org
|
||||
. This repository contains all public release branches. Upcoming releases
|
||||
can be viewed in their current state at any time. Short-lived development
|
||||
branches contain unreviewed work in progress. Commits which address
|
||||
security vulnerablilities are withheld until after public disclosure.
|
||||
A public-access GIT repository is also available at https://gitlab.isc.org
|
||||
. This repository is a mirror, updated several times per day, of the
|
||||
source repository maintained by ISC. It contains all the public release
|
||||
branches; upcoming releases can be viewed in their current state at any
|
||||
time. It does not contain development branches or unreviewed work in
|
||||
progress. Commits which address security vulnerablilities are withheld
|
||||
until after public disclosure.
|
||||
|
||||
You can browse the source online via https://gitlab.isc.org/isc-projects/
|
||||
bind9
|
||||
@@ -67,7 +69,7 @@ Whenever a branch is ready for publication, a tag is placed of the form
|
||||
v9_X_Y. The 9.12.0 release, for instance, is tagged as v9_12_0.
|
||||
|
||||
The branch in which the next major release is being developed is called
|
||||
main.
|
||||
master.
|
||||
|
||||
Reporting bugs
|
||||
|
||||
@@ -123,7 +125,7 @@ Patches for BIND may be submitted directly via merge requests in ISC's
|
||||
GitLab source repository for BIND.
|
||||
|
||||
Patches can also be submitted as diffs against a specific version of BIND
|
||||
-- preferably the current top of the main branch. Diffs may be generated
|
||||
-- preferably the current top of the master branch. Diffs may be generated
|
||||
using either git format-patch or git diff.
|
||||
|
||||
Those wanting to write code for BIND may be interested in the developer
|
||||
|
||||
+9
-7
@@ -39,7 +39,7 @@ anyone can see the source, but only ISC employees have commit access.
|
||||
In the past, the source could only be seen once ISC had published
|
||||
a release; read access to the source repository was restricted just
|
||||
as commit access was. That has changed, as ISC now provides a
|
||||
public git repository of the BIND source tree (see below).
|
||||
public git mirror to the BIND source tree (see below).
|
||||
|
||||
At ISC, we're committed to
|
||||
building communities that are welcoming and inclusive: environments where people
|
||||
@@ -55,12 +55,14 @@ the industry.
|
||||
Public BIND releases are always available from the
|
||||
[ISC FTP site](ftp://ftp.isc.org/isc/bind9).
|
||||
|
||||
A public-access git repository is also available at
|
||||
[https://gitlab.isc.org](https://gitlab.isc.org). This repository
|
||||
contains all public release branches. Upcoming releases can be viewed in
|
||||
their current state at any time. Short-lived development branches
|
||||
contain unreviewed work in progress. Commits which address security
|
||||
vulnerablilities are withheld until after public disclosure.
|
||||
A public-access GIT repository is also available at
|
||||
[https://gitlab.isc.org](https://gitlab.isc.org).
|
||||
This repository is a mirror, updated several times per day, of the
|
||||
source repository maintained by ISC. It contains all the public release
|
||||
branches; upcoming releases can be viewed in their current state at any
|
||||
time. It does *not* contain development branches or unreviewed work in
|
||||
progress. Commits which address security vulnerablilities are withheld
|
||||
until after public disclosure.
|
||||
|
||||
You can browse the source online via
|
||||
[https://gitlab.isc.org/isc-projects/bind9](https://gitlab.isc.org/isc-projects/bind9)
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
Copyright (C) 1996-2021 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright (C) 1996-2020 Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
-----------------------------------------------------------------------------
|
||||
|
||||
|
||||
+3
-1
@@ -48,7 +48,9 @@ docclean manclean maintainer-clean::
|
||||
doc man:: ${MANOBJS}
|
||||
|
||||
installdirs:
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${sysconfdir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir} \
|
||||
${DESTDIR}${localstatedir}/run ${DESTDIR}${sysconfdir}
|
||||
$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man1
|
||||
|
||||
install:: installdirs
|
||||
${INSTALL_DATA} ${top_srcdir}/bind.keys ${DESTDIR}${sysconfdir}
|
||||
|
||||
@@ -34,16 +34,16 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
Regularly tested platforms
|
||||
|
||||
As of Oct 2021, BIND 9.16 is fully supported and regularly tested on the
|
||||
As of Jul 2020, BIND 9.16 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
|
||||
* Debian 9, 10, 11
|
||||
* Ubuntu LTS 18.04, 20.04
|
||||
* Fedora 34
|
||||
* Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
|
||||
* FreeBSD 11.4, 12.2, 13.0
|
||||
* OpenBSD 7.0
|
||||
* Alpine Linux 3.14
|
||||
* Debian 9, 10
|
||||
* Ubuntu LTS 16.04, 20.04
|
||||
* Fedora 32
|
||||
* Red Hat Enterprise Linux / CentOS 7, 8
|
||||
* FreeBSD 11.4, 12.1
|
||||
* OpenBSD 6.7
|
||||
* Alpine Linux 3.12
|
||||
|
||||
The amd64, i386, armhf and arm64 CPU architectures are all fully
|
||||
supported.
|
||||
@@ -54,7 +54,7 @@ The following are platforms on which BIND is known to build and run. ISC
|
||||
makes every effort to fix bugs on these platforms, but may be unable to do
|
||||
so quickly due to lack of hardware, less familiarity on the part of
|
||||
engineering staff, and other constraints. With the exception of Windows
|
||||
Server 2016, none of these are tested regularly by ISC.
|
||||
Server 2012 R2, none of these are tested regularly by ISC.
|
||||
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* Windows 10 / x64
|
||||
@@ -62,7 +62,7 @@ Server 2016, none of these are tested regularly by ISC.
|
||||
* Solaris 11
|
||||
* NetBSD
|
||||
* Other Linux distributions still supported by their vendors, such as:
|
||||
+ Ubuntu 20.10+
|
||||
+ Ubuntu 19.04+
|
||||
+ Gentoo
|
||||
+ Arch Linux
|
||||
* OpenWRT/LEDE 17.01+
|
||||
@@ -79,7 +79,7 @@ assessed against the risk of adverse effect on officially supported
|
||||
platforms.
|
||||
|
||||
* Platforms past or close to their respective EOL dates, such as:
|
||||
+ Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
|
||||
+ Ubuntu 14.04, 18.10
|
||||
+ CentOS 6
|
||||
+ Debian Jessie
|
||||
+ FreeBSD 10.x
|
||||
|
||||
+11
-11
@@ -42,16 +42,16 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
### Regularly tested platforms
|
||||
|
||||
As of Oct 2021, BIND 9.16 is fully supported and regularly tested on the
|
||||
As of Jul 2020, BIND 9.16 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
|
||||
* Debian 9, 10, 11
|
||||
* Ubuntu LTS 18.04, 20.04
|
||||
* Fedora 34
|
||||
* Red Hat Enterprise Linux / CentOS / Oracle Linux 7, 8
|
||||
* FreeBSD 11.4, 12.2, 13.0
|
||||
* OpenBSD 7.0
|
||||
* Alpine Linux 3.14
|
||||
* Debian 9, 10
|
||||
* Ubuntu LTS 16.04, 20.04
|
||||
* Fedora 32
|
||||
* Red Hat Enterprise Linux / CentOS 7, 8
|
||||
* FreeBSD 11.4, 12.1
|
||||
* OpenBSD 6.7
|
||||
* Alpine Linux 3.12
|
||||
|
||||
The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
|
||||
|
||||
@@ -61,7 +61,7 @@ The following are platforms on which BIND is known to build and run.
|
||||
ISC makes every effort to fix bugs on these platforms, but may be unable to
|
||||
do so quickly due to lack of hardware, less familiarity on the part of
|
||||
engineering staff, and other constraints. With the exception of Windows
|
||||
Server 2016, none of these are tested regularly by ISC.
|
||||
Server 2012 R2, none of these are tested regularly by ISC.
|
||||
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* Windows 10 / x64
|
||||
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
|
||||
* Solaris 11
|
||||
* NetBSD
|
||||
* Other Linux distributions still supported by their vendors, such as:
|
||||
* Ubuntu 20.10+
|
||||
* Ubuntu 19.04+
|
||||
* Gentoo
|
||||
* Arch Linux
|
||||
* OpenWRT/LEDE 17.01+
|
||||
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
|
||||
platforms.
|
||||
|
||||
* Platforms past or close to their respective EOL dates, such as:
|
||||
* Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
|
||||
* Ubuntu 14.04, 18.10
|
||||
* CentOS 6
|
||||
* Debian Jessie
|
||||
* FreeBSD 10.x
|
||||
|
||||
@@ -136,9 +136,9 @@ time. See Compile-time options below for details on other libraries that
|
||||
may be required to support optional features.
|
||||
|
||||
Successful builds have been observed on many versions of Linux and UNIX,
|
||||
including RHEL/CentOS/Oracle Linux, Fedora, Debian, Ubuntu, SLES,
|
||||
openSUSE, Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
|
||||
OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
|
||||
including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE, Slackware,
|
||||
Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris, OpenIndiana, OmniOS CE,
|
||||
HP-UX, and OpenWRT.
|
||||
|
||||
BIND is also available for Windows Server 2012 R2 and higher. See
|
||||
win32utils/build.txt for details on building for Windows systems.
|
||||
@@ -329,8 +329,8 @@ the change that was made; these categories are:
|
||||
[doc] Documentation
|
||||
[contrib] Changes to the contributed tools and libraries in the
|
||||
'contrib' subdirectory
|
||||
Used in the main development branch to reserve change
|
||||
[placeholder] numbers for use in other branches, e.g., when fixing a bug
|
||||
Used in the master development branch to reserve change
|
||||
[placeholder] numbers for use in other branches, e.g. when fixing a bug
|
||||
that only exists in older releases
|
||||
|
||||
In general, [func] and [experimental] tags will only appear in new-feature
|
||||
|
||||
@@ -152,9 +152,9 @@ support at compile time. See [Compile-time options](#opts) below
|
||||
for details on other libraries that may be required to support
|
||||
optional features.
|
||||
|
||||
Successful builds have been observed on many versions of Linux and UNIX,
|
||||
including RHEL/CentOS/Oracle Linux, Fedora, Debian, Ubuntu, SLES,
|
||||
openSUSE, Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
|
||||
Successful builds have been observed on many versions of Linux and
|
||||
UNIX, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
|
||||
Slackware, Alpine, FreeBSD, NetBSD, OpenBSD, macOS, Solaris,
|
||||
OpenIndiana, OmniOS CE, HP-UX, and OpenWRT.
|
||||
|
||||
BIND is also available for Windows Server 2012 R2 and higher. See
|
||||
|
||||
Vendored
+1
-2
@@ -1,4 +1,4 @@
|
||||
# generated automatically by aclocal 1.16.3 -*- Autoconf -*-
|
||||
# generated automatically by aclocal 1.16.2 -*- Autoconf -*-
|
||||
|
||||
# Copyright (C) 1996-2020 Free Software Foundation, Inc.
|
||||
|
||||
@@ -376,7 +376,6 @@ AC_DEFUN([AM_SUBST_NOTMAKE], [_AM_SUBST_NOTMAKE($@)])
|
||||
|
||||
m4_include([m4/ax_check_compile_flag.m4])
|
||||
m4_include([m4/ax_check_openssl.m4])
|
||||
m4_include([m4/ax_gcc_func_attribute.m4])
|
||||
m4_include([m4/ax_posix_shell.m4])
|
||||
m4_include([m4/ax_pthread.m4])
|
||||
m4_include([m4/ax_restore_flags.m4])
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
@@ -15,8 +15,9 @@ VERSION=@BIND9_VERSION@
|
||||
|
||||
@BIND9_MAKE_INCLUDES@
|
||||
|
||||
CINCLUDES = ${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} \
|
||||
${ISCCFG_INCLUDES} ${ISC_INCLUDES} ${OPENSSL_CFLAGS}
|
||||
CINCLUDES = ${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
|
||||
${ISC_INCLUDES} \
|
||||
${OPENSSL_CFLAGS}
|
||||
|
||||
CDEFINES = -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
|
||||
CWARNINGS =
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -687,7 +687,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
|
||||
|
||||
CHECK(dns_zone_create(&zone, mctx));
|
||||
|
||||
dns_zone_settype(zone, dns_zone_primary);
|
||||
dns_zone_settype(zone, dns_zone_master);
|
||||
|
||||
isc_buffer_constinit(&buffer, zonename, strlen(zonename));
|
||||
isc_buffer_add(&buffer, strlen(zonename));
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -184,7 +184,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
const char *zname;
|
||||
const char *zfile = NULL;
|
||||
const cfg_obj_t *maps[4];
|
||||
const cfg_obj_t *primariesobj = NULL;
|
||||
const cfg_obj_t *mastersobj = NULL;
|
||||
const cfg_obj_t *inviewobj = NULL;
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *classobj = NULL;
|
||||
@@ -278,12 +278,8 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
|
||||
* Is the redirect zone configured as a slave?
|
||||
*/
|
||||
if (strcasecmp(cfg_obj_asstring(typeobj), "redirect") == 0) {
|
||||
cfg_map_get(zoptions, "primaries", &primariesobj);
|
||||
if (primariesobj == NULL) {
|
||||
cfg_map_get(zoptions, "masters", &primariesobj);
|
||||
}
|
||||
|
||||
if (primariesobj != NULL) {
|
||||
cfg_map_get(zoptions, "masters", &mastersobj);
|
||||
if (mastersobj != NULL) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -35,62 +35,62 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``named-checkconf`` checks the syntax, but not the semantics, of a
|
||||
``named`` configuration file. The file, along with all files included by it, is parsed and checked for syntax
|
||||
errors. If no file is specified,
|
||||
``named`` configuration file. The file is parsed and checked for syntax
|
||||
errors, along with all files included by it. If no file is specified,
|
||||
``/etc/named.conf`` is read by default.
|
||||
|
||||
Note: files that ``named`` reads in separate parser contexts, such as
|
||||
``rndc.key`` and ``bind.keys``, are not automatically read by
|
||||
``named-checkconf``. Configuration errors in these files may cause
|
||||
``named`` to fail to run, even if ``named-checkconf`` was successful.
|
||||
However, ``named-checkconf`` can be run on these files explicitly.
|
||||
``named-checkconf`` can be run on these files explicitly, however.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-h``
|
||||
This option prints the usage summary and exits.
|
||||
**-h**
|
||||
Print the usage summary and exit.
|
||||
|
||||
``-j``
|
||||
When loading a zonefile, this option instructs ``named`` to read the journal if it exists.
|
||||
**-j**
|
||||
When loading a zonefile read the journal if it exists.
|
||||
|
||||
``-l``
|
||||
This option lists all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. primary or secondary).
|
||||
**-l**
|
||||
List all the configured zones. Each line of output contains the zone
|
||||
name, class (e.g. IN), view, and type (e.g. master or slave).
|
||||
|
||||
``-c``
|
||||
This option specifies that only the "core" configuration should be checked. This suppresses the loading of
|
||||
**-c**
|
||||
Check "core" configuration only. This suppresses the loading of
|
||||
plugin modules, and causes all parameters to ``plugin`` statements to
|
||||
be ignored.
|
||||
|
||||
``-i``
|
||||
This option ignores warnings on deprecated options.
|
||||
**-i**
|
||||
Ignore warnings on deprecated options.
|
||||
|
||||
``-p``
|
||||
This option prints out the ``named.conf`` and included files in canonical form if
|
||||
**-p**
|
||||
Print out the ``named.conf`` and included files in canonical form if
|
||||
no errors were detected. See also the ``-x`` option.
|
||||
|
||||
``-t directory``
|
||||
This option instructs ``named`` to chroot to ``directory``, so that ``include`` directives in the
|
||||
**-t** directory
|
||||
Chroot to ``directory`` so that include directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
``named``.
|
||||
|
||||
``-v``
|
||||
This option prints the version of the ``named-checkconf`` program and exits.
|
||||
**-v**
|
||||
Print the version of the ``named-checkconf`` program and exit.
|
||||
|
||||
``-x``
|
||||
When printing the configuration files in canonical form, this option obscures
|
||||
**-x**
|
||||
When printing the configuration files in canonical form, obscure
|
||||
shared secrets by replacing them with strings of question marks
|
||||
(``?``). This allows the contents of ``named.conf`` and related files
|
||||
to be shared - for example, when submitting bug reports -
|
||||
('?'). This allows the contents of ``named.conf`` and related files
|
||||
to be shared MDASH for example, when submitting bug reports MDASH
|
||||
without compromising private data. This option cannot be used without
|
||||
``-p``.
|
||||
|
||||
``-z``
|
||||
This option performs a test load of all zones of type ``primary`` found in ``named.conf``.
|
||||
**-z**
|
||||
Perform a test load of all master zones found in ``named.conf``.
|
||||
|
||||
``filename``
|
||||
This indicates the name of the configuration file to be checked. If not specified,
|
||||
filename
|
||||
The name of the configuration file to be checked. If not specified,
|
||||
it defaults to ``/etc/named.conf``.
|
||||
|
||||
Return Values
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -45,7 +45,7 @@
|
||||
static int quiet = 0;
|
||||
static isc_mem_t *mctx = NULL;
|
||||
dns_zone_t *zone = NULL;
|
||||
dns_zonetype_t zonetype = dns_zone_primary;
|
||||
dns_zonetype_t zonetype = dns_zone_master;
|
||||
static int dumpzone = 0;
|
||||
static const char *output_filename;
|
||||
static const char *prog_name = NULL;
|
||||
|
||||
+107
-108
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -43,164 +43,163 @@ configuring them into a name server.
|
||||
|
||||
``named-compilezone`` is similar to ``named-checkzone``, but it always
|
||||
dumps the zone contents to a specified file in a specified format.
|
||||
It also applies stricter check levels by default, since the
|
||||
dump output is used as an actual zone file loaded by ``named``.
|
||||
Additionally, it applies stricter check levels by default, since the
|
||||
dump output will be used as an actual zone file loaded by ``named``.
|
||||
When manually specified otherwise, the check levels must at least be as
|
||||
strict as those specified in the ``named`` configuration file.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-d``
|
||||
This option enables debugging.
|
||||
**-d**
|
||||
Enable debugging.
|
||||
|
||||
``-h``
|
||||
This option prints the usage summary and exits.
|
||||
**-h**
|
||||
Print the usage summary and exit.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which only sets an exit code to indicate
|
||||
successful or failed completion.
|
||||
**-q**
|
||||
Quiet mode - exit code only.
|
||||
|
||||
``-v``
|
||||
This option prints the version of the ``named-checkzone`` program and exits.
|
||||
**-v**
|
||||
Print the version of the ``named-checkzone`` program and exit.
|
||||
|
||||
``-j``
|
||||
When loading a zone file, this option tells ``named`` to read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name with the
|
||||
string ``.jnl`` appended.
|
||||
**-j**
|
||||
When loading a zone file, read the journal if it exists. The journal
|
||||
file name is assumed to be the zone file name appended with the
|
||||
string ``.jnl``.
|
||||
|
||||
``-J filename``
|
||||
When loading the zone file, this option tells ``named`` to read the journal from the given file, if
|
||||
it exists. This implies ``-j``.
|
||||
**-J** filename
|
||||
When loading the zone file read the journal from the given file, if
|
||||
it exists. (Implies -j.)
|
||||
|
||||
``-c class``
|
||||
This option specifies the class of the zone. If not specified, ``IN`` is assumed.
|
||||
**-c** class
|
||||
Specify the class of the zone. If not specified, "IN" is assumed.
|
||||
|
||||
``-i mode``
|
||||
This option performs post-load zone integrity checks. Possible modes are
|
||||
``full`` (the default), ``full-sibling``, ``local``,
|
||||
``local-sibling``, and ``none``.
|
||||
**-i** mode
|
||||
Perform post-load zone integrity checks. Possible modes are
|
||||
``"full"`` (default), ``"full-sibling"``, ``"local"``,
|
||||
``"local-sibling"`` and ``"none"``.
|
||||
|
||||
Mode ``full`` checks that MX records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
Mode ``"full"`` checks that MX records refer to A or AAAA record
|
||||
(both in-zone and out-of-zone hostnames). Mode ``"local"`` only
|
||||
checks MX records which refer to in-zone hostnames.
|
||||
|
||||
Mode ``full`` checks that SRV records refer to A or AAAA records
|
||||
(both in-zone and out-of-zone hostnames). Mode ``local`` only
|
||||
Mode ``"full"`` checks that SRV records refer to A or AAAA record
|
||||
(both in-zone and out-of-zone hostnames). Mode ``"local"`` only
|
||||
checks SRV records which refer to in-zone hostnames.
|
||||
|
||||
Mode ``full`` checks that delegation NS records refer to A or AAAA
|
||||
records (both in-zone and out-of-zone hostnames). It also checks that
|
||||
Mode ``"full"`` checks that delegation NS records refer to A or AAAA
|
||||
record (both in-zone and out-of-zone hostnames). It also checks that
|
||||
glue address records in the zone match those advertised by the child.
|
||||
Mode ``local`` only checks NS records which refer to in-zone
|
||||
hostnames or verifies that some required glue exists, i.e., when the
|
||||
name server is in a child zone.
|
||||
Mode ``"local"`` only checks NS records which refer to in-zone
|
||||
hostnames or that some required glue exists, that is when the
|
||||
nameserver is in a child zone.
|
||||
|
||||
Modes ``full-sibling`` and ``local-sibling`` disable sibling glue
|
||||
checks, but are otherwise the same as ``full`` and ``local``,
|
||||
Mode ``"full-sibling"`` and ``"local-sibling"`` disable sibling glue
|
||||
checks but are otherwise the same as ``"full"`` and ``"local"``
|
||||
respectively.
|
||||
|
||||
Mode ``none`` disables the checks.
|
||||
Mode ``"none"`` disables the checks.
|
||||
|
||||
``-f format``
|
||||
This option specifies the format of the zone file. Possible formats are ``text``
|
||||
(the default), ``raw``, and ``map``.
|
||||
**-f** format
|
||||
Specify the format of the zone file. Possible formats are ``"text"``
|
||||
(default), ``"raw"``, and ``"map"``.
|
||||
|
||||
``-F format``
|
||||
This option specifies the format of the output file specified. For
|
||||
``named-checkzone``, this does not have any effect unless it dumps
|
||||
**-F** format
|
||||
Specify the format of the output file specified. For
|
||||
``named-checkzone``, this does not cause any effects unless it dumps
|
||||
the zone contents.
|
||||
|
||||
Possible formats are ``text`` (the default), which is the standard
|
||||
textual representation of the zone, and ``map``, ``raw``, and
|
||||
``raw=N``, which store the zone in a binary format for rapid
|
||||
loading by ``named``. ``raw=N`` specifies the format version of the
|
||||
raw zone file: if ``N`` is 0, the raw file can be read by any version of
|
||||
``named``; if N is 1, the file can only be read by release 9.9.0 or
|
||||
higher. The default is 1.
|
||||
Possible formats are ``"text"`` (default), which is the standard
|
||||
textual representation of the zone, and ``"map"``, ``"raw"``, and
|
||||
``"raw=N"``, which store the zone in a binary format for rapid
|
||||
loading by ``named``. ``"raw=N"`` specifies the format version of the
|
||||
raw zone file: if N is 0, the raw file can be read by any version of
|
||||
``named``; if N is 1, the file can be read by release 9.9.0 or
|
||||
higher; the default is 1.
|
||||
|
||||
``-k mode``
|
||||
This option performs ``check-names`` checks with the specified failure mode.
|
||||
Possible modes are ``fail`` (the default for ``named-compilezone``),
|
||||
``warn`` (the default for ``named-checkzone``), and ``ignore``.
|
||||
**-k** mode
|
||||
Perform ``"check-names"`` checks with the specified failure mode.
|
||||
Possible modes are ``"fail"`` (default for ``named-compilezone``),
|
||||
``"warn"`` (default for ``named-checkzone``) and ``"ignore"``.
|
||||
|
||||
``-l ttl``
|
||||
This option sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value causes the zone to be rejected. This
|
||||
**-l** ttl
|
||||
Sets a maximum permissible TTL for the input file. Any record with a
|
||||
TTL higher than this value will cause the zone to be rejected. This
|
||||
is similar to using the ``max-zone-ttl`` option in ``named.conf``.
|
||||
|
||||
``-L serial``
|
||||
When compiling a zone to ``raw`` or ``map`` format, this option sets the "source
|
||||
serial" value in the header to the specified serial number. This is
|
||||
expected to be used primarily for testing purposes.
|
||||
**-L** serial
|
||||
When compiling a zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
|
||||
``-m mode``
|
||||
This option specifies whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail``, ``warn`` (the default), and
|
||||
``ignore``.
|
||||
**-m** mode
|
||||
Specify whether MX records should be checked to see if they are
|
||||
addresses. Possible modes are ``"fail"``, ``"warn"`` (default) and
|
||||
``"ignore"``.
|
||||
|
||||
``-M mode``
|
||||
This option checks whether a MX record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
**-M** mode
|
||||
Check if a MX record refers to a CNAME. Possible modes are
|
||||
``"fail"``, ``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-n mode``
|
||||
This option specifies whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``fail`` (the default for
|
||||
``named-compilezone``), ``warn`` (the default for ``named-checkzone``),
|
||||
and ``ignore``.
|
||||
**-n** mode
|
||||
Specify whether NS records should be checked to see if they are
|
||||
addresses. Possible modes are ``"fail"`` (default for
|
||||
``named-compilezone``), ``"warn"`` (default for ``named-checkzone``)
|
||||
and ``"ignore"``.
|
||||
|
||||
``-o filename``
|
||||
This option writes the zone output to ``filename``. If ``filename`` is ``-``, then
|
||||
the zone output is written to standard output. This is mandatory for ``named-compilezone``.
|
||||
**-o** filename
|
||||
Write zone output to ``filename``. If ``filename`` is ``-`` then
|
||||
write to standard out. This is mandatory for ``named-compilezone``.
|
||||
|
||||
``-r mode``
|
||||
This option checks for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``fail``,
|
||||
``warn`` (the default), and ``ignore``.
|
||||
**-r** mode
|
||||
Check for records that are treated as different by DNSSEC but are
|
||||
semantically equal in plain DNS. Possible modes are ``"fail"``,
|
||||
``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-s style``
|
||||
This option specifies the style of the dumped zone file. Possible styles are
|
||||
``full`` (the default) and ``relative``. The ``full`` format is most
|
||||
suitable for processing automatically by a separate script.
|
||||
The relative format is more human-readable and is thus
|
||||
suitable for editing by hand. For ``named-checkzone``, this does not
|
||||
have any effect unless it dumps the zone contents. It also does not
|
||||
**-s** style
|
||||
Specify the style of the dumped zone file. Possible styles are
|
||||
``"full"`` (default) and ``"relative"``. The full format is most
|
||||
suitable for processing automatically by a separate script. On the
|
||||
other hand, the relative format is more human-readable and is thus
|
||||
suitable for editing by hand. For ``named-checkzone`` this does not
|
||||
cause any effects unless it dumps the zone contents. It also does not
|
||||
have any meaning if the output format is not text.
|
||||
|
||||
``-S mode``
|
||||
This option checks whether an SRV record refers to a CNAME. Possible modes are
|
||||
``fail``, ``warn`` (the default), and ``ignore``.
|
||||
**-S** mode
|
||||
Check if a SRV record refers to a CNAME. Possible modes are
|
||||
``"fail"``, ``"warn"`` (default) and ``"ignore"``.
|
||||
|
||||
``-t directory``
|
||||
This option tells ``named`` to chroot to ``directory``, so that ``include`` directives in the
|
||||
**-t** directory
|
||||
Chroot to ``directory`` so that include directives in the
|
||||
configuration file are processed as if run by a similarly chrooted
|
||||
``named``.
|
||||
|
||||
``-T mode``
|
||||
This option checks whether Sender Policy Framework (SPF) records exist and issues a
|
||||
**-T** mode
|
||||
Check if Sender Policy Framework (SPF) records exist and issues a
|
||||
warning if an SPF-formatted TXT record is not also present. Possible
|
||||
modes are ``warn`` (the default) and ``ignore``.
|
||||
modes are ``"warn"`` (default), ``"ignore"``.
|
||||
|
||||
``-w directory``
|
||||
This option instructs ``named`` to chdir to ``directory``, so that relative filenames in master file
|
||||
``$INCLUDE`` directives work. This is similar to the directory clause in
|
||||
**-w** directory
|
||||
chdir to ``directory`` so that relative filenames in master file
|
||||
$INCLUDE directives work. This is similar to the directory clause in
|
||||
``named.conf``.
|
||||
|
||||
``-D``
|
||||
This option dumps the zone file in canonical format. This is always enabled for
|
||||
**-D**
|
||||
Dump zone file in canonical format. This is always enabled for
|
||||
``named-compilezone``.
|
||||
|
||||
``-W mode``
|
||||
This option specifies whether to check for non-terminal wildcards. Non-terminal
|
||||
**-W** mode
|
||||
Specify whether to check for non-terminal wildcards. Non-terminal
|
||||
wildcards are almost always the result of a failure to understand the
|
||||
wildcard matching algorithm (:rfc:`1034`). Possible modes are ``warn``
|
||||
(the default) and ``ignore``.
|
||||
wildcard matching algorithm (:rfc:`1034`). Possible modes are ``"warn"``
|
||||
(default) and ``"ignore"``.
|
||||
|
||||
``zonename``
|
||||
This indicates the domain name of the zone being checked.
|
||||
zonename
|
||||
The domain name of the zone being checked.
|
||||
|
||||
``filename``
|
||||
This is the name of the zone file.
|
||||
filename
|
||||
The name of the zone file.
|
||||
|
||||
Return Values
|
||||
~~~~~~~~~~~~~
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
@@ -114,7 +114,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -41,17 +41,17 @@ can be used, for example, to secure dynamic DNS updates to a zone or for
|
||||
the ``rndc`` command channel.
|
||||
|
||||
When run as ``tsig-keygen``, a domain name can be specified on the
|
||||
command line to be used as the name of the generated key. If no
|
||||
command line which will be used as the name of the generated key. If no
|
||||
name is specified, the default is ``tsig-key``.
|
||||
|
||||
When run as ``ddns-confgen``, the generated key is accompanied by
|
||||
configuration text and instructions that can be used with ``nsupdate``
|
||||
and ``named`` when setting up dynamic DNS, including an example
|
||||
``update-policy`` statement. (This usage is similar to the ``rndc-confgen``
|
||||
command for setting up command-channel security.)
|
||||
``update-policy`` statement. (This usage similar to the ``rndc-confgen``
|
||||
command for setting up command channel security.)
|
||||
|
||||
Note that ``named`` itself can configure a local DDNS key for use with
|
||||
``nsupdate -l``; it does this when a zone is configured with
|
||||
``nsupdate -l``: it does this when a zone is configured with
|
||||
``update-policy local;``. ``ddns-confgen`` is only needed when a more
|
||||
elaborate configuration is required: for instance, if ``nsupdate`` is to
|
||||
be used from a remote system.
|
||||
@@ -59,40 +59,40 @@ be used from a remote system.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
|
||||
**-a** algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and
|
||||
hmac-sha512. The default is hmac-sha256. Options are
|
||||
case-insensitive, and the "hmac-" prefix may be omitted.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of options and arguments.
|
||||
**-h**
|
||||
Prints a short summary of options and arguments.
|
||||
|
||||
``-k keyname``
|
||||
This option specifies the key name of the DDNS authentication key. The default is
|
||||
**-k** keyname
|
||||
Specifies the key name of the DDNS authentication key. The default is
|
||||
``ddns-key`` when neither the ``-s`` nor ``-z`` option is specified;
|
||||
otherwise, the default is ``ddns-key`` as a separate label followed
|
||||
by the argument of the option, e.g., ``ddns-key.example.com.`` The
|
||||
key name must have the format of a valid domain name, consisting of
|
||||
letters, digits, hyphens, and periods.
|
||||
letters, digits, hyphens and periods.
|
||||
|
||||
``-q`` (``ddns-confgen`` only)
|
||||
This option enables quiet mode, which prints only the key, with no
|
||||
explanatory text or usage examples. This is essentially identical to
|
||||
**-q**
|
||||
(``ddns-confgen`` only.) Quiet mode: Print only the key, with no
|
||||
explanatory text or usage examples; This is essentially identical to
|
||||
``tsig-keygen``.
|
||||
|
||||
``-s name`` (``ddns-confgen`` only)
|
||||
This option generates a configuration example to allow
|
||||
**-s** name
|
||||
(``ddns-confgen`` only.) Generate configuration example to allow
|
||||
dynamic updates of a single hostname. The example ``named.conf`` text
|
||||
shows how to set an update policy for the specified name using the
|
||||
"name" nametype. The default key name is ``ddns-key.name``. Note that the
|
||||
"name" nametype. The default key name is ddns-key.name. Note that the
|
||||
"self" nametype cannot be used, since the name to be updated may
|
||||
differ from the key name. This option cannot be used with the ``-z``
|
||||
option.
|
||||
|
||||
``-z zone`` (``ddns-confgen`` only)
|
||||
This option generates a configuration example to allow
|
||||
dynamic updates of a zone. The example ``named.conf`` text shows how
|
||||
**-z** zone
|
||||
(``ddns-confgen`` only.) Generate configuration example to allow
|
||||
dynamic updates of a zone: The example ``named.conf`` text shows how
|
||||
to set an update policy for the specified zone using the "zonesub"
|
||||
nametype, allowing updates to all subdomain names within that zone.
|
||||
This option cannot be used with the ``-s`` option.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -41,72 +41,76 @@ by hand. Alternatively, it can be run with the ``-a`` option to set up a
|
||||
``rndc.key`` file and avoid the need for a ``rndc.conf`` file and a
|
||||
``controls`` statement altogether.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
Arguments
|
||||
~~~~~~~~~
|
||||
|
||||
``-a``
|
||||
This option sets automatic ``rndc`` configuration, which creates a file ``rndc.key``
|
||||
in ``/etc`` (or a different ``sysconfdir`` specified when BIND
|
||||
**-a**
|
||||
Do automatic ``rndc`` configuration. This creates a file ``rndc.key``
|
||||
in ``/etc`` (or whatever ``sysconfdir`` was specified as when BIND
|
||||
was built) that is read by both ``rndc`` and ``named`` on startup.
|
||||
The ``rndc.key`` file defines a default command channel and
|
||||
authentication key allowing ``rndc`` to communicate with ``named`` on
|
||||
the local host with no further configuration.
|
||||
|
||||
Running ``rndc-confgen -a`` allows BIND 9 and ``rndc`` to be used as
|
||||
drop-in replacements for BIND 8 and ``ndc``, with no changes to the
|
||||
existing BIND 8 ``named.conf`` file.
|
||||
|
||||
If a more elaborate configuration than that generated by
|
||||
``rndc-confgen -a`` is required, for example if rndc is to be used
|
||||
remotely, run ``rndc-confgen`` without the ``-a`` option
|
||||
and set up ``rndc.conf`` and ``named.conf`` as directed.
|
||||
remotely, you should run ``rndc-confgen`` without the ``-a`` option
|
||||
and set up a ``rndc.conf`` and ``named.conf`` as directed.
|
||||
|
||||
``-A algorithm``
|
||||
This option specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384, and
|
||||
**-A** algorithm
|
||||
Specifies the algorithm to use for the TSIG key. Available choices
|
||||
are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256, hmac-sha384 and
|
||||
hmac-sha512. The default is hmac-sha256.
|
||||
|
||||
``-b keysize``
|
||||
This option specifies the size of the authentication key in bits. The size must be between
|
||||
**-b** keysize
|
||||
Specifies the size of the authentication key in bits. Must be between
|
||||
1 and 512 bits; the default is the hash size.
|
||||
|
||||
``-c keyfile``
|
||||
This option is used with the ``-a`` option to specify an alternate location for
|
||||
**-c** keyfile
|
||||
Used with the ``-a`` option to specify an alternate location for
|
||||
``rndc.key``.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``rndc-confgen``.
|
||||
|
||||
``-k keyname``
|
||||
This option specifies the key name of the ``rndc`` authentication key. This must be a
|
||||
**-k** keyname
|
||||
Specifies the key name of the rndc authentication key. This must be a
|
||||
valid domain name. The default is ``rndc-key``.
|
||||
|
||||
``-p port``
|
||||
This option specifies the command channel port where ``named`` listens for
|
||||
**-p** port
|
||||
Specifies the command channel port where ``named`` listens for
|
||||
connections from ``rndc``. The default is 953.
|
||||
|
||||
``-s address``
|
||||
This option specifies the IP address where ``named`` listens for command-channel
|
||||
**-s** address
|
||||
Specifies the IP address where ``named`` listens for command channel
|
||||
connections from ``rndc``. The default is the loopback address
|
||||
127.0.0.1.
|
||||
|
||||
``-t chrootdir``
|
||||
This option is used with the ``-a`` option to specify a directory where ``named``
|
||||
runs chrooted. An additional copy of the ``rndc.key`` is
|
||||
written relative to this directory, so that it is found by the
|
||||
**-t** chrootdir
|
||||
Used with the ``-a`` option to specify a directory where ``named``
|
||||
will run chrooted. An additional copy of the ``rndc.key`` will be
|
||||
written relative to this directory so that it will be found by the
|
||||
chrooted ``named``.
|
||||
|
||||
``-u user``
|
||||
This option is used with the ``-a`` option to set the owner of the generated ``rndc.key`` file.
|
||||
If ``-t`` is also specified, only the file in the chroot
|
||||
**-u** user
|
||||
Used with the ``-a`` option to set the owner of the ``rndc.key`` file
|
||||
generated. If ``-t`` is also specified only the file in the chroot
|
||||
area has its owner changed.
|
||||
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
To allow ``rndc`` to be used with no manual configuration, run:
|
||||
To allow ``rndc`` to be used with no manual configuration, run
|
||||
|
||||
``rndc-confgen -a``
|
||||
|
||||
To print a sample ``rndc.conf`` file and the corresponding ``controls`` and
|
||||
``key`` statements to be manually inserted into ``named.conf``, run:
|
||||
To print a sample ``rndc.conf`` file and corresponding ``controls`` and
|
||||
``key`` statements to be manually inserted into ``named.conf``, run
|
||||
|
||||
``rndc-confgen``
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
@@ -115,7 +115,7 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
<PostBuildEvent>
|
||||
<Command>cd ..\..\..\Build\$(Configuration)
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
+14
-17
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -33,7 +33,6 @@
|
||||
#include <isc/hex.h>
|
||||
#include <isc/lib.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/md.h>
|
||||
#include <isc/mem.h>
|
||||
#ifdef WIN32
|
||||
@@ -72,6 +71,7 @@
|
||||
#include <isccfg/log.h>
|
||||
#include <isccfg/namedconf.h>
|
||||
|
||||
#include <irs/netdb.h>
|
||||
#include <irs/resconf.h>
|
||||
|
||||
#define CHECK(r) \
|
||||
@@ -601,13 +601,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
|
||||
dns_name_t *keyname;
|
||||
isc_result_t result;
|
||||
bool match_root = false;
|
||||
enum {
|
||||
INITIAL_KEY,
|
||||
STATIC_KEY,
|
||||
INITIAL_DS,
|
||||
STATIC_DS,
|
||||
TRUSTED
|
||||
} anchortype;
|
||||
enum { INITIAL_KEY,
|
||||
STATIC_KEY,
|
||||
INITIAL_DS,
|
||||
STATIC_DS,
|
||||
TRUSTED } anchortype;
|
||||
const cfg_obj_t *obj;
|
||||
|
||||
keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
|
||||
@@ -1727,7 +1725,6 @@ main(int argc, char *argv[]) {
|
||||
dns_namelist_t namelist;
|
||||
unsigned int resopt, clopt;
|
||||
isc_appctx_t *actx = NULL;
|
||||
isc_nm_t *netmgr = NULL;
|
||||
isc_taskmgr_t *taskmgr = NULL;
|
||||
isc_socketmgr_t *socketmgr = NULL;
|
||||
isc_timermgr_t *timermgr = NULL;
|
||||
@@ -1751,9 +1748,9 @@ main(int argc, char *argv[]) {
|
||||
isc_mem_create(&mctx);
|
||||
|
||||
CHECK(isc_appctx_create(mctx, &actx));
|
||||
CHECK(isc_managers_create(mctx, 1, 0, &netmgr, &taskmgr));
|
||||
CHECK(isc_socketmgr_create(mctx, &socketmgr));
|
||||
CHECK(isc_timermgr_create(mctx, &timermgr));
|
||||
CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
|
||||
CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
|
||||
CHECK(isc_timermgr_createinctx(mctx, &timermgr));
|
||||
|
||||
parse_args(argc, argv);
|
||||
|
||||
@@ -1774,8 +1771,8 @@ main(int argc, char *argv[]) {
|
||||
|
||||
/* Create client */
|
||||
clopt = DNS_CLIENTCREATEOPT_USECACHE;
|
||||
result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr,
|
||||
clopt, &client, srcaddr4, srcaddr6);
|
||||
result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr,
|
||||
clopt, &client, srcaddr4, srcaddr6);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
|
||||
isc_result_totext(result));
|
||||
@@ -1795,7 +1792,7 @@ main(int argc, char *argv[]) {
|
||||
CHECK(convert_name(&qfn, &query_name, qname));
|
||||
|
||||
/* Set up resolution options */
|
||||
resopt = DNS_CLIENTRESOPT_NOCDFLAG;
|
||||
resopt = DNS_CLIENTRESOPT_ALLOWRUN | DNS_CLIENTRESOPT_NOCDFLAG;
|
||||
if (no_sigs) {
|
||||
resopt |= DNS_CLIENTRESOPT_NODNSSEC;
|
||||
}
|
||||
@@ -1858,7 +1855,7 @@ cleanup:
|
||||
dns_client_destroy(&client);
|
||||
}
|
||||
if (taskmgr != NULL) {
|
||||
isc_managers_destroy(&netmgr, &taskmgr);
|
||||
isc_taskmgr_destroy(&taskmgr);
|
||||
}
|
||||
if (timermgr != NULL) {
|
||||
isc_timermgr_destroy(&timermgr);
|
||||
|
||||
+90
-90
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -43,15 +43,15 @@ Description
|
||||
``delv`` is a tool for sending DNS queries and validating the results,
|
||||
using the same internal resolver and validator logic as ``named``.
|
||||
|
||||
``delv`` sends to a specified name server all queries needed to
|
||||
``delv`` will send to a specified name server all queries needed to
|
||||
fetch and validate the requested data; this includes the original
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains,
|
||||
requested query, subsequent queries to follow CNAME or DNAME chains, and
|
||||
queries for DNSKEY, and DS records to establish a chain of trust for
|
||||
DNSSEC validation. It does not perform iterative resolution, but
|
||||
simulates the behavior of a name server configured for DNSSEC validating
|
||||
and forwarding.
|
||||
|
||||
By default, responses are validated using the built-in DNSSEC trust anchor
|
||||
By default, responses are validated using built-in DNSSEC trust anchor
|
||||
for the root zone ("."). Records returned by ``delv`` are either fully
|
||||
validated or were not signed. If validation fails, an explanation of the
|
||||
failure is included in the output; the validation process can be traced
|
||||
@@ -59,13 +59,13 @@ in detail. Because ``delv`` does not rely on an external server to carry
|
||||
out validation, it can be used to check the validity of DNS responses in
|
||||
environments where local name servers may not be trustworthy.
|
||||
|
||||
Unless it is told to query a specific name server, ``delv`` tries
|
||||
Unless it is told to query a specific name server, ``delv`` will try
|
||||
each of the servers listed in ``/etc/resolv.conf``. If no usable server
|
||||
addresses are found, ``delv`` sends queries to the localhost
|
||||
addresses are found, ``delv`` will send queries to the localhost
|
||||
addresses (127.0.0.1 for IPv4, ::1 for IPv6).
|
||||
|
||||
When no command-line arguments or options are given, ``delv``
|
||||
performs an NS query for "." (the root zone).
|
||||
When no command line arguments or options are given, ``delv`` will
|
||||
perform an NS query for "." (the root zone).
|
||||
|
||||
Simple Usage
|
||||
~~~~~~~~~~~~
|
||||
@@ -89,109 +89,109 @@ where:
|
||||
If no ``server`` argument is provided, ``delv`` consults
|
||||
``/etc/resolv.conf``; if an address is found there, it queries the
|
||||
name server at that address. If either of the ``-4`` or ``-6``
|
||||
options is in use, then only addresses for the corresponding
|
||||
transport are tried. If no usable addresses are found, ``delv``
|
||||
sends queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport will be tried. If no usable addresses are found, ``delv``
|
||||
will send queries to the localhost addresses (127.0.0.1 for IPv4, ::1
|
||||
for IPv6).
|
||||
|
||||
``name``
|
||||
is the domain name to be looked up.
|
||||
|
||||
``type``
|
||||
indicates what type of query is required - ANY, A, MX, etc.
|
||||
indicates what type of query is required MDASH ANY, A, MX, etc.
|
||||
``type`` can be any valid query type. If no ``type`` argument is
|
||||
supplied, ``delv`` performs a lookup for an A record.
|
||||
supplied, ``delv`` will perform a lookup for an A record.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a anchor-file``
|
||||
This option specifies a file from which to read DNSSEC trust anchors. The default
|
||||
**-a** anchor-file
|
||||
Specifies a file from which to read DNSSEC trust anchors. The default
|
||||
is ``/etc/bind.keys``, which is included with BIND 9 and contains one
|
||||
or more trust anchors for the root zone (".").
|
||||
|
||||
Keys that do not match the root zone name are ignored. An alternate
|
||||
key name can be specified using the ``+root=NAME`` options.
|
||||
|
||||
Note: When reading the trust anchor file, ``delv`` treats ``trust-anchors``,
|
||||
``initial-key``, and ``static-key`` identically. That is, for a managed key,
|
||||
Note: When reading the trust anchor file, ``delv`` treat ``trust-anchors``
|
||||
``initial-key`` and ``static-key`` identically. That is, for a managed key,
|
||||
it is the *initial* key that is trusted; :rfc:`5011` key management is not
|
||||
supported. ``delv`` does not consult the managed-keys database maintained by
|
||||
``named``, which means that if either of the keys in ``/etc/bind.keys`` is
|
||||
revoked and rolled over, ``/etc/bind.keys`` must be updated to
|
||||
supported. ``delv`` will not consult the managed-keys database maintained by
|
||||
``named``. This means that if either of the keys in ``/etc/bind.keys`` is
|
||||
revoked and rolled over, it will be necessary to update ``/etc/bind.keys`` to
|
||||
use DNSSEC validation in ``delv``.
|
||||
|
||||
``-b address``
|
||||
This option sets the source IP address of the query to ``address``. This must be
|
||||
a valid address on one of the host's network interfaces, or ``0.0.0.0``,
|
||||
or ``::``. An optional source port may be specified by appending
|
||||
``#<port>``
|
||||
**-b** address
|
||||
Sets the source IP address of the query to ``address``. This must be
|
||||
a valid address on one of the host's network interfaces or "0.0.0.0"
|
||||
or "::". An optional source port may be specified by appending
|
||||
"#<port>"
|
||||
|
||||
``-c class``
|
||||
This option sets the query class for the requested data. Currently, only class
|
||||
**-c** class
|
||||
Sets the query class for the requested data. Currently, only class
|
||||
"IN" is supported in ``delv`` and any other value is ignored.
|
||||
|
||||
``-d level``
|
||||
This option sets the systemwide debug level to ``level``. The allowed range is
|
||||
**-d** level
|
||||
Set the systemwide debug level to ``level``. The allowed range is
|
||||
from 0 to 99. The default is 0 (no debugging). Debugging traces from
|
||||
``delv`` become more verbose as the debug level increases. See the
|
||||
``+mtrace``, ``+rtrace``, and ``+vtrace`` options below for
|
||||
additional debugging details.
|
||||
|
||||
``-h``
|
||||
This option displays the ``delv`` help usage output and exits.
|
||||
**-h**
|
||||
Display the ``delv`` help usage output and exit.
|
||||
|
||||
``-i``
|
||||
This option sets insecure mode, which disables internal DNSSEC validation. (Note,
|
||||
however, that this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it does
|
||||
**-i**
|
||||
Insecure mode. This disables internal DNSSEC validation. (Note,
|
||||
however, this does not set the CD bit on upstream queries. If the
|
||||
server being queried is performing DNSSEC validation, then it will
|
||||
not return invalid data; this can cause ``delv`` to time out. When it
|
||||
is necessary to examine invalid data to debug a DNSSEC problem, use
|
||||
``dig +cd``.)
|
||||
|
||||
``-m``
|
||||
This option enables memory usage debugging.
|
||||
**-m**
|
||||
Enables memory usage debugging.
|
||||
|
||||
``-p port#``
|
||||
This option specifies a destination port to use for queries, instead of the
|
||||
standard DNS port number 53. This option is used with a name
|
||||
**-p** port#
|
||||
Specifies a destination port to use for queries instead of the
|
||||
standard DNS port number 53. This option would be used with a name
|
||||
server that has been configured to listen for queries on a
|
||||
non-standard port number.
|
||||
|
||||
``-q name``
|
||||
This option sets the query name to ``name``. While the query name can be
|
||||
specified without using the ``-q`` option, it is sometimes necessary to
|
||||
**-q** name
|
||||
Sets the query name to ``name``. While the query name can be
|
||||
specified without using the ``-q``, it is sometimes necessary to
|
||||
disambiguate names from types or classes (for example, when looking
|
||||
up the name "ns", which could be misinterpreted as the type NS, or
|
||||
"ch", which could be misinterpreted as class CH).
|
||||
|
||||
``-t type``
|
||||
This option sets the query type to ``type``, which can be any valid query type
|
||||
**-t** type
|
||||
Sets the query type to ``type``, which can be any valid query type
|
||||
supported in BIND 9 except for zone transfer types AXFR and IXFR. As
|
||||
with ``-q``, this is useful to distinguish query-name types or classes
|
||||
when they are ambiguous. It is sometimes necessary to disambiguate
|
||||
with ``-q``, this is useful to distinguish query name type or class
|
||||
when they are ambiguous. it is sometimes necessary to disambiguate
|
||||
names from types.
|
||||
|
||||
The default query type is "A", unless the ``-x`` option is supplied
|
||||
to indicate a reverse lookup, in which case it is "PTR".
|
||||
|
||||
``-v``
|
||||
This option prints the ``delv`` version and exits.
|
||||
**-v**
|
||||
Print the ``delv`` version and exit.
|
||||
|
||||
``-x addr``
|
||||
This option performs a reverse lookup, mapping an address to a name. ``addr``
|
||||
**-x** addr
|
||||
Performs a reverse lookup, mapping an addresses to a name. ``addr``
|
||||
is an IPv4 address in dotted-decimal notation, or a colon-delimited
|
||||
IPv6 address. When ``-x`` is used, there is no need to provide the
|
||||
``name`` or ``type`` arguments; ``delv`` automatically performs a
|
||||
``name`` or ``type`` arguments. ``delv`` automatically performs a
|
||||
lookup for a name like ``11.12.13.10.in-addr.arpa`` and sets the
|
||||
query type to PTR. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
|
||||
``-4``
|
||||
This option forces ``delv`` to only use IPv4.
|
||||
**-4**
|
||||
Forces ``delv`` to only use IPv4.
|
||||
|
||||
``-6``
|
||||
This option forces ``delv`` to only use IPv6.
|
||||
**-6**
|
||||
Forces ``delv`` to only use IPv6.
|
||||
|
||||
Query Options
|
||||
~~~~~~~~~~~~~
|
||||
@@ -206,122 +206,122 @@ assign values to options like the timeout interval. They have the form
|
||||
``+keyword=value``. The query options are:
|
||||
|
||||
``+[no]cdflag``
|
||||
This option controls whether to set the CD (checking disabled) bit in queries
|
||||
Controls whether to set the CD (checking disabled) bit in queries
|
||||
sent by ``delv``. This may be useful when troubleshooting DNSSEC
|
||||
problems from behind a validating resolver. A validating resolver
|
||||
blocks invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries causes the resolver
|
||||
will block invalid responses, making it difficult to retrieve them
|
||||
for analysis. Setting the CD flag on queries will cause the resolver
|
||||
to return invalid responses, which ``delv`` can then validate
|
||||
internally and report the errors in detail.
|
||||
|
||||
``+[no]class``
|
||||
This option controls whether to display the CLASS when printing a record. The
|
||||
Controls whether to display the CLASS when printing a record. The
|
||||
default is to display the CLASS.
|
||||
|
||||
``+[no]ttl``
|
||||
This option controls whether to display the TTL when printing a record. The
|
||||
Controls whether to display the TTL when printing a record. The
|
||||
default is to display the TTL.
|
||||
|
||||
``+[no]rtrace``
|
||||
This option toggles resolver fetch logging. This reports the name and type of each
|
||||
Toggle resolver fetch logging. This reports the name and type of each
|
||||
query sent by ``delv`` in the process of carrying out the resolution
|
||||
and validation process, including the original query
|
||||
and validation process: this includes including the original query
|
||||
and all subsequent queries to follow CNAMEs and to establish a chain
|
||||
of trust for DNSSEC validation.
|
||||
|
||||
This is equivalent to setting the debug level to 1 in the "resolver"
|
||||
logging category. Setting the systemwide debug level to 1 using the
|
||||
``-d`` option produces the same output, but affects other
|
||||
logging categories as well.
|
||||
``-d`` option will product the same output (but will affect other
|
||||
logging categories as well).
|
||||
|
||||
``+[no]mtrace``
|
||||
This option toggles message logging. This produces a detailed dump of the
|
||||
Toggle message logging. This produces a detailed dump of the
|
||||
responses received by ``delv`` in the process of carrying out the
|
||||
resolution and validation process.
|
||||
|
||||
This is equivalent to setting the debug level to 10 for the "packets"
|
||||
module of the "resolver" logging category. Setting the systemwide
|
||||
debug level to 10 using the ``-d`` option produces the same
|
||||
output, but affects other logging categories as well.
|
||||
debug level to 10 using the ``-d`` option will produce the same
|
||||
output (but will affect other logging categories as well).
|
||||
|
||||
``+[no]vtrace``
|
||||
This option toggles validation logging. This shows the internal process of the
|
||||
Toggle validation logging. This shows the internal process of the
|
||||
validator as it determines whether an answer is validly signed,
|
||||
unsigned, or invalid.
|
||||
|
||||
This is equivalent to setting the debug level to 3 for the
|
||||
"validator" module of the "dnssec" logging category. Setting the
|
||||
systemwide debug level to 3 using the ``-d`` option produces the
|
||||
same output, but affects other logging categories as well.
|
||||
systemwide debug level to 3 using the ``-d`` option will produce the
|
||||
same output (but will affect other logging categories as well).
|
||||
|
||||
``+[no]short``
|
||||
This option toggles between verbose and terse answers. The default is to print the answer in a
|
||||
Provide a terse answer. The default is to print the answer in a
|
||||
verbose form.
|
||||
|
||||
``+[no]comments``
|
||||
This option toggles the display of comment lines in the output. The default is to
|
||||
Toggle the display of comment lines in the output. The default is to
|
||||
print comments.
|
||||
|
||||
``+[no]rrcomments``
|
||||
This option toggles the display of per-record comments in the output (for example,
|
||||
Toggle the display of per-record comments in the output (for example,
|
||||
human-readable key information about DNSKEY records). The default is
|
||||
to print per-record comments.
|
||||
|
||||
``+[no]crypto``
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary to debug most DNSSEC
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
|
||||
``+[no]trust``
|
||||
This option controls whether to display the trust level when printing a record.
|
||||
Controls whether to display the trust level when printing a record.
|
||||
The default is to display the trust level.
|
||||
|
||||
``+[no]split[=W]``
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
Split long hex- or base64-formatted fields in resource records into
|
||||
chunks of ``W`` characters (where ``W`` is rounded up to the nearest
|
||||
multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
|
||||
``+[no]all``
|
||||
This option sets or clears the display options ``+[no]comments``,
|
||||
Set or clear the display options ``+[no]comments``,
|
||||
``+[no]rrcomments``, and ``+[no]trust`` as a group.
|
||||
|
||||
``+[no]multiline``
|
||||
This option prints long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
Print long records (such as RRSIG, DNSKEY, and SOA records) in a
|
||||
verbose multi-line format with human-readable comments. The default
|
||||
is to print each record on a single line, to facilitate machine
|
||||
parsing of the ``delv`` output.
|
||||
|
||||
``+[no]dnssec``
|
||||
This option indicates whether to display RRSIG records in the ``delv`` output.
|
||||
Indicates whether to display RRSIG records in the ``delv`` output.
|
||||
The default is to do so. Note that (unlike in ``dig``) this does
|
||||
*not* control whether to request DNSSEC records or to
|
||||
*not* control whether to request DNSSEC records or whether to
|
||||
validate them. DNSSEC records are always requested, and validation
|
||||
always occurs unless suppressed by the use of ``-i`` or
|
||||
will always occur unless suppressed by the use of ``-i`` or
|
||||
``+noroot``.
|
||||
|
||||
``+[no]root[=ROOT]``
|
||||
This option indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
Indicates whether to perform conventional DNSSEC validation, and if so,
|
||||
specifies the name of a trust anchor. The default is to validate using a
|
||||
trust anchor of "." (the root zone), for which there is a built-in key. If
|
||||
specifying a different trust anchor, then ``-a`` must be used to specify a
|
||||
file containing the key.
|
||||
|
||||
``+[no]tcp``
|
||||
This option controls whether to use TCP when sending queries. The default is to
|
||||
Controls whether to use TCP when sending queries. The default is to
|
||||
use UDP unless a truncated response has been received.
|
||||
|
||||
``+[no]unknownformat``
|
||||
This option prints all RDATA in unknown RR-type presentation format (:rfc:`3597`).
|
||||
Print all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
The default is to print RDATA for known types in the type's
|
||||
presentation format.
|
||||
|
||||
``+[no]yaml``
|
||||
This option prints response data in YAML format.
|
||||
Print response data in YAML format.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
+9
-23
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -666,25 +666,15 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
|
||||
|
||||
if (!isc_time_isepoch(&query->time_sent)) {
|
||||
char tbuf[100];
|
||||
if (query->lookup->use_usec) {
|
||||
isc_time_formatISO8601us(&query->time_sent,
|
||||
tbuf, sizeof(tbuf));
|
||||
} else {
|
||||
isc_time_formatISO8601ms(&query->time_sent,
|
||||
tbuf, sizeof(tbuf));
|
||||
}
|
||||
isc_time_formatISO8601ms(&query->time_sent, tbuf,
|
||||
sizeof(tbuf));
|
||||
printf(" query_time: !!timestamp %s\n", tbuf);
|
||||
}
|
||||
|
||||
if (!isquery && !isc_time_isepoch(&query->time_recv)) {
|
||||
char tbuf[100];
|
||||
if (query->lookup->use_usec) {
|
||||
isc_time_formatISO8601us(&query->time_recv,
|
||||
tbuf, sizeof(tbuf));
|
||||
} else {
|
||||
isc_time_formatISO8601ms(&query->time_recv,
|
||||
tbuf, sizeof(tbuf));
|
||||
}
|
||||
isc_time_formatISO8601ms(&query->time_recv, tbuf,
|
||||
sizeof(tbuf));
|
||||
printf(" response_time: !!timestamp %s\n", tbuf);
|
||||
}
|
||||
|
||||
@@ -2197,20 +2187,16 @@ preparse_args(int argc, char **argv) {
|
||||
continue;
|
||||
}
|
||||
/* Look for dash value option. */
|
||||
if (strpbrk(option, dash_opts) != &option[0]) {
|
||||
goto invalid_option;
|
||||
}
|
||||
if (strlen(option) > 1U) {
|
||||
/* value in option. */
|
||||
if (strpbrk(option, dash_opts) != &option[0] ||
|
||||
strlen(option) > 1U) {
|
||||
/* Error or value in option. */
|
||||
continue;
|
||||
}
|
||||
/* Dash value is next argument so we need to skip it. */
|
||||
rc--, rv++;
|
||||
/* Handle missing argument */
|
||||
if (rc == 0) {
|
||||
invalid_option:
|
||||
fprintf(stderr, "Invalid option: -%s\n", option);
|
||||
usage();
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+198
-217
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -40,33 +40,33 @@ Description
|
||||
``dig`` is a flexible tool for interrogating DNS name servers. It
|
||||
performs DNS lookups and displays the answers that are returned from the
|
||||
name server(s) that were queried. Most DNS administrators use ``dig`` to
|
||||
troubleshoot DNS problems because of its flexibility, ease of use, and
|
||||
troubleshoot DNS problems because of its flexibility, ease of use and
|
||||
clarity of output. Other lookup tools tend to have less functionality
|
||||
than ``dig``.
|
||||
|
||||
Although ``dig`` is normally used with command-line arguments, it also
|
||||
has a batch mode of operation for reading lookup requests from a file. A
|
||||
brief summary of its command-line arguments and options is printed when
|
||||
the ``-h`` option is given. The BIND 9
|
||||
the ``-h`` option is given. Unlike earlier versions, the BIND 9
|
||||
implementation of ``dig`` allows multiple lookups to be issued from the
|
||||
command line.
|
||||
|
||||
Unless it is told to query a specific name server, ``dig`` tries each
|
||||
Unless it is told to query a specific name server, ``dig`` will try each
|
||||
of the servers listed in ``/etc/resolv.conf``. If no usable server
|
||||
addresses are found, ``dig`` sends the query to the local host.
|
||||
addresses are found, ``dig`` will send the query to the local host.
|
||||
|
||||
When no command-line arguments or options are given, ``dig``
|
||||
performs an NS query for "." (the root).
|
||||
When no command line arguments or options are given, ``dig`` will
|
||||
perform an NS query for "." (the root).
|
||||
|
||||
It is possible to set per-user defaults for ``dig`` via
|
||||
``${HOME}/.digrc``. This file is read and any options in it are applied
|
||||
before the command-line arguments. The ``-r`` option disables this
|
||||
feature, for scripts that need predictable behavior.
|
||||
before the command line arguments. The ``-r`` option disables this
|
||||
feature, for scripts that need predictable behaviour.
|
||||
|
||||
The IN and CH class names overlap with the IN and CH top-level domain
|
||||
The IN and CH class names overlap with the IN and CH top level domain
|
||||
names. Either use the ``-t`` and ``-c`` options to specify the type and
|
||||
class, use the ``-q`` to specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top-level domains.
|
||||
class, use the ``-q`` the specify the domain name, or use "IN." and
|
||||
"CH." when looking up these top level domains.
|
||||
|
||||
Simple Usage
|
||||
~~~~~~~~~~~~
|
||||
@@ -90,110 +90,110 @@ where:
|
||||
``/etc/resolv.conf``; if an address is found there, it queries the
|
||||
name server at that address. If either of the ``-4`` or ``-6``
|
||||
options are in use, then only addresses for the corresponding
|
||||
transport are tried. If no usable addresses are found, ``dig``
|
||||
sends the query to the local host. The reply from the name server
|
||||
transport will be tried. If no usable addresses are found, ``dig``
|
||||
will send the query to the local host. The reply from the name server
|
||||
that responds is displayed.
|
||||
|
||||
``name``
|
||||
is the name of the resource record that is to be looked up.
|
||||
|
||||
``type``
|
||||
indicates what type of query is required - ANY, A, MX, SIG, etc.
|
||||
indicates what type of query is required MDASH ANY, A, MX, SIG, etc.
|
||||
``type`` can be any valid query type. If no ``type`` argument is
|
||||
supplied, ``dig`` performs a lookup for an A record.
|
||||
supplied, ``dig`` will perform a lookup for an A record.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-4``
|
||||
This option indicates that only IPv4 should be used.
|
||||
**-4**
|
||||
Use IPv4 only.
|
||||
|
||||
``-6``
|
||||
This option indicates that only IPv6 should be used.
|
||||
**-6**
|
||||
Use IPv6 only.
|
||||
|
||||
``-b address[#port]``
|
||||
This option sets the source IP address of the query. The ``address`` must be a
|
||||
**-b** address[#port]
|
||||
Set the source IP address of the query. The ``address`` must be a
|
||||
valid address on one of the host's network interfaces, or "0.0.0.0"
|
||||
or "::". An optional port may be specified by appending ``#port``.
|
||||
or "::". An optional port may be specified by appending "#<port>"
|
||||
|
||||
``-c class``
|
||||
This option sets the query class. The default ``class`` is IN; other classes are
|
||||
**-c** class
|
||||
Set the query class. The default ``class`` is IN; other classes are
|
||||
HS for Hesiod records or CH for Chaosnet records.
|
||||
|
||||
``-f file``
|
||||
This option sets batch mode, in which ``dig`` reads a list of lookup requests to process from
|
||||
**-f** file
|
||||
Batch mode: ``dig`` reads a list of lookup requests to process from
|
||||
the given ``file``. Each line in the file should be organized in the
|
||||
same way it would be presented as a query to ``dig`` using the
|
||||
same way they would be presented as queries to ``dig`` using the
|
||||
command-line interface.
|
||||
|
||||
``-k keyfile``
|
||||
This option tells ``named`` to sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using ``tsig-keygen``. When using TSIG
|
||||
**-k** keyfile
|
||||
Sign queries using TSIG using a key read from the given file. Key
|
||||
files can be generated using tsig-keygen8. When using TSIG
|
||||
authentication with ``dig``, the name server that is queried needs to
|
||||
know the key and algorithm that is being used. In BIND, this is done
|
||||
by providing appropriate ``key`` and ``server`` statements in
|
||||
``named.conf``.
|
||||
|
||||
``-m``
|
||||
This option enables memory usage debugging.
|
||||
**-m**
|
||||
Enable memory usage debugging.
|
||||
|
||||
``-p port``
|
||||
This option sends the query to a non-standard port on the server, instead of the
|
||||
default port 53. This option is used to test a name server that
|
||||
**-p** port
|
||||
Send the query to a non-standard port on the server, instead of the
|
||||
default port 53. This option would be used to test a name server that
|
||||
has been configured to listen for queries on a non-standard port
|
||||
number.
|
||||
|
||||
``-q name``
|
||||
This option specifies the domain name to query. This is useful to distinguish the ``name``
|
||||
**-q** name
|
||||
The domain name to query. This is useful to distinguish the ``name``
|
||||
from other arguments.
|
||||
|
||||
``-r``
|
||||
This option indicates that options from ``${HOME}/.digrc`` should not be read. This is useful for
|
||||
scripts that need predictable behavior.
|
||||
**-r**
|
||||
Do not read options from ``${HOME}/.digrc``. This is useful for
|
||||
scripts that need predictable behaviour.
|
||||
|
||||
``-t type``
|
||||
This option indicates the resource record type to query, which can be any valid query type. If
|
||||
**-t** type
|
||||
The resource record type to query. It can be any valid query type. If
|
||||
it is a resource record type supported in BIND 9, it can be given by
|
||||
the type mnemonic (such as ``NS`` or ``AAAA``). The default query type is
|
||||
``A``, unless the ``-x`` option is supplied to indicate a reverse
|
||||
the type mnemonic (such as "NS" or "AAAA"). The default query type is
|
||||
"A", unless the ``-x`` option is supplied to indicate a reverse
|
||||
lookup. A zone transfer can be requested by specifying a type of
|
||||
AXFR. When an incremental zone transfer (IXFR) is required, set the
|
||||
``type`` to ``ixfr=N``. The incremental zone transfer contains
|
||||
all changes made to the zone since the serial number in the zone's
|
||||
``type`` to ``ixfr=N``. The incremental zone transfer will contain
|
||||
the changes made to the zone since the serial number in the zone's
|
||||
SOA record was ``N``.
|
||||
|
||||
All resource record types can be expressed as ``TYPEnn``, where ``nn`` is
|
||||
All resource record types can be expressed as "TYPEnn", where "nn" is
|
||||
the number of the type. If the resource record type is not supported
|
||||
in BIND 9, the result is displayed as described in :rfc:`3597`.
|
||||
in BIND 9, the result will be displayed as described in :rfc:`3597`.
|
||||
|
||||
``-u``
|
||||
This option indicates that print query times should be provided in microseconds instead of milliseconds.
|
||||
**-u**
|
||||
Print query times in microseconds instead of milliseconds.
|
||||
|
||||
``-v``
|
||||
This option prints the version number and exits.
|
||||
**-v**
|
||||
Print the version number and exit.
|
||||
|
||||
``-x addr``
|
||||
This option sets simplified reverse lookups, for mapping addresses to names. The
|
||||
**-x** addr
|
||||
Simplified reverse lookups, for mapping addresses to names. The
|
||||
``addr`` is an IPv4 address in dotted-decimal notation, or a
|
||||
colon-delimited IPv6 address. When the ``-x`` option is used, there is no
|
||||
need to provide the ``name``, ``class``, and ``type`` arguments.
|
||||
colon-delimited IPv6 address. When the ``-x`` is used, there is no
|
||||
need to provide the ``name``, ``class`` and ``type`` arguments.
|
||||
``dig`` automatically performs a lookup for a name like
|
||||
``94.2.0.192.in-addr.arpa`` and sets the query type and class to PTR
|
||||
and IN respectively. IPv6 addresses are looked up using nibble format
|
||||
under the IP6.ARPA domain.
|
||||
|
||||
``-y [hmac:]keyname:secret``
|
||||
This option signs queries using TSIG with the given authentication key.
|
||||
``keyname`` is the name of the key, and ``secret`` is the
|
||||
base64-encoded shared secret. ``hmac`` is the name of the key algorithm;
|
||||
**-y** [hmac:]keyname:secret
|
||||
Sign queries using TSIG with the given authentication key.
|
||||
``keyname`` is the name of the key, and ``secret`` is the base64
|
||||
encoded shared secret. ``hmac`` is the name of the key algorithm;
|
||||
valid choices are ``hmac-md5``, ``hmac-sha1``, ``hmac-sha224``,
|
||||
``hmac-sha256``, ``hmac-sha384``, or ``hmac-sha512``. If ``hmac`` is
|
||||
not specified, the default is ``hmac-md5``; if MD5 was disabled, the default is
|
||||
not specified, the default is ``hmac-md5`` or if MD5 was disabled
|
||||
``hmac-sha256``.
|
||||
|
||||
.. note:: Only the ``-k`` option should be used, rather than the ``-y`` option,
|
||||
because with ``-y`` the shared secret is supplied as a command-line
|
||||
argument in clear text. This may be visible in the output from ``ps1`` or
|
||||
.. note:: You should use the ``-k`` option and avoid the ``-y`` option,
|
||||
because with ``-y`` the shared secret is supplied as a command line
|
||||
argument in clear text. This may be visible in the output from ps1 or
|
||||
in a history file maintained by the user's shell.
|
||||
|
||||
Query Options
|
||||
@@ -206,293 +206,293 @@ answer get printed, and others determine the timeout and retry
|
||||
strategies.
|
||||
|
||||
Each query option is identified by a keyword preceded by a plus sign
|
||||
(``+``). Some keywords set or reset an option; these may be preceded by
|
||||
(``+``). Some keywords set or reset an option. These may be preceded by
|
||||
the string ``no`` to negate the meaning of that keyword. Other keywords
|
||||
assign values to options, like the timeout interval. They have the form
|
||||
assign values to options like the timeout interval. They have the form
|
||||
``+keyword=value``. Keywords may be abbreviated, provided the
|
||||
abbreviation is unambiguous; for example, ``+cd`` is equivalent to
|
||||
``+cdflag``. The query options are:
|
||||
|
||||
``+[no]aaflag``
|
||||
This option is a synonym for ``+[no]aaonly``.
|
||||
A synonym for ``+[no]aaonly``.
|
||||
|
||||
``+[no]aaonly``
|
||||
This option sets the ``aa`` flag in the query.
|
||||
Sets the "aa" flag in the query.
|
||||
|
||||
``+[no]additional``
|
||||
This option displays [or does not display] the additional section of a reply. The
|
||||
Display [do not display] the additional section of a reply. The
|
||||
default is to display it.
|
||||
|
||||
``+[no]adflag``
|
||||
This option sets [or does not set] the AD (authentic data) bit in the query. This
|
||||
Set [do not set] the AD (authentic data) bit in the query. This
|
||||
requests the server to return whether all of the answer and authority
|
||||
sections have been validated as secure, according to the security
|
||||
policy of the server. ``AD=1`` indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT-OUT range. ``AD=0``
|
||||
indicates that some part of the answer was insecure or not validated.
|
||||
sections have all been validated as secure according to the security
|
||||
policy of the server. AD=1 indicates that all records have been
|
||||
validated as secure and the answer is not from a OPT-OUT range. AD=0
|
||||
indicate that some part of the answer was insecure or not validated.
|
||||
This bit is set by default.
|
||||
|
||||
``+[no]all``
|
||||
This option sets or clears all display flags.
|
||||
Set or clear all display flags.
|
||||
|
||||
``+[no]answer``
|
||||
This option displays [or does not display] the answer section of a reply. The default
|
||||
Display [do not display] the answer section of a reply. The default
|
||||
is to display it.
|
||||
|
||||
``+[no]authority``
|
||||
This option displays [or does not display] the authority section of a reply. The
|
||||
Display [do not display] the authority section of a reply. The
|
||||
default is to display it.
|
||||
|
||||
``+[no]badcookie``
|
||||
This option retries the lookup with a new server cookie if a BADCOOKIE response is
|
||||
Retry lookup with the new server cookie if a BADCOOKIE response is
|
||||
received.
|
||||
|
||||
``+[no]besteffort``
|
||||
This option attempts to display the contents of messages which are malformed. The
|
||||
Attempt to display the contents of messages which are malformed. The
|
||||
default is to not display malformed answers.
|
||||
|
||||
``+bufsize[=B]``
|
||||
This option sets the UDP message buffer size advertised using EDNS0
|
||||
to ``B`` bytes. The maximum and minimum sizes of this buffer are
|
||||
65535 and 0, respectively. ``+bufsize=0`` disables EDNS (use
|
||||
``+bufsize=0 +edns`` to send an EDNS message with an advertised size
|
||||
``+bufsize=0 +edns`` to send a EDNS messages with a advertised size
|
||||
of 0 bytes). ``+bufsize`` restores the default buffer size.
|
||||
|
||||
``+[no]cdflag``
|
||||
This option sets [or does not set] the CD (checking disabled) bit in the query. This
|
||||
Set [do not set] the CD (checking disabled) bit in the query. This
|
||||
requests the server to not perform DNSSEC validation of responses.
|
||||
|
||||
``+[no]class``
|
||||
This option displays [or does not display] the CLASS when printing the record.
|
||||
Display [do not display] the CLASS when printing the record.
|
||||
|
||||
``+[no]cmd``
|
||||
This option toggles the printing of the initial comment in the output, identifying the
|
||||
version of ``dig`` and the query options that have been applied. This option
|
||||
always has a global effect; it cannot be set globally and then overridden on a
|
||||
per-lookup basis. The default is to print this comment.
|
||||
Toggles the printing of the initial comment in the output, identifying the
|
||||
version of ``dig`` and the query options that have been applied. This option
|
||||
always has global effect; it cannot be set globally and then overridden on a
|
||||
per-lookup basis. The default is to print this comment.
|
||||
|
||||
``+[no]comments``
|
||||
This option toggles the display of some comment lines in the output, with
|
||||
Toggles the display of some comment lines in the output, containing
|
||||
information about the packet header and OPT pseudosection, and the names of
|
||||
the response section. The default is to print these comments.
|
||||
the response section. The default is to print these comments.
|
||||
|
||||
Other types of comments in the output are not affected by this option, but
|
||||
can be controlled using other command-line switches. These include
|
||||
can be controlled using other command line switches. These include
|
||||
``+[no]cmd``, ``+[no]question``, ``+[no]stats``, and ``+[no]rrcomments``.
|
||||
|
||||
``+[no]cookie=####``
|
||||
This option sends [or does not send] a COOKIE EDNS option, with an optional value. Replaying a COOKIE
|
||||
from a previous response allows the server to identify a previous
|
||||
Send a COOKIE EDNS option, with optional value. Replaying a COOKIE
|
||||
from a previous response will allow the server to identify a previous
|
||||
client. The default is ``+cookie``.
|
||||
|
||||
``+cookie`` is also set when ``+trace`` is set to better emulate the
|
||||
``+cookie`` is also set when +trace is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
|
||||
``+[no]crypto``
|
||||
This option toggles the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these fields are unnecessary for debugging most DNSSEC
|
||||
Toggle the display of cryptographic fields in DNSSEC records. The
|
||||
contents of these field are unnecessary to debug most DNSSEC
|
||||
validation failures and removing them makes it easier to see the
|
||||
common failures. The default is to display the fields. When omitted,
|
||||
they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
|
||||
key ID is displayed as the replacement, e.g. ``[ key id = value ]``.
|
||||
common failures. The default is to display the fields. When omitted
|
||||
they are replaced by the string "[omitted]" or in the DNSKEY case the
|
||||
key id is displayed as the replacement, e.g. "[ key id = value ]".
|
||||
|
||||
``+[no]defname``
|
||||
This option, which is deprecated, is treated as a synonym for ``+[no]search``.
|
||||
Deprecated, treated as a synonym for ``+[no]search``
|
||||
|
||||
``+[no]dnssec``
|
||||
This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
|
||||
Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in
|
||||
the OPT record in the additional section of the query.
|
||||
|
||||
``+domain=somename``
|
||||
This option sets the search list to contain the single domain ``somename``, as if
|
||||
Set the search list to contain the single domain ``somename``, as if
|
||||
specified in a ``domain`` directive in ``/etc/resolv.conf``, and
|
||||
enables search list processing as if the ``+search`` option were
|
||||
enable search list processing as if the ``+search`` option were
|
||||
given.
|
||||
|
||||
``+dscp=value``
|
||||
This option sets the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0...63]. By default no code point is
|
||||
Set the DSCP code point to be used when sending the query. Valid DSCP
|
||||
code points are in the range [0..63]. By default no code point is
|
||||
explicitly set.
|
||||
|
||||
``+[no]edns[=#]``
|
||||
This option specifies the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version causes an EDNS query to be sent.
|
||||
Specify the EDNS version to query with. Valid values are 0 to 255.
|
||||
Setting the EDNS version will cause a EDNS query to be sent.
|
||||
``+noedns`` clears the remembered EDNS version. EDNS is set to 0 by
|
||||
default.
|
||||
|
||||
``+[no]ednsflags[=#]``
|
||||
This option sets the must-be-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex, and octal encodings are accepted. Setting a named flag
|
||||
(e.g., DO) is silently ignored. By default, no Z bits are set.
|
||||
Set the must-be-zero EDNS flags bits (Z bits) to the specified value.
|
||||
Decimal, hex and octal encodings are accepted. Setting a named flag
|
||||
(e.g. DO) will silently be ignored. By default, no Z bits are set.
|
||||
|
||||
``+[no]ednsnegotiation``
|
||||
This option enables/disables EDNS version negotiation. By default, EDNS version
|
||||
Enable / disable EDNS version negotiation. By default EDNS version
|
||||
negotiation is enabled.
|
||||
|
||||
``+[no]ednsopt[=code[:value]]``
|
||||
This option specifies the EDNS option with code point ``code`` and an optional payload
|
||||
Specify EDNS option with code point ``code`` and optionally payload
|
||||
of ``value`` as a hexadecimal string. ``code`` can be either an EDNS
|
||||
option name (for example, ``NSID`` or ``ECS``) or an arbitrary
|
||||
option name (for example, ``NSID`` or ``ECS``), or an arbitrary
|
||||
numeric value. ``+noednsopt`` clears the EDNS options to be sent.
|
||||
|
||||
``+[no]expire``
|
||||
This option sends an EDNS Expire option.
|
||||
Send an EDNS Expire option.
|
||||
|
||||
``+[no]fail``
|
||||
This option indicates that ``named`` should try [or not try] the next server if a SERVFAIL is received. The default is
|
||||
to not try the next server, which is the reverse of normal stub
|
||||
Do not try the next server if you receive a SERVFAIL. The default is
|
||||
to not try the next server which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
|
||||
``+[no]header-only``
|
||||
This option sends a query with a DNS header without a question section. The
|
||||
Send a query with a DNS header without a question section. The
|
||||
default is to add a question section. The query type and query name
|
||||
are ignored when this is set.
|
||||
|
||||
``+[no]identify``
|
||||
This option shows [or does not show] the IP address and port number that supplied
|
||||
the answer, when the ``+short`` option is enabled. If short form
|
||||
Show [or do not show] the IP address and port number that supplied
|
||||
the answer when the ``+short`` option is enabled. If short form
|
||||
answers are requested, the default is not to show the source address
|
||||
and port number of the server that provided the answer.
|
||||
|
||||
``+[no]idnin``
|
||||
This option processes [or does not process] IDN domain names on input. This requires
|
||||
``IDN SUPPORT`` to have been enabled at compile time.
|
||||
Process [do not process] IDN domain names on input. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
|
||||
The default is to process IDN input when standard output is a tty.
|
||||
The IDN processing on input is disabled when ``dig`` output is redirected
|
||||
The IDN processing on input is disabled when dig output is redirected
|
||||
to files, pipes, and other non-tty file descriptors.
|
||||
|
||||
``+[no]idnout``
|
||||
This option converts [or does not convert] puny code on output. This requires
|
||||
``IDN SUPPORT`` to have been enabled at compile time.
|
||||
Convert [do not convert] puny code on output. This requires IDN
|
||||
SUPPORT to have been enabled at compile time.
|
||||
|
||||
The default is to process puny code on output when standard output is
|
||||
a tty. The puny code processing on output is disabled when ``dig`` output
|
||||
a tty. The puny code processing on output is disabled when dig output
|
||||
is redirected to files, pipes, and other non-tty file descriptors.
|
||||
|
||||
``+[no]ignore``
|
||||
This option ignores [or does not ignore] truncation in UDP responses instead of retrying with TCP. By
|
||||
Ignore truncation in UDP responses instead of retrying with TCP. By
|
||||
default, TCP retries are performed.
|
||||
|
||||
``+[no]keepalive``
|
||||
This option sends [or does not send] an EDNS Keepalive option.
|
||||
Send [or do not send] an EDNS Keepalive option.
|
||||
|
||||
``+[no]keepopen``
|
||||
This option keeps [or does not keep] the TCP socket open between queries, and reuses it rather than
|
||||
Keep the TCP socket open between queries and reuse it rather than
|
||||
creating a new TCP socket for each lookup. The default is
|
||||
``+nokeepopen``.
|
||||
|
||||
``+[no]mapped``
|
||||
This option allows [or does not allow] mapped IPv4-over-IPv6 addresses to be used. The default is
|
||||
Allow mapped IPv4 over IPv6 addresses to be used. The default is
|
||||
``+mapped``.
|
||||
|
||||
``+[no]multiline``
|
||||
This option prints [or does not print] records, like the SOA records, in a verbose multi-line format
|
||||
Print records like the SOA records in a verbose multi-line format
|
||||
with human-readable comments. The default is to print each record on
|
||||
a single line to facilitate machine parsing of the ``dig`` output.
|
||||
a single line, to facilitate machine parsing of the ``dig`` output.
|
||||
|
||||
``+ndots=D``
|
||||
This option sets the number of dots (``D``) that must appear in ``name`` for
|
||||
Set the number of dots that have to appear in ``name`` to ``D`` for
|
||||
it to be considered absolute. The default value is that defined using
|
||||
the ``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots``
|
||||
the ndots statement in ``/etc/resolv.conf``, or 1 if no ndots
|
||||
statement is present. Names with fewer dots are interpreted as
|
||||
relative names, and are searched for in the domains listed in the
|
||||
relative names and will be searched for in the domains listed in the
|
||||
``search`` or ``domain`` directive in ``/etc/resolv.conf`` if
|
||||
``+search`` is set.
|
||||
|
||||
``+[no]nsid``
|
||||
When enabled, this option includes an EDNS name server ID request when sending a query.
|
||||
Include an EDNS name server ID request when sending a query.
|
||||
|
||||
``+[no]nssearch``
|
||||
When this option is set, ``dig`` attempts to find the authoritative
|
||||
name servers for the zone containing the name being looked up, and
|
||||
name servers for the zone containing the name being looked up and
|
||||
display the SOA record that each name server has for the zone.
|
||||
Addresses of servers that did not respond are also printed.
|
||||
Addresses of servers that that did not respond are also printed.
|
||||
|
||||
``+[no]onesoa``
|
||||
When enabled, this option prints only one (starting) SOA record when performing an AXFR. The
|
||||
Print only one (starting) SOA record when performing an AXFR. The
|
||||
default is to print both the starting and ending SOA records.
|
||||
|
||||
``+[no]opcode=value``
|
||||
When enabled, this option sets (restores) the DNS message opcode to the specified value. The
|
||||
Set [restore] the DNS message opcode to the specified value. The
|
||||
default value is QUERY (0).
|
||||
|
||||
``+padding=value``
|
||||
This option pads the size of the query packet using the EDNS Padding option to
|
||||
blocks of ``value`` bytes. For example, ``+padding=32`` causes a
|
||||
Pad the size of the query packet using the EDNS Padding option to
|
||||
blocks of ``value`` bytes. For example, ``+padding=32`` would cause a
|
||||
48-byte query to be padded to 64 bytes. The default block size is 0,
|
||||
which disables padding; the maximum is 512. Values are ordinarily
|
||||
which disables padding. The maximum is 512. Values are ordinarily
|
||||
expected to be powers of two, such as 128; however, this is not
|
||||
mandatory. Responses to padded queries may also be padded, but only
|
||||
if the query uses TCP or DNS COOKIE.
|
||||
|
||||
``+[no]qr``
|
||||
This option toggles the display of the query message as it is sent. By default, the query
|
||||
Toggles the display of the query message as it is sent. By default, the query
|
||||
is not printed.
|
||||
|
||||
``+[no]question``
|
||||
This option toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
Toggles the display of the question section of a query when an answer is
|
||||
returned. The default is to print the question section as a comment.
|
||||
|
||||
``+[no]raflag``
|
||||
This option sets [or does not set] the RA (Recursion Available) bit in the query. The
|
||||
default is ``+noraflag``. This bit is ignored by the server for
|
||||
Set [do not set] the RA (Recursion Available) bit in the query. The
|
||||
default is +noraflag. This bit should be ignored by the server for
|
||||
QUERY.
|
||||
|
||||
``+[no]rdflag``
|
||||
This option is a synonym for ``+[no]recurse``.
|
||||
A synonym for ``+[no]recurse``.
|
||||
|
||||
``+[no]recurse``
|
||||
This option toggles the setting of the RD (recursion desired) bit in the query.
|
||||
Toggle the setting of the RD (recursion desired) bit in the query.
|
||||
This bit is set by default, which means ``dig`` normally sends
|
||||
recursive queries. Recursion is automatically disabled when the
|
||||
``+nssearch`` or ``+trace`` query option is used.
|
||||
``+nssearch`` or ``+trace`` query options are used.
|
||||
|
||||
``+retry=T``
|
||||
This option sets the number of times to retry UDP and TCP queries to server to ``T``
|
||||
instead of the default, 2. Unlike ``+tries``, this does not include
|
||||
Sets the number of times to retry UDP queries to server to ``T``
|
||||
instead of the default, 2. Unlike ``+tries``, this does not include
|
||||
the initial query.
|
||||
|
||||
``+[no]rrcomments``
|
||||
This option toggles the display of per-record comments in the output (for example,
|
||||
Toggle the display of per-record comments in the output (for example,
|
||||
human-readable key information about DNSKEY records). The default is
|
||||
not to print record comments unless multiline mode is active.
|
||||
|
||||
``+[no]search``
|
||||
This option uses [or does not use] the search list defined by the searchlist or domain
|
||||
directive in ``resolv.conf``, if any. The search list is not used by
|
||||
Use [do not use] the search list defined by the searchlist or domain
|
||||
directive in ``resolv.conf`` (if any). The search list is not used by
|
||||
default.
|
||||
|
||||
``ndots`` from ``resolv.conf`` (default 1), which may be overridden by
|
||||
``+ndots``, determines whether the name is treated as relative
|
||||
and hence whether a search is eventually performed.
|
||||
'ndots' from ``resolv.conf`` (default 1) which may be overridden by
|
||||
``+ndots`` determines if the name will be treated as relative or not
|
||||
and hence whether a search is eventually performed or not.
|
||||
|
||||
``+[no]short``
|
||||
This option toggles whether a terse answer is provided. The default is to print the answer in a verbose
|
||||
form. This option always has a global effect; it cannot be set globally and
|
||||
Provide a terse answer. The default is to print the answer in a verbose
|
||||
form. This option always has global effect; it cannot be set globally and
|
||||
then overridden on a per-lookup basis.
|
||||
|
||||
``+[no]showsearch``
|
||||
This option performs [or does not perform] a search showing intermediate results.
|
||||
Perform [do not perform] a search showing intermediate results.
|
||||
|
||||
``+[no]sigchase``
|
||||
This feature is now obsolete and has been removed; use ``delv``
|
||||
instead.
|
||||
|
||||
``+split=W``
|
||||
This option splits long hex- or base64-formatted fields in resource records into
|
||||
Split long hex- or base64-formatted fields in resource records into
|
||||
chunks of ``W`` characters (where ``W`` is rounded up to the nearest
|
||||
multiple of 4). ``+nosplit`` or ``+split=0`` causes fields not to be
|
||||
split at all. The default is 56 characters, or 44 characters when
|
||||
multiline mode is active.
|
||||
|
||||
``+[no]stats``
|
||||
This option toggles the printing of statistics: when the query was made, the size of the
|
||||
reply, etc. The default behavior is to print the query statistics as a
|
||||
Toggles the printing of statistics: when the query was made, the size of the
|
||||
reply and so on. The default behavior is to print the query statistics as a
|
||||
comment after each lookup.
|
||||
|
||||
``+[no]subnet=addr[/prefix-length]``
|
||||
This option sends [or does not send] an EDNS CLIENT-SUBNET option with the specified IP
|
||||
Send (don't send) an EDNS Client Subnet option with the specified IP
|
||||
address or network prefix.
|
||||
|
||||
``dig +subnet=0.0.0.0/0``, or simply ``dig +subnet=0`` for short,
|
||||
@@ -501,74 +501,75 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
|
||||
address information must *not* be used when resolving this query.
|
||||
|
||||
``+[no]tcflag``
|
||||
This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
|
||||
``+notcflag``. This bit is ignored by the server for QUERY.
|
||||
Set [do not set] the TC (TrunCation) bit in the query. The default is
|
||||
+notcflag. This bit should be ignored by the server for QUERY.
|
||||
|
||||
``+[no]tcp``
|
||||
This option uses [or does not use] TCP when querying name servers. The default behavior
|
||||
Use [do not use] TCP when querying name servers. The default behavior
|
||||
is to use UDP unless a type ``any`` or ``ixfr=N`` query is requested,
|
||||
in which case the default is TCP. AXFR queries always use TCP.
|
||||
|
||||
``+timeout=T``
|
||||
This option sets the timeout for a query to ``T`` seconds. The default timeout is
|
||||
5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.
|
||||
Sets the timeout for a query to ``T`` seconds. The default timeout is
|
||||
5 seconds. An attempt to set ``T`` to less than 1 will result in a
|
||||
query timeout of 1 second being applied.
|
||||
|
||||
``+[no]topdown``
|
||||
This feature is related to ``dig +sigchase``, which is obsolete and
|
||||
has been removed. Use ``delv`` instead.
|
||||
|
||||
``+[no]trace``
|
||||
This option toggles tracing of the delegation path from the root name servers for
|
||||
Toggle tracing of the delegation path from the root name servers for
|
||||
the name being looked up. Tracing is disabled by default. When
|
||||
tracing is enabled, ``dig`` makes iterative queries to resolve the
|
||||
name being looked up. It follows referrals from the root servers,
|
||||
name being looked up. It will follow referrals from the root servers,
|
||||
showing the answer from each server that was used to resolve the
|
||||
lookup.
|
||||
|
||||
If ``@server`` is also specified, it affects only the initial query for
|
||||
If @server is also specified, it affects only the initial query for
|
||||
the root zone name servers.
|
||||
|
||||
``+dnssec`` is also set when ``+trace`` is set, to better emulate the
|
||||
default queries from a name server.
|
||||
``+dnssec`` is also set when +trace is set to better emulate the
|
||||
default queries from a nameserver.
|
||||
|
||||
``+tries=T``
|
||||
This option sets the number of times to try UDP and TCP queries to server to ``T``
|
||||
Sets the number of times to try UDP queries to server to ``T``
|
||||
instead of the default, 3. If ``T`` is less than or equal to zero,
|
||||
the number of tries is silently rounded up to 1.
|
||||
|
||||
``+trusted-key=####``
|
||||
This option formerly specified trusted keys for use with ``dig +sigchase``. This
|
||||
Formerly specified trusted keys for use with ``dig +sigchase``. This
|
||||
feature is now obsolete and has been removed; use ``delv`` instead.
|
||||
|
||||
``+[no]ttlid``
|
||||
This option displays [or does not display] the TTL when printing the record.
|
||||
Display [do not display] the TTL when printing the record.
|
||||
|
||||
``+[no]ttlunits``
|
||||
This option displays [or does not display] the TTL in friendly human-readable time
|
||||
units of ``s``, ``m``, ``h``, ``d``, and ``w``, representing seconds, minutes,
|
||||
hours, days, and weeks. This implies ``+ttlid``.
|
||||
Display [do not display] the TTL in friendly human-readable time
|
||||
units of "s", "m", "h", "d", and "w", representing seconds, minutes,
|
||||
hours, days and weeks. Implies +ttlid.
|
||||
|
||||
``+[no]unexpected``
|
||||
This option accepts [or does not accept] answers from unexpected sources. By default, ``dig``
|
||||
will not accept a reply from a source other than the one to which it sent the
|
||||
Accept [do not accept] answers from unexpected sources. By default, ``dig``
|
||||
won't accept a reply from a source other than the one to which it sent the
|
||||
query.
|
||||
|
||||
``+[no]unknownformat``
|
||||
This option prints all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
Print all RDATA in unknown RR type presentation format (:rfc:`3597`).
|
||||
The default is to print RDATA for known types in the type's
|
||||
presentation format.
|
||||
|
||||
``+[no]vc``
|
||||
This option uses [or does not use] TCP when querying name servers. This alternate
|
||||
Use [do not use] TCP when querying name servers. This alternate
|
||||
syntax to ``+[no]tcp`` is provided for backwards compatibility. The
|
||||
``vc`` stands for "virtual circuit."
|
||||
"vc" stands for "virtual circuit".
|
||||
|
||||
``+[no]yaml``
|
||||
When enabled, this option prints the responses (and, if ``+qr`` is in use, also the
|
||||
Print the responses (and, if <option>+qr</option> is in use, also the
|
||||
outgoing queries) in a detailed YAML format.
|
||||
|
||||
``+[no]zflag``
|
||||
This option sets [or does not set] the last unassigned DNS header flag in a DNS query.
|
||||
Set [do not set] the last unassigned DNS header flag in a DNS query.
|
||||
This flag is off by default.
|
||||
|
||||
Multiple Queries
|
||||
@@ -577,12 +578,12 @@ Multiple Queries
|
||||
The BIND 9 implementation of ``dig`` supports specifying multiple
|
||||
queries on the command line (in addition to supporting the ``-f`` batch
|
||||
file option). Each of those queries can be supplied with its own set of
|
||||
flags, options, and query options.
|
||||
flags, options and query options.
|
||||
|
||||
In this case, each ``query`` argument represents an individual query in
|
||||
In this case, each ``query`` argument represent an individual query in
|
||||
the command-line syntax described above. Each consists of any of the
|
||||
standard options and flags, the name to be looked up, an optional query
|
||||
type and class, and any query options that should be applied to that
|
||||
type and class and any query options that should be applied to that
|
||||
query.
|
||||
|
||||
A global set of query options, which should be applied to all queries,
|
||||
@@ -596,12 +597,12 @@ query options. For example:
|
||||
|
||||
dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
|
||||
shows how ``dig`` can be used from the command line to make three
|
||||
lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1,
|
||||
shows how ``dig`` could be used from the command line to make three
|
||||
lookups: an ANY query for ``www.isc.org``, a reverse lookup of 127.0.0.1
|
||||
and a query for the NS records of ``isc.org``. A global query option of
|
||||
``+qr`` is applied, so that ``dig`` shows the initial query it made for
|
||||
each lookup. The final query has a local query option of ``+noqr`` which
|
||||
means that ``dig`` does not print the initial query when it looks up the
|
||||
means that ``dig`` will not print the initial query when it looks up the
|
||||
NS records for ``isc.org``.
|
||||
|
||||
IDN Support
|
||||
@@ -609,32 +610,12 @@ IDN Support
|
||||
|
||||
If ``dig`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``dig``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, use the parameters
|
||||
``+noidnin`` and ``+noidnout``, or define the ``IDN_DISABLE`` environment
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, use parameters
|
||||
``+noidnin`` and ``+noidnout`` or define the IDN_DISABLE environment
|
||||
variable.
|
||||
|
||||
Return Codes
|
||||
~~~~~~~~~~~~
|
||||
|
||||
``dig`` return codes are:
|
||||
|
||||
``0``
|
||||
DNS response received, including NXDOMAIN status
|
||||
|
||||
``1``
|
||||
Usage error
|
||||
|
||||
``8``
|
||||
Couldn't open batch file
|
||||
|
||||
``9``
|
||||
No reply from server
|
||||
|
||||
``10``
|
||||
Internal error
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
|
||||
+43
-68
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -41,7 +41,6 @@
|
||||
#include <isc/hex.h>
|
||||
#include <isc/lang.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/netaddr.h>
|
||||
#include <isc/netdb.h>
|
||||
#include <isc/nonce.h>
|
||||
@@ -99,14 +98,6 @@
|
||||
#define NS_IN6ADDRSZ 16
|
||||
#endif /* if !defined(NS_IN6ADDRSZ) */
|
||||
|
||||
#if HAVE_SETLOCALE
|
||||
#define systemlocale(l) (void)setlocale(l, "")
|
||||
#define resetlocale(l) (void)setlocale(l, "C")
|
||||
#else
|
||||
#define systemlocale(l)
|
||||
#define resetlocale(l)
|
||||
#endif /* HAVE_SETLOCALE */
|
||||
|
||||
dig_lookuplist_t lookup_list;
|
||||
dig_serverlist_t server_list;
|
||||
dig_searchlistlist_t search_list;
|
||||
@@ -120,7 +111,6 @@ unsigned int timeout = 0;
|
||||
unsigned int extrabytes;
|
||||
isc_mem_t *mctx = NULL;
|
||||
isc_log_t *lctx = NULL;
|
||||
isc_nm_t *netmgr = NULL;
|
||||
isc_taskmgr_t *taskmgr = NULL;
|
||||
isc_task_t *global_task = NULL;
|
||||
isc_timermgr_t *timermgr = NULL;
|
||||
@@ -1347,6 +1337,11 @@ setup_system(bool ipv4only, bool ipv6only) {
|
||||
|
||||
irs_resconf_destroy(&resconf);
|
||||
|
||||
#ifdef HAVE_SETLOCALE
|
||||
/* Set locale */
|
||||
(void)setlocale(LC_ALL, "");
|
||||
#endif /* ifdef HAVE_SETLOCALE */
|
||||
|
||||
if (keyfile[0] != 0) {
|
||||
setup_file_key();
|
||||
} else if (keysecret[0] != 0) {
|
||||
@@ -1409,8 +1404,8 @@ setup_libs(void) {
|
||||
|
||||
isc_log_setdebuglevel(lctx, 0);
|
||||
|
||||
result = isc_managers_create(mctx, 1, 0, &netmgr, &taskmgr);
|
||||
check_result(result, "isc_managers_create");
|
||||
result = isc_taskmgr_create(mctx, 1, 0, NULL, &taskmgr);
|
||||
check_result(result, "isc_taskmgr_create");
|
||||
|
||||
result = isc_task_create(taskmgr, 0, &global_task);
|
||||
check_result(result, "isc_task_create");
|
||||
@@ -1681,7 +1676,7 @@ destroy_lookup(dig_lookup_t *lookup) {
|
||||
isc_mem_free(mctx, ptr);
|
||||
}
|
||||
if (lookup->sendmsg != NULL) {
|
||||
dns_message_detach(&lookup->sendmsg);
|
||||
dns_message_destroy(&lookup->sendmsg);
|
||||
}
|
||||
if (lookup->querysig != NULL) {
|
||||
debug("freeing buffer %p", lookup->querysig);
|
||||
@@ -2058,6 +2053,7 @@ insert_soa(dig_lookup_t *lookup) {
|
||||
|
||||
result = dns_message_gettempname(lookup->sendmsg, &soaname);
|
||||
check_result(result, "dns_message_gettempname");
|
||||
dns_name_init(soaname, NULL);
|
||||
dns_name_clone(lookup->name, soaname);
|
||||
ISC_LIST_INIT(soaname->list);
|
||||
ISC_LIST_APPEND(soaname->list, rdataset, link);
|
||||
@@ -2105,7 +2101,9 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
|
||||
debug("setup_lookup(%p)", lookup);
|
||||
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &lookup->sendmsg);
|
||||
result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER,
|
||||
&lookup->sendmsg);
|
||||
check_result(result, "dns_message_create");
|
||||
|
||||
if (lookup->new_search) {
|
||||
debug("resetting lookup counter.");
|
||||
@@ -2118,6 +2116,7 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
}
|
||||
result = dns_message_gettempname(lookup->sendmsg, &lookup->name);
|
||||
check_result(result, "dns_message_gettempname");
|
||||
dns_name_init(lookup->name, NULL);
|
||||
|
||||
isc_buffer_init(&lookup->namebuf, lookup->name_space,
|
||||
sizeof(lookup->name_space));
|
||||
@@ -2161,6 +2160,7 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
result = dns_message_gettempname(lookup->sendmsg,
|
||||
&lookup->oname);
|
||||
check_result(result, "dns_message_gettempname");
|
||||
dns_name_init(lookup->oname, NULL);
|
||||
/* XXX Helper funct to conv char* to name? */
|
||||
origin = lookup->origin->origin;
|
||||
#ifdef HAVE_LIBIDN2
|
||||
@@ -2937,11 +2937,7 @@ send_udp(dig_query_t *query) {
|
||||
}
|
||||
isc_buffer_usedregion(&query->sendbuf, &r);
|
||||
debug("sending a request");
|
||||
if (query->lookup->use_usec) {
|
||||
TIME_NOW_HIRES(&query->time_sent);
|
||||
} else {
|
||||
TIME_NOW(&query->time_sent);
|
||||
}
|
||||
TIME_NOW(&query->time_sent);
|
||||
INSIST(query->sock != NULL);
|
||||
query->waiting_senddone = true;
|
||||
sevent = isc_socket_socketevent(
|
||||
@@ -3081,8 +3077,7 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
|
||||
*/
|
||||
static void
|
||||
requeue_or_update_exitcode(dig_lookup_t *lookup) {
|
||||
if (lookup->eoferr == 0U && lookup->retries > 1) {
|
||||
--lookup->retries;
|
||||
if (lookup->eoferr == 0U) {
|
||||
/*
|
||||
* Peer closed the connection prematurely for the first time
|
||||
* for this lookup. Try again, keeping track of this failure.
|
||||
@@ -3224,11 +3219,7 @@ launch_next_query(dig_query_t *query, bool include_question) {
|
||||
debug("recvcount=%d", recvcount);
|
||||
if (!query->first_soa_rcvd) {
|
||||
debug("sending a request in launch_next_query");
|
||||
if (query->lookup->use_usec) {
|
||||
TIME_NOW_HIRES(&query->time_sent);
|
||||
} else {
|
||||
TIME_NOW(&query->time_sent);
|
||||
}
|
||||
TIME_NOW(&query->time_sent);
|
||||
query->waiting_senddone = true;
|
||||
isc_buffer_clear(&query->tmpsendbuf);
|
||||
isc_buffer_putuint16(&query->tmpsendbuf,
|
||||
@@ -3634,11 +3625,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
INSIST(recvcount >= 0);
|
||||
|
||||
query = event->ev_arg;
|
||||
if (query->lookup->use_usec) {
|
||||
TIME_NOW_HIRES(&query->time_recv);
|
||||
} else {
|
||||
TIME_NOW(&query->time_recv);
|
||||
}
|
||||
TIME_NOW(&query->time_recv);
|
||||
|
||||
l = query->lookup;
|
||||
|
||||
@@ -3779,7 +3766,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
goto udp_mismatch;
|
||||
}
|
||||
|
||||
dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
|
||||
check_result(result, "dns_message_create");
|
||||
|
||||
if (tsigkey != NULL) {
|
||||
if (l->querysig == NULL) {
|
||||
@@ -3819,7 +3807,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
hex_dump(&b);
|
||||
}
|
||||
query->waiting_connect = false;
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
cancel_lookup(l);
|
||||
@@ -3841,7 +3829,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
dighost_warning("Warning: Opcode mismatch: expected %s, got %s",
|
||||
expect, got);
|
||||
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
if (l->tcp_mode) {
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
@@ -3893,7 +3881,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
}
|
||||
}
|
||||
if (!match) {
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
if (l->tcp_mode) {
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
@@ -3919,7 +3907,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
if (l->trace && l->trace_root) {
|
||||
n->rdtype = l->qrdtype;
|
||||
}
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
cancel_lookup(l);
|
||||
@@ -3938,7 +3926,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
if (l->trace && l->trace_root) {
|
||||
n->rdtype = l->qrdtype;
|
||||
}
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
cancel_lookup(l);
|
||||
@@ -3962,7 +3950,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
if (l->trace && l->trace_root) {
|
||||
n->rdtype = l->qrdtype;
|
||||
}
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
cancel_lookup(l);
|
||||
@@ -4003,7 +3991,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
query->servname);
|
||||
clear_query(query);
|
||||
check_next_lookup(l);
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
UNLOCK_LOOKUP;
|
||||
return;
|
||||
@@ -4136,7 +4124,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
}
|
||||
if (l->doing_xfr) {
|
||||
if (query != l->xfr_q) {
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
isc_event_free(&event);
|
||||
query->waiting_connect = false;
|
||||
UNLOCK_LOOKUP;
|
||||
@@ -4146,7 +4134,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
docancel = check_for_more_data(query, msg, sevent);
|
||||
}
|
||||
if (docancel) {
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
clear_query(query);
|
||||
cancel_lookup(l);
|
||||
check_next_lookup(l);
|
||||
@@ -4162,14 +4150,14 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
}
|
||||
if (!query->lookup->ns_search_only ||
|
||||
query->lookup->trace_root || docancel) {
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
cancel_lookup(l);
|
||||
}
|
||||
clear_query(query);
|
||||
check_next_lookup(l);
|
||||
}
|
||||
if (msg != NULL) {
|
||||
dns_message_detach(&msg);
|
||||
dns_message_destroy(&msg);
|
||||
}
|
||||
isc_event_free(&event);
|
||||
UNLOCK_LOOKUP;
|
||||
@@ -4353,10 +4341,13 @@ destroy_libs(void) {
|
||||
debug("freeing task");
|
||||
isc_task_detach(&global_task);
|
||||
}
|
||||
|
||||
/*
|
||||
* The taskmgr_destroy() call blocks until all events are cleared
|
||||
* from the task.
|
||||
*/
|
||||
if (taskmgr != NULL) {
|
||||
debug("freeing taskmgr");
|
||||
isc_managers_destroy(&netmgr, &taskmgr);
|
||||
isc_taskmgr_destroy(&taskmgr);
|
||||
}
|
||||
LOCK_LOOKUP;
|
||||
REQUIRE(sockcount == 0);
|
||||
@@ -4421,9 +4412,8 @@ destroy_libs(void) {
|
||||
#ifdef HAVE_LIBIDN2
|
||||
static isc_result_t
|
||||
idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
|
||||
char src[MXNAME], *dst = NULL;
|
||||
char src[MXNAME], *dst;
|
||||
size_t srclen, dstlen;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
|
||||
/*
|
||||
* Copy name from 'buffer' to 'src' and terminate it with NULL.
|
||||
@@ -4431,27 +4421,23 @@ idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
|
||||
srclen = isc_buffer_usedlength(buffer) - used_org;
|
||||
if (srclen >= sizeof(src)) {
|
||||
warn("Input name too long to perform IDN conversion");
|
||||
goto cleanup;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
memmove(src, (char *)isc_buffer_base(buffer) + used_org, srclen);
|
||||
src[srclen] = '\0';
|
||||
|
||||
systemlocale(LC_ALL);
|
||||
|
||||
/*
|
||||
* Convert 'src' to the current locale's character encoding.
|
||||
*/
|
||||
idn_ace_to_locale(src, &dst);
|
||||
|
||||
resetlocale(LC_ALL);
|
||||
|
||||
/*
|
||||
* Check whether the converted name will fit back into 'buffer'.
|
||||
*/
|
||||
dstlen = strlen(dst);
|
||||
if (isc_buffer_length(buffer) < used_org + dstlen) {
|
||||
result = ISC_R_NOSPACE;
|
||||
goto cleanup;
|
||||
idn2_free(dst);
|
||||
return (ISC_R_NOSPACE);
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -4464,12 +4450,9 @@ idn_output_filter(isc_buffer_t *buffer, unsigned int used_org) {
|
||||
/*
|
||||
* Clean up.
|
||||
*/
|
||||
cleanup:
|
||||
if (dst != NULL) {
|
||||
idn2_free(dst);
|
||||
}
|
||||
idn2_free(dst);
|
||||
|
||||
return (result);
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -4485,8 +4468,6 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
|
||||
char *ascii_src;
|
||||
int res;
|
||||
|
||||
systemlocale(LC_ALL);
|
||||
|
||||
/*
|
||||
* We trust libidn2 to return an error if 'src' is too large to be a
|
||||
* valid domain name.
|
||||
@@ -4507,8 +4488,6 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) {
|
||||
(void)strlcpy(dst, final_src, dstlen);
|
||||
|
||||
idn2_free(ascii_src);
|
||||
|
||||
resetlocale(LC_ALL);
|
||||
}
|
||||
|
||||
/*%
|
||||
@@ -4523,8 +4502,6 @@ idn_ace_to_locale(const char *src, char **dst) {
|
||||
char *local_src, *utf8_src;
|
||||
int res;
|
||||
|
||||
systemlocale(LC_ALL);
|
||||
|
||||
/*
|
||||
* We need to:
|
||||
*
|
||||
@@ -4590,7 +4567,5 @@ idn_ace_to_locale(const char *src, char **dst) {
|
||||
idn2_free(utf8_src);
|
||||
|
||||
*dst = local_src;
|
||||
|
||||
resetlocale(LC_ALL);
|
||||
}
|
||||
#endif /* HAVE_LIBIDN2 */
|
||||
|
||||
+6
-7
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -13,10 +13,13 @@
|
||||
|
||||
#include <inttypes.h>
|
||||
#include <limits.h>
|
||||
#include <locale.h>
|
||||
#include <stdbool.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
#ifdef HAVE_LOCALE_H
|
||||
#include <locale.h>
|
||||
#endif /* ifdef HAVE_LOCALE_H */
|
||||
|
||||
#include <isc/app.h>
|
||||
#include <isc/commandline.h>
|
||||
#include <isc/netaddr.h>
|
||||
@@ -145,11 +148,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
|
||||
if (!short_form) {
|
||||
char fromtext[ISC_SOCKADDR_FORMATSIZE];
|
||||
isc_sockaddr_format(from, fromtext, sizeof(fromtext));
|
||||
if (query->lookup->use_usec) {
|
||||
TIME_NOW_HIRES(&now);
|
||||
} else {
|
||||
TIME_NOW(&now);
|
||||
}
|
||||
TIME_NOW(&now);
|
||||
diff = (int)isc_time_microdiff(&now, &query->time_sent);
|
||||
printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
|
||||
diff / 1000);
|
||||
|
||||
+68
-68
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -36,12 +36,12 @@ Description
|
||||
|
||||
``host`` is a simple utility for performing DNS lookups. It is normally
|
||||
used to convert names to IP addresses and vice versa. When no arguments
|
||||
or options are given, ``host`` prints a short summary of its
|
||||
command-line arguments and options.
|
||||
or options are given, ``host`` prints a short summary of its command
|
||||
line arguments and options.
|
||||
|
||||
``name`` is the domain name that is to be looked up. It can also be a
|
||||
dotted-decimal IPv4 address or a colon-delimited IPv6 address, in which
|
||||
case ``host`` by default performs a reverse lookup for that address.
|
||||
case ``host`` will by default perform a reverse lookup for that address.
|
||||
``server`` is an optional argument which is either the name or IP
|
||||
address of the name server that ``host`` should query instead of the
|
||||
server or servers listed in ``/etc/resolv.conf``.
|
||||
@@ -49,111 +49,111 @@ server or servers listed in ``/etc/resolv.conf``.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-4``
|
||||
This option specifies that only IPv4 should be used for query transport. See also the ``-6`` option.
|
||||
**-4**
|
||||
Use IPv4 only for query transport. See also the ``-6`` option.
|
||||
|
||||
``-6``
|
||||
This option specifies that only IPv6 should be used for query transport. See also the ``-4`` option.
|
||||
**-6**
|
||||
Use IPv6 only for query transport. See also the ``-4`` option.
|
||||
|
||||
``-a``
|
||||
The ``-a`` ("all") option is normally equivalent to ``-v -t ANY``. It
|
||||
also affects the behavior of the ``-l`` list zone option.
|
||||
**-a**
|
||||
"All". The ``-a`` option is normally equivalent to ``-v -t ANY``. It
|
||||
also affects the behaviour of the ``-l`` list zone option.
|
||||
|
||||
``-A``
|
||||
The ``-A`` ("almost all") option is equivalent to ``-a``, except that RRSIG,
|
||||
**-A**
|
||||
"Almost all". The ``-A`` option is equivalent to ``-a`` except RRSIG,
|
||||
NSEC, and NSEC3 records are omitted from the output.
|
||||
|
||||
``-c class``
|
||||
This option specifies the query class, which can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
**-c** class
|
||||
Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet)
|
||||
class resource records. The default class is IN (Internet).
|
||||
|
||||
``-C``
|
||||
This option indicates that ``named`` should check consistency, meaning that ``host`` queries the SOA records for zone
|
||||
**-C**
|
||||
Check consistency: ``host`` will query the SOA records for zone
|
||||
``name`` from all the listed authoritative name servers for that
|
||||
zone. The list of name servers is defined by the NS records that are
|
||||
found for the zone.
|
||||
|
||||
``-d``
|
||||
This option prints debugging traces, and is equivalent to the ``-v`` verbose option.
|
||||
**-d**
|
||||
Print debugging traces. Equivalent to the ``-v`` verbose option.
|
||||
|
||||
``-l``
|
||||
This option tells ``named` to list the zone, meaning the ``host`` command performs a zone transfer of zone
|
||||
``name`` and prints out the NS, PTR, and address records (A/AAAA).
|
||||
**-l**
|
||||
List zone: The ``host`` command performs a zone transfer of zone
|
||||
``name`` and prints out the NS, PTR and address records (A/AAAA).
|
||||
|
||||
Together, the ``-l -a`` options print all records in the zone.
|
||||
|
||||
``-N ndots``
|
||||
This option specifies the number of dots (``ndots``) that have to be in ``name`` for it to be
|
||||
**-N** ndots
|
||||
The number of dots that have to be in ``name`` for it to be
|
||||
considered absolute. The default value is that defined using the
|
||||
``ndots`` statement in ``/etc/resolv.conf``, or 1 if no ``ndots`` statement
|
||||
is present. Names with fewer dots are interpreted as relative names,
|
||||
and are searched for in the domains listed in the ``search`` or
|
||||
ndots statement in ``/etc/resolv.conf``, or 1 if no ndots statement
|
||||
is present. Names with fewer dots are interpreted as relative names
|
||||
and will be searched for in the domains listed in the ``search`` or
|
||||
``domain`` directive in ``/etc/resolv.conf``.
|
||||
|
||||
``-p port``
|
||||
This option specifies the port to query on the server. The default is 53.
|
||||
**-p** port
|
||||
Specify the port on the server to query. The default is 53.
|
||||
|
||||
``-r``
|
||||
This option specifies a non-recursive query; setting this option clears the RD (recursion
|
||||
desired) bit in the query. This means that the name server
|
||||
receiving the query does not attempt to resolve ``name``. The ``-r``
|
||||
**-r**
|
||||
Non-recursive query: Setting this option clears the RD (recursion
|
||||
desired) bit in the query. This should mean that the name server
|
||||
receiving the query will not attempt to resolve ``name``. The ``-r``
|
||||
option enables ``host`` to mimic the behavior of a name server by
|
||||
making non-recursive queries, and expecting to receive answers to
|
||||
making non-recursive queries and expecting to receive answers to
|
||||
those queries that can be referrals to other name servers.
|
||||
|
||||
``-R number``
|
||||
This option specifies the number of retries for UDP queries. If ``number`` is negative or zero,
|
||||
the number of retries is silently set to 1. The default value is 1, or
|
||||
**-R** number
|
||||
Number of retries for UDP queries: If ``number`` is negative or zero,
|
||||
the number of retries will default to 1. The default value is 1, or
|
||||
the value of the ``attempts`` option in ``/etc/resolv.conf``, if set.
|
||||
|
||||
``-s``
|
||||
This option tells ``named`` *not* to send the query to the next nameserver if any server responds
|
||||
**-s**
|
||||
Do *not* send the query to the next nameserver if any server responds
|
||||
with a SERVFAIL response, which is the reverse of normal stub
|
||||
resolver behavior.
|
||||
|
||||
``-t type``
|
||||
This option specifies the query type. The ``type`` argument can be any recognized query type:
|
||||
**-t** type
|
||||
Query type: The ``type`` argument can be any recognized query type:
|
||||
CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
|
||||
|
||||
When no query type is specified, ``host`` automatically selects an
|
||||
appropriate query type. By default, it looks for A, AAAA, and MX
|
||||
records. If the ``-C`` option is given, queries are made for SOA
|
||||
records. If the ``-C`` option is given, queries will be made for SOA
|
||||
records. If ``name`` is a dotted-decimal IPv4 address or
|
||||
colon-delimited IPv6 address, ``host`` queries for PTR records.
|
||||
colon-delimited IPv6 address, ``host`` will query for PTR records.
|
||||
|
||||
If a query type of IXFR is chosen, the starting serial number can be
|
||||
specified by appending an equals sign (=), followed by the starting serial
|
||||
number, e.g., ``-t IXFR=12345678``.
|
||||
If a query type of IXFR is chosen the starting serial number can be
|
||||
specified by appending an equal followed by the starting serial
|
||||
number (like ``-t IXFR=12345678``).
|
||||
|
||||
``-T``; ``-U``
|
||||
This option specifies TCP or UDP. By default, ``host`` uses UDP when making queries; the
|
||||
**-T**; **-U**
|
||||
TCP/UDP: By default, ``host`` uses UDP when making queries. The
|
||||
``-T`` option makes it use a TCP connection when querying the name
|
||||
server. TCP is automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type ``ANY`` queries default
|
||||
to TCP, but can be forced to use UDP initially via ``-U``.
|
||||
server. TCP will be automatically selected for queries that require
|
||||
it, such as zone transfer (AXFR) requests. Type ANY queries default
|
||||
to TCP but can be forced to UDP initially using ``-U``.
|
||||
|
||||
``-m flag``
|
||||
This option sets memory usage debugging: the flag can be ``record``, ``usage``, or
|
||||
``trace``. The ``-m`` option can be specified more than once to set
|
||||
**-m** flag
|
||||
Memory usage debugging: the flag can be ``record``, ``usage``, or
|
||||
``trace``. You can specify the ``-m`` option more than once to set
|
||||
multiple flags.
|
||||
|
||||
``-v``
|
||||
This option sets verbose output, and is equivalent to the ``-d`` debug option. Verbose output
|
||||
**-v**
|
||||
Verbose output. Equivalent to the ``-d`` debug option. Verbose output
|
||||
can also be enabled by setting the ``debug`` option in
|
||||
``/etc/resolv.conf``.
|
||||
|
||||
``-V``
|
||||
This option prints the version number and exits.
|
||||
**-V**
|
||||
Print the version number and exit.
|
||||
|
||||
``-w``
|
||||
This option sets "wait forever": the query timeout is set to the maximum possible. See
|
||||
**-w**
|
||||
Wait forever: The query timeout is set to the maximum possible. See
|
||||
also the ``-W`` option.
|
||||
|
||||
``-W wait``
|
||||
This options sets the length of the wait timeout, indicating that ``named`` should wait for up to ``wait`` seconds for a reply. If ``wait`` is
|
||||
less than 1, the wait interval is set to 1 second.
|
||||
**-W** wait
|
||||
Timeout: Wait for up to ``wait`` seconds for a reply. If ``wait`` is
|
||||
less than one, the wait interval is set to one second.
|
||||
|
||||
By default, ``host`` waits for 5 seconds for UDP responses and 10
|
||||
By default, ``host`` will wait for 5 seconds for UDP responses and 10
|
||||
seconds for TCP connections. These defaults can be overridden by the
|
||||
``timeout`` option in ``/etc/resolv.conf``.
|
||||
|
||||
@@ -164,10 +164,10 @@ IDN Support
|
||||
|
||||
If ``host`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``host``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the ``IDN_DISABLE``
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
when ``host`` runs.
|
||||
|
||||
Files
|
||||
|
||||
+21
-21
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -127,18 +127,18 @@ struct dig_lookup {
|
||||
isc_buffer_t namebuf;
|
||||
isc_buffer_t onamebuf;
|
||||
isc_buffer_t renderbuf;
|
||||
char *sendspace;
|
||||
dns_name_t *name;
|
||||
char * sendspace;
|
||||
dns_name_t * name;
|
||||
isc_interval_t interval;
|
||||
dns_message_t *sendmsg;
|
||||
dns_name_t *oname;
|
||||
dns_message_t * sendmsg;
|
||||
dns_name_t * oname;
|
||||
ISC_LINK(dig_lookup_t) link;
|
||||
ISC_LIST(dig_query_t) q;
|
||||
ISC_LIST(dig_query_t) connecting;
|
||||
dig_query_t *current_query;
|
||||
dig_query_t * current_query;
|
||||
dig_serverlist_t my_server_list;
|
||||
dig_searchlist_t *origin;
|
||||
dig_query_t *xfr_q;
|
||||
dig_query_t * xfr_q;
|
||||
uint32_t retries;
|
||||
int nsfound;
|
||||
int16_t udpsize;
|
||||
@@ -147,13 +147,13 @@ struct dig_lookup {
|
||||
uint32_t ixfr_serial;
|
||||
isc_buffer_t rdatabuf;
|
||||
char rdatastore[MXNAME];
|
||||
dst_context_t *tsigctx;
|
||||
isc_buffer_t *querysig;
|
||||
dst_context_t * tsigctx;
|
||||
isc_buffer_t * querysig;
|
||||
uint32_t msgcounter;
|
||||
dns_fixedname_t fdomain;
|
||||
isc_sockaddr_t *ecs_addr;
|
||||
char *cookie;
|
||||
dns_ednsopt_t *ednsopts;
|
||||
isc_sockaddr_t * ecs_addr;
|
||||
char * cookie;
|
||||
dns_ednsopt_t * ednsopts;
|
||||
unsigned int ednsoptscnt;
|
||||
isc_dscp_t dscp;
|
||||
unsigned int ednsflags;
|
||||
@@ -174,10 +174,10 @@ struct dig_query {
|
||||
uint32_t msg_count;
|
||||
uint32_t rr_count;
|
||||
bool ixfr_axfr;
|
||||
char *servname;
|
||||
char *userarg;
|
||||
char * servname;
|
||||
char * userarg;
|
||||
isc_buffer_t recvbuf, lengthbuf, tmpsendbuf, sendbuf;
|
||||
char *recvspace, *tmpsendspace, lengthspace[4];
|
||||
char * recvspace, *tmpsendspace, lengthspace[4];
|
||||
isc_socket_t *sock;
|
||||
ISC_LINK(dig_query_t) link;
|
||||
ISC_LINK(dig_query_t) clink;
|
||||
@@ -185,7 +185,7 @@ struct dig_query {
|
||||
isc_time_t time_sent;
|
||||
isc_time_t time_recv;
|
||||
uint64_t byte_count;
|
||||
isc_timer_t *timer;
|
||||
isc_timer_t * timer;
|
||||
};
|
||||
|
||||
struct dig_server {
|
||||
@@ -215,7 +215,7 @@ extern bool check_ra, have_ipv4, have_ipv6, specified_source, usesearch,
|
||||
showsearch, yaml;
|
||||
extern in_port_t port;
|
||||
extern unsigned int timeout;
|
||||
extern isc_mem_t *mctx;
|
||||
extern isc_mem_t * mctx;
|
||||
extern int sendcount;
|
||||
extern int ndots;
|
||||
extern int lookup_counter;
|
||||
@@ -226,10 +226,10 @@ extern char keyfile[MXNAME];
|
||||
extern char keysecret[MXNAME];
|
||||
extern const dns_name_t *hmacname;
|
||||
extern unsigned int digestbits;
|
||||
extern dns_tsigkey_t *tsigkey;
|
||||
extern dns_tsigkey_t * tsigkey;
|
||||
extern bool validated;
|
||||
extern isc_taskmgr_t *taskmgr;
|
||||
extern isc_task_t *global_task;
|
||||
extern isc_taskmgr_t * taskmgr;
|
||||
extern isc_task_t * global_task;
|
||||
extern bool free_now;
|
||||
extern bool debugging, debugtiming, memdebugging;
|
||||
extern bool keep_open;
|
||||
@@ -337,7 +337,7 @@ set_search_domain(char *domain);
|
||||
* Routines to be defined in dig.c, host.c, and nslookup.c. and
|
||||
* then assigned to the appropriate function pointer
|
||||
*/
|
||||
extern isc_result_t (*dighost_printmessage)(dig_query_t *query,
|
||||
extern isc_result_t (*dighost_printmessage)(dig_query_t * query,
|
||||
const isc_buffer_t *msgbuf,
|
||||
dns_message_t *msg, bool headers);
|
||||
|
||||
|
||||
+2
-2
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -963,7 +963,7 @@ flush_lookup_list(void) {
|
||||
isc_mem_free(mctx, sp);
|
||||
}
|
||||
if (l->sendmsg != NULL) {
|
||||
dns_message_detach(&l->sendmsg);
|
||||
dns_message_destroy(&l->sendmsg);
|
||||
}
|
||||
lp = l;
|
||||
l = ISC_LIST_NEXT(l, link);
|
||||
|
||||
+79
-69
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,11 +34,11 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``nslookup`` is a program to query Internet domain name servers.
|
||||
``nslookup`` has two modes: interactive and non-interactive. Interactive
|
||||
``Nslookup`` is a program to query Internet domain name servers.
|
||||
``Nslookup`` has two modes: interactive and non-interactive. Interactive
|
||||
mode allows the user to query name servers for information about various
|
||||
hosts and domains or to print a list of hosts in a domain.
|
||||
Non-interactive mode prints just the name and requested
|
||||
Non-interactive mode is used to print just the name and requested
|
||||
information for a host or domain.
|
||||
|
||||
Arguments
|
||||
@@ -46,7 +46,7 @@ Arguments
|
||||
|
||||
Interactive mode is entered in the following cases:
|
||||
|
||||
a. when no arguments are given (the default name server is used);
|
||||
a. when no arguments are given (the default name server will be used)
|
||||
|
||||
b. when the first argument is a hyphen (-) and the second argument is
|
||||
the host name or Internet address of a name server.
|
||||
@@ -57,7 +57,7 @@ argument specifies the host name or address of a name server.
|
||||
|
||||
Options can also be specified on the command line if they precede the
|
||||
arguments and are prefixed with a hyphen. For example, to change the
|
||||
default query type to host information, with an initial timeout of 10
|
||||
default query type to host information, and the initial timeout to 10
|
||||
seconds, type:
|
||||
|
||||
::
|
||||
@@ -65,59 +65,59 @@ seconds, type:
|
||||
nslookup -query=hinfo -timeout=10
|
||||
|
||||
The ``-version`` option causes ``nslookup`` to print the version number
|
||||
and immediately exit.
|
||||
and immediately exits.
|
||||
|
||||
Interactive Commands
|
||||
~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
``host [server]``
|
||||
This command looks up information for ``host`` using the current default server or
|
||||
using ``server``, if specified. If ``host`` is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If ``host`` is
|
||||
a name and does not have a trailing period (``.``), the search list is used
|
||||
``host`` [server]
|
||||
Look up information for host using the current default server or
|
||||
using server, if specified. If host is an Internet address and the
|
||||
query type is A or PTR, the name of the host is returned. If host is
|
||||
a name and does not have a trailing period, the search list is used
|
||||
to qualify the name.
|
||||
|
||||
To look up a host not in the current domain, append a period to the
|
||||
name.
|
||||
|
||||
``server domain`` | ``lserver domain``
|
||||
These commands change the default server to ``domain``; ``lserver`` uses the initial
|
||||
server to look up information about ``domain``, while ``server`` uses the
|
||||
current default server. If an authoritative answer cannot be found,
|
||||
``server`` domain | ``lserver`` domain
|
||||
Change the default server to domain; ``lserver`` uses the initial
|
||||
server to look up information about domain, while ``server`` uses the
|
||||
current default server. If an authoritative answer can't be found,
|
||||
the names of servers that might have the answer are returned.
|
||||
|
||||
``root``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``finger``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``ls``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``view``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``help``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``?``
|
||||
This command is not implemented.
|
||||
not implemented
|
||||
|
||||
``exit``
|
||||
This command exits the program.
|
||||
Exits the program.
|
||||
|
||||
``set keyword[=value]``
|
||||
``set`` keyword[=value]
|
||||
This command is used to change state information that affects the
|
||||
lookups. Valid keywords are:
|
||||
|
||||
``all``
|
||||
This keyword prints the current values of the frequently used options to
|
||||
Prints the current values of the frequently used options to
|
||||
``set``. Information about the current default server and host is
|
||||
also printed.
|
||||
|
||||
``class=value``
|
||||
This keyword changes the query class to one of:
|
||||
``class=``\ value
|
||||
Change the query class to one of:
|
||||
|
||||
``IN``
|
||||
the Internet class
|
||||
@@ -131,62 +131,72 @@ Interactive Commands
|
||||
``ANY``
|
||||
wildcard
|
||||
|
||||
The class specifies the protocol group of the information. The default
|
||||
is ``IN``; the abbreviation for this keyword is ``cl``.
|
||||
The class specifies the protocol group of the information.
|
||||
|
||||
(Default = IN; abbreviation = cl)
|
||||
|
||||
``nodebug``
|
||||
This keyword turns on or off the display of the full response packet, and any
|
||||
intermediate response packets, when searching. The default for this keyword is
|
||||
``nodebug``; the abbreviation for this keyword is ``[no]deb``.
|
||||
Turn on or off the display of the full response packet and any
|
||||
intermediate response packets when searching.
|
||||
|
||||
(Default = nodebug; abbreviation = [no]deb)
|
||||
|
||||
``nod2``
|
||||
This keyword turns debugging mode on or off. This displays more about what
|
||||
nslookup is doing. The default is ``nod2``.
|
||||
Turn debugging mode on or off. This displays more about what
|
||||
nslookup is doing.
|
||||
|
||||
``domain=name``
|
||||
This keyword sets the search list to ``name``.
|
||||
(Default = nod2)
|
||||
|
||||
``domain=``\ name
|
||||
Sets the search list to name.
|
||||
|
||||
``nosearch``
|
||||
If the lookup request contains at least one period, but does not end
|
||||
with a trailing period, this keyword appends the domain names in the domain
|
||||
search list to the request until an answer is received. The default is ``search``.
|
||||
If the lookup request contains at least one period but doesn't end
|
||||
with a trailing period, append the domain names in the domain
|
||||
search list to the request until an answer is received.
|
||||
|
||||
``port=value``
|
||||
This keyword changes the default TCP/UDP name server port to ``value`` from
|
||||
its default, port 53. The abbreviation for this keyword is ``po``.
|
||||
(Default = search)
|
||||
|
||||
``querytype=value`` | ``type=value``
|
||||
This keyword changes the type of the information query to ``value``. The
|
||||
defaults are A and then AAAA; the abbreviations for these keywords are
|
||||
``q`` and ``ty``.
|
||||
``port=``\ value
|
||||
Change the default TCP/UDP name server port to value.
|
||||
|
||||
Please note that it is only possible to specify one query type. Only the default
|
||||
behavior looks up both when an alternative is not specified.
|
||||
(Default = 53; abbreviation = po)
|
||||
|
||||
``querytype=``\ value | ``type=``\ value
|
||||
Change the type of the information query.
|
||||
|
||||
(Default = A and then AAAA; abbreviations = q, ty)
|
||||
|
||||
**Note:** It is only possible to specify one query type, only the default
|
||||
behavior looks up both when an alternative is not specified.
|
||||
|
||||
``norecurse``
|
||||
This keyword tells the name server to query other servers if it does not have
|
||||
the information. The default is ``recurse``; the abbreviation for this
|
||||
keyword is ``[no]rec``.
|
||||
Tell the name server to query other servers if it does not have
|
||||
the information.
|
||||
|
||||
``ndots=number``
|
||||
This keyword sets the number of dots (label separators) in a domain that
|
||||
disables searching. Absolute names always stop searching.
|
||||
(Default = recurse; abbreviation = [no]rec)
|
||||
|
||||
``retry=number``
|
||||
This keyword sets the number of retries to ``number``.
|
||||
``ndots=``\ number
|
||||
Set the number of dots (label separators) in a domain that will
|
||||
disable searching. Absolute names always stop searching.
|
||||
|
||||
``timeout=number``
|
||||
This keyword changes the initial timeout interval to wait for a reply to
|
||||
``number``, in seconds.
|
||||
``retry=``\ number
|
||||
Set the number of retries to number.
|
||||
|
||||
``timeout=``\ number
|
||||
Change the initial timeout interval for waiting for a reply to
|
||||
number seconds.
|
||||
|
||||
``novc``
|
||||
This keyword indicates that a virtual circuit should always be used when sending requests to the server.
|
||||
``novc`` is the default.
|
||||
Always use a virtual circuit when sending requests to the server.
|
||||
|
||||
(Default = novc)
|
||||
|
||||
``nofail``
|
||||
This keyword tries the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail), or terminates the query (fail) on such a response. The
|
||||
default is ``nofail``.
|
||||
Try the next nameserver if a nameserver responds with SERVFAIL or
|
||||
a referral (nofail) or terminate query (fail) on such a response.
|
||||
|
||||
(Default = nofail)
|
||||
|
||||
Return Values
|
||||
~~~~~~~~~~~~~
|
||||
@@ -199,11 +209,11 @@ IDN Support
|
||||
|
||||
If ``nslookup`` has been built with IDN (internationalized domain name)
|
||||
support, it can accept and display non-ASCII domain names. ``nslookup``
|
||||
appropriately converts character encoding of a domain name before sending
|
||||
a request to a DNS server or displaying a reply from the server.
|
||||
To turn off IDN support, define the ``IDN_DISABLE``
|
||||
environment variable. IDN support is disabled if the variable is set
|
||||
when ``nslookup`` runs, or when the standard output is not a tty.
|
||||
appropriately converts character encoding of domain name before sending
|
||||
a request to DNS server or displaying a reply from the server. If you'd
|
||||
like to turn off the IDN support for some reason, define the IDN_DISABLE
|
||||
environment variable. The IDN support is disabled if the variable is set
|
||||
when ``nslookup`` runs or when the standard output is not a tty.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -75,7 +75,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -107,7 +107,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+59
-60
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -29,7 +29,7 @@ dnssec-cds - change DS records for a child zone based on CDS/CDNSKEY
|
||||
Synopsis
|
||||
~~~~~~~~
|
||||
|
||||
:program:`dnssec-cds` [**-a** alg...] [**-c** class] [**-D**] {**-d** dsset-file} {**-f** child-file} [**-i**[extension]] [**-s** start-time] [**-T** ttl] [**-u**] [**-v** level] [**-V**] {domain}
|
||||
:program:`dnssec-cds` [**-a** alg...] [**-c** class] [**-D**] {**-d** dsset-file} {**-f** child-file} [**-i** [extension]] [**-s** start-time] [**-T** ttl] [**-u**] [**-v** level] [**-V**] {domain}
|
||||
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
@@ -38,8 +38,8 @@ The ``dnssec-cds`` command changes DS records at a delegation point
|
||||
based on CDS or CDNSKEY records published in the child zone. If both CDS
|
||||
and CDNSKEY records are present in the child zone, the CDS is preferred.
|
||||
This enables a child zone to inform its parent of upcoming changes to
|
||||
its key-signing keys (KSKs); by polling periodically with ``dnssec-cds``, the
|
||||
parent can keep the DS records up-to-date and enable automatic rolling
|
||||
its key-signing keys; by polling periodically with ``dnssec-cds``, the
|
||||
parent can keep the DS records up to date and enable automatic rolling
|
||||
of KSKs.
|
||||
|
||||
Two input files are required. The ``-f child-file`` option specifies a
|
||||
@@ -52,12 +52,12 @@ output of a previous run of ``dnssec-cds``.
|
||||
|
||||
The ``dnssec-cds`` command uses special DNSSEC validation logic
|
||||
specified by :rfc:`7344`. It requires that the CDS and/or CDNSKEY records
|
||||
be validly signed by a key represented in the existing DS records. This
|
||||
is typically the pre-existing KSK.
|
||||
are validly signed by a key represented in the existing DS records. This
|
||||
will typically be the pre-existing key-signing key (KSK).
|
||||
|
||||
For protection against replay attacks, the signatures on the child
|
||||
records must not be older than they were on a previous run of
|
||||
``dnssec-cds``. Their age is obtained from the modification time of the
|
||||
``dnssec-cds``. This time is obtained from the modification time of the
|
||||
``dsset-`` file, or from the ``-s`` option.
|
||||
|
||||
To protect against breaking the delegation, ``dnssec-cds`` ensures that
|
||||
@@ -67,104 +67,103 @@ type.
|
||||
|
||||
By default, replacement DS records are written to the standard output;
|
||||
with the ``-i`` option the input file is overwritten in place. The
|
||||
replacement DS records are the same as the existing records, when no
|
||||
change is required. The output can be empty if the CDS/CDNSKEY records
|
||||
specify that the child zone wants to be insecure.
|
||||
replacement DS records will be the same as the existing records when no
|
||||
change is required. The output can be empty if the CDS / CDNSKEY records
|
||||
specify that the child zone wants to go insecure.
|
||||
|
||||
.. warning::
|
||||
|
||||
Be careful not to delete the DS records when ``dnssec-cds`` fails!
|
||||
Warning: Be careful not to delete the DS records when ``dnssec-cds``
|
||||
fails!
|
||||
|
||||
Alternatively, ``dnssec-cds -u`` writes an ``nsupdate`` script to the
|
||||
standard output. The ``-u`` and ``-i`` options can be used together to
|
||||
standard output. You can use the ``-u`` and ``-i`` options together to
|
||||
maintain a ``dsset-`` file as well as emit an ``nsupdate`` script.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies a digest algorithm to use when converting CDNSKEY records to
|
||||
**-a** algorithm
|
||||
Specify a digest algorithm to use when converting CDNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each CDNSKEY record. This option has no effect when
|
||||
using CDS records.
|
||||
|
||||
The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values
|
||||
are case-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA-256.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zones.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zones.
|
||||
|
||||
``-D``
|
||||
This option generates DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
**-D**
|
||||
Generate DS records from CDNSKEY records if both CDS and CDNSKEY
|
||||
records are present in the child zone. By default CDS records are
|
||||
preferred.
|
||||
|
||||
``-d path``
|
||||
This specifies the location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records; if it is a directory, ``dnssec-cds``
|
||||
**-d** path
|
||||
Location of the parent DS records. The path can be the name of a file
|
||||
containing the DS records, or if it is a directory, ``dnssec-cds``
|
||||
looks for a ``dsset-`` file for the domain inside the directory.
|
||||
|
||||
To protect against replay attacks, child records are rejected if they
|
||||
were signed earlier than the modification time of the ``dsset-``
|
||||
file. This can be adjusted with the ``-s`` option.
|
||||
|
||||
``-f child-file``
|
||||
This option specifies the file containing the child's CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records, so that they can be
|
||||
**-f** child-file
|
||||
File containing the child's CDS and/or CDNSKEY records, plus its
|
||||
DNSKEY records and the covering RRSIG records so that they can be
|
||||
authenticated.
|
||||
|
||||
The examples below describe how to generate this file.
|
||||
The EXAMPLES below describe how to generate this file.
|
||||
|
||||
``-iextension``
|
||||
This option updates the ``dsset-`` file in place, instead of writing DS records to
|
||||
**-iextension**
|
||||
Update the ``dsset-`` file in place, instead of writing DS records to
|
||||
the standard output.
|
||||
|
||||
There must be no space between the ``-i`` and the extension. If
|
||||
no extension is provided, the old ``dsset-`` is discarded. If an
|
||||
There must be no space between the ``-i`` and the extension. If you
|
||||
provide no extension then the old ``dsset-`` is discarded. If an
|
||||
extension is present, a backup of the old ``dsset-`` file is kept
|
||||
with the extension appended to its filename.
|
||||
|
||||
To protect against replay attacks, the modification time of the
|
||||
``dsset-`` file is set to match the signature inception time of the
|
||||
child records, provided that it is later than the file's current
|
||||
child records, provided that is later than the file's current
|
||||
modification time.
|
||||
|
||||
``-s start-time``
|
||||
This option specifies the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or a relative time. An
|
||||
**-s** start-time
|
||||
Specify the date and time after which RRSIG records become
|
||||
acceptable. This can be either an absolute or relative time. An
|
||||
absolute start time is indicated by a number in YYYYMMDDHHMMSS
|
||||
notation; 20170827133700 denotes 13:37:00 UTC on August 27th, 2017. A
|
||||
time relative to the ``dsset-`` file is indicated with ``-N``, which is N
|
||||
time relative to the ``dsset-`` file is indicated with -N, which is N
|
||||
seconds before the file modification time. A time relative to the
|
||||
current time is indicated with ``now+N``.
|
||||
current time is indicated with now+N.
|
||||
|
||||
If no start-time is specified, the modification time of the
|
||||
``dsset-`` file is used.
|
||||
|
||||
``-T ttl``
|
||||
This option specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL,
|
||||
the new DS records also have no explicit TTL.
|
||||
**-T** ttl
|
||||
Specifies a TTL to be used for new DS records. If not specified, the
|
||||
default is the TTL of the old DS records. If they had no explicit TTL
|
||||
then the new DS records also have no explicit TTL.
|
||||
|
||||
``-u``
|
||||
This option writes an ``nsupdate`` script to the standard output, instead of
|
||||
printing the new DS reords. The output is empty if no change is
|
||||
**-u**
|
||||
Write an ``nsupdate`` script to the standard output, instead of
|
||||
printing the new DS reords. The output will be empty if no change is
|
||||
needed.
|
||||
|
||||
Note: The TTL of new records needs to be specified: it can be done in the
|
||||
original ``dsset-`` file, with the ``-T`` option, or using the
|
||||
Note: The TTL of new records needs to be specified, either in the
|
||||
original ``dsset-`` file, or with the ``-T`` option, or using the
|
||||
``nsupdate`` ``ttl`` command.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Print version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
**-v** level
|
||||
Sets the debugging level. Level 1 is intended to be usefully verbose
|
||||
for general users; higher levels are intended for developers.
|
||||
|
||||
``domain``
|
||||
This indicates the name of the delegation point/child zone apex.
|
||||
domain
|
||||
The name of the delegation point / child zone apex.
|
||||
|
||||
Exit Status
|
||||
~~~~~~~~~~~
|
||||
@@ -172,17 +171,17 @@ Exit Status
|
||||
The ``dnssec-cds`` command exits 0 on success, or non-zero if an error
|
||||
occurred.
|
||||
|
||||
If successful, the DS records may or may not need to be
|
||||
In the success case, the DS records might or might not need to be
|
||||
changed.
|
||||
|
||||
Examples
|
||||
~~~~~~~~
|
||||
|
||||
Before running ``dnssec-signzone``, ensure that the delegations
|
||||
Before running ``dnssec-signzone``, you can ensure that the delegations
|
||||
are up-to-date by running ``dnssec-cds`` on every ``dsset-`` file.
|
||||
|
||||
To fetch the child records required by ``dnssec-cds``, invoke
|
||||
``dig`` as in the script below. It is acceptable if the ``dig`` fails, since
|
||||
To fetch the child records required by ``dnssec-cds`` you can invoke
|
||||
``dig`` as in the script below. It's okay if the ``dig`` fails since
|
||||
``dnssec-cds`` performs all the necessary checking.
|
||||
|
||||
::
|
||||
@@ -194,10 +193,10 @@ To fetch the child records required by ``dnssec-cds``, invoke
|
||||
dnssec-cds -i -f /dev/stdin -d $f $d
|
||||
done
|
||||
|
||||
When the parent zone is automatically signed by ``named``,
|
||||
``dnssec-cds`` can be used with ``nsupdate`` to maintain a delegation as follows.
|
||||
When the parent zone is automatically signed by ``named``, you can use
|
||||
``dnssec-cds`` with ``nsupdate`` to maintain a delegation as follows.
|
||||
The ``dsset-`` file allows the script to avoid having to fetch and
|
||||
validate the parent DS records, and it maintains the replay attack
|
||||
validate the parent DS records, and it keeps the replay attack
|
||||
protection time.
|
||||
|
||||
::
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -262,10 +262,6 @@ emit(dns_dsdigest_t dt, bool showall, bool cds, dns_rdata_t *rdata) {
|
||||
fatal("can't convert DNSKEY");
|
||||
}
|
||||
|
||||
if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall) {
|
||||
return;
|
||||
}
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -43,13 +43,9 @@ Description
|
||||
The ``dnssec-dsfromkey`` command outputs DS (Delegation Signer) resource records
|
||||
(RRs), or CDS (Child DS) RRs with the ``-C`` option.
|
||||
|
||||
By default, only KSKs are converted (keys with flags = 257). The
|
||||
``-A`` option includes ZSKs (flags = 256). Revoked keys are never
|
||||
included.
|
||||
|
||||
The input keys can be specified in a number of ways:
|
||||
|
||||
By default, ``dnssec-dsfromkey`` reads a key file named in the format
|
||||
By default, ``dnssec-dsfromkey`` reads a key file named like
|
||||
``Knnnn.+aaa+iiiii.key``, as generated by ``dnssec-keygen``.
|
||||
|
||||
With the ``-f file`` option, ``dnssec-dsfromkey`` reads keys from a zone
|
||||
@@ -61,73 +57,73 @@ as generated by ``dnssec-keygen`` ``-C``.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-1``
|
||||
This option is an abbreviation for ``-a SHA1``.
|
||||
**-1**
|
||||
An abbreviation for ``-a SHA1``
|
||||
|
||||
``-2``
|
||||
This option is an abbreviation for ``-a SHA-256``.
|
||||
**-2**
|
||||
An abbreviation for ``-a SHA-256``
|
||||
|
||||
``-a algorithm``
|
||||
This option specifies a digest algorithm to use when converting DNSKEY records to
|
||||
**-a** algorithm
|
||||
Specify a digest algorithm to use when converting DNSKEY records to
|
||||
DS records. This option can be repeated, so that multiple DS records
|
||||
are created for each DNSKEY record.
|
||||
|
||||
The algorithm must be one of SHA-1, SHA-256, or SHA-384. These values
|
||||
are case-insensitive, and the hyphen may be omitted. If no algorithm
|
||||
are case insensitive, and the hyphen may be omitted. If no algorithm
|
||||
is specified, the default is SHA-256.
|
||||
|
||||
``-A``
|
||||
This option indicates that ZSKs are to be included when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set are converted to DS records and
|
||||
printed. This option is only useful in ``-f`` zone file mode.
|
||||
**-A**
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records and
|
||||
printed. Useful only in ``-f`` zone file mode.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class; the default is IN. This option is only useful in ``-s`` keyset
|
||||
**-c** class
|
||||
Specifies the DNS class (default is IN). Useful only in ``-s`` keyset
|
||||
or ``-f`` zone file mode.
|
||||
|
||||
``-C``
|
||||
This option generates CDS records rather than DS records.
|
||||
**-C**
|
||||
Generate CDS records rather than DS records.
|
||||
|
||||
``-f file``
|
||||
This option sets zone file mode, in which the final dnsname argument of ``dnssec-dsfromkey`` is the
|
||||
**-f** file
|
||||
Zone file mode: ``dnssec-dsfromkey``'s final dnsname argument is the
|
||||
DNS domain name of a zone whose master file can be read from
|
||||
``file``. If the zone name is the same as ``file``, then it may be
|
||||
omitted.
|
||||
|
||||
If ``file`` is ``-``, then the zone data is read from the standard
|
||||
If file is ``"-"``, then the zone data is read from the standard
|
||||
input. This makes it possible to use the output of the ``dig``
|
||||
command as input, as in:
|
||||
|
||||
``dig dnskey example.com | dnssec-dsfromkey -f - example.com``
|
||||
|
||||
``-h``
|
||||
This option prints usage information.
|
||||
**-h**
|
||||
Prints usage information.
|
||||
|
||||
``-K directory``
|
||||
This option tells BIND 9 to look for key files or ``keyset-`` files in ``directory``.
|
||||
**-K** directory
|
||||
Look for key files or ``keyset-`` files in ``directory``.
|
||||
|
||||
``-s``
|
||||
This option enables keyset mode, in which the final dnsname argument from ``dnssec-dsfromkey`` is the DNS
|
||||
**-s**
|
||||
Keyset mode: ``dnssec-dsfromkey``'s final dnsname argument is the DNS
|
||||
domain name used to locate a ``keyset-`` file.
|
||||
|
||||
``-T TTL``
|
||||
This option specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
**-T** TTL
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
Example
|
||||
~~~~~~~
|
||||
|
||||
To build the SHA-256 DS RR from the ``Kexample.com.+003+26160`` keyfile,
|
||||
issue the following command:
|
||||
To build the SHA-256 DS RR from the ``Kexample.com.+003+26160`` keyfile
|
||||
name, you can issue the following command:
|
||||
|
||||
``dnssec-dsfromkey -2 Kexample.com.+003+26160``
|
||||
|
||||
The command returns something similar to:
|
||||
The command would print something like:
|
||||
|
||||
``example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94``
|
||||
|
||||
@@ -135,16 +131,16 @@ Files
|
||||
~~~~~
|
||||
|
||||
The keyfile can be designated by the key identification
|
||||
``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key``, as
|
||||
generated by ``dnssec-keygen``.
|
||||
``Knnnn.+aaa+iiiii`` or the full file name ``Knnnn.+aaa+iiiii.key`` as
|
||||
generated by dnssec-keygen8.
|
||||
|
||||
The keyset file name is built from the ``directory``, the string
|
||||
``keyset-``, and the ``dnsname``.
|
||||
``keyset-`` and the ``dnsname``.
|
||||
|
||||
Caveat
|
||||
~~~~~~
|
||||
|
||||
A keyfile error may return "file not found," even if the file exists.
|
||||
A keyfile error can give a "file not found" even if the file exists.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -37,12 +37,12 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-importkey`` reads a public DNSKEY record and generates a pair
|
||||
of .key/.private files. The DNSKEY record may be read from an
|
||||
existing .key file, in which case a corresponding .private file is
|
||||
of .key/.private files. The DNSKEY record may be read from an existing
|
||||
.key file, in which case a corresponding .private file will be
|
||||
generated, or it may be read from any other file or from the standard
|
||||
input, in which case both .key and .private files are generated.
|
||||
input, in which case both .key and .private files will be generated.
|
||||
|
||||
The newly created .private file does *not* contain private key data, and
|
||||
The newly-created .private file does *not* contain private key data, and
|
||||
cannot be used for signing. However, having a .private file makes it
|
||||
possible to set publication (``-P``) and deletion (``-D``) times for the
|
||||
key, which means the public key can be added to and removed from the
|
||||
@@ -51,70 +51,70 @@ DNSKEY RRset on schedule even if the true private key is stored offline.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-f filename``
|
||||
This option indicates the zone file mode. Instead of a public keyfile name, the argument is the
|
||||
**-f** filename
|
||||
Zone file mode: instead of a public keyfile name, the argument is the
|
||||
DNS domain name of a zone master file, which can be read from
|
||||
``filename``. If the domain name is the same as ``filename``, then it may be
|
||||
``file``. If the domain name is the same as ``file``, then it may be
|
||||
omitted.
|
||||
|
||||
If ``filename`` is set to ``"-"``, then the zone data is read from the
|
||||
If ``file`` is set to ``"-"``, then the zone data is read from the
|
||||
standard input.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. Setting the default TTL to ``0`` or ``none``
|
||||
removes it from the key.
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to ``0`` or ``none`` removes it.
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it.
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
Files
|
||||
~~~~~
|
||||
|
||||
A keyfile can be designed by the key identification ``Knnnn.+aaa+iiiii``
|
||||
or the full file name ``Knnnn.+aaa+iiiii.key``, as generated by
|
||||
``dnssec-keygen``.
|
||||
or the full file name ``Knnnn.+aaa+iiiii.key`` as generated by
|
||||
dnssec-keygen8.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+114
-114
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,11 +34,11 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-keyfromlabel`` generates a pair of key files that reference a
|
||||
``dnssec-keyfromlabel`` generates a key pair of files that referencing a
|
||||
key object stored in a cryptographic hardware service module (HSM). The
|
||||
private key file can be used for DNSSEC signing of zone data as if it
|
||||
were a conventional signing key created by ``dnssec-keygen``, but the
|
||||
key material is stored within the HSM and the actual signing takes
|
||||
key material is stored within the HSM, and the actual signing takes
|
||||
place there.
|
||||
|
||||
The ``name`` of the key is specified on the command line. This must
|
||||
@@ -47,194 +47,194 @@ match the name of the zone for which the key is being generated.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a algorithm``
|
||||
This option selects the cryptographic algorithm. The value of ``algorithm`` must
|
||||
**-a** algorithm
|
||||
Selects the cryptographic algorithm. The value of ``algorithm`` must
|
||||
be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448.
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
|
||||
If no algorithm is specified, RSASHA1 is used by default
|
||||
If no algorithm is specified, then RSASHA1 will be used by default,
|
||||
unless the ``-3`` option is specified, in which case NSEC3RSASHA1
|
||||
is used instead. (If ``-3`` is used and an algorithm is
|
||||
specified, that algorithm is checked for compatibility with
|
||||
will be used instead. (If ``-3`` is used and an algorithm is
|
||||
specified, that algorithm will be checked for compatibility with
|
||||
NSEC3.)
|
||||
|
||||
These values are case-insensitive. In some cases, abbreviations are
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
|
||||
option, then NSEC3RSASHA1 is used instead.
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
|
||||
Since BIND 9.12.0, this option is mandatory except when using the
|
||||
``-S`` option, which copies the algorithm from the predecessory key.
|
||||
As of BIND 9.12.0, this option is mandatory except when using the
|
||||
``-S`` option (which copies the algorithm from the predecessory key).
|
||||
Previously, the default for newly generated keys was RSASHA1.
|
||||
|
||||
``-3``
|
||||
This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
**-3**
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version is used; for example,
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-l label``
|
||||
This option specifies the label for a key pair in the crypto hardware.
|
||||
**-l** label
|
||||
Specifies the label for a key pair in the crypto hardware.
|
||||
|
||||
When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
|
||||
an arbitrary string that identifies a particular key. It may be
|
||||
preceded by an optional OpenSSL engine name, followed by a colon, as
|
||||
in ``pkcs11:keylabel``.
|
||||
in "pkcs11:keylabel".
|
||||
|
||||
When BIND 9 is built with native PKCS#11 support, the label is a
|
||||
PKCS#11 URI string in the format
|
||||
``pkcs11:keyword\ =value[;\ keyword\ =value;...]``. Keywords
|
||||
include ``token``, which identifies the HSM; ``object``, which identifies
|
||||
the key; and ``pin-source``, which identifies a file from which the
|
||||
HSM's PIN code can be obtained. The label is stored in the
|
||||
on-disk ``private`` file.
|
||||
"pkcs11:``keyword``\ =value[;\ ``keyword``\ =value;...]" Keywords
|
||||
include "token", which identifies the HSM; "object", which identifies
|
||||
the key; and "pin-source", which identifies a file from which the
|
||||
HSM's PIN code can be obtained. The label will be stored in the
|
||||
on-disk "private" file.
|
||||
|
||||
If the label contains a ``pin-source`` field, tools using the
|
||||
generated key files are able to use the HSM for signing and other
|
||||
generated key files will be able to use the HSM for signing and other
|
||||
operations without any need for an operator to manually enter a PIN.
|
||||
Note: Making the HSM's PIN accessible in this manner may reduce the
|
||||
security advantage of using an HSM; use caution
|
||||
with this feature.
|
||||
security advantage of using an HSM; be sure this is what you want to
|
||||
do before making use of this feature.
|
||||
|
||||
``-n nametype``
|
||||
This option specifies the owner type of the key. The value of ``nametype`` must
|
||||
**-n** nametype
|
||||
Specifies the owner type of the key. The value of ``nametype`` must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case-insensitive.
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive.
|
||||
|
||||
``-C``
|
||||
This option enables compatibility mode, which generates an old-style key, without any metadata.
|
||||
By default, ``dnssec-keyfromlabel`` includes the key's creation
|
||||
date in the metadata stored with the private key; other dates may
|
||||
be set there as well, including publication date, activation date, etc. Keys
|
||||
**-C**
|
||||
Compatibility mode: generates an old-style key, without any metadata.
|
||||
By default, ``dnssec-keyfromlabel`` will include the key's creation
|
||||
date in the metadata stored with the private key, and other dates may
|
||||
be set there as well (publication date, activation date, etc). Keys
|
||||
that include this data may be incompatible with older versions of
|
||||
BIND; the ``-C`` option suppresses them.
|
||||
|
||||
``-c class``
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
**-c** class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
|
||||
``-f flag``
|
||||
This option sets the specified flag in the ``flag`` field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key-Signing Key) and REVOKE.
|
||||
**-f** flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
|
||||
``-G``
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with ``-P`` and ``-A``.
|
||||
**-G**
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with -P and -A.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-keyfromlabel``.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to be written.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
|
||||
``-k``
|
||||
This option generates KEY records rather than DNSKEY records.
|
||||
**-k**
|
||||
Generate KEY records rather than DNSKEY records.
|
||||
|
||||
``-L`` ttl
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. Setting
|
||||
the default TTL to ``0`` or ``none`` removes it.
|
||||
|
||||
``-p protocol``
|
||||
This option sets the protocol value for the key. The protocol is a number between
|
||||
**-p** protocol
|
||||
Sets the protocol value for the key. The protocol is a number between
|
||||
0 and 255. The default is 3 (DNSSEC). Other possible values for this
|
||||
argument are listed in :rfc:`2535` and its successors.
|
||||
|
||||
``-S key``
|
||||
This option generates a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key are set to match the
|
||||
predecessor. The activation date of the new key is set to the
|
||||
inactivation date of the existing one. The publication date is
|
||||
**-S** key
|
||||
Generate a key as an explicit successor to an existing key. The name,
|
||||
algorithm, size, and type of the key will be set to match the
|
||||
predecessor. The activation date of the new key will be set to the
|
||||
inactivation date of the existing one. The publication date will be
|
||||
set to the activation date minus the prepublication interval, which
|
||||
defaults to 30 days.
|
||||
|
||||
``-t type``
|
||||
This option indicates the type of the key. ``type`` must be one of AUTHCONF,
|
||||
**-t** type
|
||||
Indicates the use of the key. ``type`` must be one of AUTHCONF,
|
||||
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers
|
||||
to the ability to authenticate data, and CONF to the ability to encrypt
|
||||
to the ability to authenticate data, and CONF the ability to encrypt
|
||||
data.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-y``
|
||||
This option allows DNSSEC key files to be generated even if the key ID would
|
||||
**-y**
|
||||
Allows DNSSEC key files to be generated even if the key ID would
|
||||
collide with that of an existing key, in the event of either key
|
||||
being revoked. (This is only safe to enable if
|
||||
:rfc:`5011` trust anchor maintenance is not used with either of the keys
|
||||
being revoked. (This is only safe to use if you are sure you won't be
|
||||
using :rfc:`5011` trust anchor maintenance with either of the keys
|
||||
involved.)
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the ``-G`` option has not been used, the
|
||||
default is the current date.
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the -G option has not been used, the
|
||||
default is "now".
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
**-P** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
key are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the ``-G`` option has not been used, the default is the current date.
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the -G option has not been used, the default is "now".
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records which match this
|
||||
key are to be deleted.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -242,7 +242,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
@@ -264,7 +264,7 @@ printed string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
|
||||
``Knnnn.+aaa+iiiii.private`` contains the private key.
|
||||
|
||||
The ``.key`` file contains a DNS KEY record that can be inserted into a
|
||||
zone file (directly or with an $INCLUDE statement).
|
||||
zone file (directly or with a $INCLUDE statement).
|
||||
|
||||
The ``.private`` file contains algorithm-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
@@ -273,4 +273,4 @@ See Also
|
||||
~~~~~~~~
|
||||
|
||||
:manpage:`dnssec-keygen(8)`, :manpage:`dnssec-signzone(8)`, BIND 9 Administrator Reference Manual,
|
||||
:rfc:`4034`, :rfc:`7512`.
|
||||
:rfc:`4034`, The PKCS#11 URI Scheme (draft-pechanec-pkcs11uri-13).
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -268,8 +268,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
continue;
|
||||
}
|
||||
|
||||
result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
|
||||
&kasplist, &kasp);
|
||||
result = cfg_kasp_fromconfig(kconfig, mctx, lctx, &kasplist,
|
||||
&kasp);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to configure dnssec-policy '%s': %s",
|
||||
cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
|
||||
@@ -283,7 +283,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
|
||||
*kaspp = kasp;
|
||||
|
||||
/*
|
||||
* Cleanup kasp list.
|
||||
* Same cleanup for kasp list.
|
||||
*/
|
||||
for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
|
||||
kasp_next = ISC_LIST_NEXT(kasp, link);
|
||||
@@ -781,7 +781,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
|
||||
}
|
||||
|
||||
/* Set dnssec-policy related metadata */
|
||||
if (ctx->policy != NULL) {
|
||||
if (ctx->policy) {
|
||||
dst_key_setnum(key, DST_NUM_LIFETIME, ctx->lifetime);
|
||||
dst_key_setbool(key, DST_BOOL_KSK, ctx->ksk);
|
||||
dst_key_setbool(key, DST_BOOL_ZSK, ctx->zsk);
|
||||
|
||||
+132
-132
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -52,220 +52,220 @@ to direct use of ``dnssec-keygen``.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-3``
|
||||
This option uses an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
**-3**
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key. If this
|
||||
option is used with an algorithm that has both NSEC and NSEC3
|
||||
versions, then the NSEC3 version is selected; for example,
|
||||
versions, then the NSEC3 version will be used; for example,
|
||||
``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.
|
||||
|
||||
``-a algorithm``
|
||||
This option selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
**-a** algorithm
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value of
|
||||
``algorithm`` must be one of RSASHA1, NSEC3RSASHA1, RSASHA256,
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519, or ED448. For
|
||||
TKEY, the value must be DH (Diffie-Hellman); specifying this value
|
||||
automatically sets the ``-T KEY`` option as well.
|
||||
RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying his value
|
||||
will automatically set the ``-T KEY`` option as well.
|
||||
|
||||
These values are case-insensitive. In some cases, abbreviations are
|
||||
These values are case insensitive. In some cases, abbreviations are
|
||||
supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for
|
||||
ECDSAP384SHA384. If RSASHA1 is specified along with the ``-3``
|
||||
option, NSEC3RSASHA1 is used instead.
|
||||
option, then NSEC3RSASHA1 will be used instead.
|
||||
|
||||
This parameter *must* be specified except when using the ``-S``
|
||||
option, which copies the algorithm from the predecessor key.
|
||||
|
||||
In prior releases, HMAC algorithms could be generated for use as TSIG
|
||||
keys, but that feature was removed in BIND 9.13.0. Use
|
||||
keys, but that feature has been removed as of BIND 9.13.0. Use
|
||||
``tsig-keygen`` to generate TSIG keys.
|
||||
|
||||
``-b keysize``
|
||||
This option specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used: RSA keys must be between 1024 and 4096
|
||||
bits; Diffie-Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms do not need this parameter.
|
||||
**-b** keysize
|
||||
Specifies the number of bits in the key. The choice of key size
|
||||
depends on the algorithm used. RSA keys must be between 1024 and 4096
|
||||
bits. Diffie Hellman keys must be between 128 and 4096 bits. Elliptic
|
||||
curve algorithms don't need this parameter.
|
||||
|
||||
If the key size is not specified, some algorithms have pre-defined
|
||||
defaults. For example, RSA keys for use as DNSSEC zone-signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key-signing
|
||||
defaults. For example, RSA keys for use as DNSSEC zone signing keys
|
||||
have a default size of 1024 bits; RSA keys for use as key signing
|
||||
keys (KSKs, generated with ``-f KSK``) default to 2048 bits.
|
||||
|
||||
``-C``
|
||||
This option enables compatibility mode, which generates an old-style key, without any timing
|
||||
metadata. By default, ``dnssec-keygen`` includes the key's
|
||||
creation date in the metadata stored with the private key; other
|
||||
dates may be set there as well, including publication date, activation date,
|
||||
etc. Keys that include this data may be incompatible with older
|
||||
**-C**
|
||||
Compatibility mode: generates an old-style key, without any timing
|
||||
metadata. By default, ``dnssec-keygen`` will include the key's
|
||||
creation date in the metadata stored with the private key, and other
|
||||
dates may be set there as well (publication date, activation date,
|
||||
etc). Keys that include this data may be incompatible with older
|
||||
versions of BIND; the ``-C`` option suppresses them.
|
||||
|
||||
``-c class``
|
||||
This option indicates that the DNS record containing the key should have the
|
||||
**-c** class
|
||||
Indicates that the DNS record containing the key should have the
|
||||
specified class. If not specified, class IN is used.
|
||||
|
||||
``-d bits``
|
||||
This option specifies the key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256, and
|
||||
RSASHA512 the key size must be between 1024 and 4096 bits; DH size is between 128
|
||||
and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519, and ED448.
|
||||
**-d** bits
|
||||
Key size in bits. For the algorithms RSASHA1, NSEC3RSASA1, RSASHA256 and
|
||||
RSASHA512 the key size must be in range 1024-4096. DH size is between 128
|
||||
and 4096. This option is ignored for algorithms ECDSAP256SHA256,
|
||||
ECDSAP384SHA384, ED25519 and ED448.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-f flag``
|
||||
This option sets the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key-Signing Key) and REVOKE.
|
||||
**-f** flag
|
||||
Set the specified flag in the flag field of the KEY/DNSKEY record.
|
||||
The only recognized flags are KSK (Key Signing Key) and REVOKE.
|
||||
|
||||
``-G``
|
||||
This option generates a key, but does not publish it or sign with it. This option is
|
||||
incompatible with ``-P`` and ``-A``.
|
||||
**-G**
|
||||
Generate a key, but do not publish it or sign with it. This option is
|
||||
incompatible with -P and -A.
|
||||
|
||||
``-g generator``
|
||||
This option indicates the generator to use if generating a Diffie-Hellman key. Allowed
|
||||
**-g** generator
|
||||
If generating a Diffie Hellman key, use this generator. Allowed
|
||||
values are 2 and 5. If no generator is specified, a known prime from
|
||||
:rfc:`2539` is used if possible; otherwise the default is 2.
|
||||
:rfc:`2539` will be used if possible; otherwise the default is 2.
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-keygen``.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to be written.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to be written.
|
||||
|
||||
``-k policy``
|
||||
This option creates keys for a specific ``dnssec-policy``. If a policy uses multiple keys,
|
||||
``dnssec-keygen`` generates multiple keys. This also
|
||||
creates a ".state" file to keep track of the key state.
|
||||
**-k** policy
|
||||
Create keys for a specific dnssec-policy. If a policy uses multiple keys,
|
||||
``dnssec-keygen`` will generate multiple keys. This will also
|
||||
create a ".state" file to keep track of the key state.
|
||||
|
||||
This option creates keys according to the ``dnssec-policy`` configuration, hence
|
||||
it cannot be used at the same time as many of the other options that
|
||||
This option creates keys according to the dnssec-policy configuration, hence
|
||||
it cannot be used together with many of the other options that
|
||||
``dnssec-keygen`` provides.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
is the same as leaving it unset.
|
||||
|
||||
``-l file``
|
||||
This option provides a configuration file that contains a ``dnssec-policy`` statement
|
||||
**-l** file
|
||||
Provide a configuration file that contains a dnssec-policy statement
|
||||
(matching the policy set with ``-k``).
|
||||
|
||||
``-n nametype``
|
||||
This option specifies the owner type of the key. The value of ``nametype`` must
|
||||
**-n** nametype
|
||||
Specifies the owner type of the key. The value of ``nametype`` must
|
||||
either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY
|
||||
(for a key associated with a host (KEY)), USER (for a key associated
|
||||
with a user (KEY)), or OTHER (DNSKEY). These values are
|
||||
case-insensitive. The default is ZONE for DNSKEY generation.
|
||||
with a user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
|
||||
``-p protocol``
|
||||
This option sets the protocol value for the generated key, for use with
|
||||
**-p** protocol
|
||||
Sets the protocol value for the generated key, for use with
|
||||
``-T KEY``. The protocol is a number between 0 and 255. The default
|
||||
is 3 (DNSSEC). Other possible values for this argument are listed in
|
||||
:rfc:`2535` and its successors.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which suppresses unnecessary output, including progress
|
||||
**-q**
|
||||
Quiet mode: Suppresses unnecessary output, including progress
|
||||
indication. Without this option, when ``dnssec-keygen`` is run
|
||||
interactively to generate an RSA or DSA key pair, it prints a
|
||||
interactively to generate an RSA or DSA key pair, it will print a
|
||||
string of symbols to ``stderr`` indicating the progress of the key
|
||||
generation. A ``.`` indicates that a random number has been found which
|
||||
passed an initial sieve test; ``+`` means a number has passed a single
|
||||
round of the Miller-Rabin primality test; and a space ( ) means that the
|
||||
generation. A '.' indicates that a random number has been found which
|
||||
passed an initial sieve test; '+' means a number has passed a single
|
||||
round of the Miller-Rabin primality test; a space means that the
|
||||
number has passed all the tests and is a satisfactory key.
|
||||
|
||||
``-S key``
|
||||
This option creates a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key are set to match
|
||||
the existing key. The activation date of the new key is set to
|
||||
the inactivation date of the existing one. The publication date is
|
||||
set to the activation date minus the prepublication interval,
|
||||
**-S** key
|
||||
Create a new key which is an explicit successor to an existing key.
|
||||
The name, algorithm, size, and type of the key will be set to match
|
||||
the existing key. The activation date of the new key will be set to
|
||||
the inactivation date of the existing one. The publication date will
|
||||
be set to the activation date minus the prepublication interval,
|
||||
which defaults to 30 days.
|
||||
|
||||
``-s strength``
|
||||
This option specifies the strength value of the key. The strength is a number
|
||||
**-s** strength
|
||||
Specifies the strength value of the key. The strength is a number
|
||||
between 0 and 15, and currently has no defined purpose in DNSSEC.
|
||||
|
||||
``-T rrtype``
|
||||
This option specifies the resource record type to use for the key. ``rrtype``
|
||||
**-T** rrtype
|
||||
Specifies the resource record type to use for the key. ``rrtype``
|
||||
must be either DNSKEY or KEY. The default is DNSKEY when using a
|
||||
DNSSEC algorithm, but it can be overridden to KEY for use with
|
||||
SIG(0).
|
||||
|
||||
``-t type``
|
||||
This option indicates the type of the key for use with ``-T KEY``. ``type``
|
||||
**-t** type
|
||||
Indicates the use of the key, for use with ``-T KEY``. ``type``
|
||||
must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
|
||||
is AUTHCONF. AUTH refers to the ability to authenticate data, and
|
||||
CONF to the ability to encrypt data.
|
||||
CONF the ability to encrypt data.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
explicitly prevent a date from being set, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
to sign it. If not set, and if the ``-G`` option has not been used, the
|
||||
default is the current date.
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it. If not set, and if the -G option has not been used, the
|
||||
default is "now".
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it. If not set,
|
||||
and if the ``-G`` option has not been used, the default is the current date. If set,
|
||||
and ``-P`` is not set, the publication date is set to the
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it. If not set,
|
||||
and if the -G option has not been used, the default is "now". If set,
|
||||
if and -P is not set, then the publication date will be set to the
|
||||
activation date minus the prepublication interval.
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
@@ -273,7 +273,7 @@ explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
@@ -295,9 +295,9 @@ string. ``Knnnn.+aaa+iiiii.key`` contains the public key, and
|
||||
``Knnnn.+aaa+iiiii.private`` contains the private key.
|
||||
|
||||
The ``.key`` file contains a DNSKEY or KEY record. When a zone is being
|
||||
signed by ``named`` or ``dnssec-signzone -S``, DNSKEY records are
|
||||
signed by ``named`` or ``dnssec-signzone`` ``-S``, DNSKEY records are
|
||||
included automatically. In other cases, the ``.key`` file can be
|
||||
inserted into a zone file manually or with an ``$INCLUDE`` statement.
|
||||
inserted into a zone file manually or with a ``$INCLUDE`` statement.
|
||||
|
||||
The ``.private`` file contains algorithm-specific fields. For obvious
|
||||
security reasons, this file does not have general read permission.
|
||||
@@ -310,7 +310,7 @@ To generate an ECDSAP256SHA256 zone-signing key for the zone
|
||||
|
||||
``dnssec-keygen -a ECDSAP256SHA256 example.com``
|
||||
|
||||
The command prints a string of the form:
|
||||
The command would print a string of the form:
|
||||
|
||||
``Kexample.com.+013+26160``
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -41,38 +41,38 @@ containing the now-revoked key.
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-r``
|
||||
This option indicates to remove the original keyset files after writing the new keyset files.
|
||||
**-r**
|
||||
After writing the new keyset files remove the original keyset files.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-f``
|
||||
This option indicates a forced overwrite and causes ``dnssec-revoke`` to write the new key pair,
|
||||
**-f**
|
||||
Force overwrite: Causes ``dnssec-revoke`` to write the new key pair
|
||||
even if a file already exists matching the algorithm and key ID of
|
||||
the revoked key.
|
||||
|
||||
``-R``
|
||||
This option prints the key tag of the key with the REVOKE bit set, but does not
|
||||
**-R**
|
||||
Print the key tag of the key with the REVOKE bit set but do not
|
||||
revoke the key.
|
||||
|
||||
See Also
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -40,7 +40,7 @@ timing metadata as specified by the ``-P``, ``-A``, ``-R``, ``-I``, and
|
||||
other signing software to determine when a key is to be published,
|
||||
whether it should be used for signing a zone, etc.
|
||||
|
||||
If none of these options is set on the command line,
|
||||
If none of these options is set on the command line, then
|
||||
``dnssec-settime`` simply prints the key timing metadata already stored
|
||||
in the key.
|
||||
|
||||
@@ -54,165 +54,163 @@ the key file. The private file's permissions are always set to be
|
||||
inaccessible to anyone other than the owner (mode 0600).
|
||||
|
||||
When working with state files, it is possible to update the timing metadata in
|
||||
those files as well with ``-s``. With this option, it is also possible to update key
|
||||
those files as well with ``-s``. If this option is used you can also update key
|
||||
states with ``-d`` (DS), ``-k`` (DNSKEY), ``-r`` (RRSIG of KSK), or ``-z``
|
||||
(RRSIG of ZSK). Allowed states are HIDDEN, RUMOURED, OMNIPRESENT, and
|
||||
UNRETENTIVE.
|
||||
|
||||
The goal state of the key can also be set with ``-g``. This should be either
|
||||
HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
|
||||
zone or published.
|
||||
You can also set the goal state of the key with ``-g``. This should be either
|
||||
HIDDEN or OMNIPRESENT (representing whether the key should be removed from the
|
||||
zone, or published).
|
||||
|
||||
It is NOT RECOMMENDED to manipulate state files manually, except for testing
|
||||
It is NOT RECOMMENDED to manipulate state files manually except for testing
|
||||
purposes.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-f``
|
||||
This option forces an update of an old-format key with no metadata fields. Without
|
||||
this option, ``dnssec-settime`` fails when attempting to update a
|
||||
legacy key. With this option, the key is recreated in the new
|
||||
**-f**
|
||||
Force an update of an old-format key with no metadata fields. Without
|
||||
this option, ``dnssec-settime`` will fail when attempting to update a
|
||||
legacy key. With this option, the key will be recreated in the new
|
||||
format, but with the original key data retained. The key's creation
|
||||
date is set to the present time. If no other values are
|
||||
specified, then the key's publication and activation dates are also
|
||||
set to the present time.
|
||||
date will be set to the present time. If no other values are
|
||||
specified, then the key's publication and activation dates will also
|
||||
be set to the present time.
|
||||
|
||||
``-K directory``
|
||||
This option sets the directory in which the key files are to reside.
|
||||
**-K** directory
|
||||
Sets the directory in which the key files are to reside.
|
||||
|
||||
``-L ttl``
|
||||
This option sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. This is the TTL used when the key is imported into a zone,
|
||||
unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL takes precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL
|
||||
defaults to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
**-L** ttl
|
||||
Sets the default TTL to use for this key when it is converted into a
|
||||
DNSKEY RR. If the key is imported into a zone, this is the TTL that
|
||||
will be used for it, unless there was already a DNSKEY RRset in
|
||||
place, in which case the existing TTL would take precedence. If this
|
||||
value is not set and there is no existing DNSKEY RRset, the TTL will
|
||||
default to the SOA TTL. Setting the default TTL to ``0`` or ``none``
|
||||
removes it from the key.
|
||||
|
||||
``-h``
|
||||
This option emits a usage message and exits.
|
||||
**-h**
|
||||
Emit usage message and exit.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
Timing Options
|
||||
~~~~~~~~~~~~~~
|
||||
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the
|
||||
argument begins with a ``+`` or ``-``, it is interpreted as an offset from
|
||||
argument begins with a '+' or '-', it is interpreted as an offset from
|
||||
the present time. For convenience, if such an offset is followed by one
|
||||
of the suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, then the offset is
|
||||
of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is
|
||||
computed in years (defined as 365 24-hour days, ignoring leap years),
|
||||
months (defined as 30 24-hour days), weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the offset is computed in seconds. To
|
||||
explicitly prevent a date from being set, use ``none`` or ``never``.
|
||||
unset a date, use 'none' or 'never'.
|
||||
|
||||
``-P date/offset``
|
||||
This option sets the date on which a key is to be published to the zone. After
|
||||
that date, the key is included in the zone but is not used
|
||||
**-P** date/offset
|
||||
Sets the date on which a key is to be published to the zone. After
|
||||
that date, the key will be included in the zone but will not be used
|
||||
to sign it.
|
||||
|
||||
``-P ds date/offset``
|
||||
This option Sets the date on which DS records that match this key have been
|
||||
**-P** ds date/offset
|
||||
Sets the date on which DS records that match this key have been
|
||||
seen in the parent zone.
|
||||
|
||||
``-P sync date/offset``
|
||||
This option sets the date on which CDS and CDNSKEY records that match this key
|
||||
**-P** sync date/offset
|
||||
Sets the date on which CDS and CDNSKEY records that match this key
|
||||
are to be published to the zone.
|
||||
|
||||
``-A date/offset``
|
||||
This option sets the date on which the key is to be activated. After that date,
|
||||
the key is included in the zone and used to sign it.
|
||||
**-A** date/offset
|
||||
Sets the date on which the key is to be activated. After that date,
|
||||
the key will be included in the zone and used to sign it.
|
||||
|
||||
``-R date/offset``
|
||||
This option sets the date on which the key is to be revoked. After that date, the
|
||||
key is flagged as revoked. It is included in the zone and
|
||||
is used to sign it.
|
||||
**-R** date/offset
|
||||
Sets the date on which the key is to be revoked. After that date, the
|
||||
key will be flagged as revoked. It will be included in the zone and
|
||||
will be used to sign it.
|
||||
|
||||
``-I date/offset``
|
||||
This option sets the date on which the key is to be retired. After that date, the
|
||||
key is still included in the zone, but it is not used to
|
||||
**-I** date/offset
|
||||
Sets the date on which the key is to be retired. After that date, the
|
||||
key will still be included in the zone, but it will not be used to
|
||||
sign it.
|
||||
|
||||
``-D date/offset``
|
||||
This option sets the date on which the key is to be deleted. After that date, the
|
||||
key is no longer included in the zone. (However, it may remain in the key
|
||||
repository.)
|
||||
**-D** date/offset
|
||||
Sets the date on which the key is to be deleted. After that date, the
|
||||
key will no longer be included in the zone. (It may remain in the key
|
||||
repository, however.)
|
||||
|
||||
``-D ds date/offset``
|
||||
This option sets the date on which the DS records that match this key have
|
||||
**-D** ds date/offset
|
||||
Sets the date on which the DS records that match this key have
|
||||
been seen removed from the parent zone.
|
||||
|
||||
``-D sync date/offset``
|
||||
This option sets the date on which the CDS and CDNSKEY records that match this
|
||||
**-D** sync date/offset
|
||||
Sets the date on which the CDS and CDNSKEY records that match this
|
||||
key are to be deleted.
|
||||
|
||||
``-S predecessor key``
|
||||
This option selects a key for which the key being modified is an explicit
|
||||
**-S** predecessor key
|
||||
Select a key for which the key being modified will be an explicit
|
||||
successor. The name, algorithm, size, and type of the predecessor key
|
||||
must exactly match those of the key being modified. The activation
|
||||
date of the successor key is set to the inactivation date of the
|
||||
predecessor. The publication date is set to the activation date
|
||||
date of the successor key will be set to the inactivation date of the
|
||||
predecessor. The publication date will be set to the activation date
|
||||
minus the prepublication interval, which defaults to 30 days.
|
||||
|
||||
``-i interval``
|
||||
This option sets the prepublication interval for a key. If set, then the
|
||||
**-i** interval
|
||||
Sets the prepublication interval for a key. If set, then the
|
||||
publication and activation dates must be separated by at least this
|
||||
much time. If the activation date is specified but the publication
|
||||
date is not, the publication date defaults to this much time
|
||||
date isn't, then the publication date will default to this much time
|
||||
before the activation date; conversely, if the publication date is
|
||||
specified but not the activation date, activation is set to
|
||||
specified but activation date isn't, then activation will be set to
|
||||
this much time after publication.
|
||||
|
||||
If the key is being created as an explicit successor to another key,
|
||||
If the key is being set to be an explicit successor to another key,
|
||||
then the default prepublication interval is 30 days; otherwise it is
|
||||
zero.
|
||||
|
||||
As with date offsets, if the argument is followed by one of the
|
||||
suffixes ``y``, ``mo``, ``w``, ``d``, ``h``, or ``mi``, the interval is
|
||||
suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the interval is
|
||||
measured in years, months, weeks, days, hours, or minutes,
|
||||
respectively. Without a suffix, the interval is measured in seconds.
|
||||
|
||||
Key State Options
|
||||
~~~~~~~~~~~~~~~~~
|
||||
|
||||
To test dnssec-policy it may be necessary to construct keys with artificial
|
||||
state information; these options are used by the testing framework for that
|
||||
purpose, but should never be used in production.
|
||||
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
|
||||
Known key states are HIDDEN, RUMOURED, OMNIPRESENT and UNRETENTIVE. These should
|
||||
not be set manually except for testing purposes.
|
||||
|
||||
``-s``
|
||||
This option indicates that when setting key timing data, the state file should also be updated.
|
||||
When setting key timing data, also update the state file.
|
||||
|
||||
``-g state``
|
||||
This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
``-g``
|
||||
Set the goal state for this key. Must be HIDDEN or OMNIPRESENT.
|
||||
|
||||
``-d state date/offset``
|
||||
This option sets the DS state for this key as of the specified date, offset from the current date.
|
||||
``-d``
|
||||
Set the DS state for this key, and when it was last changed.
|
||||
|
||||
``-k state date/offset``
|
||||
This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
|
||||
``-k``
|
||||
Set the DNSKEY state for this key, and when it was last changed.
|
||||
|
||||
``-r state date/offset``
|
||||
This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
|
||||
``-r``
|
||||
Set the RRSIG (KSK) state for this key, and when it was last changed.
|
||||
|
||||
``-z state date/offset``
|
||||
This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
|
||||
``-z``
|
||||
|
||||
Set the RRSIG (ZSK) state for this key, and when it was last changed.
|
||||
|
||||
Printing Options
|
||||
~~~~~~~~~~~~~~~~
|
||||
@@ -220,15 +218,15 @@ Printing Options
|
||||
``dnssec-settime`` can also be used to print the timing metadata
|
||||
associated with a key.
|
||||
|
||||
``-u``
|
||||
This option indicates that times should be printed in Unix epoch format.
|
||||
**-u**
|
||||
Print times in UNIX epoch format.
|
||||
|
||||
``-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all``
|
||||
This option prints a specific metadata value or set of metadata values.
|
||||
The ``-p`` option may be followed by one or more of the following letters or
|
||||
strings to indicate which value or values to print: ``C`` for the
|
||||
creation date, ``P`` for the publication date, ``Pds` for the DS publication
|
||||
date, ``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
|
||||
**-p** C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
|
||||
Prints a specific metadata value or set of metadata values. The ``-p``
|
||||
option may be followed by one or more of the following letters or strings
|
||||
to indicate which value or values to print: ``C`` for the creation date,
|
||||
``P`` for the publication date, ``Pds` for the DS publication date,
|
||||
``Psync`` for the CDS and CDNSKEY publication date, ``A`` for the
|
||||
activation date, ``R`` for the revocation date, ``I`` for the inactivation
|
||||
date, ``D`` for the deletion date, ``Dds`` for the DS deletion date,
|
||||
and ``Dsync`` for the CDS and CDNSKEY deletion date. To print all of the
|
||||
|
||||
+56
-124
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -39,7 +39,6 @@
|
||||
#include <isc/file.h>
|
||||
#include <isc/hash.h>
|
||||
#include <isc/hex.h>
|
||||
#include <isc/managers.h>
|
||||
#include <isc/md.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/mutex.h>
|
||||
@@ -124,7 +123,7 @@ struct signer_event {
|
||||
|
||||
static dns_dnsseckeylist_t keylist;
|
||||
static unsigned int keycount = 0;
|
||||
static isc_rwlock_t keylist_lock;
|
||||
isc_rwlock_t keylist_lock;
|
||||
static isc_stdtime_t starttime = 0, endtime = 0, dnskey_endtime = 0, now;
|
||||
static int cycle = -1;
|
||||
static int jitter = 0;
|
||||
@@ -144,7 +143,6 @@ static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
|
||||
static unsigned int nverified = 0, nverifyfailed = 0;
|
||||
static const char *directory = NULL, *dsdir = NULL;
|
||||
static isc_mutex_t namelock, statslock;
|
||||
static isc_nm_t *netmgr = NULL;
|
||||
static isc_taskmgr_t *taskmgr = NULL;
|
||||
static dns_db_t *gdb; /* The database */
|
||||
static dns_dbversion_t *gversion; /* The database version */
|
||||
@@ -178,9 +176,8 @@ static bool remove_orphansigs = false;
|
||||
static bool remove_inactkeysigs = false;
|
||||
static bool output_dnssec_only = false;
|
||||
static bool output_stdout = false;
|
||||
static bool set_maxttl = false;
|
||||
bool set_maxttl = false;
|
||||
static dns_ttl_t maxttl = 0;
|
||||
static bool no_max_check = false;
|
||||
|
||||
#define INCSTAT(counter) \
|
||||
if (printstats) { \
|
||||
@@ -383,9 +380,9 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
|
||||
dst_key_t *pubkey = NULL, *privkey = NULL;
|
||||
dns_dnsseckey_t *key = NULL;
|
||||
|
||||
RWLOCK(&keylist_lock, isc_rwlocktype_read);
|
||||
isc_rwlock_lock(&keylist_lock, isc_rwlocktype_read);
|
||||
key = keythatsigned_unlocked(rrsig);
|
||||
RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
|
||||
isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_read);
|
||||
if (key != NULL) {
|
||||
return (key);
|
||||
}
|
||||
@@ -553,7 +550,11 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
|
||||
key = keythatsigned(&rrsig);
|
||||
sig_format(&rrsig, sigstr, sizeof(sigstr));
|
||||
expired = isc_serial_gt(now + cycle, rrsig.timeexpire);
|
||||
if (key != NULL && issigningkey(key)) {
|
||||
expired = isc_serial_gt(now + cycle, rrsig.timeexpire);
|
||||
} else {
|
||||
expired = isc_serial_gt(now, rrsig.timeexpire);
|
||||
}
|
||||
|
||||
if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
|
||||
/* rrsig is dropped and not replaced */
|
||||
@@ -589,10 +590,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
vbprintf(2, "\trrsig by %s dropped - %s\n",
|
||||
sigstr,
|
||||
expired ? "expired"
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
resign = true;
|
||||
}
|
||||
} else if (!ispublishedkey(key) && remove_orphansigs) {
|
||||
@@ -610,10 +611,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
vbprintf(2, "\trrsig by %s dropped - %s\n",
|
||||
sigstr,
|
||||
expired ? "expired"
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
: rrsig.originalttl != set->ttl
|
||||
? "ttl change"
|
||||
: "failed to "
|
||||
"verify");
|
||||
}
|
||||
} else if (!expired) {
|
||||
vbprintf(2, "\trrsig by %s retained\n", sigstr);
|
||||
@@ -643,7 +644,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
}
|
||||
} else {
|
||||
tuple = NULL;
|
||||
vbprintf(2, "\tremoving signature by %s\n", sigstr);
|
||||
vbprintf(2, "removing signature by %s\n", sigstr);
|
||||
result = dns_difftuple_create(
|
||||
mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
|
||||
&sigrdata, &tuple);
|
||||
@@ -689,20 +690,20 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
dns_name_equal(name, gorigin))
|
||||
{
|
||||
bool have_ksk;
|
||||
dns_dnsseckey_t *curr;
|
||||
dns_dnsseckey_t *tmpkey;
|
||||
|
||||
have_ksk = isksk(key);
|
||||
for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
|
||||
curr = ISC_LIST_NEXT(curr, link))
|
||||
for (tmpkey = ISC_LIST_HEAD(keylist); tmpkey != NULL;
|
||||
tmpkey = ISC_LIST_NEXT(tmpkey, link))
|
||||
{
|
||||
if (dst_key_alg(key->key) !=
|
||||
dst_key_alg(curr->key)) {
|
||||
dst_key_alg(tmpkey->key)) {
|
||||
continue;
|
||||
}
|
||||
if (REVOKE(curr->key)) {
|
||||
if (REVOKE(tmpkey->key)) {
|
||||
continue;
|
||||
}
|
||||
if (isksk(curr)) {
|
||||
if (isksk(tmpkey)) {
|
||||
have_ksk = true;
|
||||
}
|
||||
}
|
||||
@@ -712,65 +713,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
|
||||
"signing with dnskey");
|
||||
}
|
||||
} else if (iszsk(key)) {
|
||||
/*
|
||||
* Sign with the ZSK unless there is a predecessor
|
||||
* key that already signs this RRset.
|
||||
*/
|
||||
bool have_pre_sig = false;
|
||||
dns_dnsseckey_t *curr;
|
||||
uint32_t pre;
|
||||
isc_result_t ret = dst_key_getnum(
|
||||
key->key, DST_NUM_PREDECESSOR, &pre);
|
||||
if (ret == ISC_R_SUCCESS) {
|
||||
/*
|
||||
* This key has a predecessor, look for the
|
||||
* corresponding key in the keylist. The
|
||||
* key we are looking for must be:
|
||||
* - From the same cryptographic algorithm.
|
||||
* - Have the ZSK type (iszsk).
|
||||
* - Have key ID equal to the predecessor id.
|
||||
* - Have a successor that matches 'key' id.
|
||||
*/
|
||||
for (curr = ISC_LIST_HEAD(keylist);
|
||||
curr != NULL;
|
||||
curr = ISC_LIST_NEXT(curr, link))
|
||||
{
|
||||
uint32_t suc;
|
||||
|
||||
if (dst_key_alg(key->key) !=
|
||||
dst_key_alg(curr->key) ||
|
||||
!iszsk(curr) ||
|
||||
dst_key_id(curr->key) != pre)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
ret = dst_key_getnum(curr->key,
|
||||
DST_NUM_SUCCESSOR,
|
||||
&suc);
|
||||
if (ret != ISC_R_SUCCESS ||
|
||||
dst_key_id(key->key) != suc) {
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* curr is the predecessor we were
|
||||
* looking for. Check if this key
|
||||
* signs this RRset.
|
||||
*/
|
||||
if (nowsignedby[curr->index]) {
|
||||
have_pre_sig = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* If we have a signature of a predecessor key,
|
||||
* skip signing with this key.
|
||||
*/
|
||||
if (!have_pre_sig) {
|
||||
signwithkey(name, set, key->key, ttl, add,
|
||||
"signing with dnskey");
|
||||
}
|
||||
signwithkey(name, set, key->key, ttl, add,
|
||||
"signing with dnskey");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1389,8 +1333,8 @@ get_soa_ttls(void) {
|
||||
result = dns_rdataset_first(&soaset);
|
||||
check_result(result, "dns_rdataset_first");
|
||||
dns_rdataset_current(&soaset, &rdata);
|
||||
zone_soa_min_ttl = dns_soa_getminimum(&rdata);
|
||||
soa_ttl = soaset.ttl;
|
||||
zone_soa_min_ttl = ISC_MIN(dns_soa_getminimum(&rdata), soa_ttl);
|
||||
if (set_maxttl) {
|
||||
zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
|
||||
soa_ttl = ISC_MIN(soa_ttl, maxttl);
|
||||
@@ -1407,8 +1351,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
|
||||
dns_dbnode_t *node = NULL;
|
||||
dns_rdataset_t rdataset;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
uint32_t old_serial, new_serial = 0;
|
||||
dns_updatemethod_t used = dns_updatemethod_none;
|
||||
uint32_t old_serial, new_serial;
|
||||
|
||||
result = dns_db_getoriginnode(gdb, &node);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1432,20 +1375,16 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
|
||||
|
||||
if (method == dns_updatemethod_date ||
|
||||
method == dns_updatemethod_unixtime) {
|
||||
new_serial = dns_update_soaserial(old_serial, method, &used);
|
||||
new_serial = dns_update_soaserial(old_serial, method);
|
||||
} else if (serial != 0 || method == dns_updatemethod_none) {
|
||||
/* Set SOA serial to the value provided. */
|
||||
new_serial = serial;
|
||||
used = method;
|
||||
} else {
|
||||
new_serial = dns_update_soaserial(old_serial, method, &used);
|
||||
}
|
||||
|
||||
if (method != used) {
|
||||
fprintf(stderr,
|
||||
"%s: warning: Serial number would not advance, "
|
||||
"using increment method instead\n",
|
||||
program);
|
||||
/* Increment SOA serial using RFC 1982 arithmetic */
|
||||
new_serial = (old_serial + 1) & 0xFFFFFFFF;
|
||||
if (new_serial == 0) {
|
||||
new_serial = 1;
|
||||
}
|
||||
}
|
||||
|
||||
/* If the new serial is not likely to cause a zone transfer
|
||||
@@ -2783,13 +2722,10 @@ static void
|
||||
report(const char *format, ...) {
|
||||
if (!quiet) {
|
||||
FILE *out = output_stdout ? stderr : stdout;
|
||||
char buf[4096];
|
||||
va_list args;
|
||||
|
||||
va_start(args, format);
|
||||
vsnprintf(buf, sizeof(buf), format, args);
|
||||
vfprintf(out, format, args);
|
||||
va_end(args);
|
||||
fprintf(out, "%s\n", buf);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -3063,7 +2999,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
|
||||
isc_buffer_t namebuf;
|
||||
isc_region_t r;
|
||||
isc_result_t result;
|
||||
dns_dnsseckey_t *key, *curr;
|
||||
dns_dnsseckey_t *key, *tmpkey;
|
||||
unsigned char dsbuf[DNS_DS_BUFFERSIZE];
|
||||
unsigned char keybuf[DST_KEY_MAXSIZE];
|
||||
unsigned int filenamelen;
|
||||
@@ -3104,16 +3040,16 @@ writeset(const char *prefix, dns_rdatatype_t type) {
|
||||
have_ksk = false;
|
||||
have_non_ksk = true;
|
||||
}
|
||||
for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
|
||||
curr = ISC_LIST_NEXT(curr, link))
|
||||
for (tmpkey = ISC_LIST_HEAD(keylist); tmpkey != NULL;
|
||||
tmpkey = ISC_LIST_NEXT(tmpkey, link))
|
||||
{
|
||||
if (dst_key_alg(key->key) != dst_key_alg(curr->key)) {
|
||||
if (dst_key_alg(key->key) != dst_key_alg(tmpkey->key)) {
|
||||
continue;
|
||||
}
|
||||
if (REVOKE(curr->key)) {
|
||||
if (REVOKE(tmpkey->key)) {
|
||||
continue;
|
||||
}
|
||||
if (isksk(curr)) {
|
||||
if (isksk(tmpkey)) {
|
||||
have_ksk = true;
|
||||
} else {
|
||||
have_non_ksk = true;
|
||||
@@ -3493,12 +3429,6 @@ main(int argc, char *argv[]) {
|
||||
|
||||
case 'H':
|
||||
set_iter = true;
|
||||
/* too-many is NOT DOCUMENTED */
|
||||
if (strcmp(isc_commandline_argument, "too-many") == 0) {
|
||||
nsec3iter = 151;
|
||||
no_max_check = true;
|
||||
break;
|
||||
}
|
||||
nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
|
||||
if (*endp != '\0') {
|
||||
fatal("iterations must be numeric");
|
||||
@@ -3867,7 +3797,11 @@ main(int argc, char *argv[]) {
|
||||
* of keys rather early.
|
||||
*/
|
||||
ISC_LIST_INIT(keylist);
|
||||
isc_rwlock_init(&keylist_lock, 0, 0);
|
||||
result = isc_rwlock_init(&keylist_lock, 0, 0);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("could not initialize keylist_lock: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
/*
|
||||
* Fill keylist with:
|
||||
@@ -3917,6 +3851,7 @@ main(int argc, char *argv[]) {
|
||||
warnifallksk(gdb);
|
||||
|
||||
if (IS_NSEC3) {
|
||||
unsigned int max;
|
||||
bool answer;
|
||||
|
||||
hash_length = dns_nsec3_hashlength(dns_hash_sha1);
|
||||
@@ -3935,15 +3870,12 @@ main(int argc, char *argv[]) {
|
||||
"NSEC-only DNSKEY");
|
||||
}
|
||||
|
||||
if (nsec3iter > dns_nsec3_maxiterations()) {
|
||||
if (no_max_check) {
|
||||
fprintf(stderr,
|
||||
"Ignoring max iterations check.\n");
|
||||
} else {
|
||||
fatal("NSEC3 iterations too big. Maximum "
|
||||
"iterations allowed %u.",
|
||||
dns_nsec3_maxiterations());
|
||||
}
|
||||
result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
|
||||
check_result(result, "dns_nsec3_maxiterations()");
|
||||
if (nsec3iter > max) {
|
||||
fatal("NSEC3 iterations too big for weakest DNSKEY "
|
||||
"strength. Maximum iterations allowed %u.",
|
||||
max);
|
||||
}
|
||||
} else {
|
||||
hashlist_init(&hashlist, 0, 0); /* silence clang */
|
||||
@@ -4016,7 +3948,7 @@ main(int argc, char *argv[]) {
|
||||
print_time(outfp);
|
||||
print_version(outfp);
|
||||
|
||||
result = isc_managers_create(mctx, ntasks, 0, &netmgr, &taskmgr);
|
||||
result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fatal("failed to create task manager: %s",
|
||||
isc_result_totext(result));
|
||||
@@ -4071,7 +4003,7 @@ main(int argc, char *argv[]) {
|
||||
for (i = 0; i < (int)ntasks; i++) {
|
||||
isc_task_detach(&tasks[i]);
|
||||
}
|
||||
isc_managers_destroy(&netmgr, &taskmgr);
|
||||
isc_taskmgr_destroy(&taskmgr);
|
||||
isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
|
||||
postsign();
|
||||
TIME_NOW(&sign_finish);
|
||||
|
||||
+170
-175
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -34,238 +34,233 @@ Synopsis
|
||||
Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-signzone`` signs a zone; it generates NSEC and RRSIG records
|
||||
``dnssec-signzone`` signs a zone. It generates NSEC and RRSIG records
|
||||
and produces a signed version of the zone. The security status of
|
||||
delegations from the signed zone (that is, whether the child zones are
|
||||
secure) is determined by the presence or absence of a ``keyset``
|
||||
secure or not) is determined by the presence or absence of a ``keyset``
|
||||
file for each child zone.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-a``
|
||||
This option verifies all generated signatures.
|
||||
**-a**
|
||||
Verify all generated signatures.
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zone.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zone.
|
||||
|
||||
``-C``
|
||||
This option sets compatibility mode, in which a ``keyset-zonename`` file is generated in addition
|
||||
**-C**
|
||||
Compatibility mode: Generate a ``keyset-zonename`` file in addition
|
||||
to ``dsset-zonename`` when signing a zone, for use by older versions
|
||||
of ``dnssec-signzone``.
|
||||
|
||||
``-d directory``
|
||||
This option indicates the directory where BIND 9 should look for ``dsset-`` or ``keyset-`` files.
|
||||
**-d** directory
|
||||
Look for ``dsset-`` or ``keyset-`` files in ``directory``.
|
||||
|
||||
``-D``
|
||||
This option indicates that only those record types automatically managed by
|
||||
``dnssec-signzone``, i.e., RRSIG, NSEC, NSEC3 and NSEC3PARAM records, should be included in the output.
|
||||
**-D**
|
||||
Output only those record types automatically managed by
|
||||
``dnssec-signzone``, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records.
|
||||
If smart signing (``-S``) is used, DNSKEY records are also included.
|
||||
The resulting file can be included in the original zone file with
|
||||
``$INCLUDE``. This option cannot be combined with ``-O raw``,
|
||||
``-O map``, or serial-number updating.
|
||||
``-O map``, or serial number updating.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing, when applicable.
|
||||
**-E** engine
|
||||
When applicable, specifies the hardware to use for cryptographic
|
||||
operations, such as a secure key store used for signing.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-g``
|
||||
This option indicates that DS records for child zones should be generated from a ``dsset-`` or ``keyset-``
|
||||
file. Existing DS records are removed.
|
||||
**-g**
|
||||
Generate DS records for child zones from ``dsset-`` or ``keyset-``
|
||||
file. Existing DS records will be removed.
|
||||
|
||||
``-K directory``
|
||||
This option specifies the directory to search for DNSSEC keys. If not
|
||||
specified, it defaults to the current directory.
|
||||
**-K** directory
|
||||
Key repository: Specify a directory to search for DNSSEC keys. If not
|
||||
specified, defaults to the current directory.
|
||||
|
||||
``-k key``
|
||||
This option tells BIND 9 to treat the specified key as a key-signing key, ignoring any key flags. This
|
||||
**-k** key
|
||||
Treat specified key as a key signing key ignoring any key flags. This
|
||||
option may be specified multiple times.
|
||||
|
||||
``-M maxttl``
|
||||
This option sets the maximum TTL for the signed zone. Any TTL higher than ``maxttl``
|
||||
in the input zone is reduced to ``maxttl`` in the output. This
|
||||
**-M** maxttl
|
||||
Sets the maximum TTL for the signed zone. Any TTL higher than maxttl
|
||||
in the input zone will be reduced to maxttl in the output. This
|
||||
provides certainty as to the largest possible TTL in the signed zone,
|
||||
which is useful to know when rolling keys. The maxttl is the longest
|
||||
which is useful to know when rolling keys because it is the longest
|
||||
possible time before signatures that have been retrieved by resolvers
|
||||
expire from resolver caches. Zones that are signed with this
|
||||
will expire from resolver caches. Zones that are signed with this
|
||||
option should be configured to use a matching ``max-zone-ttl`` in
|
||||
``named.conf``. (Note: This option is incompatible with ``-D``,
|
||||
because it modifies non-DNSSEC data in the output zone.)
|
||||
|
||||
``-s start-time``
|
||||
This option specifies the date and time when the generated RRSIG records become
|
||||
**-s** start-time
|
||||
Specify the date and time when the generated RRSIG records become
|
||||
valid. This can be either an absolute or relative time. An absolute
|
||||
start time is indicated by a number in YYYYMMDDHHMMSS notation;
|
||||
20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative
|
||||
start time is indicated by ``+N``, which is N seconds from the current
|
||||
start time is indicated by +N, which is N seconds from the current
|
||||
time. If no ``start-time`` is specified, the current time minus 1
|
||||
hour (to allow for clock skew) is used.
|
||||
|
||||
``-e end-time``
|
||||
This option specifies the date and time when the generated RRSIG records expire. As
|
||||
**-e** end-time
|
||||
Specify the date and time when the generated RRSIG records expire. As
|
||||
with ``start-time``, an absolute time is indicated in YYYYMMDDHHMMSS
|
||||
notation. A time relative to the start time is indicated with ``+N``,
|
||||
notation. A time relative to the start time is indicated with +N,
|
||||
which is N seconds from the start time. A time relative to the
|
||||
current time is indicated with ``now+N``. If no ``end-time`` is
|
||||
specified, 30 days from the start time is the default.
|
||||
current time is indicated with now+N. If no ``end-time`` is
|
||||
specified, 30 days from the start time is used as a default.
|
||||
``end-time`` must be later than ``start-time``.
|
||||
|
||||
``-X extended end-time``
|
||||
This option specifies the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset expire. This is to be used in cases when the DNSKEY
|
||||
**-X** extended end-time
|
||||
Specify the date and time when the generated RRSIG records for the
|
||||
DNSKEY RRset will expire. This is to be used in cases when the DNSKEY
|
||||
signatures need to persist longer than signatures on other records;
|
||||
e.g., when the private component of the KSK is kept offline and the
|
||||
KSK signature is to be refreshed manually.
|
||||
|
||||
As with ``end-time``, an absolute time is indicated in
|
||||
As with ``start-time``, an absolute time is indicated in
|
||||
YYYYMMDDHHMMSS notation. A time relative to the start time is
|
||||
indicated with ``+N``, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with ``now+N``. If no
|
||||
indicated with +N, which is N seconds from the start time. A time
|
||||
relative to the current time is indicated with now+N. If no
|
||||
``extended end-time`` is specified, the value of ``end-time`` is used
|
||||
as the default. (``end-time``, in turn, defaults to 30 days from the
|
||||
start time.) ``extended end-time`` must be later than ``start-time``.
|
||||
|
||||
``-f output-file``
|
||||
This option indicates the name of the output file containing the signed zone. The default
|
||||
**-f** output-file
|
||||
The name of the output file containing the signed zone. The default
|
||||
is to append ``.signed`` to the input filename. If ``output-file`` is
|
||||
set to ``-``, then the signed zone is written to the standard
|
||||
output, with a default output format of ``full``.
|
||||
set to ``"-"``, then the signed zone is written to the standard
|
||||
output, with a default output format of "full".
|
||||
|
||||
``-h``
|
||||
This option prints a short summary of the options and arguments to
|
||||
**-h**
|
||||
Prints a short summary of the options and arguments to
|
||||
``dnssec-signzone``.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-i interval``
|
||||
This option indicates that, when a previously signed zone is passed as input, records may be
|
||||
re-signed. The ``interval`` option specifies the cycle interval as an
|
||||
offset from the current time, in seconds. If a RRSIG record expires
|
||||
after the cycle interval, it is retained; otherwise, it is considered
|
||||
to be expiring soon and it is replaced.
|
||||
**-i** interval
|
||||
When a previously-signed zone is passed as input, records may be
|
||||
resigned. The ``interval`` option specifies the cycle interval as an
|
||||
offset from the current time (in seconds). If a RRSIG record expires
|
||||
after the cycle interval, it is retained. Otherwise, it is considered
|
||||
to be expiring soon, and it will be replaced.
|
||||
|
||||
The default cycle interval is one quarter of the difference between
|
||||
the signature end and start times. So if neither ``end-time`` nor
|
||||
``start-time`` is specified, ``dnssec-signzone`` generates
|
||||
the signature end and start times. So if neither ``end-time`` or
|
||||
``start-time`` are specified, ``dnssec-signzone`` generates
|
||||
signatures that are valid for 30 days, with a cycle interval of 7.5
|
||||
days. Therefore, if any existing RRSIG records are due to expire in
|
||||
less than 7.5 days, they are replaced.
|
||||
less than 7.5 days, they would be replaced.
|
||||
|
||||
``-I input-format``
|
||||
This option sets the format of the input zone file. Possible formats are ``text``
|
||||
(the default), ``raw``, and ``map``. This option is primarily
|
||||
intended to be used for dynamic signed zones, so that the dumped zone
|
||||
**-I** input-format
|
||||
The format of the input zone file. Possible formats are ``"text"``
|
||||
(default), ``"raw"``, and ``"map"``. This option is primarily
|
||||
intended to be used for dynamic signed zones so that the dumped zone
|
||||
file in a non-text format containing updates can be signed directly.
|
||||
This option is not useful for non-dynamic zones.
|
||||
The use of this option does not make much sense for non-dynamic
|
||||
zones.
|
||||
|
||||
``-j jitter``
|
||||
**-j** jitter
|
||||
When signing a zone with a fixed signature lifetime, all RRSIG
|
||||
records issued at the time of signing expire simultaneously. If the
|
||||
zone is incrementally signed, i.e., a previously signed zone is passed
|
||||
as input to the signer, all expired signatures must be regenerated
|
||||
at approximately the same time. The ``jitter`` option specifies a jitter
|
||||
window that is used to randomize the signature expire time, thus
|
||||
records issued at the time of signing expires simultaneously. If the
|
||||
zone is incrementally signed, i.e. a previously-signed zone is passed
|
||||
as input to the signer, all expired signatures have to be regenerated
|
||||
at about the same time. The ``jitter`` option specifies a jitter
|
||||
window that will be used to randomize the signature expire time, thus
|
||||
spreading incremental signature regeneration over time.
|
||||
|
||||
Signature lifetime jitter also, to some extent, benefits validators and
|
||||
servers by spreading out cache expiration, i.e., if large numbers of
|
||||
RRSIGs do not expire at the same time from all caches, there is
|
||||
less congestion than if all validators need to refetch at around the
|
||||
Signature lifetime jitter also to some extent benefits validators and
|
||||
servers by spreading out cache expiration, i.e. if large numbers of
|
||||
RRSIGs don't expire at the same time from all caches there will be
|
||||
less congestion than if all validators need to refetch at mostly the
|
||||
same time.
|
||||
|
||||
``-L serial``
|
||||
When writing a signed zone to "raw" or "map" format, this option sets the "source
|
||||
serial" value in the header to the specified ``serial`` number. (This is
|
||||
**-L** serial
|
||||
When writing a signed zone to "raw" or "map" format, set the "source
|
||||
serial" value in the header to the specified serial number. (This is
|
||||
expected to be used primarily for testing purposes.)
|
||||
|
||||
``-n ncpus``
|
||||
This option specifies the number of threads to use. By default, one thread is
|
||||
**-n** ncpus
|
||||
Specifies the number of threads to use. By default, one thread is
|
||||
started for each detected CPU.
|
||||
|
||||
``-N soa-serial-format``
|
||||
This option sets the SOA serial number format of the signed zone. Possible formats are
|
||||
``keep`` (the default), ``increment``, ``unixtime``, and
|
||||
``date``.
|
||||
**-N** soa-serial-format
|
||||
The SOA serial number format of the signed zone. Possible formats are
|
||||
``"keep"`` (default), ``"increment"``, ``"unixtime"``, and
|
||||
``"date"``.
|
||||
|
||||
**keep**
|
||||
This format indicates that the SOA serial number should not be modified.
|
||||
``"keep"``
|
||||
Do not modify the SOA serial number.
|
||||
|
||||
**increment**
|
||||
This format increments the SOA serial number using :rfc:`1982` arithmetic.
|
||||
``"increment"``
|
||||
Increment the SOA serial number using :rfc:`1982` arithmetic.
|
||||
|
||||
**unixtime**
|
||||
This format sets the SOA serial number to the number of seconds
|
||||
since the beginning of the Unix epoch, unless the serial
|
||||
number is already greater than or equal to that value, in
|
||||
which case it is simply incremented by one.
|
||||
``"unixtime"``
|
||||
Set the SOA serial number to the number of seconds since epoch.
|
||||
|
||||
**date**
|
||||
This format sets the SOA serial number to today's date, in
|
||||
YYYYMMDDNN format, unless the serial number is already greater
|
||||
than or equal to that value, in which case it is simply
|
||||
incremented by one.
|
||||
``"date"``
|
||||
Set the SOA serial number to today's date in YYYYMMDDNN format.
|
||||
|
||||
``-o origin``
|
||||
This option sets the zone origin. If not specified, the name of the zone file is
|
||||
**-o** origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
|
||||
``-O output-format``
|
||||
This option sets the format of the output file containing the signed zone. Possible
|
||||
formats are ``text`` (the default), which is the standard textual
|
||||
representation of the zone; ``full``, which is text output in a
|
||||
format suitable for processing by external scripts; and ``map``,
|
||||
``raw``, and ``raw=N``, which store the zone in binary formats
|
||||
for rapid loading by ``named``. ``raw=N`` specifies the format
|
||||
**-O** output-format
|
||||
The format of the output file containing the signed zone. Possible
|
||||
formats are ``"text"`` (default), which is the standard textual
|
||||
representation of the zone; ``"full"``, which is text output in a
|
||||
format suitable for processing by external scripts; and ``"map"``,
|
||||
``"raw"``, and ``"raw=N"``, which store the zone in binary formats
|
||||
for rapid loading by ``named``. ``"raw=N"`` specifies the format
|
||||
version of the raw zone file: if N is 0, the raw file can be read by
|
||||
any version of ``named``; if N is 1, the file can be read by release
|
||||
9.9.0 or higher. The default is 1.
|
||||
9.9.0 or higher; the default is 1.
|
||||
|
||||
``-P``
|
||||
This option disables post-sign verification tests.
|
||||
**-P**
|
||||
Disable post sign verification tests.
|
||||
|
||||
The post-sign verification tests ensure that for each algorithm in
|
||||
use there is at least one non-revoked self-signed KSK key, that all
|
||||
revoked KSK keys are self-signed, and that all records in the zone
|
||||
The post sign verification test ensures that for each algorithm in
|
||||
use there is at least one non revoked self signed KSK key, that all
|
||||
revoked KSK keys are self signed, and that all records in the zone
|
||||
are signed by the algorithm. This option skips these tests.
|
||||
|
||||
``-Q``
|
||||
This option removes signatures from keys that are no longer active.
|
||||
**-Q**
|
||||
Remove signatures from keys that are no longer active.
|
||||
|
||||
Normally, when a previously signed zone is passed as input to the
|
||||
Normally, when a previously-signed zone is passed as input to the
|
||||
signer, and a DNSKEY record has been removed and replaced with a new
|
||||
one, signatures from the old key that are still within their validity
|
||||
period are retained. This allows the zone to continue to validate
|
||||
with cached copies of the old DNSKEY RRset. The ``-Q`` option forces
|
||||
with cached copies of the old DNSKEY RRset. The ``-Q`` forces
|
||||
``dnssec-signzone`` to remove signatures from keys that are no longer
|
||||
active. This enables ZSK rollover using the procedure described in
|
||||
:rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").
|
||||
|
||||
``-q``
|
||||
This option enables quiet mode, which suppresses unnecessary output. Without this option, when
|
||||
``dnssec-signzone`` is run it prints three pieces of information to standard output: the number of
|
||||
keys in use; the algorithms used to verify the zone was signed correctly and
|
||||
other status information; and the filename containing the signed
|
||||
zone. With the option that output is suppressed, leaving only the filename.
|
||||
Quiet mode: Suppresses unnecessary output. Without this option, when
|
||||
``dnssec-signzone`` is run it will print to standard output the number of
|
||||
keys in use, the algorithms used to verify the zone was signed correctly and
|
||||
other status information, and finally the filename containing the signed
|
||||
zone. With it, that output is suppressed, leaving only the filename.
|
||||
|
||||
``-R``
|
||||
This option removes signatures from keys that are no longer published.
|
||||
**-R**
|
||||
Remove signatures from keys that are no longer published.
|
||||
|
||||
This option is similar to ``-Q``, except it forces
|
||||
``dnssec-signzone`` to remove signatures from keys that are no longer
|
||||
``dnssec-signzone`` to signatures from keys that are no longer
|
||||
published. This enables ZSK rollover using the procedure described in
|
||||
:rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
|
||||
Rollover").
|
||||
|
||||
``-S``
|
||||
This option enables smart signing, which instructs ``dnssec-signzone`` to search the key
|
||||
**-S**
|
||||
Smart signing: Instructs ``dnssec-signzone`` to search the key
|
||||
repository for keys that match the zone being signed, and to include
|
||||
them in the zone if appropriate.
|
||||
|
||||
@@ -279,94 +274,94 @@ Options
|
||||
If the key's publication date is set and is in the past, the key
|
||||
is published in the zone.
|
||||
|
||||
If the key's activation date is set and is in the past, the key is
|
||||
If the key's activation date is set and in the past, the key is
|
||||
published (regardless of publication date) and used to sign the
|
||||
zone.
|
||||
|
||||
If the key's revocation date is set and is in the past, and the key
|
||||
If the key's revocation date is set and in the past, and the key
|
||||
is published, then the key is revoked, and the revoked key is used
|
||||
to sign the zone.
|
||||
|
||||
If either the key's unpublication or deletion date is set and
|
||||
If either of the key's unpublication or deletion dates are set and
|
||||
in the past, the key is NOT published or used to sign the zone,
|
||||
regardless of any other metadata.
|
||||
|
||||
If the key's sync publication date is set and is in the past,
|
||||
If key's sync publication date is set and in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are created.
|
||||
|
||||
If the key's sync deletion date is set and is in the past,
|
||||
If key's sync deletion date is set and in the past,
|
||||
synchronization records (type CDS and/or CDNSKEY) are removed.
|
||||
|
||||
``-T ttl``
|
||||
This option specifies a TTL to be used for new DNSKEY records imported into the
|
||||
**-T** ttl
|
||||
Specifies a TTL to be used for new DNSKEY records imported into the
|
||||
zone from the key repository. If not specified, the default is the
|
||||
TTL value from the zone's SOA record. This option is ignored when
|
||||
signing without ``-S``, since DNSKEY records are not imported from
|
||||
the key repository in that case. It is also ignored if there are any
|
||||
pre-existing DNSKEY records at the zone apex, in which case new
|
||||
records' TTL values are set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a
|
||||
records' TTL values will be set to match them, or if any of the
|
||||
imported DNSKEY records had a default TTL value. In the event of a a
|
||||
conflict between TTL values in imported keys, the shortest one is
|
||||
used.
|
||||
|
||||
``-t``
|
||||
This option prints statistics at completion.
|
||||
**-t**
|
||||
Print statistics at completion.
|
||||
|
||||
``-u``
|
||||
This option updates the NSEC/NSEC3 chain when re-signing a previously signed zone.
|
||||
**-u**
|
||||
Update NSEC/NSEC3 chain when re-signing a previously signed zone.
|
||||
With this option, a zone signed with NSEC can be switched to NSEC3,
|
||||
or a zone signed with NSEC3 can be switched to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, ``dnssec-signzone``
|
||||
retains the existing chain when re-signing.
|
||||
or a zone signed with NSEC3 can be switch to NSEC or to NSEC3 with
|
||||
different parameters. Without this option, ``dnssec-signzone`` will
|
||||
retain the existing chain when re-signing.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-x``
|
||||
This option indicates that BIND 9 should only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and should omit signatures from zone-signing keys. (This is similar to the
|
||||
**-x**
|
||||
Only sign the DNSKEY, CDNSKEY, and CDS RRsets with key-signing keys,
|
||||
and omit signatures from zone-signing keys. (This is similar to the
|
||||
``dnssec-dnskey-kskonly yes;`` zone option in ``named``.)
|
||||
|
||||
``-z``
|
||||
This option indicates that BIND 9 should ignore the KSK flag on keys when determining what to sign. This causes
|
||||
**-z**
|
||||
Ignore KSK flag on key when determining what to sign. This causes
|
||||
KSK-flagged keys to sign all records, not just the DNSKEY RRset.
|
||||
(This is similar to the ``update-check-ksk no;`` zone option in
|
||||
``named``.)
|
||||
|
||||
``-3 salt``
|
||||
This option generates an NSEC3 chain with the given hex-encoded salt. A dash
|
||||
(-) can be used to indicate that no salt is to be used when
|
||||
**-3** salt
|
||||
Generate an NSEC3 chain with the given hex encoded salt. A dash
|
||||
(salt) can be used to indicate that no salt is to be used when
|
||||
generating the NSEC3 chain.
|
||||
|
||||
``-H iterations``
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should use this many iterations. The default
|
||||
**-H** iterations
|
||||
When generating an NSEC3 chain, use this many iterations. The default
|
||||
is 10.
|
||||
|
||||
``-A``
|
||||
This option indicates that, when generating an NSEC3 chain, BIND 9 should set the OPTOUT flag on all NSEC3
|
||||
records and should not generate NSEC3 records for insecure delegations.
|
||||
**-A**
|
||||
When generating an NSEC3 chain set the OPTOUT flag on all NSEC3
|
||||
records and do not generate NSEC3 records for insecure delegations.
|
||||
|
||||
Using this option twice (i.e., ``-AA``) turns the OPTOUT flag off for
|
||||
all records. This is useful when using the ``-u`` option to modify an
|
||||
NSEC3 chain which previously had OPTOUT set.
|
||||
|
||||
``zonefile``
|
||||
This option sets the file containing the zone to be signed.
|
||||
**zonefile**
|
||||
The file containing the zone to be signed.
|
||||
|
||||
``key``
|
||||
This option specifies which keys should be used to sign the zone. If no keys are
|
||||
specified, the zone is examined for DNSKEY records at the
|
||||
zone apex. If these records are found and there are matching private keys in
|
||||
the current directory, they are used for signing.
|
||||
**key**
|
||||
Specify which keys should be used to sign the zone. If no keys are
|
||||
specified, then the zone will be examined for DNSKEY records at the
|
||||
zone apex. If these are found and there are matching private keys, in
|
||||
the current directory, then these will be used for signing.
|
||||
|
||||
Example
|
||||
~~~~~~~
|
||||
|
||||
The following command signs the ``example.com`` zone with the
|
||||
ECDSAP256SHA256 key generated by ``dnssec-keygen``
|
||||
ECDSAP256SHA256 key generated by key generated by ``dnssec-keygen``
|
||||
(Kexample.com.+013+17247). Because the ``-S`` option is not being used,
|
||||
the zone's keys must be in the master file (``db.example.com``). This
|
||||
invocation looks for ``dsset`` files in the current directory, so that
|
||||
invocation looks for ``dsset`` files, in the current directory, so that
|
||||
DS records can be imported from them (``-g``).
|
||||
|
||||
::
|
||||
@@ -378,7 +373,7 @@ DS records can be imported from them (``-g``).
|
||||
|
||||
In the above example, ``dnssec-signzone`` creates the file
|
||||
``db.example.com.signed``. This file should be referenced in a zone
|
||||
statement in the ``named.conf`` file.
|
||||
statement in a ``named.conf`` file.
|
||||
|
||||
This example re-signs a previously signed zone with default parameters.
|
||||
The private keys are assumed to be in the current directory.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -81,13 +81,10 @@ static bool keyset_kskonly = false;
|
||||
static void
|
||||
report(const char *format, ...) {
|
||||
if (!quiet) {
|
||||
char buf[4096];
|
||||
va_list args;
|
||||
|
||||
va_start(args, format);
|
||||
vsnprintf(buf, sizeof(buf), format, args);
|
||||
vfprintf(stdout, format, args);
|
||||
va_end(args);
|
||||
fprintf(stdout, "%s\n", buf);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
|
||||
See the COPYRIGHT file distributed with this work for additional
|
||||
information regarding copyright ownership.
|
||||
@@ -35,72 +35,72 @@ Description
|
||||
~~~~~~~~~~~
|
||||
|
||||
``dnssec-verify`` verifies that a zone is fully signed for each
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the
|
||||
NSEC/NSEC3 chains are complete.
|
||||
algorithm found in the DNSKEY RRset for the zone, and that the NSEC /
|
||||
NSEC3 chains are complete.
|
||||
|
||||
Options
|
||||
~~~~~~~
|
||||
|
||||
``-c class``
|
||||
This option specifies the DNS class of the zone.
|
||||
**-c** class
|
||||
Specifies the DNS class of the zone.
|
||||
|
||||
``-E engine``
|
||||
This option specifies the cryptographic hardware to use, when applicable.
|
||||
**-E** engine
|
||||
Specifies the cryptographic hardware to use, when applicable.
|
||||
|
||||
When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
|
||||
engine identifier that drives the cryptographic accelerator or
|
||||
hardware service module (usually ``pkcs11``). When BIND is
|
||||
built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
|
||||
When BIND is built with OpenSSL PKCS#11 support, this defaults to the
|
||||
string "pkcs11", which identifies an OpenSSL engine that can drive a
|
||||
cryptographic accelerator or hardware service module. When BIND is
|
||||
built with native PKCS#11 cryptography (--enable-native-pkcs11), it
|
||||
defaults to the path of the PKCS#11 provider library specified via
|
||||
``--with-pkcs11``.
|
||||
"--with-pkcs11".
|
||||
|
||||
``-I input-format``
|
||||
This option sets the format of the input zone file. Possible formats are ``text``
|
||||
(the default) and ``raw``. This option is primarily intended to be used
|
||||
for dynamic signed zones, so that the dumped zone file in a non-text
|
||||
format containing updates can be verified independently.
|
||||
This option is not useful for non-dynamic zones.
|
||||
**-I** input-format
|
||||
The format of the input zone file. Possible formats are ``"text"``
|
||||
(default) and ``"raw"``. This option is primarily intended to be used
|
||||
for dynamic signed zones so that the dumped zone file in a non-text
|
||||
format containing updates can be verified independently. The use of
|
||||
this option does not make much sense for non-dynamic zones.
|
||||
|
||||
``-o origin``
|
||||
This option indicates the zone origin. If not specified, the name of the zone file is
|
||||
**-o** origin
|
||||
The zone origin. If not specified, the name of the zone file is
|
||||
assumed to be the origin.
|
||||
|
||||
``-v level``
|
||||
This option sets the debugging level.
|
||||
**-v** level
|
||||
Sets the debugging level.
|
||||
|
||||
``-V``
|
||||
This option prints version information.
|
||||
**-V**
|
||||
Prints version information.
|
||||
|
||||
``-q``
|
||||
This option sets quiet mode, which suppresses output. Without this option, when ``dnssec-verify``
|
||||
is run it prints to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly, and other status
|
||||
information. With this option, all non-error output is suppressed, and only the exit
|
||||
code indicates success.
|
||||
Quiet mode: Suppresses output. Without this option, when ``dnssec-verify``
|
||||
is run it will print to standard output the number of keys in use, the
|
||||
algorithms used to verify the zone was signed correctly and other status
|
||||
information. With it, all non-error output is suppressed, and only the exit
|
||||
code will indicate success.
|
||||
|
||||
``-x``
|
||||
This option verifies only that the DNSKEY RRset is signed with key-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset is signed
|
||||
by all active keys. When this flag is set, it is not an error if
|
||||
**-x**
|
||||
Only verify that the DNSKEY RRset is signed with key-signing keys.
|
||||
Without this flag, it is assumed that the DNSKEY RRset will be signed
|
||||
by all active keys. When this flag is set, it will not be an error if
|
||||
the DNSKEY RRset is not signed by zone-signing keys. This corresponds
|
||||
to the ``-x`` option in ``dnssec-signzone``.
|
||||
|
||||
``-z``
|
||||
This option indicates that the KSK flag on the keys should be ignored when determining whether the zone is
|
||||
correctly signed. Without this flag, it is assumed that there is
|
||||
**-z**
|
||||
Ignore the KSK flag on the keys when determining whether the zone if
|
||||
correctly signed. Without this flag it is assumed that there will be
|
||||
a non-revoked, self-signed DNSKEY with the KSK flag set for each
|
||||
algorithm, and that RRsets other than DNSKEY RRset are signed with
|
||||
algorithm and that RRsets other than DNSKEY RRset will be signed with
|
||||
a different DNSKEY without the KSK flag set.
|
||||
|
||||
With this flag set, BIND 9 only requires that for each algorithm, there
|
||||
be at least one non-revoked, self-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets be signed by a
|
||||
With this flag set, we only require that for each algorithm, there
|
||||
will be at least one non-revoked, self-signed DNSKEY, regardless of
|
||||
the KSK flag state, and that other RRsets will be signed by a
|
||||
non-revoked key for the same algorithm that includes the self-signed
|
||||
key; the same key may be used for both purposes. This corresponds to
|
||||
the ``-z`` option in ``dnssec-signzone``.
|
||||
|
||||
``zonefile``
|
||||
This option indicates the file containing the zone to be signed.
|
||||
**zonefile**
|
||||
The file containing the zone to be signed.
|
||||
|
||||
See Also
|
||||
~~~~~~~~
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -276,7 +276,7 @@ strtokeystate(const char *str) {
|
||||
return ((dst_key_state_t)i);
|
||||
}
|
||||
}
|
||||
fatal("unknown key state %s", str);
|
||||
fatal("unknown key state");
|
||||
}
|
||||
|
||||
isc_stdtime_t
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -42,13 +42,9 @@ extern uint8_t dtype[8];
|
||||
|
||||
typedef void(fatalcallback_t)(void);
|
||||
|
||||
#ifndef CPPCHECK
|
||||
ISC_PLATFORM_NORETURN_PRE void
|
||||
fatal(const char *format, ...)
|
||||
ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;
|
||||
#else /* CPPCHECK */
|
||||
#define fatal(...) exit(1)
|
||||
#endif
|
||||
|
||||
void
|
||||
setfatalcallback(fatalcallback_t *callback);
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
@IF PYTHON
|
||||
<PostBuildEvent>
|
||||
@@ -122,7 +122,7 @@ set PYTHONPATH=.
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
@IF PYTHON
|
||||
<PostBuildEvent>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
@@ -109,7 +109,7 @@
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
|
||||
@@ -76,7 +76,7 @@
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
@@ -108,7 +108,7 @@
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
@@ -49,7 +49,6 @@ CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${DBDRIVER_INCLUDES} \
|
||||
${LIBUV_CFLAGS} \
|
||||
${FSTRM_CFLAGS} \
|
||||
${LMDB_CFLAGS} \
|
||||
${OPENSSL_CFLAGS} \
|
||||
${PROTOBUF_C_CFLAGS} \
|
||||
${JSON_C_CFLAGS} \
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
- file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
- file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
-
|
||||
- See the COPYRIGHT file distributed with this work for additional
|
||||
- information regarding copyright ownership.
|
||||
|
||||
@@ -11,7 +11,7 @@ static char xslmsg[] =
|
||||
"Public\n"
|
||||
" - License, v. 2.0. If a copy of the MPL was not distributed with "
|
||||
"this\n"
|
||||
" - file, you can obtain one at https://mozilla.org/MPL/2.0/.\n"
|
||||
" - file, You can obtain one at http://mozilla.org/MPL/2.0/.\n"
|
||||
" -\n"
|
||||
" - See the COPYRIGHT file distributed with this work for additional\n"
|
||||
" - information regarding copyright ownership.\n"
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+86
-98
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -48,38 +48,44 @@ options {\n\
|
||||
answer-cookie true;\n\
|
||||
automatic-interface-scan yes;\n\
|
||||
bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
|
||||
# blackhole {none;};\n\
|
||||
cookie-algorithm siphash24;\n"
|
||||
# blackhole {none;};\n"
|
||||
" cookie-algorithm siphash24;\n"
|
||||
#ifndef WIN32
|
||||
" coresize default;\n\
|
||||
datasize default;\n"
|
||||
#endif /* ifndef WIN32 */
|
||||
"\
|
||||
# deallocate-on-exit <obsolete>;\n\
|
||||
# directory <none>\n\
|
||||
dnssec-policy \"none\";\n\
|
||||
dump-file \"named_dump.db\";\n\
|
||||
edns-udp-size 1232;\n"
|
||||
edns-udp-size 4096;\n\
|
||||
# fake-iquery <obsolete>;\n"
|
||||
#ifndef WIN32
|
||||
" files unlimited;\n"
|
||||
#endif /* ifndef WIN32 */
|
||||
#if defined(HAVE_GEOIP2) && !defined(WIN32)
|
||||
" geoip-directory \"" MAXMINDDB_PREFIX
|
||||
"/share/GeoIP\";\n"
|
||||
" geoip-directory \"" MAXMINDDB_PREFIX "/share/"
|
||||
"GeoIP\";"
|
||||
"\n"
|
||||
#elif defined(HAVE_GEOIP2)
|
||||
" geoip-directory \".\";\n"
|
||||
#endif /* if defined(HAVE_GEOIP2) && !defined(WIN32) */
|
||||
"\
|
||||
# has-old-clients <obsolete>;\n\
|
||||
heartbeat-interval 60;\n\
|
||||
# host-statistics <obsolete>;\n\
|
||||
interface-interval 60;\n\
|
||||
# keep-response-order {none;};\n\
|
||||
listen-on {any;};\n\
|
||||
listen-on-v6 {any;};\n\
|
||||
# lock-file \"" NAMED_LOCALSTATEDIR "/run/named/named.lock\";\n\
|
||||
match-mapped-addresses no;\n\
|
||||
max-ixfr-ratio unlimited;\n\
|
||||
max-rsa-exponent-size 0; /* no limit */\n\
|
||||
max-udp-size 1232;\n\
|
||||
max-udp-size 4096;\n\
|
||||
memstatistics-file \"named.memstats\";\n\
|
||||
# multiple-cnames <obsolete>;\n\
|
||||
# named-xfer <obsolete>;\n\
|
||||
nocookie-udp-size 4096;\n\
|
||||
notify-rate 20;\n\
|
||||
nta-lifetime 3600;\n\
|
||||
@@ -95,6 +101,7 @@ options {\n\
|
||||
rrset-order { order random; };\n\
|
||||
secroots-file \"named.secroots\";\n\
|
||||
send-cookie true;\n\
|
||||
# serial-queries <obsolete>;\n\
|
||||
serial-query-rate 20;\n\
|
||||
server-id none;\n\
|
||||
session-keyalg hmac-sha256;\n\
|
||||
@@ -105,6 +112,7 @@ options {\n\
|
||||
#endif /* ifndef WIN32 */
|
||||
" startup-notify-rate 20;\n\
|
||||
statistics-file \"named.stats\";\n\
|
||||
# statistics-interval <obsolete>;\n\
|
||||
tcp-advertised-timeout 300;\n\
|
||||
tcp-clients 150;\n\
|
||||
tcp-idle-timeout 300;\n\
|
||||
@@ -118,7 +126,10 @@ options {\n\
|
||||
transfers-in 10;\n\
|
||||
transfers-out 10;\n\
|
||||
transfers-per-ns 2;\n\
|
||||
# treat-cr-as-space <obsolete>;\n\
|
||||
trust-anchor-telemetry yes;\n\
|
||||
# use-id-pool <obsolete>;\n\
|
||||
# use-ixfr <obsolete>;\n\
|
||||
\n\
|
||||
/* view */\n\
|
||||
allow-new-zones no;\n\
|
||||
@@ -128,12 +139,13 @@ options {\n\
|
||||
allow-recursion { localnets; localhost; };\n\
|
||||
allow-recursion-on { any; };\n\
|
||||
allow-update-forwarding {none;};\n\
|
||||
# allow-v6-synthesis <obsolete>;\n\
|
||||
auth-nxdomain false;\n\
|
||||
check-dup-records warn;\n\
|
||||
check-mx warn;\n\
|
||||
check-names primary fail;\n\
|
||||
check-names master fail;\n\
|
||||
check-names response ignore;\n\
|
||||
check-names secondary warn;\n\
|
||||
check-names slave warn;\n\
|
||||
check-spf warn;\n\
|
||||
clients-per-query 10;\n\
|
||||
dnssec-accept-expired no;\n\
|
||||
@@ -142,11 +154,12 @@ options {\n\
|
||||
" dnstap-identity hostname;\n"
|
||||
#endif /* ifdef HAVE_DNSTAP */
|
||||
"\
|
||||
# fetch-glue <obsolete>;\n\
|
||||
fetch-quota-params 100 0.1 0.3 0.7;\n\
|
||||
fetches-per-server 0;\n\
|
||||
fetches-per-zone 0;\n\
|
||||
glue-cache yes;\n\
|
||||
lame-ttl 0;\n"
|
||||
lame-ttl 600;\n"
|
||||
#ifdef HAVE_LMDB
|
||||
" lmdb-mapsize 32M;\n"
|
||||
#endif /* ifdef HAVE_LMDB */
|
||||
@@ -155,18 +168,17 @@ options {\n\
|
||||
max-clients-per-query 100;\n\
|
||||
max-ncache-ttl 10800; /* 3 hours */\n\
|
||||
max-recursion-depth 7;\n\
|
||||
max-recursion-queries 100;\n\
|
||||
max-stale-ttl 86400; /* 1 day */\n\
|
||||
max-recursion-queries 75;\n\
|
||||
max-stale-ttl 43200; /* 12 hours */\n\
|
||||
message-compression yes;\n\
|
||||
min-ncache-ttl 0; /* 0 hours */\n\
|
||||
min-cache-ttl 0; /* 0 seconds */\n\
|
||||
# min-roots <obsolete>;\n\
|
||||
minimal-any false;\n\
|
||||
minimal-responses no-auth-recursive;\n\
|
||||
notify-source *;\n\
|
||||
notify-source-v6 *;\n\
|
||||
nsec3-test-zone no;\n\
|
||||
parental-source *;\n\
|
||||
parental-source-v6 *;\n\
|
||||
provide-ixfr true;\n\
|
||||
qname-minimization relaxed;\n\
|
||||
query-source address *;\n\
|
||||
@@ -177,14 +189,13 @@ options {\n\
|
||||
require-server-cookie no;\n\
|
||||
resolver-nonbackoff-tries 3;\n\
|
||||
resolver-retry-interval 800; /* in milliseconds */\n\
|
||||
# rfc2308-type1 <obsolete>;\n\
|
||||
root-key-sentinel yes;\n\
|
||||
servfail-ttl 1;\n\
|
||||
# sortlist <none>\n\
|
||||
stale-answer-client-timeout off;\n\
|
||||
stale-answer-enable false;\n\
|
||||
stale-answer-ttl 30; /* 30 seconds */\n\
|
||||
stale-answer-ttl 1; /* 1 second */\n\
|
||||
stale-cache-enable true;\n\
|
||||
stale-refresh-time 30; /* 30 seconds */\n\
|
||||
synth-from-dnssec no;\n\
|
||||
# topology <none>\n\
|
||||
transfer-format many-answers;\n\
|
||||
@@ -210,8 +221,10 @@ options {\n\
|
||||
dnssec-update-mode maintain;\n\
|
||||
# forward <none>\n\
|
||||
# forwarders <none>\n\
|
||||
# inline-signing no;\n\
|
||||
inline-signing no;\n\
|
||||
ixfr-from-differences false;\n\
|
||||
# maintain-ixfr-base <obsolete>;\n\
|
||||
# max-ixfr-log-size <obsolete>\n\
|
||||
max-journal-size default;\n\
|
||||
max-records 0;\n\
|
||||
max-refresh-time 2419200; /* 4 weeks */\n\
|
||||
@@ -248,7 +261,6 @@ view \"_bind\" chaos {\n\
|
||||
recursion no;\n\
|
||||
notify no;\n\
|
||||
allow-new-zones no;\n\
|
||||
max-cache-size 2M;\n\
|
||||
\n\
|
||||
# Prevent use of this zone in DNS amplified reflection DoS attacks\n\
|
||||
rate-limit {\n\
|
||||
@@ -258,22 +270,22 @@ view \"_bind\" chaos {\n\
|
||||
};\n\
|
||||
\n\
|
||||
zone \"version.bind\" chaos {\n\
|
||||
type primary;\n\
|
||||
type master;\n\
|
||||
database \"_builtin version\";\n\
|
||||
};\n\
|
||||
\n\
|
||||
zone \"hostname.bind\" chaos {\n\
|
||||
type primary;\n\
|
||||
type master;\n\
|
||||
database \"_builtin hostname\";\n\
|
||||
};\n\
|
||||
\n\
|
||||
zone \"authors.bind\" chaos {\n\
|
||||
type primary;\n\
|
||||
type master;\n\
|
||||
database \"_builtin authors\";\n\
|
||||
};\n\
|
||||
\n\
|
||||
zone \"id.server\" chaos {\n\
|
||||
type primary;\n\
|
||||
type master;\n\
|
||||
database \"_builtin id\";\n\
|
||||
};\n\
|
||||
};\n\
|
||||
@@ -281,24 +293,22 @@ view \"_bind\" chaos {\n\
|
||||
"#\n\
|
||||
# Default trusted key(s), used if \n\
|
||||
# \"dnssec-validation auto;\" is set and\n\
|
||||
# " NAMED_SYSCONFDIR "/bind.keys doesn't exist).\n\
|
||||
# sysconfdir/bind.keys doesn't exist).\n\
|
||||
#\n\
|
||||
# BEGIN TRUST ANCHORS\n"
|
||||
# BEGIN DNSSEC KEYS\n"
|
||||
|
||||
/* Imported from bind.keys.h: */
|
||||
TRUST_ANCHORS
|
||||
|
||||
"# END TRUST ANCHORS\n\
|
||||
"# END MANAGED KEYS\n\
|
||||
\n\
|
||||
primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
|
||||
2001:500:200::b; # b.root-servers.net\n\
|
||||
2001:500:2::c; # c.root-servers.net\n\
|
||||
masters " DEFAULT_IANA_ROOT_ZONE_MASTERS " {\n\
|
||||
2001:500:84::b; # b.root-servers.net\n\
|
||||
2001:500:2f::f; # f.root-servers.net\n\
|
||||
2001:500:12::d0d; # g.root-servers.net\n\
|
||||
2001:7fd::1; # k.root-servers.net\n\
|
||||
2620:0:2830:202::132; # xfr.cjr.dns.icann.org\n\
|
||||
2620:0:2d0:202::132; # xfr.lax.dns.icann.org\n\
|
||||
199.9.14.201; # b.root-servers.net\n\
|
||||
192.228.79.201; # b.root-servers.net\n\
|
||||
192.33.4.12; # c.root-servers.net\n\
|
||||
192.5.5.241; # f.root-servers.net\n\
|
||||
192.112.36.4; # g.root-servers.net\n\
|
||||
@@ -323,16 +333,18 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,
|
||||
const cfg_obj_t **obj) {
|
||||
int i;
|
||||
|
||||
for (i = 0; maps[i] != NULL; i++) {
|
||||
for (i = 0;; i++) {
|
||||
if (maps[i] == NULL) {
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
}
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_checknames_get(const cfg_obj_t **maps, const char *const names[],
|
||||
named_checknames_get(const cfg_obj_t **maps, const char *which,
|
||||
const cfg_obj_t **obj) {
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *checknames;
|
||||
@@ -341,10 +353,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
|
||||
int i;
|
||||
|
||||
REQUIRE(maps != NULL);
|
||||
REQUIRE(names != NULL);
|
||||
REQUIRE(which != NULL);
|
||||
REQUIRE(obj != NULL && *obj == NULL);
|
||||
|
||||
for (i = 0; maps[i] != NULL; i++) {
|
||||
for (i = 0;; i++) {
|
||||
if (maps[i] == NULL) {
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
checknames = NULL;
|
||||
if (cfg_map_get(maps[i], "check-names", &checknames) ==
|
||||
ISC_R_SUCCESS) {
|
||||
@@ -360,19 +375,14 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
|
||||
{
|
||||
value = cfg_listelt_value(element);
|
||||
type = cfg_tuple_get(value, "type");
|
||||
|
||||
for (size_t j = 0; names[j] != NULL; j++) {
|
||||
if (strcasecmp(cfg_obj_asstring(type),
|
||||
names[j]) == 0) {
|
||||
*obj = cfg_tuple_get(value,
|
||||
"mode");
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
if (strcasecmp(cfg_obj_asstring(type), which) ==
|
||||
0) {
|
||||
*obj = cfg_tuple_get(value, "mode");
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
int
|
||||
@@ -434,10 +444,10 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
|
||||
|
||||
str = cfg_obj_asstring(zonetypeobj);
|
||||
if (strcasecmp(str, "primary") == 0 || strcasecmp(str, "master") == 0) {
|
||||
ztype = dns_zone_primary;
|
||||
ztype = dns_zone_master;
|
||||
} else if (strcasecmp(str, "secondary") == 0 ||
|
||||
strcasecmp(str, "slave") == 0) {
|
||||
ztype = dns_zone_secondary;
|
||||
ztype = dns_zone_slave;
|
||||
} else if (strcasecmp(str, "mirror") == 0) {
|
||||
ztype = dns_zone_mirror;
|
||||
} else if (strcasecmp(str, "stub") == 0) {
|
||||
@@ -556,55 +566,36 @@ named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
}
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
|
||||
const cfg_obj_t **ret) {
|
||||
isc_result_t
|
||||
named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
|
||||
const cfg_obj_t **ret) {
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
const cfg_obj_t *masters = NULL;
|
||||
const cfg_listelt_t *elt;
|
||||
|
||||
REQUIRE(cctx != NULL);
|
||||
REQUIRE(name != NULL);
|
||||
REQUIRE(ret != NULL && *ret == NULL);
|
||||
|
||||
result = cfg_map_get(cctx, list, &obj);
|
||||
result = cfg_map_get(cctx, "masters", &masters);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
elt = cfg_list_first(obj);
|
||||
while (elt != NULL) {
|
||||
obj = cfg_listelt_value(elt);
|
||||
if (strcasecmp(cfg_obj_asstring(cfg_tuple_get(obj, "name")),
|
||||
name) == 0) {
|
||||
*ret = obj;
|
||||
for (elt = cfg_list_first(masters); elt != NULL;
|
||||
elt = cfg_list_next(elt)) {
|
||||
const cfg_obj_t *list;
|
||||
const char *listname;
|
||||
|
||||
list = cfg_listelt_value(elt);
|
||||
listname = cfg_obj_asstring(cfg_tuple_get(list, "name"));
|
||||
|
||||
if (strcasecmp(listname, name) == 0) {
|
||||
*ret = list;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
elt = cfg_list_next(elt);
|
||||
}
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
|
||||
const char *name, const cfg_obj_t **ret) {
|
||||
isc_result_t result;
|
||||
|
||||
if (strcmp(list, "parental-agents") == 0) {
|
||||
return (getremotesdef(cctx, list, name, ret));
|
||||
} else if (strcmp(list, "primaries") == 0) {
|
||||
result = getremotesdef(cctx, list, name, ret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
result = getremotesdef(cctx, "masters", name, ret);
|
||||
}
|
||||
return (result);
|
||||
}
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
|
||||
const cfg_obj_t *list, isc_mem_t *mctx,
|
||||
dns_ipkeylist_t *ipkl) {
|
||||
named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
|
||||
uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
|
||||
uint32_t listcount = 0, l = 0, j;
|
||||
uint32_t stackcount = 0, pushed = 0;
|
||||
@@ -687,7 +678,7 @@ resume:
|
||||
isc_buffer_t b;
|
||||
|
||||
addr = cfg_tuple_get(cfg_listelt_value(element),
|
||||
"remoteselement");
|
||||
"masterselement");
|
||||
key = cfg_tuple_get(cfg_listelt_value(element), "key");
|
||||
|
||||
if (!cfg_obj_issockaddr(addr)) {
|
||||
@@ -719,12 +710,11 @@ resume:
|
||||
if (j < l) {
|
||||
continue;
|
||||
}
|
||||
list = NULL;
|
||||
tresult = named_config_getremotesdef(config, listtype,
|
||||
listname, &list);
|
||||
tresult = named_config_getmastersdef(config, listname,
|
||||
&list);
|
||||
if (tresult == ISC_R_NOTFOUND) {
|
||||
cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
|
||||
"%s \"%s\" not found", listtype,
|
||||
"masters \"%s\" not found",
|
||||
listname);
|
||||
|
||||
result = tresult;
|
||||
@@ -975,15 +965,13 @@ named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {
|
||||
|
||||
struct keyalgorithms {
|
||||
const char *str;
|
||||
enum {
|
||||
hmacnone,
|
||||
hmacmd5,
|
||||
hmacsha1,
|
||||
hmacsha224,
|
||||
hmacsha256,
|
||||
hmacsha384,
|
||||
hmacsha512
|
||||
} hmac;
|
||||
enum { hmacnone,
|
||||
hmacmd5,
|
||||
hmacsha1,
|
||||
hmacsha224,
|
||||
hmacsha256,
|
||||
hmacsha384,
|
||||
hmacsha512 } hmac;
|
||||
unsigned int type;
|
||||
uint16_t size;
|
||||
} algorithms[] = { { "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+11
-18
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -19,7 +19,6 @@
|
||||
#include <isc/event.h>
|
||||
#include <isc/file.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/mutex.h>
|
||||
#include <isc/net.h>
|
||||
#include <isc/netaddr.h>
|
||||
#include <isc/nonce.h>
|
||||
@@ -107,7 +106,6 @@ struct named_controls {
|
||||
named_server_t *server;
|
||||
controllistenerlist_t listeners;
|
||||
bool shuttingdown;
|
||||
isc_mutex_t symtab_lock;
|
||||
isccc_symtab_t *symtab;
|
||||
};
|
||||
|
||||
@@ -392,6 +390,10 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
|
||||
break;
|
||||
}
|
||||
isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
|
||||
if (result != ISCCC_R_BADAUTH) {
|
||||
log_invalid(&conn->ccmsg, result);
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
|
||||
if (key == NULL) {
|
||||
@@ -438,10 +440,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
|
||||
/*
|
||||
* Duplicate suppression (required for UDP).
|
||||
*/
|
||||
LOCK(&listener->controls->symtab_lock);
|
||||
isccc_cc_cleansymtab(listener->controls->symtab, now);
|
||||
result = isccc_cc_checkdup(listener->controls->symtab, request, now);
|
||||
UNLOCK(&listener->controls->symtab_lock);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
if (result == ISC_R_EXISTS) {
|
||||
result = ISCCC_R_DUPLICATE;
|
||||
@@ -1522,19 +1522,15 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
|
||||
isc_result_t result;
|
||||
named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));
|
||||
|
||||
*controls = (named_controls_t){
|
||||
.server = server,
|
||||
};
|
||||
|
||||
if (controls == NULL) {
|
||||
return (ISC_R_NOMEMORY);
|
||||
}
|
||||
controls->server = server;
|
||||
ISC_LIST_INIT(controls->listeners);
|
||||
|
||||
isc_mutex_init(&controls->symtab_lock);
|
||||
LOCK(&controls->symtab_lock);
|
||||
controls->shuttingdown = false;
|
||||
controls->symtab = NULL;
|
||||
result = isccc_cc_createsymtab(&controls->symtab);
|
||||
UNLOCK(&controls->symtab_lock);
|
||||
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
isc_mutex_destroy(&controls->symtab_lock);
|
||||
isc_mem_put(server->mctx, controls, sizeof(*controls));
|
||||
return (result);
|
||||
}
|
||||
@@ -1549,9 +1545,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {
|
||||
|
||||
REQUIRE(ISC_LIST_EMPTY(controls->listeners));
|
||||
|
||||
LOCK(&controls->symtab_lock);
|
||||
isccc_symtab_destroy(&controls->symtab);
|
||||
UNLOCK(&controls->symtab_lock);
|
||||
isc_mutex_destroy(&controls->symtab_lock);
|
||||
isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
|
||||
}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -21,7 +21,7 @@
|
||||
|
||||
#include <isccfg/cfg.h>
|
||||
|
||||
#define DEFAULT_IANA_ROOT_ZONE_PRIMARIES "_default_iana_root_zone_primaries"
|
||||
#define DEFAULT_IANA_ROOT_ZONE_MASTERS "_default_iana_root_zone_masters"
|
||||
|
||||
isc_result_t
|
||||
named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
|
||||
@@ -31,7 +31,7 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,
|
||||
const cfg_obj_t **obj);
|
||||
|
||||
isc_result_t
|
||||
named_checknames_get(const cfg_obj_t **maps, const char *const names[],
|
||||
named_checknames_get(const cfg_obj_t **maps, const char *name,
|
||||
const cfg_obj_t **obj);
|
||||
|
||||
int
|
||||
@@ -59,13 +59,12 @@ named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
isc_dscp_t **dscpsp, uint32_t count);
|
||||
|
||||
isc_result_t
|
||||
named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
|
||||
const char *name, const cfg_obj_t **ret);
|
||||
named_config_getmastersdef(const cfg_obj_t *cctx, const char *name,
|
||||
const cfg_obj_t **ret);
|
||||
|
||||
isc_result_t
|
||||
named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
|
||||
const cfg_obj_t *list, isc_mem_t *mctx,
|
||||
dns_ipkeylist_t *ipkl);
|
||||
named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
|
||||
|
||||
isc_result_t
|
||||
named_config_getport(const cfg_obj_t *config, in_port_t *portp);
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
@@ -45,10 +45,10 @@
|
||||
#define NAMED_RUN_PID_DIR 1
|
||||
#endif /* ifndef NAMED_RUN_PID_DIR */
|
||||
|
||||
EXTERN isc_mem_t *named_g_mctx INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus INIT(0);
|
||||
EXTERN unsigned int named_g_udpdisp INIT(0);
|
||||
EXTERN isc_taskmgr_t *named_g_taskmgr INIT(NULL);
|
||||
EXTERN isc_mem_t *named_g_mctx INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus INIT(0);
|
||||
EXTERN unsigned int named_g_udpdisp INIT(0);
|
||||
EXTERN isc_taskmgr_t *named_g_taskmgr INIT(NULL);
|
||||
EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
|
||||
EXTERN unsigned int named_g_cpus_detected INIT(1);
|
||||
|
||||
@@ -60,42 +60,42 @@ EXTERN bool named_g_run_done INIT(false);
|
||||
* for really short timers, another for client timers, and one
|
||||
* for zone timers.
|
||||
*/
|
||||
EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
|
||||
EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
|
||||
EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
|
||||
EXTERN isc_nm_t *named_g_nm INIT(NULL);
|
||||
EXTERN cfg_parser_t *named_g_parser INIT(NULL);
|
||||
EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
|
||||
EXTERN const char *named_g_version INIT(VERSION);
|
||||
EXTERN const char *named_g_product INIT(PRODUCT);
|
||||
EXTERN const char *named_g_description INIT(DESCRIPTION);
|
||||
EXTERN const char *named_g_srcid INIT(SRCID);
|
||||
EXTERN const char *named_g_configargs INIT(CONFIGARGS);
|
||||
EXTERN const char *named_g_builder INIT(BUILDER);
|
||||
EXTERN in_port_t named_g_port INIT(0);
|
||||
EXTERN isc_dscp_t named_g_dscp INIT(-1);
|
||||
EXTERN isc_nm_t *named_g_nm INIT(NULL);
|
||||
EXTERN cfg_parser_t *named_g_parser INIT(NULL);
|
||||
EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
|
||||
EXTERN const char *named_g_version INIT(VERSION);
|
||||
EXTERN const char *named_g_product INIT(PRODUCT);
|
||||
EXTERN const char *named_g_description INIT(DESCRIPTION);
|
||||
EXTERN const char *named_g_srcid INIT(SRCID);
|
||||
EXTERN const char *named_g_configargs INIT(CONFIGARGS);
|
||||
EXTERN const char *named_g_builder INIT(BUILDER);
|
||||
EXTERN in_port_t named_g_port INIT(0);
|
||||
EXTERN isc_dscp_t named_g_dscp INIT(-1);
|
||||
|
||||
EXTERN named_server_t *named_g_server INIT(NULL);
|
||||
|
||||
/*
|
||||
* Logging.
|
||||
*/
|
||||
EXTERN isc_log_t *named_g_lctx INIT(NULL);
|
||||
EXTERN isc_log_t *named_g_lctx INIT(NULL);
|
||||
EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
|
||||
EXTERN isc_logmodule_t *named_g_modules INIT(NULL);
|
||||
EXTERN unsigned int named_g_debuglevel INIT(0);
|
||||
EXTERN isc_logmodule_t *named_g_modules INIT(NULL);
|
||||
EXTERN unsigned int named_g_debuglevel INIT(0);
|
||||
|
||||
/*
|
||||
* Current configuration information.
|
||||
*/
|
||||
EXTERN cfg_obj_t *named_g_config INIT(NULL);
|
||||
EXTERN cfg_obj_t *named_g_config INIT(NULL);
|
||||
EXTERN const cfg_obj_t *named_g_defaults INIT(NULL);
|
||||
EXTERN const char *named_g_conffile INIT(NAMED_SYSCONFDIR "/named.conf");
|
||||
EXTERN const char *named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR "/bind.keys");
|
||||
EXTERN const char *named_g_keyfile INIT(NAMED_SYSCONFDIR "/rndc.key");
|
||||
|
||||
EXTERN dns_tsigkey_t *named_g_sessionkey INIT(NULL);
|
||||
EXTERN dns_name_t named_g_sessionkeyname;
|
||||
EXTERN bool named_g_conffileset INIT(false);
|
||||
EXTERN dns_tsigkey_t *named_g_sessionkey INIT(NULL);
|
||||
EXTERN dns_name_t named_g_sessionkeyname;
|
||||
EXTERN bool named_g_conffileset INIT(false);
|
||||
EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);
|
||||
|
||||
/*
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user