Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
  Ondřej SurýandEvan Hunt
|
d7f4a59c28 | ||
 Ondřej SurýandMark Andrews
|
55e0c0e461 | ||
|
Mark Andrews
|
c8dd6c82a3 |
@@ -154,7 +154,6 @@ stages:
|
||||
misc:sid:amd64:
|
||||
<<: *precheck_job
|
||||
script:
|
||||
- sh util/check-ans-prereq.sh
|
||||
- sh util/checklibs.sh > checklibs.out
|
||||
- sh util/tabify-changes < CHANGES > CHANGES.tmp
|
||||
- diff -urNap CHANGES CHANGES.tmp
|
||||
|
||||
@@ -1,58 +1,3 @@
|
||||
--- 9.14.0rc1 released ---
|
||||
|
||||
5168. [bug] Do not crash on shutdown when RPZ fails to load. Also,
|
||||
keep previous version of the database if RPZ fails to
|
||||
load. [GL #813]
|
||||
|
||||
5167. [bug] nxdomain-redirect could sometimes lookup the wrong
|
||||
redirect name. [GL #892]
|
||||
|
||||
5166. [placeholder]
|
||||
|
||||
5165. [contrib] Removed SDB drivers from contrib; they're obsolete.
|
||||
[GL #428]
|
||||
|
||||
5164. [bug] Correct errno to result translation in dlz filesystem
|
||||
modules. [GL #884]
|
||||
|
||||
5163. [cleanup] Out-of-tree builds failed --enable-dnstap. [GL #836]
|
||||
|
||||
5162. [cleanup] Improve dnssec-keymgr manual. Thanks to Tony Finch.
|
||||
[GL !1518]
|
||||
|
||||
5161. [bug] Do not require the SEP bit to be set for mirror zone
|
||||
trust anchors. [GL #873]
|
||||
|
||||
5160. [contrib] Added DNAME support to the DLZ LDAP schema. Also
|
||||
fixed a compilation bug affecting several DLZ
|
||||
modules. [GL #872]
|
||||
|
||||
5159. [bug] dnssec-coverage was incorrectly ignoring
|
||||
names specified on the command line without
|
||||
trailing dots. [GL !1478]
|
||||
|
||||
5158. [protocol] Add support for AMTRELAY and ZONEMD. [GL #867]
|
||||
|
||||
5157. [bug] Nslookup now errors out if there are extra command
|
||||
line arguments. [GL #207]
|
||||
|
||||
5141. [security] Zone transfer controls for writable DLZ zones were
|
||||
not effective as the allowzonexfr method was not being
|
||||
called for such zones. (CVE-2019-6465) [GL #790]
|
||||
|
||||
5118. [security] Named could crash if it is managing a key with
|
||||
`managed-keys` and the authoritative zone is rolling
|
||||
the key to an unsupported algorithm. (CVE-2018-5745)
|
||||
[GL #780]
|
||||
|
||||
5110. [security] Named leaked memory if there were multiple Key Tag
|
||||
EDNS options present. (CVE-2018-5744) [GL #772]
|
||||
|
||||
--- 9.13.6 released ---
|
||||
|
||||
5156. [doc] Extended and refined the section of the ARM describing
|
||||
mirror zones. [GL #774]
|
||||
|
||||
5155. [func] "named -V" now outputs the default paths to
|
||||
named.conf, rndc.conf, bind.keys, and other
|
||||
files used or created by named and other tools, so
|
||||
@@ -108,6 +53,8 @@
|
||||
and "nsdname-enable" both now default to yes,
|
||||
regardless of compile-time settings. [GL #824]
|
||||
|
||||
5141. [placeholder]
|
||||
|
||||
5140. [bug] Don't immediately mark existing keys as inactive and
|
||||
deleted when running dnssec-keymgr for the first
|
||||
time. [GL #117]
|
||||
@@ -178,6 +125,8 @@
|
||||
|
||||
5119. [placeholder]
|
||||
|
||||
5118. [placeholder]
|
||||
|
||||
5117. [placeholder]
|
||||
|
||||
5116. [bug] Named/named-checkconf triggered a assertion when
|
||||
@@ -198,6 +147,8 @@
|
||||
5111. [bug] Occluded DNSKEY records could make it into the
|
||||
delegating NSEC/NSEC3 bitmap. [GL #742]
|
||||
|
||||
5110. [placeholder]
|
||||
|
||||
5109. [cleanup] Remove support for RSAMD5 algorithm. [GL #628]
|
||||
|
||||
--- 9.13.5 released ---
|
||||
|
||||
@@ -13,7 +13,7 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
Regularly tested platforms
|
||||
|
||||
As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
|
||||
As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
|
||||
* Debian 8, 9, 10
|
||||
@@ -51,7 +51,7 @@ Server 2012 R2, none of these are tested regularly by ISC.
|
||||
|
||||
Unsupported platforms
|
||||
|
||||
These are platforms on which BIND 9.14 is known not to build or run:
|
||||
These are platforms on which BIND 9.13 is known not to build or run:
|
||||
|
||||
* Platforms without at least OpenSSL 1.0.2
|
||||
* Windows 10 / x86
|
||||
|
||||
+2
-2
@@ -23,7 +23,7 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
### Regularly tested platforms
|
||||
|
||||
As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
|
||||
As of Jan 2019, BIND 9.13 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
|
||||
* Debian 8, 9, 10
|
||||
@@ -60,7 +60,7 @@ Server 2012 R2, none of these are tested regularly by ISC.
|
||||
|
||||
## Unsupported platforms
|
||||
|
||||
These are platforms on which BIND 9.14 is known *not* to build or run:
|
||||
These are platforms on which BIND 9.13 is known *not* to build or run:
|
||||
|
||||
* Platforms without at least OpenSSL 1.0.2
|
||||
* Windows 10 / x86
|
||||
|
||||
@@ -5,7 +5,7 @@ Contents
|
||||
1. Introduction
|
||||
2. Reporting bugs and getting help
|
||||
3. Contributing to BIND
|
||||
4. BIND 9.14 features
|
||||
4. BIND 9.13 features
|
||||
5. Building BIND
|
||||
6. macOS
|
||||
7. Dependencies
|
||||
@@ -100,19 +100,17 @@ If you prefer, you may also submit code by opening a GitLab Issue and
|
||||
including your patch as an attachment, preferably generated by git
|
||||
format-patch.
|
||||
|
||||
BIND 9.14 features
|
||||
BIND 9.13 features
|
||||
|
||||
BIND 9.14.0 is the first release from a new stable branch of BIND 9,
|
||||
incorporating all changes from the 9.13 development branch, updating the
|
||||
most recent stable branch, 9.12. These changes include:
|
||||
BIND 9.13 is the newest development branch of BIND 9. It includes a number
|
||||
of changes from BIND 9.12 and earlier releases. New features include:
|
||||
|
||||
* A new "plugin" mechanism has been added to allow query functionality
|
||||
to be extended using dynamically loadable libraries. The "filter-aaaa"
|
||||
feature has been removed from named and is now implemented as a
|
||||
plugin.
|
||||
* Socket and task code has been refactored to improve performance.
|
||||
* QNAME minimization, as described in RFC 7816, is now supported.
|
||||
* Socket and task code has been refactored to improve performance on
|
||||
most modern machines.
|
||||
* "Root key sentinel" support, enabling validating resolvers to indicate
|
||||
via a special query which trust anchors are configured for the root
|
||||
zone.
|
||||
@@ -125,8 +123,6 @@ most recent stable branch, 9.12. These changes include:
|
||||
which DNSSEC validation should not be performed.
|
||||
* The default value of "dnssec-validation" is now "auto".
|
||||
* IDNA2008 is now supported when linking with libidn2.
|
||||
* "named -V" now outputs the default paths for files used by named and
|
||||
other tools.
|
||||
|
||||
In addition, workarounds that were formerly in place to enable resolution
|
||||
of domains whose authoritative servers did not respond to EDNS queries
|
||||
@@ -140,8 +136,7 @@ is now mandatory: building BIND without DNSSEC is no longer supported.
|
||||
Special code to support certain legacy operating systems has also been
|
||||
removed; see the file PLATFORMS.md for details of supported platforms. In
|
||||
addition to OpenSSL, BIND now requires support for IPv6, threads, and
|
||||
standard atomic operations provided by the C compiler. Non-threaded builds
|
||||
are no longer supported.
|
||||
standard atomic operations provided by the C compiler.
|
||||
|
||||
Building BIND
|
||||
|
||||
|
||||
@@ -15,7 +15,7 @@
|
||||
1. [Introduction](#intro)
|
||||
1. [Reporting bugs and getting help](#help)
|
||||
1. [Contributing to BIND](#contrib)
|
||||
1. [BIND 9.14 features](#features)
|
||||
1. [BIND 9.13 features](#features)
|
||||
1. [Building BIND](#build)
|
||||
1. [macOS](#macos)
|
||||
1. [Dependencies](#dependencies)
|
||||
@@ -117,18 +117,17 @@ If you prefer, you may also submit code by opening a
|
||||
including your patch as an attachment, preferably generated by
|
||||
`git format-patch`.
|
||||
|
||||
### <a name="features"/> BIND 9.14 features
|
||||
### <a name="features"/> BIND 9.13 features
|
||||
|
||||
BIND 9.14.0 is the first release from a new stable branch of BIND 9,
|
||||
incorporating all changes from the 9.13 development branch, updating
|
||||
the most recent stable branch, 9.12. These changes include:
|
||||
BIND 9.13 is the newest development branch of BIND 9. It includes a
|
||||
number of changes from BIND 9.12 and earlier releases. New features
|
||||
include:
|
||||
|
||||
* A new "plugin" mechanism has been added to allow query functionality
|
||||
to be extended using dynamically loadable libraries. The "filter-aaaa"
|
||||
feature has been removed from named and is now implemented as a plugin.
|
||||
* Socket and task code has been refactored to improve performance.
|
||||
* QNAME minimization, as described in RFC 7816, is now supported.
|
||||
* Socket and task code has been refactored to improve performance on most
|
||||
modern machines.
|
||||
* "Root key sentinel" support, enabling validating resolvers to indicate
|
||||
via a special query which trust anchors are configured for the root zone.
|
||||
* Secondary zones can now be configured as "mirror" zones; their contents
|
||||
@@ -140,8 +139,6 @@ the most recent stable branch, 9.12. These changes include:
|
||||
DNSSEC validation should not be performed.
|
||||
* The default value of "dnssec-validation" is now "auto".
|
||||
* IDNA2008 is now supported when linking with `libidn2`.
|
||||
* "named -V" now outputs the default paths for files used by named
|
||||
and other tools.
|
||||
|
||||
In addition, workarounds that were formerly in place to enable resolution
|
||||
of domains whose authoritative servers did not respond to EDNS queries
|
||||
@@ -158,7 +155,7 @@ Special code to support certain legacy operating systems has also
|
||||
been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
|
||||
of supported platforms. In addition to OpenSSL, BIND now requires
|
||||
support for IPv6, threads, and standard atomic operations provided
|
||||
by the C compiler. Non-threaded builds are no longer supported.
|
||||
by the C compiler.
|
||||
|
||||
### <a name="build"/> Building BIND
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -143,5 +143,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -437,5 +437,5 @@ RFC5155\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -824,5 +824,5 @@ There are probably too many query options\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -269,5 +269,5 @@ runs\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -301,5 +301,5 @@ runs or when the standard output is not a tty\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+1
-21
@@ -879,29 +879,12 @@ get_next_command(void) {
|
||||
isc_mem_free(mctx, buf);
|
||||
}
|
||||
|
||||
ISC_PLATFORM_NORETURN_PRE static void
|
||||
usage(void) ISC_PLATFORM_NORETURN_POST;
|
||||
|
||||
static void
|
||||
usage(void) {
|
||||
fprintf(stderr, "Usage:\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] # interactive mode using default server\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] - server # interactive mode using 'server'\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] host # just look up 'host' using default server\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
parse_args(int argc, char **argv) {
|
||||
bool have_lookup = false;
|
||||
|
||||
usesearch = true;
|
||||
for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
|
||||
for (argc--, argv++; argc > 0; argc--, argv++) {
|
||||
debug("main parsing %s", argv[0]);
|
||||
if (argv[0][0] == '-') {
|
||||
if (strncasecmp(argv[0], "-ver", 4) == 0) {
|
||||
@@ -917,9 +900,6 @@ parse_args(int argc, char **argv) {
|
||||
in_use = true;
|
||||
addlookup(argv[0]);
|
||||
} else {
|
||||
if (argv[1] != NULL) {
|
||||
usage();
|
||||
}
|
||||
set_nameserver(argv[0]);
|
||||
check_ra = false;
|
||||
}
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
|
||||
.sp
|
||||
The
|
||||
\fIalgorithm\fR
|
||||
must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c \fIclass\fR
|
||||
@@ -293,5 +293,5 @@ RFC 7344\&.
|
||||
.RE
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -129,9 +129,9 @@
|
||||
record. This option has no effect when using CDS records.
|
||||
</p>
|
||||
<p>
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
|
||||
(SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
|
||||
values are case insensitive. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
</p>
|
||||
</dd>
|
||||
|
||||
+46
-105
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -39,103 +39,61 @@
|
||||
dnssec-dsfromkey \- DNSSEC DS RR generation tool
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
|
||||
\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
|
||||
\fB\-l\fR
|
||||
option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
|
||||
\fB\-C\fR
|
||||
it outputs CDS (Child DS) RRs\&.
|
||||
.PP
|
||||
The input keys can be specified in a number of ways:
|
||||
.PP
|
||||
By default,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads a key file named like
|
||||
Knnnn\&.+aaa+iiiii\&.key, as generated by
|
||||
\fBdnssec\-keygen\fR\&.
|
||||
.PP
|
||||
With the
|
||||
\fB\-f \fR\fB\fIfile\fR\fR
|
||||
option,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
|
||||
.PP
|
||||
With the
|
||||
\fB\-s\fR
|
||||
option,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads a
|
||||
keyset\-
|
||||
file, as generated by
|
||||
\fBdnssec\-keygen\fR\fB\-C\fR\&.
|
||||
outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-1
|
||||
.RS 4
|
||||
An abbreviation for
|
||||
\fB\-a SHA1\fR
|
||||
Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-2
|
||||
.RS 4
|
||||
An abbreviation for
|
||||
\fB\-a SHA\-256\fR
|
||||
Use SHA\-256 as the digest algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-a \fIalgorithm\fR
|
||||
.RS 4
|
||||
Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
|
||||
.sp
|
||||
The
|
||||
\fIalgorithm\fR
|
||||
must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
.RE
|
||||
.PP
|
||||
\-A
|
||||
.RS 4
|
||||
Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
|
||||
\fB\-f\fR
|
||||
zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c \fIclass\fR
|
||||
.RS 4
|
||||
Specifies the DNS class (default is IN)\&. Useful only in
|
||||
\fB\-s\fR
|
||||
keyset or
|
||||
\fB\-f\fR
|
||||
zone file mode\&.
|
||||
Select the digest algorithm\&. The value of
|
||||
\fBalgorithm\fR
|
||||
must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
|
||||
.RE
|
||||
.PP
|
||||
\-C
|
||||
.RS 4
|
||||
Generate CDS records rather than DS records\&. This is mutually exclusive with the
|
||||
\fB\-l\fR
|
||||
option for generating DLV records\&.
|
||||
Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-T \fITTL\fR
|
||||
.RS 4
|
||||
Specifies the TTL of the DS records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-K \fIdirectory\fR
|
||||
.RS 4
|
||||
Look for key files (or, in keyset mode,
|
||||
keyset\-
|
||||
files) in
|
||||
\fBdirectory\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
\-f \fIfile\fR
|
||||
.RS 4
|
||||
Zone file mode:
|
||||
\fBdnssec\-dsfromkey\fR\*(Aqs final
|
||||
\fIdnsname\fR
|
||||
argument is the DNS domain name of a zone whose master file can be read from
|
||||
Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
|
||||
\fBfile\fR\&. If the zone name is the same as
|
||||
\fBfile\fR, then it may be omitted\&.
|
||||
.sp
|
||||
If
|
||||
\fIfile\fR
|
||||
is
|
||||
\fBfile\fR
|
||||
is set to
|
||||
"\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
|
||||
\fBdig\fR
|
||||
command as input, as in:
|
||||
@@ -143,41 +101,26 @@ command as input, as in:
|
||||
\fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
|
||||
.RE
|
||||
.PP
|
||||
\-h
|
||||
\-A
|
||||
.RS 4
|
||||
Prints usage information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-K \fIdirectory\fR
|
||||
.RS 4
|
||||
Look for key files or
|
||||
keyset\-
|
||||
files in
|
||||
\fBdirectory\fR\&.
|
||||
Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l \fIdomain\fR
|
||||
.RS 4
|
||||
Generate a DLV set instead of a DS set\&. The specified
|
||||
\fIdomain\fR
|
||||
is appended to the name for each record in the set\&. This is mutually exclusive with the
|
||||
\fB\-C\fR
|
||||
option for generating CDS records\&.
|
||||
\fBdomain\fR
|
||||
is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-s
|
||||
.RS 4
|
||||
Keyset mode:
|
||||
\fBdnssec\-dsfromkey\fR\*(Aqs final
|
||||
\fIdnsname\fR
|
||||
argument is the DNS domain name used to locate a
|
||||
keyset\-
|
||||
file\&.
|
||||
Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-T \fITTL\fR
|
||||
\-c \fIclass\fR
|
||||
.RS 4
|
||||
Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
|
||||
Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v \fIlevel\fR
|
||||
@@ -185,6 +128,11 @@ Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
|
||||
Sets the debugging level\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h
|
||||
.RS 4
|
||||
Prints usage information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-V
|
||||
.RS 4
|
||||
Prints version information\&.
|
||||
@@ -193,16 +141,16 @@ Prints version information\&.
|
||||
.PP
|
||||
To build the SHA\-256 DS RR from the
|
||||
\fBKexample\&.com\&.+003+26160\fR
|
||||
keyfile name, you can issue the following command:
|
||||
keyfile name, the following command would be issued:
|
||||
.PP
|
||||
\fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
|
||||
.PP
|
||||
The command would print something like:
|
||||
.PP
|
||||
\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
|
||||
\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
|
||||
.SH "FILES"
|
||||
.PP
|
||||
The keyfile can be designated by the key identification
|
||||
The keyfile can be designed by the key identification
|
||||
Knnnn\&.+aaa+iiiii
|
||||
or the full file name
|
||||
Knnnn\&.+aaa+iiiii\&.key
|
||||
@@ -222,20 +170,13 @@ A keyfile error can give a "file not found" even if the file exists\&.
|
||||
\fBdnssec-keygen\fR(8),
|
||||
\fBdnssec-signzone\fR(8),
|
||||
BIND 9 Administrator Reference Manual,
|
||||
RFC 3658
|
||||
(DS RRs),
|
||||
RFC 4431
|
||||
(DLV RRs),
|
||||
RFC 4509
|
||||
(SHA\-256 for DS RRs),
|
||||
RFC 6605
|
||||
(SHA\-384 for DS RRs),
|
||||
RFC 7344
|
||||
(CDS and CDNSKEY RRs)\&.
|
||||
RFC 3658,
|
||||
RFC 4431\&.
|
||||
RFC 4509\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -33,167 +33,105 @@
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
[<code class="option">-1</code>]
|
||||
[<code class="option">-2</code>]
|
||||
[<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
|
||||
[<code class="option">-C</code>]
|
||||
[<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
{keyfile}
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-A</code>]
|
||||
{<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
|
||||
[dnsname]
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
{-s}
|
||||
[<code class="option">-1</code>]
|
||||
[<code class="option">-2</code>]
|
||||
[<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
[<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
|
||||
[<code class="option">-s</code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
|
||||
[<code class="option">-A</code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
{dnsname}
|
||||
</p></div>
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-h</code>
|
||||
| <code class="option">-V</code>
|
||||
]
|
||||
</p></div>
|
||||
[<code class="option">-h</code>]
|
||||
[<code class="option">-V</code>]
|
||||
</p></div>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.7"></a><h2>DESCRIPTION</h2>
|
||||
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
|
||||
Signer) resource records (RRs) and other similarly-constructed RRs:
|
||||
with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
|
||||
Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
|
||||
DS) RRs.
|
||||
<p><span class="command"><strong>dnssec-dsfromkey</strong></span>
|
||||
outputs the Delegation Signer (DS) resource record (RR), as defined in
|
||||
RFC 3658 and RFC 4509, for the given key(s).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
The input keys can be specified in a number of ways:
|
||||
</p>
|
||||
|
||||
<p>
|
||||
By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
|
||||
named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
|
||||
by <span class="command"><strong>dnssec-keygen</strong></span>.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
|
||||
option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
|
||||
or partial zone file (which can contain just the DNSKEY records).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
With the <code class="option">-s</code>
|
||||
option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
|
||||
a <code class="filename">keyset-</code> file, as generated
|
||||
by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.8"></a><h2>OPTIONS</h2>
|
||||
|
||||
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term">-1</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
An abbreviation for <code class="option">-a SHA1</code>
|
||||
Use SHA-1 as the digest algorithm (the default is to use
|
||||
both SHA-1 and SHA-256).
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-2</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
An abbreviation for <code class="option">-a SHA-256</code>
|
||||
Use SHA-256 as the digest algorithm.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specify a digest algorithm to use when converting DNSKEY
|
||||
records to DS records. This option can be repeated, so
|
||||
that multiple DS records are created for each DNSKEY
|
||||
record.
|
||||
</p>
|
||||
<p>
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
Select the digest algorithm. The value of
|
||||
<code class="option">algorithm</code> must be one of SHA-1 (SHA1),
|
||||
SHA-256 (SHA256) or SHA-384 (SHA384).
|
||||
These values are case insensitive.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-A</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records
|
||||
and printed. Useful only in <code class="option">-f</code> zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in <code class="option">-s</code> keyset or <code class="option">-f</code>
|
||||
zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-C</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with the <code class="option">-l</code> option for generating DLV
|
||||
records.
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with generating lookaside records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the TTL of the DS records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Look for key files (or, in keyset mode,
|
||||
<code class="filename">keyset-</code> files) in
|
||||
<code class="option">directory</code>.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
|
||||
final <em class="replaceable"><code>dnsname</code></em> argument is
|
||||
the DNS domain name of a zone whose master file can be read
|
||||
Zone file mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a zone master file, which can be read
|
||||
from <code class="option">file</code>. If the zone name is the same as
|
||||
<code class="option">file</code>, then it may be omitted.
|
||||
</p>
|
||||
<p>
|
||||
If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
|
||||
If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
|
||||
the zone data is read from the standard input. This makes it
|
||||
possible to use the output of the <span class="command"><strong>dig</strong></span>
|
||||
command as input, as in:
|
||||
@@ -202,41 +140,37 @@
|
||||
<strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-h</span></dt>
|
||||
<dt><span class="term">-A</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints usage information.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Look for key files or <code class="filename">keyset-</code> files in
|
||||
<code class="option">directory</code>.
|
||||
</p>
|
||||
</dd>
|
||||
<p>
|
||||
Include ZSKs when generating DS records. Without this option,
|
||||
only keys which have the KSK flag set will be converted to DS
|
||||
records and printed. Useful only in zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<em class="replaceable"><code>domain</code></em> is appended to the name for each
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<code class="option">domain</code> is appended to the name for each
|
||||
record in the set.
|
||||
This is mutually exclusive with the <code class="option">-C</code> option
|
||||
for generating CDS records.
|
||||
The DNSSEC Lookaside Validation (DLV) RR is described
|
||||
in RFC 4431. This is mutually exclusive with generating
|
||||
CDS records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-s</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
|
||||
final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
|
||||
domain name used to locate a <code class="filename">keyset-</code> file.
|
||||
Keyset mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a keyset file.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
|
||||
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in keyset or zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
|
||||
@@ -245,6 +179,12 @@
|
||||
Sets the debugging level.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-h</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints usage information.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-V</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -260,23 +200,22 @@
|
||||
<p>
|
||||
To build the SHA-256 DS RR from the
|
||||
<strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
|
||||
keyfile name, you can issue the following command:
|
||||
keyfile name, the following command would be issued:
|
||||
</p>
|
||||
<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
|
||||
</p>
|
||||
<p>
|
||||
The command would print something like:
|
||||
</p>
|
||||
<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
|
||||
<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.10"></a><h2>FILES</h2>
|
||||
|
||||
<p>
|
||||
The keyfile can be designated by the key identification
|
||||
The keyfile can be designed by the key identification
|
||||
<code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
|
||||
<code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
|
||||
<span class="refentrytitle">dnssec-keygen</span>(8).
|
||||
@@ -306,11 +245,9 @@
|
||||
<span class="refentrytitle">dnssec-signzone</span>(8)
|
||||
</span>,
|
||||
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
|
||||
<em class="citetitle">RFC 3658</em> (DS RRs),
|
||||
<em class="citetitle">RFC 4431</em> (DLV RRs),
|
||||
<em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
|
||||
<em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
|
||||
<em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
|
||||
<em class="citetitle">RFC 3658</em>,
|
||||
<em class="citetitle">RFC 4431</em>.
|
||||
<em class="citetitle">RFC 4509</em>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -134,5 +134,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
|
||||
.RS 4
|
||||
Selects the cryptographic algorithm\&. The value of
|
||||
\fBalgorithm\fR
|
||||
must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
|
||||
must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
|
||||
.sp
|
||||
If no algorithm is specified, then RSASHA1 will be used by default, unless the
|
||||
\fB\-3\fR
|
||||
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -89,7 +89,7 @@
|
||||
<dd>
|
||||
<p>
|
||||
Selects the cryptographic algorithm. The value of
|
||||
<code class="option">algorithm</code> must be one of RSASHA1,
|
||||
<code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
</p>
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -62,7 +62,7 @@ may be preferable to direct use of
|
||||
.RS 4
|
||||
Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
|
||||
\fBalgorithm\fR
|
||||
must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
|
||||
must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
|
||||
\fB\-T KEY\fR
|
||||
option as well\&.
|
||||
.sp
|
||||
@@ -354,5 +354,5 @@ RFC 4034\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -99,7 +99,7 @@
|
||||
<dd>
|
||||
<p>
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value
|
||||
of <code class="option">algorithm</code> must be one of RSASHA1,
|
||||
of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -99,5 +99,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -200,5 +200,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -468,5 +468,5 @@ RFC 4641\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -113,5 +113,5 @@ RFC 4033\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+52
-61
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -10,12 +10,12 @@
|
||||
.\" Title: named.conf
|
||||
.\" Author:
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 2019-02-06
|
||||
.\" Date: 2018-10-23
|
||||
.\" Manual: BIND9
|
||||
.\" Source: ISC
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "NAMED\&.CONF" "5" "2019\-02\-06" "ISC" "BIND9"
|
||||
.TH "NAMED\&.CONF" "5" "2018\-10\-23" "ISC" "BIND9"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
@@ -209,9 +209,9 @@ options {
|
||||
bindkeys\-file \fIquoted_string\fR;
|
||||
blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
cache\-file \fIquoted_string\fR;
|
||||
catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
|
||||
[ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
|
||||
port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
\fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
|
||||
in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
|
||||
check\-dup\-records ( fail | warn | ignore );
|
||||
@@ -265,15 +265,12 @@ options {
|
||||
dnssec\-secure\-to\-insecure \fIboolean\fR;
|
||||
dnssec\-update\-mode ( maintain | no\-resign );
|
||||
dnssec\-validation ( yes | no | auto );
|
||||
dnstap { ( all | auth | client | forwarder |
|
||||
resolver | update ) [ ( query | response ) ];
|
||||
\&.\&.\&. };
|
||||
dnstap\-identity ( \fIquoted_string\fR | none |
|
||||
hostname );
|
||||
dnstap\-output ( file | unix ) \fIquoted_string\fR [
|
||||
size ( unlimited | \fIsize\fR ) ] [ versions (
|
||||
unlimited | \fIinteger\fR ) ] [ suffix ( increment
|
||||
| timestamp ) ];
|
||||
dnstap { ( all | auth | client | forwarder | resolver | update ) [
|
||||
( query | response ) ]; \&.\&.\&. };
|
||||
dnstap\-identity ( \fIquoted_string\fR | none | hostname );
|
||||
dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
|
||||
\fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
|
||||
increment | timestamp ) ];
|
||||
dnstap\-version ( \fIquoted_string\fR | none );
|
||||
dscp \fIinteger\fR;
|
||||
dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
|
||||
@@ -289,6 +286,9 @@ options {
|
||||
fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
|
||||
fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
|
||||
files ( default | unlimited | \fIsizeval\fR );
|
||||
filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
|
||||
filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
|
||||
flush\-zones\-on\-shutdown \fIboolean\fR;
|
||||
forward ( first | only );
|
||||
forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
|
||||
@@ -409,17 +409,18 @@ options {
|
||||
resolver\-retry\-interval \fIinteger\fR;
|
||||
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
|
||||
\fIinteger\fR;
|
||||
response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
|
||||
\fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
|
||||
disabled | drop | given | no\-op | nodata | nxdomain | passthru
|
||||
| tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
|
||||
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
|
||||
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
|
||||
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
|
||||
[ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
|
||||
dnsrps\-options { \fIunspecified\-text\fR } ];
|
||||
response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
policy ( cname | disabled | drop | given | no\-op | nodata |
|
||||
nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
|
||||
qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
|
||||
dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
|
||||
} ];
|
||||
root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
|
||||
root\-key\-sentinel \fIboolean\fR;
|
||||
rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
|
||||
@@ -480,18 +481,6 @@ options {
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "PLUGIN"
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
plugin ( query ) \fIstring\fR [ { \fIunspecified\-text\fR
|
||||
} ];
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "SERVER"
|
||||
.sp
|
||||
.if n \{\
|
||||
@@ -591,9 +580,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
auth\-nxdomain \fIboolean\fR; // default changed
|
||||
auto\-dnssec ( allow | maintain | off );
|
||||
cache\-file \fIquoted_string\fR;
|
||||
catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
|
||||
[ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
|
||||
port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
\fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
|
||||
in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
|
||||
check\-dup\-records ( fail | warn | ignore );
|
||||
@@ -646,9 +635,8 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
dnssec\-secure\-to\-insecure \fIboolean\fR;
|
||||
dnssec\-update\-mode ( maintain | no\-resign );
|
||||
dnssec\-validation ( yes | no | auto );
|
||||
dnstap { ( all | auth | client | forwarder |
|
||||
resolver | update ) [ ( query | response ) ];
|
||||
\&.\&.\&. };
|
||||
dnstap { ( all | auth | client | forwarder | resolver | update ) [
|
||||
( query | response ) ]; \&.\&.\&. };
|
||||
dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
|
||||
@@ -662,6 +650,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
fetch\-quota\-params \fIinteger\fR \fIfixedpoint\fR \fIfixedpoint\fR \fIfixedpoint\fR;
|
||||
fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
|
||||
fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
|
||||
filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
|
||||
filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
|
||||
forward ( first | only );
|
||||
forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
|
||||
| \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
|
||||
@@ -702,8 +693,6 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
max\-udp\-size \fIinteger\fR;
|
||||
max\-zone\-ttl ( unlimited | \fIttlval\fR );
|
||||
message\-compression \fIboolean\fR;
|
||||
min\-cache\-ttl \fIttlval\fR;
|
||||
min\-ncache\-ttl \fIttlval\fR;
|
||||
min\-refresh\-time \fIinteger\fR;
|
||||
min\-retry\-time \fIinteger\fR;
|
||||
minimal\-any \fIboolean\fR;
|
||||
@@ -722,8 +711,6 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
nta\-lifetime \fIttlval\fR;
|
||||
nta\-recheck \fIttlval\fR;
|
||||
nxdomain\-redirect \fIstring\fR;
|
||||
plugin ( query ) \fIstring\fR [ {
|
||||
\fIunspecified\-text\fR } ];
|
||||
preferred\-glue \fIstring\fR;
|
||||
prefetch \fIinteger\fR [ \fIinteger\fR ];
|
||||
provide\-ixfr \fIboolean\fR;
|
||||
@@ -761,17 +748,18 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
resolver\-retry\-interval \fIinteger\fR;
|
||||
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
|
||||
\fIinteger\fR;
|
||||
response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
|
||||
\fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
|
||||
disabled | drop | given | no\-op | nodata | nxdomain | passthru
|
||||
| tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
|
||||
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
|
||||
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
|
||||
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
|
||||
[ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
|
||||
dnsrps\-options { \fIunspecified\-text\fR } ];
|
||||
response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
policy ( cname | disabled | drop | given | no\-op | nodata |
|
||||
nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
|
||||
qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
|
||||
dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
|
||||
} ];
|
||||
root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
|
||||
root\-key\-sentinel \fIboolean\fR;
|
||||
rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
|
||||
@@ -907,7 +895,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR
|
||||
| * ) ] [ dscp \fIinteger\fR ];
|
||||
notify\-to\-soa \fIboolean\fR;
|
||||
pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR
|
||||
pubkey \fIinteger\fR
|
||||
\fIinteger\fR
|
||||
\fIinteger\fR
|
||||
request\-expire \fIboolean\fR;
|
||||
request\-ixfr \fIboolean\fR;
|
||||
serial\-update\-method ( date | increment | unixtime );
|
||||
@@ -1013,6 +1003,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
|
||||
[ dscp \fIinteger\fR ];
|
||||
notify\-to\-soa \fIboolean\fR;
|
||||
pubkey \fIinteger\fR \fIinteger\fR
|
||||
request\-expire \fIboolean\fR;
|
||||
request\-ixfr \fIboolean\fR;
|
||||
serial\-update\-method ( date | increment | unixtime );
|
||||
@@ -1060,5 +1051,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2004-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -13,7 +13,7 @@
|
||||
|
||||
<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
|
||||
<info>
|
||||
<date>2019-02-06</date>
|
||||
<date>2018-12-07</date>
|
||||
</info>
|
||||
<refentryinfo>
|
||||
<corpname>ISC</corpname>
|
||||
|
||||
+56
-62
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -190,9 +190,9 @@ options
|
||||
bindkeys-file <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
blackhole { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
|
||||
[ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
|
||||
catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
|
||||
port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
|
||||
<em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
|
||||
in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
|
||||
check-dup-records ( fail | warn | ignore );<br>
|
||||
@@ -246,15 +246,12 @@ options
|
||||
dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-update-mode ( maintain | no-resign );<br>
|
||||
dnssec-validation ( yes | no | auto );<br>
|
||||
dnstap { ( all | auth | client | forwarder |<br>
|
||||
resolver | update ) [ ( query | response ) ];<br>
|
||||
... };<br>
|
||||
dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none |<br>
|
||||
hostname );<br>
|
||||
dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [<br>
|
||||
size ( unlimited | <em class="replaceable"><code>size</code></em> ) ] [ versions (<br>
|
||||
unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix ( increment<br>
|
||||
| timestamp ) ];<br>
|
||||
dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
|
||||
( query | response ) ]; ... };<br>
|
||||
dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
|
||||
dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
|
||||
<em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
|
||||
increment | timestamp ) ];<br>
|
||||
dnstap-version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
|
||||
dscp <em class="replaceable"><code>integer</code></em>;<br>
|
||||
dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
|
||||
@@ -270,6 +267,9 @@ options
|
||||
fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
|
||||
fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
|
||||
files ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
|
||||
filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
|
||||
filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
|
||||
flush-zones-on-shutdown <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
forward ( first | only );<br>
|
||||
forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
|
||||
@@ -390,17 +390,18 @@ options
|
||||
resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
|
||||
response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
|
||||
<em class="replaceable"><code>integer</code></em>;<br>
|
||||
response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
|
||||
<em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname |<br>
|
||||
disabled | drop | given | no-op | nodata | nxdomain | passthru<br>
|
||||
| tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
|
||||
break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
|
||||
nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
|
||||
[ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
|
||||
response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
policy ( cname | disabled | drop | given | no-op | nodata |<br>
|
||||
nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
|
||||
recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
|
||||
} ];<br>
|
||||
root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
|
||||
root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
|
||||
@@ -461,16 +462,7 @@ options
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.17"></a><h2>PLUGIN</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
plugin ( query ) <em class="replaceable"><code>string</code></em> [ { <em class="replaceable"><code>unspecified-text</code></em><br>
|
||||
} ];<br>
|
||||
</p></div>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.18"></a><h2>SERVER</h2>
|
||||
<a name="id-1.17"></a><h2>SERVER</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
server <em class="replaceable"><code>netprefix</code></em> {<br>
|
||||
@@ -509,7 +501,7 @@ server
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.19"></a><h2>STATISTICS-CHANNELS</h2>
|
||||
<a name="id-1.18"></a><h2>STATISTICS-CHANNELS</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
statistics-channels {<br>
|
||||
@@ -522,7 +514,7 @@ statistics-channels
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.20"></a><h2>TRUSTED-KEYS</h2>
|
||||
<a name="id-1.19"></a><h2>TRUSTED-KEYS</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
trusted-keys { <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
|
||||
@@ -531,7 +523,7 @@ trusted-keys
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.21"></a><h2>VIEW</h2>
|
||||
<a name="id-1.20"></a><h2>VIEW</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
view <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
|
||||
@@ -557,9 +549,9 @@ view
|
||||
auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
|
||||
auto-dnssec ( allow | maintain | off );<br>
|
||||
cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
catalog-zones { zone <em class="replaceable"><code>string</code></em> [ default-masters [ port <em class="replaceable"><code>integer</code></em> ]<br>
|
||||
[ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
|
||||
catalog-zones { zone <em class="replaceable"><code>quoted_string</code></em> [ default-masters [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<br>
|
||||
port <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port <em class="replaceable"><code>integer</code></em> ] ) [ key<br>
|
||||
<em class="replaceable"><code>string</code></em> ]; ... } ] [ zone-directory <em class="replaceable"><code>quoted_string</code></em> ] [<br>
|
||||
in-memory <em class="replaceable"><code>boolean</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ]; ... };<br>
|
||||
check-dup-records ( fail | warn | ignore );<br>
|
||||
@@ -612,9 +604,8 @@ view
|
||||
dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-update-mode ( maintain | no-resign );<br>
|
||||
dnssec-validation ( yes | no | auto );<br>
|
||||
dnstap { ( all | auth | client | forwarder |<br>
|
||||
resolver | update ) [ ( query | response ) ];<br>
|
||||
... };<br>
|
||||
dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
|
||||
( query | response ) ]; ... };<br>
|
||||
dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
|
||||
<em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
|
||||
@@ -628,6 +619,9 @@ view
|
||||
fetch-quota-params <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em> <em class="replaceable"><code>fixedpoint</code></em>;<br>
|
||||
fetches-per-server <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
|
||||
fetches-per-zone <em class="replaceable"><code>integer</code></em> [ ( drop | fail ) ];<br>
|
||||
filter-aaaa { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
filter-aaaa-on-v4 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
|
||||
filter-aaaa-on-v6 ( break-dnssec | <em class="replaceable"><code>boolean</code></em> );<br>
|
||||
forward ( first | only );<br>
|
||||
forwarders [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>ipv4_address</code></em><br>
|
||||
| <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
|
||||
@@ -668,8 +662,6 @@ view
|
||||
max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
max-zone-ttl ( unlimited | <em class="replaceable"><code>ttlval</code></em> );<br>
|
||||
message-compression <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
|
||||
min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
|
||||
min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
|
||||
min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
|
||||
minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
@@ -688,8 +680,6 @@ view
|
||||
nta-lifetime <em class="replaceable"><code>ttlval</code></em>;<br>
|
||||
nta-recheck <em class="replaceable"><code>ttlval</code></em>;<br>
|
||||
nxdomain-redirect <em class="replaceable"><code>string</code></em>;<br>
|
||||
plugin ( query ) <em class="replaceable"><code>string</code></em> [ {<br>
|
||||
<em class="replaceable"><code>unspecified-text</code></em> } ];<br>
|
||||
preferred-glue <em class="replaceable"><code>string</code></em>;<br>
|
||||
prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
|
||||
provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
@@ -727,17 +717,18 @@ view
|
||||
resolver-retry-interval <em class="replaceable"><code>integer</code></em>;<br>
|
||||
response-padding { <em class="replaceable"><code>address_match_element</code></em>; ... } block-size<br>
|
||||
<em class="replaceable"><code>integer</code></em>;<br>
|
||||
response-policy { zone <em class="replaceable"><code>string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl<br>
|
||||
<em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ policy ( cname |<br>
|
||||
disabled | drop | given | no-op | nodata | nxdomain | passthru<br>
|
||||
| tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [<br>
|
||||
break-dnssec <em class="replaceable"><code>boolean</code></em> ] [ max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [ min-ns-dots <em class="replaceable"><code>integer</code></em> ] [<br>
|
||||
nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ]<br>
|
||||
[ recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em> } ];<br>
|
||||
response-policy { zone <em class="replaceable"><code>quoted_string</code></em> [ log <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
policy ( cname | disabled | drop | given | no-op | nodata |<br>
|
||||
nxdomain | passthru | tcp-only <em class="replaceable"><code>quoted_string</code></em> ) ] [<br>
|
||||
recursive-only <em class="replaceable"><code>boolean</code></em> ] [ nsip-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsdname-enable <em class="replaceable"><code>boolean</code></em> ]; ... } [ break-dnssec <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
max-policy-ttl <em class="replaceable"><code>ttlval</code></em> ] [ min-update-interval <em class="replaceable"><code>ttlval</code></em> ] [<br>
|
||||
min-ns-dots <em class="replaceable"><code>integer</code></em> ] [ nsip-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
qname-wait-recurse <em class="replaceable"><code>boolean</code></em> ] [ recursive-only <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
|
||||
dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
|
||||
} ];<br>
|
||||
root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
|
||||
root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
|
||||
@@ -873,7 +864,9 @@ view
|
||||
notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em><br>
|
||||
| * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
|
||||
notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
|
||||
pubkey <em class="replaceable"><code>integer</code></em><br>
|
||||
<em class="replaceable"><code>integer</code></em><br>
|
||||
<em class="replaceable"><code>integer</code></em><br>
|
||||
request-expire <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
serial-update-method ( date | increment | unixtime );<br>
|
||||
@@ -907,7 +900,7 @@ view
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.22"></a><h2>ZONE</h2>
|
||||
<a name="id-1.21"></a><h2>ZONE</h2>
|
||||
|
||||
<div class="literallayout"><p><br>
|
||||
zone <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
|
||||
@@ -976,6 +969,7 @@ zone
|
||||
notify-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * ) ]<br>
|
||||
[ dscp <em class="replaceable"><code>integer</code></em> ];<br>
|
||||
notify-to-soa <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em><br>
|
||||
request-expire <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
serial-update-method ( date | increment | unixtime );<br>
|
||||
@@ -1007,14 +1001,14 @@ zone
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.23"></a><h2>FILES</h2>
|
||||
<a name="id-1.22"></a><h2>FILES</h2>
|
||||
|
||||
<p><code class="filename">/etc/named.conf</code>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.24"></a><h2>SEE ALSO</h2>
|
||||
<a name="id-1.23"></a><h2>SEE ALSO</h2>
|
||||
|
||||
<p><span class="citerefentry">
|
||||
<span class="refentrytitle">ddns-confgen</span>(8)
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+1
-1
@@ -14712,7 +14712,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
|
||||
CHECK(ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
(void) putnull(text);
|
||||
CHECK(putnull(text));
|
||||
|
||||
cleanup:
|
||||
if (msg != NULL) {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -519,5 +519,5 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -93,5 +93,5 @@ Specify how long to pause before carrying out key destruction\&. The default is
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -116,5 +116,5 @@ Open the session with the given PKCS#11 slot\&. The default is slot 0\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -94,5 +94,5 @@ will prompt for it\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -65,5 +65,5 @@ Make the PKCS#11 libisc initialization verbose\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -112,5 +112,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -87,5 +87,5 @@ binary\&. Used for testing\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2012-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2012-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -152,5 +152,5 @@ binary\&. Used for testing\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+19
-25
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -49,7 +49,7 @@ and
|
||||
\fBdnssec\-settime\fR\&.
|
||||
.PP
|
||||
DNSSEC policy can be read from a configuration file (default
|
||||
/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a "default" policy used for all zones\&.
|
||||
/etc/dnssec\-policy\&.conf), from which the key parameters, publication and rollover schedule, and desired coverage duration for any given zone can be determined\&. This file may be used to define individual DNSSEC policies on a per\-zone basis, or to set a default policy used for all zones\&.
|
||||
.PP
|
||||
When
|
||||
\fBdnssec\-keymgr\fR
|
||||
@@ -69,10 +69,6 @@ will search the key directory (either the current working directory or the direc
|
||||
\fB\-K\fR
|
||||
option), and check the keys for all the zones represented in the directory\&.
|
||||
.PP
|
||||
Key times that are in the past will not be updated unless the
|
||||
\fB\-f\fR
|
||||
is used (see below)\&. Key inactivation and deletion times that are less than five minutes in the future will be delayed by five minutes\&.
|
||||
.PP
|
||||
It is expected that this tool will be run automatically and unattended (for example, by
|
||||
\fBcron\fR)\&.
|
||||
.SH "OPTIONS"
|
||||
@@ -181,8 +177,7 @@ would be used for zones that had unusually high security needs\&.
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
\fIAlgorithm policies:\fR
|
||||
(\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
|
||||
Algorithm policies: (\fBalgorithm\-policy \fR\fB\fIalgorithm\fR\fR\fB { \&.\&.\&. };\fR
|
||||
) override default per\-algorithm settings\&. For example, by default, RSASHA256 keys use 2048\-bit key sizes for both KSK and ZSK\&. This can be modified using
|
||||
\fBalgorithm\-policy\fR, and the new key sizes would then be used for any key of type RSASHA256\&.
|
||||
.RE
|
||||
@@ -195,60 +190,59 @@ would be used for zones that had unusually high security needs\&.
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
\fIZone policies:\fR
|
||||
(\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
|
||||
Zone policies: (\fBzone \fR\fB\fIname\fR\fR\fB { \&.\&.\&. };\fR
|
||||
) set policy for a single zone by name\&. A zone policy can inherit a policy class by including a
|
||||
\fBpolicy\fR
|
||||
option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&. If a zone does not have its own policy then the "default" policy applies\&.
|
||||
option\&. Zone names beginning with digits (i\&.e\&., 0\-9) must be quoted\&.
|
||||
.RE
|
||||
.PP
|
||||
Options that can be specified in policies:
|
||||
.PP
|
||||
\fBalgorithm\fR \fIname\fR;
|
||||
\fBalgorithm\fR
|
||||
.RS 4
|
||||
The key algorithm\&. If no policy is defined, the default is RSASHA256\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBcoverage\fR \fIduration\fR;
|
||||
\fBcoverage\fR
|
||||
.RS 4
|
||||
The length of time to ensure that keys will be correct; no action will be taken to create new keys to be activated after this time\&. This can be represented as a number of seconds, or as a duration using human\-readable units (examples: "1y" or "6 months")\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is six months\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBdirectory\fR \fIpath\fR;
|
||||
\fBdirectory\fR
|
||||
.RS 4
|
||||
Specifies the directory in which keys should be stored\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBkey\-size\fR \fIkeytype\fR \fIsize\fR;
|
||||
\fBkey\-size\fR
|
||||
.RS 4
|
||||
Specifies the number of bits to use in creating keys\&. The keytype is either "zsk" or "ksk"\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
|
||||
Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBkeyttl\fR \fIduration\fR;
|
||||
\fBkeyttl\fR
|
||||
.RS 4
|
||||
The key TTL\&. If no policy is defined, the default is one hour\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBpost\-publish\fR \fIkeytype\fR \fIduration\fR;
|
||||
\fBpost\-publish\fR
|
||||
.RS 4
|
||||
How long after inactivation a key should be deleted from the zone\&. Note: If
|
||||
\fBroll\-period\fR
|
||||
is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
is not set, this value is ignored\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBpre\-publish\fR \fIkeytype\fR \fIduration\fR;
|
||||
\fBpre\-publish\fR
|
||||
.RS 4
|
||||
How long before activation a key should be published\&. Note: If
|
||||
\fBroll\-period\fR
|
||||
is not set, this value is ignored\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
is not set, this value is ignored\&. Takes two arguments: keytype (either "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. The default is one month\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBroll\-period\fR \fIkeytype\fR \fIduration\fR;
|
||||
\fBroll\-period\fR
|
||||
.RS 4
|
||||
How frequently keys should be rolled over\&. The keytype is either "zsk" or "ksk"\&. A default duration for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSKs\&. KSKs do not roll over by default\&.
|
||||
How frequently keys should be rolled over\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is one year for ZSK\*(Aqs\&. KSK\*(Aqs do not roll over by default\&.
|
||||
.RE
|
||||
.PP
|
||||
\fBstandby\fR \fIkeytype\fR \fInumber\fR;
|
||||
\fBstandby\fR
|
||||
.RS 4
|
||||
Not yet implemented\&.
|
||||
.RE
|
||||
@@ -294,5 +288,5 @@ Allow configuration of standby keys and use of the REVOKE bit, for keys that use
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -65,12 +65,11 @@
|
||||
</para>
|
||||
<para>
|
||||
DNSSEC policy can be read from a configuration file (default
|
||||
<filename>/etc/dnssec-policy.conf</filename>), from which the
|
||||
key parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
<filename>/etc/dnssec-policy.conf</filename>), from which the key
|
||||
parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
file may be used to define individual DNSSEC policies on a
|
||||
per-zone basis, or to set a "<literal>default</literal>" policy
|
||||
used for all zones.
|
||||
per-zone basis, or to set a default policy used for all zones.
|
||||
</para>
|
||||
<para>
|
||||
When <command>dnssec-keymgr</command> runs, it examines the DNSSEC
|
||||
@@ -246,7 +245,7 @@
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<emphasis>Algorithm policies:</emphasis>
|
||||
Algorithm policies:
|
||||
(<option>algorithm-policy <replaceable>algorithm</replaceable> { ... };</option> )
|
||||
override default per-algorithm settings. For example, by default,
|
||||
RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
|
||||
@@ -256,13 +255,11 @@
|
||||
</listitem>
|
||||
<listitem>
|
||||
<para>
|
||||
<emphasis>Zone policies:</emphasis>
|
||||
Zone policies:
|
||||
(<option>zone <replaceable>name</replaceable> { ... };</option> )
|
||||
set policy for a single zone by name. A zone policy can inherit
|
||||
a policy class by including a <option>policy</option> option.
|
||||
Zone names beginning with digits (i.e., 0-9) must be quoted.
|
||||
If a zone does not have its own policy then the
|
||||
"<literal>default</literal>" policy applies.
|
||||
</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
@@ -271,8 +268,7 @@
|
||||
</para>
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term><command>algorithm</command>
|
||||
<replaceable>name</replaceable><literal>;</literal></term>
|
||||
<term><command>algorithm</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
The key algorithm. If no policy is defined, the default is
|
||||
@@ -281,14 +277,13 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>coverage</command>
|
||||
<replaceable>duration</replaceable><literal>;</literal></term>
|
||||
<term><command>coverage</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
The length of time to ensure that keys will be correct; no action
|
||||
will be taken to create new keys to be activated after this time.
|
||||
This can be represented as a number of seconds, or as a duration
|
||||
using human-readable units (examples: "1y" or "6 months").
|
||||
This can be represented as a number of seconds, or as a duration using
|
||||
human-readable units (examples: "1y" or "6 months").
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies.
|
||||
If no policy is configured, the default is six months.
|
||||
@@ -296,8 +291,7 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>directory</command>
|
||||
<replaceable>path</replaceable><literal>;</literal></term>
|
||||
<term><command>directory</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the directory in which keys should be stored.
|
||||
@@ -305,12 +299,11 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>key-size</command> <replaceable>keytype</replaceable>
|
||||
<replaceable>size</replaceable><literal>;</literal></term>
|
||||
<term><command>key-size</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the number of bits to use in creating keys.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is 2048 bits for RSA keys.
|
||||
@@ -318,8 +311,7 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>keyttl</command>
|
||||
<replaceable>duration</replaceable><literal>;</literal></term>
|
||||
<term><command>keyttl</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
The key TTL. If no policy is defined, the default is one hour.
|
||||
@@ -327,50 +319,46 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>post-publish</command> <replaceable>keytype</replaceable>
|
||||
<replaceable>duration</replaceable><literal>;</literal></term>
|
||||
<term><command>post-publish</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
How long after inactivation a key should be deleted from the zone.
|
||||
Note: If <option>roll-period</option> is not set, this value is
|
||||
ignored. The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm
|
||||
ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
|
||||
duration. A default value for this option can be set in algorithm
|
||||
policies as well as in policy classes or zone policies. The default
|
||||
is one month.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>pre-publish</command> <replaceable>keytype</replaceable>
|
||||
<replaceable>duration</replaceable><literal>;</literal></term>
|
||||
<term><command>pre-publish</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
How long before activation a key should be published. Note: If
|
||||
<option>roll-period</option> is not set, this value is ignored.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. The default is
|
||||
one month.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>roll-period</command> <replaceable>keytype</replaceable>
|
||||
<replaceable>duration</replaceable><literal>;</literal></term>
|
||||
<term><command>roll-period</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
How frequently keys should be rolled over.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is one year for ZSKs. KSKs do not
|
||||
configured, the default is one year for ZSK's. KSK's do not
|
||||
roll over by default.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term><command>standby</command> <replaceable>keytype</replaceable>
|
||||
<replaceable>number</replaceable><literal>;</literal></term>
|
||||
<term><command>standby</command></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Not yet implemented.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2016-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2016-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -57,12 +57,11 @@
|
||||
</p>
|
||||
<p>
|
||||
DNSSEC policy can be read from a configuration file (default
|
||||
<code class="filename">/etc/dnssec-policy.conf</code>), from which the
|
||||
key parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
<code class="filename">/etc/dnssec-policy.conf</code>), from which the key
|
||||
parameters, publication and rollover schedule, and desired
|
||||
coverage duration for any given zone can be determined. This
|
||||
file may be used to define individual DNSSEC policies on a
|
||||
per-zone basis, or to set a "<code class="literal">default</code>" policy
|
||||
used for all zones.
|
||||
per-zone basis, or to set a default policy used for all zones.
|
||||
</p>
|
||||
<p>
|
||||
When <span class="command"><strong>dnssec-keymgr</strong></span> runs, it examines the DNSSEC
|
||||
@@ -92,12 +91,6 @@
|
||||
set by the <code class="option">-K</code> option), and check the keys for
|
||||
all the zones represented in the directory.
|
||||
</p>
|
||||
<p>
|
||||
Key times that are in the past will not be updated unless
|
||||
the <code class="option">-f</code> is used (see below). Key inactivation
|
||||
and deletion times that are less than five minutes in the future
|
||||
will be delayed by five minutes.
|
||||
</p>
|
||||
<p>
|
||||
It is expected that this tool will be run automatically and
|
||||
unattended (for example, by <span class="command"><strong>cron</strong></span>).
|
||||
@@ -211,7 +204,7 @@
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="emphasis"><em>Algorithm policies:</em></span>
|
||||
Algorithm policies:
|
||||
(<code class="option">algorithm-policy <em class="replaceable"><code>algorithm</code></em> { ... };</code> )
|
||||
override default per-algorithm settings. For example, by default,
|
||||
RSASHA256 keys use 2048-bit key sizes for both KSK and ZSK. This
|
||||
@@ -221,13 +214,11 @@
|
||||
</li>
|
||||
<li class="listitem">
|
||||
<p>
|
||||
<span class="emphasis"><em>Zone policies:</em></span>
|
||||
Zone policies:
|
||||
(<code class="option">zone <em class="replaceable"><code>name</code></em> { ... };</code> )
|
||||
set policy for a single zone by name. A zone policy can inherit
|
||||
a policy class by including a <code class="option">policy</code> option.
|
||||
Zone names beginning with digits (i.e., 0-9) must be quoted.
|
||||
If a zone does not have its own policy then the
|
||||
"<code class="literal">default</code>" policy applies.
|
||||
</p>
|
||||
</li>
|
||||
</ul></div>
|
||||
@@ -235,90 +226,81 @@
|
||||
Options that can be specified in policies:
|
||||
</p>
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term"><span class="command"><strong>algorithm</strong></span>
|
||||
<em class="replaceable"><code>name</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>algorithm</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The key algorithm. If no policy is defined, the default is
|
||||
RSASHA256.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>coverage</strong></span>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>coverage</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The length of time to ensure that keys will be correct; no action
|
||||
will be taken to create new keys to be activated after this time.
|
||||
This can be represented as a number of seconds, or as a duration
|
||||
using human-readable units (examples: "1y" or "6 months").
|
||||
This can be represented as a number of seconds, or as a duration using
|
||||
human-readable units (examples: "1y" or "6 months").
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies.
|
||||
If no policy is configured, the default is six months.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>directory</strong></span>
|
||||
<em class="replaceable"><code>path</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>directory</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the directory in which keys should be stored.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>key-size</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>size</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>key-size</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the number of bits to use in creating keys.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is 2048 bits for RSA keys.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>keyttl</strong></span>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
The key TTL. If no policy is defined, the default is one hour.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>post-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>post-publish</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How long after inactivation a key should be deleted from the zone.
|
||||
Note: If <code class="option">roll-period</code> is not set, this value is
|
||||
ignored. The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm
|
||||
ignored. Takes two arguments: keytype (eihter "zsk" or "ksk") and a
|
||||
duration. A default value for this option can be set in algorithm
|
||||
policies as well as in policy classes or zone policies. The default
|
||||
is one month.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>pre-publish</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>pre-publish</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How long before activation a key should be published. Note: If
|
||||
<code class="option">roll-period</code> is not set, this value is ignored.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
Takes two arguments: keytype (either "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. The default is
|
||||
one month.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>roll-period</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>duration</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>roll-period</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
How frequently keys should be rolled over.
|
||||
The keytype is either "zsk" or "ksk".
|
||||
A default duration for this option can be set in algorithm policies
|
||||
Takes two arguments: keytype (eihter "zsk" or "ksk") and a duration.
|
||||
A default value for this option can be set in algorithm policies
|
||||
as well as in policy classes or zone policies. If no policy is
|
||||
configured, the default is one year for ZSKs. KSKs do not
|
||||
configured, the default is one year for ZSK's. KSK's do not
|
||||
roll over by default.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><span class="command"><strong>standby</strong></span> <em class="replaceable"><code>keytype</code></em>
|
||||
<em class="replaceable"><code>number</code></em><code class="literal">;</code></span></dt>
|
||||
<dt><span class="term"><span class="command"><strong>standby</strong></span></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Not yet implemented.
|
||||
|
||||
@@ -169,7 +169,7 @@ def parse_args():
|
||||
parser.add_argument('-D', '--dsfromkey', dest='dsfromkey',
|
||||
default=os.path.join(prefix(sbindir),
|
||||
'dnssec-dsfromkey'),
|
||||
type=str, help='path to \'dnssec-dsfromkey\'')
|
||||
type=str, help='path to \'dig\'')
|
||||
parser.add_argument('-f', '--file', dest='masterfile', type=str,
|
||||
help='zone master file')
|
||||
parser.add_argument('-l', '--lookaside', dest='lookaside', type=str,
|
||||
|
||||
@@ -188,9 +188,8 @@ def parse_args():
|
||||
if args.filename and len(args.zone) > 1:
|
||||
fatal("ERROR: -f can only be used with one zone.")
|
||||
|
||||
# strip trailing dots if any
|
||||
args.zone = [x[:-1] if (len(x) > 1 and x[-1] == '.') else x
|
||||
for x in args.zone]
|
||||
# strip trailing dots
|
||||
args.zone = [x[:-1] for x in args.zone if len(x) > 1 and x[-1] == '.']
|
||||
|
||||
# convert from time arguments to seconds
|
||||
try:
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -750,5 +750,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -230,5 +230,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000, 2001, 2004, 2005, 2007, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
args="-z -m2h"
|
||||
warn=0
|
||||
error=0
|
||||
ok=2
|
||||
retcode=0
|
||||
match=
|
||||
zones="one.example. two.example"
|
||||
@@ -13,5 +13,4 @@ rm -f named-compilezone
|
||||
rm -f */K*.key
|
||||
rm -f */K*.private
|
||||
rm -rf coverage.*
|
||||
rm -rf dotted-dotless
|
||||
rm -f ns*/named.lock
|
||||
|
||||
@@ -132,8 +132,3 @@ ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
|
||||
dir=12-ksk-deletion
|
||||
ksk1=`$KEYGEN -q -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
|
||||
ksk2=`$KEYGEN -q -K $dir -S $ksk1.key example.com`
|
||||
|
||||
# Test 13: check names with/without dots at the end
|
||||
dir=13-dotted-dotless
|
||||
zsk1=`$KEYGEN -q -K $dir -a rsasha256 one.example`
|
||||
zsk2=`$KEYGEN -q -K $dir -a rsasha256 two.example`
|
||||
|
||||
@@ -32,9 +32,9 @@ ret=0
|
||||
for dir in [0-9][0-9]-*; do
|
||||
ret=0
|
||||
echo_i "$dir"
|
||||
args= warn= error= ok= retcode= match= zones=
|
||||
args= warn= error= ok= retcode= match=
|
||||
. $dir/expect
|
||||
$COVERAGE $args -K $dir ${zones:-example.com} > coverage.$n 2>&1
|
||||
$COVERAGE $args -K $dir example.com > coverage.$n 2>&1
|
||||
|
||||
# check that return code matches expectations
|
||||
found=$?
|
||||
|
||||
@@ -536,22 +536,10 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
|
||||
*/
|
||||
isc_result_t
|
||||
dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
|
||||
isc_result_t result;
|
||||
UNUSED(client);
|
||||
|
||||
result = dlz_findzonedb(dbdata, name, NULL, NULL);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
return (result);
|
||||
}
|
||||
|
||||
/*
|
||||
* Exception for 10.53.0.5 so we can test that allow-transfer
|
||||
* is effective.
|
||||
*/
|
||||
if (strcmp(client, "10.53.0.5") == 0) {
|
||||
return (ISC_R_NOPERM);
|
||||
}
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
/* Just say yes for all our zones */
|
||||
return (dlz_findzonedb(dbdata, name, NULL, NULL));
|
||||
}
|
||||
|
||||
/*
|
||||
|
||||
@@ -108,23 +108,15 @@ test_update testdc1.alternate.nil. A "86400 A 10.53.0.10" "10.53.0.10" || ret=1
|
||||
status=`expr $status + $ret`
|
||||
|
||||
newtest "testing AXFR from DLZ drivers"
|
||||
$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.example.ns1.test$n
|
||||
lines=`cat dig.out.example.ns1.test$n | wc -l`
|
||||
$DIG $DIGOPTS +noall +answer axfr example.nil > dig.out.ns1.test$n
|
||||
lines=`cat dig.out.ns1.test$n | wc -l`
|
||||
[ ${lines:-0} -eq 4 ] || ret=1
|
||||
$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
|
||||
lines=`cat dig.out.alternate.ns1.test$n | wc -l`
|
||||
$DIG $DIGOPTS +noall +answer axfr alternate.nil > dig.out.ns1.test$n
|
||||
lines=`cat dig.out.ns1.test$n | wc -l`
|
||||
[ ${lines:-0} -eq 5 ] || ret=1
|
||||
[ "$ret" -eq 0 ] || echo_i "failed"
|
||||
status=`expr $status + $ret`
|
||||
|
||||
newtest "testing AXFR denied from DLZ drivers"
|
||||
$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr example.nil > dig.out.example.ns1.test$n
|
||||
grep "; Transfer failed" dig.out.example.ns1.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS -b 10.53.0.5 +noall +answer axfr alternate.nil > dig.out.alternate.ns1.test$n
|
||||
grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
|
||||
[ "$ret" -eq 0 ] || echo_i "failed"
|
||||
status=`expr $status + $ret`
|
||||
|
||||
newtest "testing unsearched/unregistered DLZ zone is not found"
|
||||
$DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
|
||||
grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1
|
||||
|
||||
@@ -247,7 +247,7 @@ zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
|
||||
cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"
|
||||
|
||||
# "$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
|
||||
"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
|
||||
"$SIGNER" -P -3 - -o "$zone" -f ${zonefile}.signed "$zonefile"
|
||||
|
||||
#
|
||||
# A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
|
||||
|
||||
@@ -3593,23 +3593,12 @@ status=$((status+ret))
|
||||
|
||||
echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)"
|
||||
ret=0
|
||||
dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns1.test$n || ret=1
|
||||
dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns4.test$n || ret=1
|
||||
grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory ($n)"
|
||||
ret=0
|
||||
dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1
|
||||
grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1
|
||||
grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1
|
||||
$PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1
|
||||
n=$(($n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "check that the view is logged in messages from the validator when using views ($n)"
|
||||
ret=0
|
||||
grep "view rec: *validat" ns4/named.run > /dev/null || ret=1
|
||||
|
||||
@@ -35,7 +35,10 @@ DSFILENAME2=dsset-`echo $zone2 |sed -e "s/\.$//g"`$TP
|
||||
$DSFROMKEY -a SHA-256 $keyname12 > $DSFILENAME1
|
||||
$DSFROMKEY -a SHA-256 $keyname22 > $DSFILENAME2
|
||||
|
||||
algo=SHA-384
|
||||
supported=`cat ../supported`
|
||||
case "$supported" in
|
||||
*) algo=SHA-384 ;;
|
||||
esac
|
||||
|
||||
$DSFROMKEY -a $algo $keyname12 >> $DSFILENAME1
|
||||
$DSFROMKEY -a $algo $keyname22 > $DSFILENAME2
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
SYSTEMTESTTOP=..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
if $PERL -e 'use Net::DNS;' 2>/dev/null
|
||||
then
|
||||
:
|
||||
else
|
||||
echo_i "This test requires the Net::DNS library." >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -368,14 +368,7 @@ openpgpkey OPENPGPKEY ( AQMFD5raczCJHViKtLYhWGz8hMY
|
||||
csync01 CSYNC 0 0 A NS AAAA
|
||||
csync02 CSYNC 0 0
|
||||
|
||||
;type 63
|
||||
zonemd01 ZONEMD 2019020700 1 0 (
|
||||
C220B8A6ED5728A971902F7E3D4FD93A
|
||||
DEEA88B0453C2E8E8C863D465AB06CF3
|
||||
4EB95B266398C98B59124FA239CB7EEB
|
||||
)
|
||||
|
||||
; type 64 -- 98 (unassigned)
|
||||
; type 63 -- 98 (unassigned)
|
||||
|
||||
; type 99
|
||||
spf01 SPF "v=spf1 -all"
|
||||
@@ -462,15 +455,7 @@ doa01 DOA ( 1234567890 1234567890 1 "image/gif"
|
||||
hmsBich1awPAjkY1SZR8bJWrz382SGqIBQQFQd4IsUTaX+ceuudPEQA7 )
|
||||
doa02 DOA 0 1 2 "" aHR0cHM6Ly93d3cuaXNjLm9yZy8=
|
||||
|
||||
; type 260
|
||||
amtrelay01 AMTRELAY 0 0 0
|
||||
amtrelay02 AMTRELAY 0 1 0
|
||||
amtrelay03 AMTRELAY 0 0 1 0.0.0.0
|
||||
amtrelay04 AMTRELAY 0 0 2 ::
|
||||
amtrelay05 AMTRELAY 0 0 3 example.net.
|
||||
amtrelay06 AMTRELAY \# 2 0004
|
||||
|
||||
; type 261 -- 32767 (unassigned)
|
||||
; type 260 -- 32767 (unassigned)
|
||||
|
||||
; type 32768
|
||||
ta TA 30795 1 1 (
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
@@ -7,17 +9,15 @@
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
rm -rf ./*/*.jbk \
|
||||
rm -rf \
|
||||
./*/*.jbk \
|
||||
./*/*.nzd ./*/*.nzd-lock ./*/*.nzf \
|
||||
./*/named.conf ./*/named.memstats ./*/named.run* ./*/named.lock \
|
||||
./*/trusted.conf \
|
||||
./K* ./*/K* \
|
||||
./checkecdsa \
|
||||
./freeze.test* thaw.test* \
|
||||
./import.key \
|
||||
././ns*/managed-keys.bind* ./ns*/*.mkeys* \
|
||||
./K*.key ./K*.private ./*/K*.key ./*/K*.private \
|
||||
./*/managed-keys.bind* ./*/*.mkeys* \
|
||||
./*/dsset-* ./*/nzf-* \
|
||||
./*/*.db ./*/*.db.signed ./*/*.db.jnl ./*/*.db.signed.jnl \
|
||||
./*.out ./*.out* ./*/*.out ./*/*.out* \
|
||||
./*/*.bk ./*/*.bk.jnl ./*/*.bk.signed ./*/*.bk.signed.jnl \
|
||||
ns3/a-file ns3/removedkeys
|
||||
$(cat ./cleanfiles) $(cat ./*/cleanfiles)
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
./checkecdsa
|
||||
./freeze.test*
|
||||
./thaw.test*
|
||||
./import.key
|
||||
@@ -0,0 +1,2 @@
|
||||
./*/a-file
|
||||
./*/removedkeys
|
||||
@@ -8,7 +8,7 @@
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA a.root-servers.nil. hostmaster 1 3600 1200 604800 3600
|
||||
@ SOA a.root-servers.nil. hostmaster 2000010100 3600 1200 604800 3600
|
||||
@ NS a.root-servers.nil.
|
||||
a.root-servers.nil. A 10.53.0.1
|
||||
example NS ns2.example.
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA a.root-servers.nil. hostmaster 1 3600 1200 604800 3600
|
||||
@ SOA a.root-servers.nil. hostmaster 2000010100 3600 1200 604800 3600
|
||||
@ NS ns2
|
||||
ns2 A 10.53.0.2
|
||||
foo CNAME foo.example.
|
||||
|
||||
@@ -55,11 +55,6 @@ zone "verify-axfr" {
|
||||
file "verify-axfr.db.signed";
|
||||
};
|
||||
|
||||
zone "verify-csk" {
|
||||
type master;
|
||||
file "verify-csk.db.signed";
|
||||
};
|
||||
|
||||
zone "verify-ixfr" {
|
||||
type master;
|
||||
file "verify-ixfr.db.signed";
|
||||
|
||||
@@ -32,18 +32,6 @@ done
|
||||
# the "root" zone on ns1.
|
||||
keys_to_trust="$keys_to_trust $keyname1"
|
||||
|
||||
# Prepare a zone signed using a Combined Signing Key (CSK) without the SEP bit
|
||||
# set and add that key to the list of keys to trust.
|
||||
zone=verify-csk
|
||||
infile=verify.db.in
|
||||
zonefile=verify-csk.db
|
||||
|
||||
keyname=`$KEYGEN -a RSASHA256 $zone 2> /dev/null`
|
||||
cat $infile $keyname.key > $zonefile
|
||||
$SIGNER -P -o $zone $zonefile > /dev/null
|
||||
keys_to_trust="$keys_to_trust $keyname"
|
||||
|
||||
# Prepare remaining zones used in the test.
|
||||
ORIGINAL_SERIAL=`awk '$2 == "SOA" {print $5}' verify.db.in`
|
||||
UPDATED_SERIAL_BAD=`expr ${ORIGINAL_SERIAL} + 1`
|
||||
UPDATED_SERIAL_GOOD=`expr ${ORIGINAL_SERIAL} + 2`
|
||||
|
||||
@@ -56,12 +56,6 @@ zone "verify-axfr" {
|
||||
file "verify-axfr.db.mirror";
|
||||
};
|
||||
|
||||
zone "verify-csk" {
|
||||
type mirror;
|
||||
masters { 10.53.0.2; };
|
||||
file "verify-csk.db.mirror";
|
||||
};
|
||||
|
||||
zone "verify-ixfr" {
|
||||
type mirror;
|
||||
masters { 10.53.0.2; };
|
||||
|
||||
@@ -17,20 +17,10 @@ RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
|
||||
|
||||
# Wait until the transfer of the given zone to ns3 either completes successfully
|
||||
# or is aborted by a verification failure or a REFUSED response from the master.
|
||||
# Note that matching on any transfer status is deliberately avoided because some
|
||||
# checks performed by this test cause transfer attempts to end with the "IXFR
|
||||
# failed" status, which is followed by an AXFR retry and this test needs to
|
||||
# check what the result of the latter transfer attempt is.
|
||||
wait_for_transfer() {
|
||||
zone=$1
|
||||
for i in 1 2 3 4 5 6 7 8 9 10; do
|
||||
# Wait until a "freeing transfer context" message is logged
|
||||
# after one of the transfer results we are looking for is
|
||||
# logged. This is needed to prevent races when checking for
|
||||
# "mirror zone is now in use" messages.
|
||||
nextpartpeek ns3/named.run | \
|
||||
awk "matched; /'$zone\/IN'.*Transfer status: (success|verify failure|REFUSED)/ {matched=1}" | \
|
||||
grep "'$zone/IN'.*freeing transfer context" > /dev/null && return
|
||||
nextpartpeek ns3/named.run | egrep "'$zone/IN'.*Transfer status: (success|verify failure|REFUSED)" > /dev/null && return
|
||||
sleep 1
|
||||
done
|
||||
echo_i "exceeded time limit waiting for proof of '$zone' being transferred to appear in ns3/named.run"
|
||||
@@ -44,13 +34,7 @@ wait_for_load() {
|
||||
serial=$2
|
||||
log=$3
|
||||
for i in 1 2 3 4 5 6 7 8 9 10; do
|
||||
# Wait until a "zone_postload: (...): done" message is logged
|
||||
# after one of the loading-related messages we are looking for
|
||||
# is logged. This is needed to prevent races when checking for
|
||||
# "mirror zone is now in use" messages.
|
||||
nextpartpeek $log | \
|
||||
awk "matched; /$zone.*(loaded serial $serial|unable to load)/ {matched=1}" | \
|
||||
grep "zone_postload: zone $zone/IN: done" > /dev/null && return
|
||||
nextpartpeek $log | egrep "$zone.*(loaded serial $serial|unable to load)" > /dev/null && return
|
||||
sleep 1
|
||||
done
|
||||
echo_i "exceeded time limit waiting for proof of '$zone' being loaded to appear in $log"
|
||||
@@ -77,8 +61,7 @@ echo_i "checking that an unsigned mirror zone is rejected ($n)"
|
||||
ret=0
|
||||
wait_for_transfer verify-unsigned
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-unsigned SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-unsigned.*Zone contains no DNSSEC keys" > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-unsigned.*mirror zone is now in use" > /dev/null && ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
@@ -90,32 +73,18 @@ ret=0
|
||||
nextpartreset ns3/named.run
|
||||
wait_for_transfer verify-untrusted
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-untrusted SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-untrusted.*No trusted DNSKEY found" > /dev/null || ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-untrusted.*No trusted KSK DNSKEY found" > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-untrusted.*mirror zone is now in use" > /dev/null && ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo_i "checking that a mirror zone signed using a CSK without the SEP bit set is accepted ($n)"
|
||||
ret=0
|
||||
nextpartreset ns3/named.run
|
||||
wait_for_transfer verify-csk
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-csk SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${ORIGINAL_SERIAL}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-csk.*mirror zone is now in use" > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo_i "checking that an AXFR of an incorrectly signed mirror zone is rejected ($n)"
|
||||
ret=0
|
||||
nextpartreset ns3/named.run
|
||||
wait_for_transfer verify-axfr
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-axfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-axfr SOA" > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null && ret=1
|
||||
@@ -131,7 +100,6 @@ reload_zone verify-axfr ${UPDATED_SERIAL_GOOD}
|
||||
$RNDCCMD 10.53.0.3 retransfer verify-axfr > /dev/null 2>&1
|
||||
wait_for_transfer verify-axfr
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-axfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-axfr.*mirror zone is now in use" > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
@@ -142,14 +110,23 @@ echo_i "checking that an IXFR of an incorrectly signed mirror zone is rejected (
|
||||
nextpartreset ns3/named.run
|
||||
ret=0
|
||||
wait_for_transfer verify-ixfr
|
||||
# Sanity check: the initial, properly signed version of the zone should have
|
||||
# been announced as coming into effect.
|
||||
nextpart ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null || ret=1
|
||||
# Make a copy of the original zone file for reuse in journal tests below.
|
||||
cp ns2/verify-ixfr.db.signed ns3/verify-journal.db.mirror
|
||||
# Wait 1 second so that the zone file timestamp changes and the subsequent
|
||||
# invocation of "rndc reload" triggers a zone reload.
|
||||
# invocation of "rndc reload" triggers a zone reload. This should also be way
|
||||
# more than enough for the log message announcing the mirror zone coming into
|
||||
# effect to appear in the log (see below).
|
||||
sleep 1
|
||||
# Sanity check: the initial, properly signed version of the zone should have
|
||||
# been announced as coming into effect. Note that we cannot check that
|
||||
# immediately after wait_for_transfer() as the latter might return before the
|
||||
# log message we are looking for here appears; we also cannot call nextpart()
|
||||
# after we update the zone on ns2 since there is a possibility of periodic
|
||||
# refreshes triggering an IXFR of the "verify-ixfr" zone before the "rndc
|
||||
# refresh" call below and that possibility needs to be handled as proper
|
||||
# behavior. Thus, we need to look for the log message now.
|
||||
nextpart ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null || ret=1
|
||||
# Update the "verify-ixfr" zone on ns2.
|
||||
cat ns2/verify-ixfr.db.bad.signed > ns2/verify-ixfr.db.signed
|
||||
reload_zone verify-ixfr ${UPDATED_SERIAL_BAD}
|
||||
# Make a copy of the bad zone journal for reuse in journal tests below.
|
||||
@@ -164,9 +141,6 @@ if [ `nextpartpeek ns3/named.run | grep "verify-ixfr.*got incremental response"
|
||||
fi
|
||||
# Ensure the new, bad version of the zone was not accepted.
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
# A positive answer is expected as the original version of the "verify-ixfr"
|
||||
# zone should have been successfully verified.
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
|
||||
# Despite the verification failure for this IXFR, this mirror zone should still
|
||||
@@ -191,7 +165,6 @@ $RNDCCMD 10.53.0.3 refresh verify-ixfr > /dev/null 2>&1
|
||||
wait_for_transfer verify-ixfr
|
||||
# Ensure the new, good version of the zone was accepted.
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
# The log message announcing the mirror zone coming into effect should not have
|
||||
# been logged this time since the mirror zone in question is expected to
|
||||
@@ -206,7 +179,6 @@ ret=0
|
||||
nextpartreset ns3/named.run
|
||||
wait_for_load verify-load ${UPDATED_SERIAL_BAD} ns3/named.run
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-load SOA" > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null && ret=1
|
||||
@@ -222,7 +194,6 @@ nextpart ns3/named.run > /dev/null
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
|
||||
wait_for_load verify-load ${UPDATED_SERIAL_GOOD} ns3/named.run
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-load SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-load.*mirror zone is now in use" > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
@@ -249,7 +220,6 @@ nextpart ns3/named.run > /dev/null
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
|
||||
wait_for_load verify-ixfr ${UPDATED_SERIAL_BAD} ns3/named.run
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "${UPDATED_SERIAL_BAD}.*; serial" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
nextpartpeek ns3/named.run | grep "No correct RSASHA256 signature for verify-ixfr SOA" > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null && ret=1
|
||||
@@ -273,7 +243,6 @@ nextpart ns3/named.run > /dev/null
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} mirror ns3
|
||||
wait_for_load verify-ixfr ${UPDATED_SERIAL_GOOD} ns3/named.run
|
||||
$DIG $DIGOPTS @10.53.0.3 +norec verify-ixfr SOA > dig.out.ns3.test$n 2>&1 || ret=1
|
||||
grep "ANSWER: 0" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "${UPDATED_SERIAL_GOOD}.*; serial" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
nextpartpeek ns3/named.run | grep "verify-ixfr.*mirror zone is now in use" > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
|
||||
@@ -19,6 +19,3 @@ managed-keys.jnl, causing RFC 5011 initialization to fail.
|
||||
|
||||
ns5 is a validator which is prevented from getting a response from the
|
||||
root server, causing key refresh queries to fail.
|
||||
|
||||
ns6 is a validator which has unsupported algorithms, one at start up,
|
||||
one because of an algorithm rollover.
|
||||
|
||||
@@ -16,10 +16,9 @@ rm -f */named.conf
|
||||
rm -f */named.memstats */named.run */named.run.prev
|
||||
rm -f dig.out* delv.out* rndc.out* signer.out*
|
||||
rm -f dsset-. ns1/dsset-.
|
||||
rm -f ns1/zone.key
|
||||
rm -f ns*/managed-keys.bind*
|
||||
rm -f ns*/named.lock
|
||||
rm -f ns1/named.secroots ns1/root.db.signed* ns1/root.db.tmp
|
||||
rm -f ns5/named.args
|
||||
rm -f ns7/view1.mkeys ns7/view2.mkeys
|
||||
rm -f ns6/view1.mkeys ns6/view2.mkeys
|
||||
rm -rf ns4/nope
|
||||
|
||||
@@ -8,16 +8,16 @@
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 20
|
||||
. IN SOA gson.nominum.com. a.root.servers.nil. (
|
||||
2000042100 ; serial
|
||||
600 ; refresh
|
||||
600 ; retry
|
||||
1200 ; expire
|
||||
2 ; minimum
|
||||
)
|
||||
. NS a.root-servers.nil.
|
||||
a.root-servers.nil. A 10.53.0.1
|
||||
. IN SOA gson.nominum.com. a.root.servers.nil. (
|
||||
2000042100 ; serial
|
||||
600 ; refresh
|
||||
600 ; retry
|
||||
1200 ; expire
|
||||
2 ; minimum
|
||||
)
|
||||
. NS a.root-servers.nil.
|
||||
a.root-servers.nil. A 10.53.0.1
|
||||
|
||||
; no delegation
|
||||
|
||||
example. TXT "This is a test."
|
||||
example. TXT "This is a test."
|
||||
|
||||
@@ -26,18 +26,13 @@ cp managed.conf ../ns2/managed.conf
|
||||
cp managed.conf ../ns4/managed.conf
|
||||
cp managed.conf ../ns5/managed.conf
|
||||
|
||||
# Configure a trusted key statement (used by delv).
|
||||
# Configure a trusted key statement (used by delv)
|
||||
keyfile_to_trusted_keys $keyname > trusted.conf
|
||||
|
||||
# Prepare an unsupported algorithm key.
|
||||
unsupportedkey=Kunknown.+255+00000
|
||||
cp unsupported.key "${unsupportedkey}.key"
|
||||
|
||||
#
|
||||
# Save keyname and keyid for managed key id test.
|
||||
#
|
||||
echo "$keyname" > managed.key
|
||||
echo "$zskkeyname" > zone.key
|
||||
keyid=`expr $keyname : 'K\.+00.+\([0-9]*\)'`
|
||||
keyid=`expr $keyid + 0`
|
||||
echo "$keyid" > managed.key.id
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
. IN DNSKEY 257 3 255 BJiXuidPHuGIne8GlCBLG+Oq/FZruQd2s3uBo+SxY16NUP/Vwl8MctMK62KsblDU1gIJAdEMVep2tsOkuSm0bIbJ8NBex+N9rSvzH2YJlDCT9QnNfv4q5RRTcVA3lk9nkmWHo6zcAT33yuS+THOCSznOMCJRq8JGZ6xqMJLv9FucuK6CCe6QBAZ5e98dpyGTWQLu7AERKKFqda9YCk3KQfdzx/HZ4SpQpRLncIXvGm1PIMT8Ar95NB/BsFJGwr5ZTaQtRYOXf2DD7wD3pfMsTJCdZyC0J0EtGBG109I+Oou1cswUfqZLXip/aV3eaBAUqLcZpg8P8vAbrvEq4uMS4OMZeXL6nu0irrdS1Pqmax8RsC+x3fg9EBH3QmHroJZtiU5h+0x4qApp7HE4Z5zFRuxIp9iB
|
||||
@@ -1 +0,0 @@
|
||||
-m record,size,mctx -T clienttest -c named.conf -d 99 -X named.lock -g -T mkeytimers=5/10/20
|
||||
@@ -22,8 +22,8 @@ options {
|
||||
recursion yes;
|
||||
notify no;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
trust-anchor-telemetry no;
|
||||
dnssec-validation auto;
|
||||
bindkeys-file "managed.conf";
|
||||
};
|
||||
|
||||
key rndc_key {
|
||||
@@ -35,9 +35,16 @@ controls {
|
||||
inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||
};
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../common/root.hint";
|
||||
view view1 {
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
};
|
||||
|
||||
include "managed.conf";
|
||||
view view2 {
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
#!/bin/sh -e
|
||||
#
|
||||
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# This Source Code Form is subject to the terms of the Mozilla Public
|
||||
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
#
|
||||
# See the COPYRIGHT file distributed with this work for additional
|
||||
# information regarding copyright ownership.
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
zone=.
|
||||
zonefile=root.db
|
||||
|
||||
# an RSA key
|
||||
rsakey=`$KEYGEN -a rsasha256 -qfk rsasha256.`
|
||||
|
||||
# a key with unsupported algorithm
|
||||
unsupportedkey=Kunknown.+255+00000
|
||||
cp unsupported-managed.key "${unsupportedkey}.key"
|
||||
|
||||
# root key
|
||||
rootkey=`cat ../ns1/managed.key`
|
||||
cp "../ns1/${rootkey}.key" .
|
||||
|
||||
# Configure the resolving server with a managed trusted key.
|
||||
keyfile_to_managed_keys $unsupportedkey $rsakey $rootkey > managed.conf
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user