Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Mark Andrews
|
5ae5788151 | ||
|
Mark Andrews
|
89c596b1eb |
@@ -1,64 +0,0 @@
|
||||
;;; Directory Local Variables
|
||||
;;; For more information see (info "(emacs) Directory Variables")
|
||||
|
||||
((c-mode .
|
||||
((eval .
|
||||
(set (make-local-variable 'directory-of-current-dir-locals-file)
|
||||
(file-name-directory (locate-dominating-file default-directory ".dir-locals.el"))
|
||||
)
|
||||
)
|
||||
(eval .
|
||||
(set (make-local-variable 'include-directories)
|
||||
(list
|
||||
|
||||
;; top directory
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "./"))
|
||||
|
||||
;; current directory
|
||||
(expand-file-name (concat default-directory "./"))
|
||||
|
||||
;; libisc
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/isc/include"))
|
||||
|
||||
;; libdns
|
||||
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/dns/include"))
|
||||
|
||||
;; libisccc
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/isccc/include"))
|
||||
|
||||
;; libisccfg
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/isccfg/include"))
|
||||
|
||||
;; libns
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/ns/include"))
|
||||
|
||||
;; libirs
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/irs/include"))
|
||||
|
||||
;; libbind9
|
||||
(expand-file-name
|
||||
(concat directory-of-current-dir-locals-file "lib/bind9/include"))
|
||||
|
||||
(expand-file-name "/usr/local/opt/openssl@1.1/include")
|
||||
(expand-file-name "/usr/local/opt/libxml2/include/libxml2")
|
||||
(expand-file-name "/usr/local/include")
|
||||
)
|
||||
)
|
||||
)
|
||||
|
||||
(eval setq flycheck-clang-include-path include-directories)
|
||||
(eval setq flycheck-cppcheck-include-path include-directories)
|
||||
)
|
||||
))
|
||||
+27
-49
@@ -1,58 +1,36 @@
|
||||
*-symtbl.c
|
||||
*.a
|
||||
*.gcda
|
||||
*.gcno
|
||||
*.la
|
||||
*.lo
|
||||
*.o
|
||||
*.orig
|
||||
*.plist/ # ccc-analyzer store its results in .plist directories
|
||||
Makefile
|
||||
config.log
|
||||
config.h
|
||||
config.cache
|
||||
config.status
|
||||
libtool
|
||||
/isc-config.sh
|
||||
/configure.lineno
|
||||
autom4te.cache/
|
||||
*.rej
|
||||
*.orig
|
||||
*.o
|
||||
*.lo
|
||||
*.so
|
||||
*.a
|
||||
*.la
|
||||
*.gcno
|
||||
*.gcda
|
||||
*_test
|
||||
*~
|
||||
*-symtbl.c
|
||||
timestamp
|
||||
ans.run
|
||||
named.run
|
||||
named.memstats
|
||||
gen.dSYM/
|
||||
.ccache/
|
||||
.cproject
|
||||
.deps/
|
||||
.dirstamp
|
||||
.libs/
|
||||
# ccc-analyzer store its results in .plist directories
|
||||
*.plist/
|
||||
*~
|
||||
.project
|
||||
.cproject
|
||||
.settings
|
||||
/aclocal.m4
|
||||
/ar-lib
|
||||
/autom4te.cache/
|
||||
/bind.keys.h
|
||||
/compile
|
||||
/config.cache
|
||||
/config.guess
|
||||
/config.h
|
||||
/config.h.in
|
||||
/config.log
|
||||
/config.status
|
||||
/config.sub
|
||||
/configure
|
||||
/configure.lineno
|
||||
/depcomp
|
||||
/install-sh
|
||||
/isc-config.sh
|
||||
/libltdl/*
|
||||
/libtool
|
||||
/ltmain.sh
|
||||
/m4/libtool.m4
|
||||
/m4/ltargz.m4
|
||||
/m4/ltdl.m4
|
||||
/m4/ltoptions.m4
|
||||
/m4/ltsugar.m4
|
||||
/m4/ltversion.m4
|
||||
/m4/lt~obsolete.m4
|
||||
/missing
|
||||
/py-compile
|
||||
/stamp-h1
|
||||
/test-driver
|
||||
Makefile
|
||||
ans.run
|
||||
gen.dSYM/
|
||||
kyua.log
|
||||
named.memstats
|
||||
named.run
|
||||
timestamp
|
||||
kyua.log
|
||||
+275
-480
@@ -1,226 +1,172 @@
|
||||
variables:
|
||||
# Not normally needed, but may be if some script uses `apt-get install`.
|
||||
DEBIAN_FRONTEND: noninteractive
|
||||
# Locale settings do not affect the build, but might affect tests.
|
||||
LC_ALL: C
|
||||
|
||||
DOCKER_DRIVER: overlay2
|
||||
CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
|
||||
CCACHE_DIR: "/ccache"
|
||||
SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
|
||||
|
||||
# VirtualBox driver needs to set build_dir to "/builds" in gitlab-runner.toml
|
||||
KYUA_RESULT: "$CI_PROJECT_DIR/kyua.results"
|
||||
|
||||
BUILD_PARALLEL_JOBS: 6
|
||||
TEST_PARALLEL_JOBS: 6
|
||||
|
||||
stages:
|
||||
- precheck
|
||||
- build
|
||||
- unit
|
||||
- system
|
||||
- docs
|
||||
- test
|
||||
- push
|
||||
|
||||
### Runner Tag Templates
|
||||
|
||||
.linux-amd64: &linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- amd64
|
||||
|
||||
.linux-i386: &linux_i386
|
||||
tags:
|
||||
- linux
|
||||
- i386
|
||||
|
||||
### Docker Image Templates
|
||||
|
||||
# Alpine Linux
|
||||
|
||||
.alpine-3.10-amd64: &alpine_3_10_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:alpine-3.10-amd64"
|
||||
<<: *linux_amd64
|
||||
|
||||
# CentOS
|
||||
|
||||
.centos-centos6-amd64: ¢os_centos6_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
|
||||
<<: *linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.centos-centos7-amd64: ¢os_centos7_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
|
||||
<<: *linux_amd64
|
||||
|
||||
# Debian
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.debian-jessie-amd64: &debian_jessie_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
|
||||
<<: *linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.debian-jessie-i386: &debian_jessie_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
.debian-stretch-amd64: &debian_stretch_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
|
||||
<<: *linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.debian-stretch-i386: &debian_stretch_i386_image
|
||||
.debian-stretch-i386:: &debian_stretch_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
|
||||
<<: *linux_i386
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
.debian-buster-amd64: &debian_buster_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
|
||||
<<: *linux_i386
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.debian-buster-i386:: &debian_buster_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-buster-i386"
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
.debian-sid-amd64: &debian_sid_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
|
||||
<<: *linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.debian-sid-i386: &debian_sid_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
|
||||
<<: *linux_i386
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
# Fedora
|
||||
.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.fedora-30-amd64: &fedora_30_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:fedora-30-amd64"
|
||||
<<: *linux_amd64
|
||||
|
||||
# Ubuntu
|
||||
.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
.ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
|
||||
<<: *linux_amd64
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- amd64
|
||||
|
||||
.ubuntu-xenial-i386: &ubuntu_xenial_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-i386"
|
||||
<<: *linux_i386
|
||||
|
||||
.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
|
||||
<<: *linux_amd64
|
||||
|
||||
.ubuntu-bionic-i386: &ubuntu_bionic_i386_image
|
||||
image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
|
||||
<<: *linux_i386
|
||||
|
||||
### Job Templates
|
||||
|
||||
.default-triggering-rules: &default_triggering_rules
|
||||
only:
|
||||
- merge_requests
|
||||
- tags
|
||||
- web
|
||||
|
||||
.precheck: &precheck_job
|
||||
<<: *default_triggering_rules
|
||||
<<: *debian_sid_amd64_image
|
||||
stage: precheck
|
||||
|
||||
.autoconf: &autoconf_job
|
||||
<<: *default_triggering_rules
|
||||
<<: *debian_sid_amd64_image
|
||||
stage: precheck
|
||||
script:
|
||||
- autoreconf -fi
|
||||
artifacts:
|
||||
untracked: true
|
||||
expire_in: "1 hour"
|
||||
|
||||
.configure: &configure |
|
||||
./configure \
|
||||
--disable-maintainer-mode \
|
||||
--enable-developer \
|
||||
--with-libtool \
|
||||
--with-geoip2=auto \
|
||||
--disable-static \
|
||||
--with-cmocka \
|
||||
--with-libxml2 \
|
||||
--with-json \
|
||||
--prefix=$HOME/.local \
|
||||
--without-make-clean \
|
||||
$EXTRA_CONFIGURE \
|
||||
|| cat config.log
|
||||
tags:
|
||||
- linux
|
||||
- docker
|
||||
- i386
|
||||
|
||||
.build: &build_job
|
||||
<<: *default_triggering_rules
|
||||
stage: build
|
||||
before_script:
|
||||
- test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
|
||||
# - ./autogen.sh
|
||||
script:
|
||||
- *configure
|
||||
- make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
|
||||
- test -z "${RUN_MAKE_INSTALL}" || make install
|
||||
dependencies:
|
||||
- autoreconf:sid:amd64
|
||||
needs:
|
||||
- autoreconf:sid:amd64
|
||||
- ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
|
||||
- make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
|
||||
artifacts:
|
||||
paths:
|
||||
- doc/
|
||||
expire_in: '1 hour'
|
||||
untracked: true
|
||||
expire_in: "1 hour"
|
||||
|
||||
.setup_interfaces: &setup_interfaces |
|
||||
if [ "$(id -u)" -eq "0" ]; then
|
||||
sh -x bin/tests/system/ifconfig.sh up;
|
||||
else
|
||||
sudo sh -x bin/tests/system/ifconfig.sh up;
|
||||
fi
|
||||
|
||||
.setup_softhsm: &setup_softhsm |
|
||||
sh -x util/prepare-softhsm2.sh
|
||||
.install_test: &install_test_job
|
||||
stage: test
|
||||
before_script:
|
||||
- mkdir $HOME/.local
|
||||
script:
|
||||
- make install
|
||||
|
||||
.system_test: &system_test_job
|
||||
<<: *default_triggering_rules
|
||||
stage: system
|
||||
retry: 2
|
||||
stage: test
|
||||
before_script:
|
||||
- *setup_interfaces
|
||||
- *setup_softhsm
|
||||
- rm -rf .ccache
|
||||
- bash -x bin/tests/system/ifconfig.sh up
|
||||
- bash -x util/prepare-softhsm2.sh
|
||||
script:
|
||||
- ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
|
||||
- test -s bin/tests/system/systests.output
|
||||
artifacts:
|
||||
untracked: true
|
||||
expire_in: "1 week"
|
||||
expire_in: '1 week'
|
||||
when: on_failure
|
||||
|
||||
.kyua_report: &kyua_report_html |
|
||||
kyua report-html \
|
||||
--force \
|
||||
--results-file "$KYUA_RESULT" \
|
||||
--results-filter "" \
|
||||
--output kyua_html
|
||||
|
||||
.unit_test: &unit_test_job
|
||||
<<: *default_triggering_rules
|
||||
stage: unit
|
||||
stage: test
|
||||
before_script:
|
||||
- *setup_softhsm
|
||||
- export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
|
||||
- bash -x util/prepare-softhsm2.sh
|
||||
script:
|
||||
- make unit
|
||||
after_script:
|
||||
- *kyua_report_html
|
||||
- kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
|
||||
artifacts:
|
||||
paths:
|
||||
- kyua.log
|
||||
- kyua.results
|
||||
- kyua_html/
|
||||
expire_in: "1 week"
|
||||
- kyua.log
|
||||
- kyua.results
|
||||
- kyua_html/
|
||||
expire_in: '1 week'
|
||||
when: on_failure
|
||||
|
||||
### Job Definitions
|
||||
|
||||
# Jobs in the precheck stage
|
||||
|
||||
autoreconf:sid:amd64:
|
||||
<<: *autoconf_job
|
||||
|
||||
misc:sid:amd64:
|
||||
<<: *precheck_job
|
||||
precheck:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
stage: precheck
|
||||
script:
|
||||
- sh util/check-ans-prereq.sh
|
||||
- sh util/checklibs.sh > checklibs.out
|
||||
- sh util/tabify-changes < CHANGES > CHANGES.tmp
|
||||
- diff -urNap CHANGES CHANGES.tmp
|
||||
- rm CHANGES.tmp
|
||||
- perl util/check-changes CHANGES
|
||||
- perl -w util/merge_copyrights
|
||||
- diff -urNap util/copyrights util/newcopyrights
|
||||
@@ -229,45 +175,27 @@ misc:sid:amd64:
|
||||
- if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
|
||||
- xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
|
||||
- xmllint --noout --nonet --html `git ls-files '*.html'`
|
||||
- sh util/check-win32util-configure
|
||||
artifacts:
|
||||
paths:
|
||||
- util/newcopyrights
|
||||
- checklibs.out
|
||||
expire_in: "1 week"
|
||||
- util/newcopyrights
|
||||
- checklibs.out
|
||||
expire_in: '1 week'
|
||||
when: on_failure
|
||||
|
||||
🐞:sid:amd64:
|
||||
<<: *precheck_job
|
||||
script:
|
||||
- util/check-cocci
|
||||
- if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
|
||||
|
||||
# Jobs for doc builds on Debian Sid (amd64)
|
||||
|
||||
docs:sid:amd64:
|
||||
docs:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
stage: docs
|
||||
stage: test
|
||||
dependencies:
|
||||
- build:debian:sid:amd64
|
||||
script:
|
||||
- ./configure || cat config.log
|
||||
- make -C doc/misc docbook
|
||||
- make -C doc/arm Bv9ARM.html
|
||||
dependencies:
|
||||
- autoreconf:sid:amd64
|
||||
needs:
|
||||
- autoreconf:sid:amd64
|
||||
artifacts:
|
||||
paths:
|
||||
- doc/arm/
|
||||
expire_in: "1 month"
|
||||
only:
|
||||
- merge_requests
|
||||
- tags
|
||||
- web
|
||||
- master@isc-projects/bind9
|
||||
- /^v9_[1-9][0-9]$/@isc-projects/bind9
|
||||
- doc/arm/
|
||||
expire_in: '1 month'
|
||||
|
||||
push:docs:sid:amd64:
|
||||
push:docs:
|
||||
<<: *debian_sid_amd64_image
|
||||
stage: push
|
||||
dependencies: []
|
||||
@@ -275,35 +203,33 @@ push:docs:sid:amd64:
|
||||
- curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
|
||||
only:
|
||||
- master@isc-projects/bind9
|
||||
- /^v9_[1-9][0-9]$/@isc-projects/bind9
|
||||
- /^v9_.*$/@isc-projects/bind9
|
||||
|
||||
# Jobs for regular GCC builds on Alpine Linux 3.10 (amd64)
|
||||
#build:debian:jessie:amd64:
|
||||
# <<: *debian_jessie_amd64_image
|
||||
# <<: *build_job
|
||||
#
|
||||
#build:debian:jessie:i386:
|
||||
# <<: *debian_jessie_i386_image
|
||||
# <<: *build_job
|
||||
#
|
||||
#build:debian:stretch:amd64:
|
||||
# <<: *debian_stretch_amd64_image
|
||||
# <<: *build_job
|
||||
#
|
||||
#build:debian:buster:i386:
|
||||
# <<: *debian_buster_i386_image
|
||||
# <<: *build_job
|
||||
#
|
||||
#build:ubuntu:trusty:amd64:
|
||||
# <<: *ubuntu_trusty_amd64_image
|
||||
# <<: *build_job
|
||||
#
|
||||
#build:ubuntu:xenial:i386:
|
||||
# <<: *ubuntu_xenial_i386_image
|
||||
# <<: *build_job
|
||||
|
||||
gcc:alpine3.10:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--enable-dnstap"
|
||||
<<: *alpine_3_10_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:alpine3.10:amd64:
|
||||
<<: *alpine_3_10_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:alpine3.10:amd64
|
||||
needs: ["gcc:alpine3.10:amd64"]
|
||||
|
||||
unit:gcc:alpine3.10:amd64:
|
||||
<<: *alpine_3_10_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:alpine3.10:amd64
|
||||
needs: ["gcc:alpine3.10:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on CentOS 6 (amd64)
|
||||
|
||||
gcc:centos6:amd64:
|
||||
build:centos:centos6:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
@@ -311,238 +237,45 @@ gcc:centos6:amd64:
|
||||
<<: *centos_centos6_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:centos6:amd64:
|
||||
<<: *centos_centos6_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:centos6:amd64
|
||||
needs: ["gcc:centos6:amd64"]
|
||||
|
||||
unit:gcc:centos6:amd64:
|
||||
<<: *centos_centos6_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:centos6:amd64
|
||||
needs: ["gcc:centos6:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on CentOS 7 (amd64)
|
||||
|
||||
gcc:centos7:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:centos7:amd64:
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:centos7:amd64
|
||||
needs: ["gcc:centos7:amd64"]
|
||||
|
||||
unit:gcc:centos7:amd64:
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:centos7:amd64
|
||||
needs: ["gcc:centos7:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Debian 8 Jessie (amd64)
|
||||
|
||||
gcc:jessie:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--without-cmocka --with-python --disable-geoip"
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:jessie:amd64:
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:jessie:amd64
|
||||
needs: ["gcc:jessie:amd64"]
|
||||
|
||||
unit:gcc:jessie:amd64:
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:jessie:amd64
|
||||
needs: ["gcc:jessie:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Debian 9 Stretch (amd64)
|
||||
|
||||
gcc:stretch:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:stretch:amd64
|
||||
needs: ["gcc:stretch:amd64"]
|
||||
|
||||
unit:gcc:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:stretch:amd64
|
||||
needs: ["gcc:stretch:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Debian 10 Buster (amd64)
|
||||
|
||||
gcc:buster:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
<<: *debian_buster_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:buster:amd64:
|
||||
<<: *debian_buster_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:buster:amd64
|
||||
needs: ["gcc:buster:amd64"]
|
||||
|
||||
unit:gcc:buster:amd64:
|
||||
<<: *debian_buster_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:buster:amd64
|
||||
needs: ["gcc:buster:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Debian Sid (amd64)
|
||||
|
||||
gcc:sid:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O3 -g"
|
||||
EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
|
||||
RUN_MAKE_INSTALL: 1
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:sid:amd64
|
||||
needs: ["gcc:sid:amd64"]
|
||||
|
||||
unit:gcc:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:sid:amd64
|
||||
needs: ["gcc:sid:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Debian Sid (i386)
|
||||
|
||||
gcc:sid:i386:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O3 -g"
|
||||
EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2 --without-python"
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:sid:i386:
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:sid:i386
|
||||
needs: ["gcc:sid:i386"]
|
||||
|
||||
unit:gcc:sid:i386:
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:sid:i386
|
||||
needs: ["gcc:sid:i386"]
|
||||
|
||||
# Jobs for regular GCC builds on Fedora 30 (amd64)
|
||||
|
||||
gcc:fedora30:amd64:
|
||||
build:centos:centos7:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--with-libidn2"
|
||||
<<: *fedora_30_amd64_image
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:fedora30:amd64:
|
||||
<<: *fedora_30_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:fedora30:amd64
|
||||
needs: ["gcc:fedora30:amd64"]
|
||||
build:clang:debian:stretch:amd64:
|
||||
variables:
|
||||
CC: clang
|
||||
CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
unit:gcc:fedora30:amd64:
|
||||
<<: *fedora_30_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:fedora30:amd64
|
||||
needs: ["gcc:fedora30:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
|
||||
|
||||
gcc:xenial:amd64:
|
||||
build:debian:jessie:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--disable-geoip"
|
||||
<<: *ubuntu_xenial_amd64_image
|
||||
EXTRA_CONFIGURE: --without-cmocka
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:xenial:amd64:
|
||||
<<: *ubuntu_xenial_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:xenial:amd64
|
||||
needs: ["gcc:xenial:amd64"]
|
||||
build:debian:stretch:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
unit:gcc:xenial:amd64:
|
||||
<<: *ubuntu_xenial_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:xenial:amd64
|
||||
needs: ["gcc:xenial:amd64"]
|
||||
|
||||
# Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
|
||||
|
||||
gcc:bionic:amd64:
|
||||
build:debian:sid:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--with-libidn2"
|
||||
<<: *ubuntu_bionic_amd64_image
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:gcc:bionic:amd64:
|
||||
<<: *ubuntu_bionic_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- gcc:bionic:amd64
|
||||
needs: ["gcc:bionic:amd64"]
|
||||
|
||||
unit:gcc:bionic:amd64:
|
||||
<<: *ubuntu_bionic_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- gcc:bionic:amd64
|
||||
needs: ["gcc:bionic:amd64"]
|
||||
|
||||
# Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
|
||||
|
||||
asan:sid:amd64:
|
||||
build:asan:debian:sid:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
|
||||
@@ -551,50 +284,118 @@ asan:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:asan:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- asan:sid:amd64
|
||||
needs: ["asan:sid:amd64"]
|
||||
|
||||
unit:asan:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- asan:sid:amd64
|
||||
needs: ["asan:sid:amd64"]
|
||||
|
||||
# Jobs for Clang builds on Debian Stretch (amd64)
|
||||
|
||||
clang:stretch:amd64:
|
||||
build:clang:debian:stretch:i386:
|
||||
variables:
|
||||
CC: clang
|
||||
CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
|
||||
EXTRA_CONFIGURE: "--with-python=python3"
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
unit:clang:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- clang:stretch:amd64
|
||||
needs: ["clang:stretch:amd64"]
|
||||
|
||||
# Jobs for Clang builds on Debian Stretch (i386)
|
||||
|
||||
clang:stretch:i386:
|
||||
variables:
|
||||
CC: clang
|
||||
CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
|
||||
EXTRA_CONFIGURE: "--with-python=python2"
|
||||
<<: *debian_stretch_i386_image
|
||||
<<: *build_job
|
||||
|
||||
# Jobs for PKCS#11-enabled GCC builds on Debian Sid (amd64)
|
||||
build:debian:sid:i386:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
EXTRA_CONFIGURE: "--with-libidn2"
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *build_job
|
||||
|
||||
pkcs11:sid:amd64:
|
||||
unittest:centos:centos6:amd64:
|
||||
<<: *centos_centos6_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:centos:centos6:amd64
|
||||
|
||||
unittest:centos:centos7:amd64:
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:centos:centos7:amd64
|
||||
|
||||
unittest:debian:jessie:amd64:
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:debian:jessie:amd64
|
||||
|
||||
unittest:debian:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:debian:stretch:amd64
|
||||
|
||||
unittest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:debian:sid:amd64
|
||||
|
||||
unittest:asan:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:asan:debian:sid:amd64
|
||||
|
||||
unittest:clang:debian:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:clang:debian:stretch:amd64
|
||||
|
||||
unittest:debian:sid:i386:
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- build:debian:sid:i386
|
||||
|
||||
systemtest:centos:centos6:amd64:
|
||||
<<: *centos_centos6_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:centos:centos6:amd64
|
||||
|
||||
systemtest:centos:centos7:amd64:
|
||||
<<: *centos_centos7_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:centos:centos7:amd64
|
||||
|
||||
systemtest:debian:jessie:amd64:
|
||||
<<: *debian_jessie_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:debian:jessie:amd64
|
||||
|
||||
systemtest:debian:stretch:amd64:
|
||||
<<: *debian_stretch_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:debian:stretch:amd64
|
||||
|
||||
systemtest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:debian:sid:amd64
|
||||
|
||||
systemtest:asan:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:asan:debian:sid:amd64
|
||||
|
||||
systemtest:debian:sid:i386:
|
||||
<<: *debian_sid_i386_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- build:debian:sid:i386
|
||||
|
||||
install:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *install_test_job
|
||||
dependencies:
|
||||
- build:debian:sid:amd64
|
||||
|
||||
pkcs11:build:debian:sid:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -O2 -g"
|
||||
@@ -602,40 +403,34 @@ pkcs11:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:pkcs11:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- pkcs11:sid:amd64
|
||||
needs: ["pkcs11:sid:amd64"]
|
||||
|
||||
unit:pkcs11:sid:amd64:
|
||||
pkcs11:unittest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- pkcs11:sid:amd64
|
||||
needs: ["pkcs11:sid:amd64"]
|
||||
- pkcs11:build:debian:sid:amd64
|
||||
|
||||
# Jobs with libtool disabled
|
||||
pkcs11:systemtest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- pkcs11:build:debian:sid:amd64
|
||||
|
||||
nolibtool:sid:amd64:
|
||||
noassert:build:debian:sid:amd64:
|
||||
variables:
|
||||
CC: gcc
|
||||
CFLAGS: "-Wall -Wextra -Og -g"
|
||||
EXTRA_CONFIGURE: "--with-libidn2 --without-libtool --with-dlopen"
|
||||
CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
|
||||
EXTRA_CONFIGURE: "--with-libidn2"
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *build_job
|
||||
|
||||
system:nolibtool:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- nolibtool:sid:amd64
|
||||
needs: ["nolibtool:sid:amd64"]
|
||||
|
||||
unit:nolibtool:sid:amd64:
|
||||
noassert:unittest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *unit_test_job
|
||||
dependencies:
|
||||
- nolibtool:sid:amd64
|
||||
needs: ["nolibtool:sid:amd64"]
|
||||
- noassert:build:debian:sid:amd64
|
||||
|
||||
noassert:systemtest:debian:sid:amd64:
|
||||
<<: *debian_sid_amd64_image
|
||||
<<: *system_test_job
|
||||
dependencies:
|
||||
- noassert:build:debian:sid:amd64
|
||||
|
||||
@@ -1,21 +1,19 @@
|
||||
## Release Checklist
|
||||
|
||||
- [ ] (Manager) Check for the presence of a milestone for the release:
|
||||
- [ ] (Manager) Check for the presence of a milestone for the release.
|
||||
- If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
|
||||
- [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
|
||||
- (SwEng) Prepare the sources for tarball generation:
|
||||
- [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
|
||||
- (SwEng) Prepare the sources for tarball generation.
|
||||
- [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
|
||||
- [ ] Update API files for libraries with new version information.
|
||||
- [ ] Change software version and library versions in configure.in (new major release only).
|
||||
- [ ] Ensure Kyua and ATF files are correct.
|
||||
- [ ] Rebuild configure using autoconf on docs.isc.org.
|
||||
- [ ] Update CHANGES.
|
||||
- [ ] Update CHANGES.SE (subscription branch only).
|
||||
- [ ] Update "version".
|
||||
- [ ] Update "readme.md".
|
||||
- Check the release notes are correct:
|
||||
- [ ] Compare content with merge requests for the release.
|
||||
- [ ] Check formatting.
|
||||
- [ ] Ensure the release notes are correct for this release (content, formatting, etc.).
|
||||
- [ ] Build documentation on docs.isc.org.
|
||||
- [ ] Commit changes and make sure the gitlab-ci tests are passing.
|
||||
- [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
|
||||
@@ -26,19 +24,9 @@
|
||||
- [ ] (QA) Request the signature on the tarballs.
|
||||
- [ ] (QA) Check signatures on tarballs.
|
||||
- [ ] (QA) Tell Support to handle notification of release.
|
||||
- [ ] (Manager) Inform Marketing of the release
|
||||
- [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
|
||||
- [ ] (Support) Make tarballs and signatures available to download.
|
||||
- [ ] (Manager) Update [https://wiki.isc.org/bin/view/Main/BindReleaseDates](BIND release dates page) when public announcement has been made.
|
||||
- [ ] (Manager) Inform marketing of the release
|
||||
|
||||
- [ ] (SwEng) Update DEB and RPM packages
|
||||
- [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
|
||||
|
||||
## Support
|
||||
- [ ] Make tarballs and signatures available to download.
|
||||
- [ ] Write release email to bind9-announce.
|
||||
- [ ] Write email to bind9-users (if a major release).
|
||||
- [ ] Update tickets in case of waiting support customers.
|
||||
|
||||
## Marketing
|
||||
- [ ] Post short note to Twitter.
|
||||
- [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
|
||||
- [ ] Write blog article (if a major release).
|
||||
|
||||
@@ -1,577 +1,3 @@
|
||||
--- 9.14.6 released ---
|
||||
|
||||
5289. [bug] Address NULL pointer dereference in rpz.c:rpz_detach.
|
||||
[GL #1210]
|
||||
|
||||
5286. [contrib] Address potential NULL pointer dereferences in
|
||||
dlz_mysqldyn_mod.c. [GL #1207]
|
||||
|
||||
5285. [port] win32: implement "-T maxudpXXX". [GL #837]
|
||||
|
||||
5283. [bug] When a response-policy zone expires, ensure that
|
||||
its policies are removed from the RPZ summary
|
||||
database. [GL #1146]
|
||||
|
||||
5282. [bug] Fixed a bug in searching for possible wildcard matches
|
||||
for query names in the RPZ summary database. [GL #1146]
|
||||
|
||||
5281. [cleanup] Don't escape commas when reporting named's command
|
||||
line. [GL #1189]
|
||||
|
||||
5280. [protocol] Add support for displaying EDNS option LLQ. [GL #1201]
|
||||
|
||||
5279. [bug] When loading, reject zones containing CDS or CDNSKEY
|
||||
RRsets at the zone apex if they would cause DNSSEC
|
||||
validation failures if published in the parent zone
|
||||
as the DS RRset. [GL #1187]
|
||||
|
||||
--- 9.14.5 released ---
|
||||
|
||||
5277. [bug] Cache DB statistics could underflow when serve-stale
|
||||
was in use, because of a bug in counter maintenance
|
||||
when RRsets become stale.
|
||||
|
||||
Functions for dumping statistics have been updated
|
||||
to dump active, stale, and ancient statistic
|
||||
counters. Ancient RRset counters are prefixed
|
||||
with '~'; stale RRset counters are still prefixed
|
||||
with '#'. [GL #602]
|
||||
|
||||
5275. [bug] Mark DS records included in referral messages
|
||||
with trust level "pending" so that they can be
|
||||
validated and cached immediately, with no need to
|
||||
re-query. [GL #964]
|
||||
|
||||
5274. [bug] Address potential use after free race when shutting
|
||||
down rpz. [GL #1175]
|
||||
|
||||
5273. [bug] Check that bits [64..71] of a dns64 prefix are zero.
|
||||
[GL #1159]
|
||||
|
||||
5269. [port] cygwin: can return ETIMEDOUT on connect() with a
|
||||
non-blocking socket. [GL #1133]
|
||||
|
||||
5268. [bug] named could crash during configuration if
|
||||
configured to use "geoip continent" ACLs with
|
||||
legacy GeoIP. [GL #1163]
|
||||
|
||||
5266. [bug] named-checkconf failed to report dnstap-output
|
||||
missing from named.conf when dnstap was specified.
|
||||
[GL #1136]
|
||||
|
||||
5265. [bug] DNS64 and RPZ nodata (CNAME *.) rules interacted badly
|
||||
[GL #1106]
|
||||
|
||||
5264. [func] New DNS Cookie algorithm - siphash24 - has been added
|
||||
to BIND 9. [GL #605]
|
||||
|
||||
5236. [func] Add SipHash 2-4 implementation in lib/isc/siphash.c
|
||||
and switch isc_hash_function() to use SipHash 2-4.
|
||||
[GL #605]
|
||||
|
||||
--- 9.14.4 released ---
|
||||
|
||||
5260. [bug] dnstap-read was producing malformed output for large
|
||||
packets. [GL #1093]
|
||||
|
||||
5258. [func] Added support for the GeoIP2 API from MaxMind,
|
||||
when BIND is compiled using "configure --with-geoip2".
|
||||
The legacy GeoIP API can be enabled by using
|
||||
"configure --with-geoip" instead. These options
|
||||
cannot be used together.
|
||||
|
||||
Certain geoip ACL settings that were available with
|
||||
legacy GeoIP are not available when using GeoIP2.
|
||||
See the ARM for details. [GL #182]
|
||||
|
||||
5257. [bug] Some statistics data was not being displayed.
|
||||
Add shading to the zone tables. [GL #1030]
|
||||
|
||||
5256. [bug] Ensure that glue records are included in root
|
||||
priming responses if "minimal-responses" is not
|
||||
set to "yes". [GL #1092]
|
||||
|
||||
5255. [bug] Errors encountered while reloading inline-signing
|
||||
zones could be ignored, causing the zone content to
|
||||
be left in an incompletely updated state rather than
|
||||
reverted. [GL #1109]
|
||||
|
||||
5254. [func] Collect metrics to report to the statistics-channel
|
||||
DNSSEC signing operations (dnssec-sign) and refresh
|
||||
operations (dnssec-refresh) per zone and per keytag.
|
||||
[GL #513]
|
||||
|
||||
5253. [port] Support platforms that don't define ULLONG_MAX.
|
||||
[GL #1098]
|
||||
|
||||
5251. [bug] Statistics were broken in x86 Windows builds.
|
||||
[GL #1081]
|
||||
|
||||
5249. [bug] Fix a possible underflow in recursion clients
|
||||
statistics when hitting recursive clients
|
||||
soft quota. [GL #1067]
|
||||
|
||||
--- 9.14.3 released ---
|
||||
|
||||
5244. [security] Fixed a race condition in dns_dispatch_getnext()
|
||||
that could cause an assertion failure if a
|
||||
significant number of incoming packets were
|
||||
rejected. (CVE-2019-6471) [GL #942]
|
||||
|
||||
5243. [bug] Fix a possible race between dispatcher and socket
|
||||
code in a high-load cold-cache resolver scenario.
|
||||
[GL #943]
|
||||
|
||||
5242. [bug] In relaxed qname minimizatiom mode, fall back to
|
||||
normal resolution when encountering a lame
|
||||
delegation, and use _.domain/A queries rather
|
||||
than domain/NS. [GL #1055]
|
||||
|
||||
5241. [bug] Fix Ed448 private and public key ASN.1 prefix blobs.
|
||||
[GL #225]
|
||||
|
||||
5240. [bug] Remove key id calculation for RSAMD5. [GL #996]
|
||||
|
||||
5238. [bug] Fix a possible deadlock in TCP code. [GL #1046]
|
||||
|
||||
5237. [bug] Recurse to find the root server list with 'dig +trace'.
|
||||
[GL #1028]
|
||||
|
||||
5234. [port] arm: just use the compiler's default support for
|
||||
yield. [GL #981]
|
||||
|
||||
--- 9.14.2 released ---
|
||||
|
||||
5233. [bug] Negative trust anchors did not work with "forward only;"
|
||||
to validating resolvers. [GL #997]
|
||||
|
||||
5231. [protocol] Add support for displaying CLIENT-TAG and SERVER-TAG.
|
||||
[GL #960]
|
||||
|
||||
5229. [protocol] Enforce known SSHFP fingerprint lengths. [GL #852]
|
||||
|
||||
5228. [cleanup] If trusted-keys and managed-keys are configured
|
||||
simultaneously for the same name, the key cannot
|
||||
be rolled automatically. This configuration now
|
||||
logs a warning. [GL #868]
|
||||
|
||||
5224. [bug] Only test provide-ixfr on TCP streams. [GL #991]
|
||||
|
||||
5223. [bug] Fixed a race in the filter-aaaa plugin accessing
|
||||
the hash table. [GL #1005]
|
||||
|
||||
5222. [bug] 'delv -t ANY' could leak memory. [GL #983]
|
||||
|
||||
5221. [test] Enable parallel execution of system tests on
|
||||
Windows. [GL !4101]
|
||||
|
||||
5220. [cleanup] Refactor the isc_stat structure to take advantage
|
||||
of stdatomic. [GL !1493]
|
||||
|
||||
5219. [bug] Fixed a race in the filter-aaaa plugin that could
|
||||
trigger a crash when returning an instance object
|
||||
to the memory pool. [GL #982]
|
||||
|
||||
5218. [bug] Conditionally include <dlfcn.h>. [GL #995]
|
||||
|
||||
5217. [bug] Restore key id calculation for RSAMD5. [GL #996]
|
||||
|
||||
5216. [bug] Fetches-per-zone counter wasn't updated correctly
|
||||
when doing qname minimization. [GL #992]
|
||||
|
||||
5215. [bug] Change #5124 was incomplete; named could still
|
||||
return FORMERR instead of SERVFAIL in some cases.
|
||||
[GL #990]
|
||||
|
||||
5214. [bug] win32: named now removes its lock file upon shutdown.
|
||||
[GL #979]
|
||||
|
||||
5213. [bug] win32: Eliminated a race which allowed named.exe running
|
||||
as a service to be killed prematurely during shutdown.
|
||||
[GL #978]
|
||||
|
||||
5211. [bug] Allow out-of-zone additional data to be included
|
||||
in authoritative responses if recursion is allowed
|
||||
and "minimal-responses" is disabled. This behavior
|
||||
was inadvertently removed in change #4605. [GL #817]
|
||||
|
||||
5210. [bug] When dnstap is enabled and recursion is not
|
||||
available, incoming queries are now logged
|
||||
as "auth". Previously, this depended on whether
|
||||
recursion was requested by the client, not on
|
||||
whether recursion was available. [GL #963]
|
||||
|
||||
5209. [bug] When update-check-ksk is true, add_sigs was not
|
||||
considering offline keys, leaving record sets signed
|
||||
with the incorrect type key. [GL #763]
|
||||
|
||||
5208. [test] Run valid rdata wire encodings through totext+fromtext
|
||||
and tofmttext+fromtext methods to check these methods.
|
||||
[GL #899]
|
||||
|
||||
5207. [test] Check delv and dig TTL values. [GL #965]
|
||||
|
||||
5206. [bug] Delv could print out bad TTLs. [GL #965]
|
||||
|
||||
5205. [bug] Enforce that a DS hash exists. [GL #899]
|
||||
|
||||
5204. [test] Check that dns_rdata_fromtext() produces a record that
|
||||
will be accepted by dns_rdata_fromwire(). [GL #852]
|
||||
|
||||
5203. [bug] Enforce whether key rdata exists or not in KEY,
|
||||
DNSKEY, CDNSKEY and RKEY. [GL #899]
|
||||
|
||||
5202. [bug] <dns/ecs.h> was missing ISC_LANG_ENDDECLS. [GL #976]
|
||||
|
||||
5190. [bug] Ignore trust anchors using disabled algorithms.
|
||||
[GL #806]
|
||||
|
||||
--- 9.14.1 released ---
|
||||
|
||||
5201. [bug] Fix a possible deadlock in RPZ update code. [GL #973]
|
||||
|
||||
5200. [security] tcp-clients settings could be exceeded in some cases,
|
||||
which could lead to exhaustion of file descriptors.
|
||||
(CVE-2018-5743) [GL #615]
|
||||
|
||||
5199. [security] In certain configurations, named could crash
|
||||
if nxdomain-redirect was in use and a redirected
|
||||
query resulted in an NXDOMAIN from the cache.
|
||||
(CVE-2019-6467) [GL #880]
|
||||
|
||||
5198. [bug] If a fetch context was being shut down and, at the same
|
||||
time, we returned from qname minimization, an INSIST
|
||||
could be hit. [GL #966]
|
||||
|
||||
5197. [bug] dig could die in best effort mode on multiple SIG(0)
|
||||
records. Similarly on multiple OPT and multiple TSIG
|
||||
records. [GL #920]
|
||||
|
||||
5196. [bug] make install failed with --with-dlopen=no. [GL #955]
|
||||
|
||||
5195. [bug] "allow-update" and "allow-update-forwarding" were
|
||||
treated as configuration errors if used at the
|
||||
options or view level. [GL #913]
|
||||
|
||||
5194. [bug] Enforce non empty ZOMEMD hash. [GL #899]
|
||||
|
||||
5193. [bug] EID and NIMLOC failed to do multi-line output
|
||||
correctly. [GL #899]
|
||||
|
||||
5189. [cleanup] Remove revoked root DNSKEY from bind.keys. [GL #945]
|
||||
|
||||
5187. [test] Set time zone before running any tests in dnstap_test.
|
||||
[GL #940]
|
||||
|
||||
5186. [cleanup] More dnssec-keygen manual tidying. [GL !1678]
|
||||
|
||||
5184. [bug] Missing unlocks in sdlz.c. [GL #936]
|
||||
|
||||
5183. [bug] Reinitialize ECS data before reusing client
|
||||
structures. [GL #881]
|
||||
|
||||
--- 9.14.0 released ---
|
||||
|
||||
--- 9.14.0rc3 released ---
|
||||
|
||||
5182. [bug] Fix a high-load race/crash in handling of
|
||||
isc_socket_close() in resolver. [GL #834]
|
||||
|
||||
5180. [bug] delv now honors the operating system's preferred
|
||||
ephemeral port range. [GL #925]
|
||||
|
||||
5179. [cleanup] Replace some vague type declarations with the more
|
||||
specific dns_secalg_t and dns_dsdigest_t.
|
||||
Thanks to Tony Finch. [GL !1498]
|
||||
|
||||
5178. [bug] Handle EDQUOT (disk quota) and ENOSPC (disk full)
|
||||
errors when writing files. [GL #902]
|
||||
|
||||
5177. [func] Add the ability to specify in named.conf whether a
|
||||
response-policy zone's SOA record should be added
|
||||
to the additional section (add-soa yes/no). [GL #865]
|
||||
|
||||
5167. [bug] nxdomain-redirect could sometimes lookup the wrong
|
||||
redirect name. [GL #892]
|
||||
|
||||
--- 9.14.0rc2 released ---
|
||||
|
||||
5176. [tests] Remove a dependency on libxml in statschannel system
|
||||
test. [GL #926]
|
||||
|
||||
5175. [bug] Fixed a problem with file input in dnssec-keymgr,
|
||||
dnssec-coverage and dnssec-checkds when using
|
||||
python3. [GL #882]
|
||||
|
||||
5174. [doc] Tidy dnssec-keygen manual. [GL !1557]
|
||||
|
||||
5173. [bug] Fixed a race in socket code that could occur when
|
||||
accept, send, or recv were called from an event
|
||||
loop but the socket had been closed by another
|
||||
thread. [RT #874]
|
||||
|
||||
5172. [bug] nsupdate now honors the operating system's preferred
|
||||
ephemeral port range. [GL #905]
|
||||
|
||||
5171. [func] named plugins are now installed into a separate
|
||||
directory. Supplying a filename (a string without path
|
||||
separators) in a "plugin" configuration stanza now
|
||||
causes named to look for that plugin in that directory.
|
||||
[GL #878]
|
||||
|
||||
5170. [test] Added --with-dlz-filesystem to feature-test. [GL !1587]
|
||||
|
||||
5169. [bug] The presence of certain types in an otherwise
|
||||
empty node could cause a crash while processing a
|
||||
type ANY query. [GL #901]
|
||||
|
||||
--- 9.14.0rc1 released ---
|
||||
|
||||
5168. [bug] Do not crash on shutdown when RPZ fails to load. Also,
|
||||
keep previous version of the database if RPZ fails to
|
||||
load. [GL #813]
|
||||
|
||||
5165. [contrib] Removed SDB drivers from contrib; they're obsolete.
|
||||
[GL #428]
|
||||
|
||||
5164. [bug] Correct errno to result translation in dlz filesystem
|
||||
modules. [GL #884]
|
||||
|
||||
5163. [cleanup] Out-of-tree builds failed --enable-dnstap. [GL #836]
|
||||
|
||||
5162. [cleanup] Improve dnssec-keymgr manual. Thanks to Tony Finch.
|
||||
[GL !1518]
|
||||
|
||||
5161. [bug] Do not require the SEP bit to be set for mirror zone
|
||||
trust anchors. [GL #873]
|
||||
|
||||
5160. [contrib] Added DNAME support to the DLZ LDAP schema. Also
|
||||
fixed a compilation bug affecting several DLZ
|
||||
modules. [GL #872]
|
||||
|
||||
5159. [bug] dnssec-coverage was incorrectly ignoring
|
||||
names specified on the command line without
|
||||
trailing dots. [GL !1478]
|
||||
|
||||
5158. [protocol] Add support for AMTRELAY and ZONEMD. [GL #867]
|
||||
|
||||
5157. [bug] Nslookup now errors out if there are extra command
|
||||
line arguments. [GL #207]
|
||||
|
||||
5141. [security] Zone transfer controls for writable DLZ zones were
|
||||
not effective as the allowzonexfr method was not being
|
||||
called for such zones. (CVE-2019-6465) [GL #790]
|
||||
|
||||
5118. [security] Named could crash if it is managing a key with
|
||||
`managed-keys` and the authoritative zone is rolling
|
||||
the key to an unsupported algorithm. (CVE-2018-5745)
|
||||
[GL #780]
|
||||
|
||||
5110. [security] Named leaked memory if there were multiple Key Tag
|
||||
EDNS options present. (CVE-2018-5744) [GL #772]
|
||||
|
||||
--- 9.13.6 released ---
|
||||
|
||||
5156. [doc] Extended and refined the section of the ARM describing
|
||||
mirror zones. [GL #774]
|
||||
|
||||
5155. [func] "named -V" now outputs the default paths to
|
||||
named.conf, rndc.conf, bind.keys, and other
|
||||
files used or created by named and other tools, so
|
||||
that the correct paths to these files can quickly be
|
||||
determined regardless of the configure settings
|
||||
used when BIND was built. [GL #859]
|
||||
|
||||
5154. [bug] dig: process_opt could be called twice on the same
|
||||
message leading to a assertion failure. [GL #860]
|
||||
|
||||
5153. [func] Zone transfer statistics (size, number of records, and
|
||||
number of messages) are now logged for outgoing
|
||||
transfers as well as incoming ones. [GL #513]
|
||||
|
||||
5152. [func] Improved logging of DNSSEC key events:
|
||||
- Zone signing and DNSKEY maintenance events are
|
||||
now logged to the "dnssec" category
|
||||
- Messages are now logged when DNSSEC keys are
|
||||
published, activated, inactivated, deleted,
|
||||
or revoked.
|
||||
[GL #714]
|
||||
|
||||
5151. [func] Options that have been been marked as obsolete in
|
||||
named.conf for a very long time are now fatal
|
||||
configuration errors. [GL #358]
|
||||
|
||||
5150. [cleanup] Remove the ability to compile BIND with assertions
|
||||
disabled. [GL #735]
|
||||
|
||||
5149. [func] "rndc dumpdb" now prints a line above a stale RRset
|
||||
indicating how long the data will be retained in the
|
||||
cache for emergency use. [GL #101]
|
||||
|
||||
5148. [bug] named did not sign the TKEY response. [GL #821]
|
||||
|
||||
5147. [bug] dnssec-keymgr: Add a five-minute margin to better
|
||||
handle key events close to 'now'. [GL #848]
|
||||
|
||||
5146. [placeholder]
|
||||
|
||||
5145. [func] Use atomics instead of locked variables for isc_quota
|
||||
and isc_counter. [GL !1389]
|
||||
|
||||
5144. [bug] dig now returns a non-zero exit code when a TCP
|
||||
connection is prematurely closed by a peer more than
|
||||
once for the same lookup. [GL #820]
|
||||
|
||||
5143. [bug] dnssec-keymgr and dnssec-coverage failed to find
|
||||
key files for zone names ending in ".". [GL #560]
|
||||
|
||||
5142. [cleanup] Removed "configure --disable-rpz-nsip" and
|
||||
"--disable-rpz-nsdname" options. "nsip-enable"
|
||||
and "nsdname-enable" both now default to yes,
|
||||
regardless of compile-time settings. [GL #824]
|
||||
|
||||
5140. [bug] Don't immediately mark existing keys as inactive and
|
||||
deleted when running dnssec-keymgr for the first
|
||||
time. [GL #117]
|
||||
|
||||
5139. [bug] If possible, don't use forwarders when priming.
|
||||
This ensures we can get root server IP addresses
|
||||
from priming query response glue, which may not
|
||||
be present if the forwarding server is returning
|
||||
minimal responses. [GL #752]
|
||||
|
||||
5138. [bug] Under some circumstances named could hit an assertion
|
||||
failure when doing qname minimization when using
|
||||
forwarders. [GL #797]
|
||||
|
||||
5137. [func] named now logs messages whenever a mirror zone becomes
|
||||
usable or unusable for resolution purposes. [GL #818]
|
||||
|
||||
5136. [cleanup] Check in named-checkconf that allow-update and
|
||||
allow-update-forwarding are not set at the
|
||||
view/options level; fix documentation. [GL #512]
|
||||
|
||||
5135. [port] sparc: Use smt_pause() instead of pause. [GL #816]
|
||||
|
||||
5134. [bug] win32: WSAStartup was not called before getservbyname
|
||||
was called. [GL #590]
|
||||
|
||||
5133. [bug] 'rndc managed-keys' didn't handle class and view
|
||||
correctly and failed to add new lines between each
|
||||
view. [GL !1327]
|
||||
|
||||
5132. [bug] Fix race condition in cleanup part of dns_dt_create().
|
||||
[GL !1323]
|
||||
|
||||
5131. [cleanup] Address Coverity warnings. [GL #801]
|
||||
|
||||
5130. [cleanup] Remove support for l10n message catalogs. [GL #709]
|
||||
|
||||
5129. [contrib] sdlz_helper.c:build_querylist was not properly
|
||||
splitting the query string. [GL #798]
|
||||
|
||||
5128. [bug] Refreshkeytime was not being updated for managed
|
||||
keys zones. [GL #784]
|
||||
|
||||
5127. [bug] rcode.c:maybe_numeric failed to handle NUL in text
|
||||
regions. [GL #807]
|
||||
|
||||
5126. [bug] Named incorrectly accepted empty base64 and hex encoded
|
||||
fields when reading master files. [GL #807]
|
||||
|
||||
5125. [bug] Allow for up to 100 records or 64k of data when caching
|
||||
a negative response. [GL #804]
|
||||
|
||||
5124. [bug] Named could incorrectly return FORMERR rather than
|
||||
SERVFAIL. [GL #804]
|
||||
|
||||
5123. [bug] dig could hang indefinitely after encountering an error
|
||||
before creating a TCP socket. [GL #692]
|
||||
|
||||
5122. [bug] In a "forward first;" configuration, a forwarder
|
||||
timeout did not prevent that forwarder from being
|
||||
queried again after falling back to full recursive
|
||||
resolution. [GL #315]
|
||||
|
||||
5121. [contrib] dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none
|
||||
matching zone names. [GL !1299]
|
||||
|
||||
5120. [placeholder]
|
||||
|
||||
5119. [placeholder]
|
||||
|
||||
5117. [placeholder]
|
||||
|
||||
5116. [bug] Named/named-checkconf triggered a assertion when
|
||||
a mirror zone's name is bad. [GL #778]
|
||||
|
||||
5115. [bug] Allow unsupported algorithms in zone when not used for
|
||||
signing with dnssec-signzone. [GL #783]
|
||||
|
||||
5114. [func] Include a 'reconfig/reload in progress' status line
|
||||
in rndc status, use it in tests.
|
||||
|
||||
5113. [port] Fixed a Windows build error.
|
||||
|
||||
5112. [bug] Named/named-checkconf could dump core if there was
|
||||
a missing masters clause and a bad notify clause.
|
||||
[GL #779]
|
||||
|
||||
5111. [bug] Occluded DNSKEY records could make it into the
|
||||
delegating NSEC/NSEC3 bitmap. [GL #742]
|
||||
|
||||
5109. [cleanup] Remove support for RSAMD5 algorithm. [GL #628]
|
||||
|
||||
--- 9.13.5 released ---
|
||||
|
||||
5108. [bug] Named could fail to determine bottom of zone when
|
||||
removing out of date keys leading to invalid NSEC
|
||||
and NSEC3 records being added to the zone. [GL #771]
|
||||
|
||||
5107. [bug] 'host -U' did not work. [GL #769]
|
||||
|
||||
5106. [experimental] A new "plugin" mechanism has been added to allow
|
||||
extension of query processing functionality through
|
||||
the use of dynamically loadable libraries. A
|
||||
"filter-aaaa.so" plugin has been implemented,
|
||||
replacing the filter-aaaa feature that was formerly
|
||||
implemented as a native part of BIND.
|
||||
|
||||
The "filter-aaaa", "filter-aaaa-on-v4" and
|
||||
"filter-aaaa-on-v6" options can no longer be
|
||||
configured using native named.conf syntax. However,
|
||||
loading the filter-aaaa.so plugin and setting its
|
||||
parameters provides identical functionality.
|
||||
|
||||
Note that the plugin API is a work in progress and
|
||||
is likely to evolve as further plugins are
|
||||
implemented. [GL #15]
|
||||
|
||||
5105. [bug] Fix a race between process_fd and socketclose in
|
||||
unix socket code. [GL #744]
|
||||
|
||||
5104. [cleanup] Log clearer informational message when a catz zone
|
||||
is overridden by a zone in named.conf.
|
||||
Thanks to Tony Finch. [GL !1157]
|
||||
|
||||
5103. [bug] Add missing design by contract tests to dns_catz*.
|
||||
[GL #748]
|
||||
|
||||
5102. [bug] dnssec-coverage failed to use the default TTL when
|
||||
checking KSK deletion times leading to a exception.
|
||||
[GL #585]
|
||||
|
||||
5101. [bug] Fix default installation path for Python modules and
|
||||
remove the dnspython dependency accidentally introduced
|
||||
by change 4970. [GL #730]
|
||||
|
||||
5100. [func] Pin resolver tasks to specific task queues. [GL !1117]
|
||||
|
||||
5099. [func] Failed mutex and conditional creations are always
|
||||
fatal. [GL #674]
|
||||
|
||||
--- 9.13.4 released ---
|
||||
|
||||
5098. [func] Failed memory allocations are now fatal. [GL #674]
|
||||
|
||||
5097. [cleanup] Remove embedded ATF unit testing framework
|
||||
@@ -598,8 +24,8 @@
|
||||
5091. [func] Two new global and per-view options min-cache-ttl
|
||||
and min-ncache-ttl [GL #613]
|
||||
|
||||
5090. [bug] dig and mdig failed to properly pre-parse dash value
|
||||
pairs when value was a separate argument and started
|
||||
5090. [bug] dig and mdig failed to properly preparse dash value
|
||||
pairs when value was a seperate argument and started
|
||||
with a dash. [GL #584]
|
||||
|
||||
5089. [bug] Restore localhost fallback in dig and host which is
|
||||
@@ -665,7 +91,7 @@
|
||||
5072. [bug] Add unit tests for isc_buffer_copyregion() and fix its
|
||||
behavior for auto-reallocated buffers. [GL #644]
|
||||
|
||||
5071. [bug] Comparison of NXT records was broken. [GL #631]
|
||||
5071. [bug] Comparision of NXT records was broken. [GL #631]
|
||||
|
||||
5070. [bug] Record types which support a empty rdata field were
|
||||
not handling the empty rdata field case. [GL #638]
|
||||
@@ -684,7 +110,7 @@
|
||||
|
||||
5065. [bug] Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
|
||||
|
||||
5064. [test] Initialize TZ environment variable before calling
|
||||
5064. [test] Initalize TZ environment variable before calling
|
||||
dns_test_begin in dnstap_test. [GL #624]
|
||||
|
||||
5063. [test] In statschannel test try a few times before failing
|
||||
@@ -910,7 +336,7 @@
|
||||
5001. [bug] Fix refcount errors on error paths. [GL !563]
|
||||
|
||||
5000. [bug] named_server_servestale() could leave the server in
|
||||
exclusive mode if an error occurred. [GL #441]
|
||||
exclusive mode if an error occured. [GL #441]
|
||||
|
||||
4999. [cleanup] Remove custom printf implementation in lib/isc/print.c.
|
||||
[GL #261]
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
CONTRIBUTING
|
||||
|
||||
BIND Source Access and Contributor Guidelines
|
||||
|
||||
Feb 22, 2018
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
Copyright (C) 1996-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright (C) 1996-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
This Source Code Form is subject to the terms of the Mozilla Public
|
||||
License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
HISTORY
|
||||
|
||||
Functional enhancements from prior major releases of BIND 9
|
||||
|
||||
BIND 9.11
|
||||
@@ -433,11 +431,11 @@ BIND 9.4.0
|
||||
* Detect duplicates of UDP queries we are recursing on and drop them.
|
||||
New stats category "duplicates".
|
||||
* "USE INTERNAL MALLOC" is now runtime selectable.
|
||||
* The lame cache is now done on a <qname,qclass,qtype> basis as some
|
||||
servers only appear to be lame for certain query types.
|
||||
* The lame cache is now done on a basis as some servers only appear to
|
||||
be lame for certain query types.
|
||||
* Limit the number of recursive clients that can be waiting for a single
|
||||
query (<qname,qtype,qclass>) to resolve. New options clients-per-query
|
||||
and max-clients-per-query.
|
||||
query () to resolve. New options clients-per-query and
|
||||
max-clients-per-query.
|
||||
* dig: report the number of extra bytes still left in the packet after
|
||||
processing all the records.
|
||||
* Support for IPSECKEY rdata type.
|
||||
|
||||
+5
-5
@@ -97,27 +97,27 @@ test-force:
|
||||
exit $$status
|
||||
|
||||
README: README.md
|
||||
${PANDOC} --email-obfuscation=none -s --metadata title="README" -f markdown-smart -t html README.md | \
|
||||
${PANDOC} --email-obfuscation=none -s -t html README.md | \
|
||||
${W3M} -dump -cols 75 -O ascii -T text/html | \
|
||||
sed -e '$${/^$$/d;}' > $@
|
||||
|
||||
HISTORY: HISTORY.md
|
||||
${PANDOC} --email-obfuscation=none -s --metadata title="HISTORY" -f markdown-smart -t html HISTORY.md | \
|
||||
${PANDOC} --email-obfuscation=none -s -t html HISTORY.md | \
|
||||
${W3M} -dump -cols 75 -O ascii -T text/html | \
|
||||
sed -e '$${/^$$/d;}' > $@
|
||||
|
||||
OPTIONS: OPTIONS.md
|
||||
${PANDOC} --email-obfuscation=none -s --metadata title="OPTIONS" -f markdown-smart -t html OPTIONS.md | \
|
||||
${PANDOC} --email-obfuscation=none -s -t html OPTIONS.md | \
|
||||
${W3M} -dump -cols 75 -O ascii -T text/html | \
|
||||
sed -e '$${/^$$/d;}' > $@
|
||||
|
||||
CONTRIBUTING: CONTRIBUTING.md
|
||||
${PANDOC} --email-obfuscation=none -s --metadata title="CONTRIBUTING" -f markdown-smart -t html CONTRIBUTING.md | \
|
||||
${PANDOC} --email-obfuscation=none -s -t html CONTRIBUTING.md | \
|
||||
${W3M} -dump -cols 75 -O ascii -T text/html | \
|
||||
sed -e '$${/^$$/d;}' > $@
|
||||
|
||||
PLATFORMS: PLATFORMS.md
|
||||
${PANDOC} --email-obfuscation=none -s --metadata title="PLATFORMS" -f markdown-smart -t html PLATFORMS.md | \
|
||||
${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
|
||||
${W3M} -dump -cols 75 -O ascii -T text/html | \
|
||||
sed -e '$${/^$$/d;}' > $@
|
||||
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
OPTIONS
|
||||
|
||||
Setting the STD_CDEFINES environment variable before running configure can
|
||||
be used to enable certain compile-time options that are not explicitly
|
||||
defined in configure.
|
||||
|
||||
Some of these settings are:
|
||||
|
||||
Setting Description
|
||||
Setting Description
|
||||
Overwrite memory with tag values when allocating
|
||||
-DISC_MEM_DEFAULTFILL=1 or freeing it; this impairs performance but
|
||||
makes debugging of memory problems easier.
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
PLATFORMS
|
||||
|
||||
Supported platforms
|
||||
|
||||
In general, this version of BIND will build and run on any POSIX-compliant
|
||||
@@ -15,61 +13,49 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
Regularly tested platforms
|
||||
|
||||
As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
As of May 2018, BIND 9.13 is tested on the following systems:
|
||||
|
||||
* Debian 8, 9, 10
|
||||
* Debian 8, 9
|
||||
* Ubuntu 16.04, 18.04
|
||||
* Fedora 28, 29
|
||||
* Red Hat Enterprise Linux / CentOS 6, 7
|
||||
* FreeBSD 11.x
|
||||
* OpenBSD 6.2, 6.3
|
||||
* Fedora 27, 28
|
||||
* Red Hat/CentOS 6, 7
|
||||
* FreeBSD 10.x, 11.x
|
||||
* OpenBSD 6.3
|
||||
|
||||
The amd64, i386, armhf and arm64 CPU architectures are all fully
|
||||
supported.
|
||||
|
||||
Best effort
|
||||
|
||||
The following are platforms on which BIND is known to build and run. ISC
|
||||
makes every effort to fix bugs on these platforms, but may be unable to do
|
||||
so quickly due to lack of hardware, less familiarity on the part of
|
||||
engineering staff, and other constraints. With the exception of Windows
|
||||
Server 2012 R2, none of these are tested regularly by ISC.
|
||||
The following are platforms on which BIND is known to build and run, but
|
||||
on which it is not routinely tested. ISC makes every effort to fix bugs on
|
||||
these platforms, but may be unable to do so quickly due to lack of
|
||||
hardware, less familiarity on the part of engineering staff, and other
|
||||
constraints.
|
||||
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* Windows 10 / x64
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* macOS 10.12+
|
||||
* Solaris 11
|
||||
* FreeBSD 10.x, 12.0+
|
||||
* OpenBSD 6.4+
|
||||
* Solaris 10
|
||||
* FreeBSD 12+
|
||||
* OpenBSD 6.2
|
||||
* NetBSD
|
||||
* Other Linux distributions still supported by their vendors, such as:
|
||||
* Older or less popular Linux distributions still supported by their
|
||||
vendors, such as:
|
||||
+ Ubuntu 14.04, 18.10+
|
||||
+ Gentoo
|
||||
+ Arch Linux
|
||||
+ ArchLinux
|
||||
+ Alpine Linux
|
||||
* OpenWRT/LEDE 17.01+
|
||||
* OpenWRT/LEDE 17.0
|
||||
* Other CPU architectures (mips, mipsel, sparc, ...)
|
||||
|
||||
Unsupported platforms
|
||||
|
||||
These are platforms on which BIND 9.14 is known not to build or run:
|
||||
These are platforms on which BIND is known not to build or run:
|
||||
|
||||
* Platforms without at least OpenSSL 1.0.2
|
||||
* Windows 10 / x86
|
||||
* Windows Server 2012 and older
|
||||
* Solaris 10 and older
|
||||
* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
|
||||
* Platforms that don't support atomic operations (via compiler or
|
||||
library)
|
||||
* Linux without NPTL (Native POSIX Thread Library)
|
||||
|
||||
Platform quirks
|
||||
|
||||
NetBSD 6 i386
|
||||
|
||||
The i386 build of NetBSD requires the libatomic library, available from
|
||||
the gcc5-libs package. Because this library is in a non-standard path, its
|
||||
location must be specified in the configure command line:
|
||||
|
||||
LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
|
||||
|
||||
+43
-26
@@ -23,61 +23,78 @@ offer support on a "best effort" basis for some.
|
||||
|
||||
### Regularly tested platforms
|
||||
|
||||
As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
|
||||
following systems:
|
||||
As of May 2018, BIND 9.13 is tested on the following systems:
|
||||
|
||||
* Debian 8, 9, 10
|
||||
* Debian 8, 9
|
||||
* Ubuntu 16.04, 18.04
|
||||
* Fedora 28, 29
|
||||
* Red Hat Enterprise Linux / CentOS 6, 7
|
||||
* FreeBSD 11.x
|
||||
* OpenBSD 6.2, 6.3
|
||||
* Fedora 27, 28
|
||||
* Red Hat/CentOS 6, 7
|
||||
* FreeBSD 10.x, 11.x
|
||||
* OpenBSD 6.3
|
||||
|
||||
The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
|
||||
|
||||
### Best effort
|
||||
|
||||
The following are platforms on which BIND is known to build and run.
|
||||
ISC makes every effort to fix bugs on these platforms, but may be unable to
|
||||
do so quickly due to lack of hardware, less familiarity on the part of
|
||||
engineering staff, and other constraints. With the exception of Windows
|
||||
Server 2012 R2, none of these are tested regularly by ISC.
|
||||
The following are platforms on which BIND is known to build and run,
|
||||
but on which it is not routinely tested. ISC makes every effort to fix bugs
|
||||
on these platforms, but may be unable to do so quickly due to lack of
|
||||
hardware, less familiarity on the part of engineering staff, and other
|
||||
constraints.
|
||||
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* Windows 10 / x64
|
||||
* Windows Server 2012 R2, 2016 / x64
|
||||
* macOS 10.12+
|
||||
* Solaris 11
|
||||
* FreeBSD 10.x, 12.0+
|
||||
* OpenBSD 6.4+
|
||||
* Solaris 10
|
||||
* FreeBSD 12+
|
||||
* OpenBSD 6.2
|
||||
* NetBSD
|
||||
* Other Linux distributions still supported by their vendors, such as:
|
||||
* Older or less popular Linux distributions still supported by their vendors, such as:
|
||||
* Ubuntu 14.04, 18.10+
|
||||
* Gentoo
|
||||
* Arch Linux
|
||||
* ArchLinux
|
||||
* Alpine Linux
|
||||
* OpenWRT/LEDE 17.01+
|
||||
* OpenWRT/LEDE 17.0
|
||||
* Other CPU architectures (mips, mipsel, sparc, ...)
|
||||
|
||||
## Unsupported platforms
|
||||
|
||||
These are platforms on which BIND 9.14 is known *not* to build or run:
|
||||
These are platforms on which BIND is known *not* to build or run:
|
||||
|
||||
* Platforms without at least OpenSSL 1.0.2
|
||||
* Windows 10 / x86
|
||||
* Windows Server 2012 and older
|
||||
* Solaris 10 and older
|
||||
* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
|
||||
* Platforms that don't support atomic operations (via compiler or library)
|
||||
* Linux without NPTL (Native POSIX Thread Library)
|
||||
|
||||
## Platform quirks
|
||||
|
||||
### NetBSD 6 i386
|
||||
### ARM
|
||||
|
||||
The i386 build of NetBSD requires the `libatomic` library, available from
|
||||
the `gcc5-libs` package. Because this library is in a non-standard path,
|
||||
its location must be specified in the `configure` command line:
|
||||
If the compilation ends with following error:
|
||||
|
||||
```
|
||||
LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
|
||||
Error: selected processor does not support `yield' in ARM mode
|
||||
```
|
||||
|
||||
You will need to set `-march` compiler option to `native`, so the compiler
|
||||
recognizes `yield` assembler instruction. The proper way to set `-march=native`
|
||||
would be to put it into `CFLAGS`, e.g. run `./configure` like this:
|
||||
`CFLAGS="-march=native -Os -g" ./configure` plus your usual options.
|
||||
|
||||
If that doesn't work, you can enforce the minimum CPU and FPU (taken from Debian
|
||||
armhf documentation):
|
||||
|
||||
* The lowest worthwhile CPU implementation is Armv7-A, therefore the recommended
|
||||
build option is `-march=armv7-a`.
|
||||
|
||||
* FPU should be set at VFPv3-D16 as they represent the miminum specification of
|
||||
the processors to support here, therefore the recommended build option is
|
||||
`-mfpu=vfpv3-d16`.
|
||||
|
||||
The configure command should look like this:
|
||||
|
||||
```
|
||||
CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
|
||||
```
|
||||
|
||||
@@ -1,5 +1,3 @@
|
||||
README
|
||||
|
||||
BIND 9
|
||||
|
||||
Contents
|
||||
@@ -7,15 +5,14 @@ Contents
|
||||
1. Introduction
|
||||
2. Reporting bugs and getting help
|
||||
3. Contributing to BIND
|
||||
4. BIND 9.14 features
|
||||
4. BIND 9.13 features
|
||||
5. Building BIND
|
||||
6. macOS
|
||||
7. Dependencies
|
||||
8. Compile-time options
|
||||
9. Automated testing
|
||||
10. Documentation
|
||||
11. Change log
|
||||
12. Acknowledgments
|
||||
7. Compile-time options
|
||||
8. Automated testing
|
||||
9. Documentation
|
||||
10. Change log
|
||||
11. Acknowledgments
|
||||
|
||||
Introduction
|
||||
|
||||
@@ -39,7 +36,7 @@ in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
|
||||
501(c)(3) public benefit corporation dedicated to providing software and
|
||||
services in support of the Internet infrastructure, developed BIND 9 and
|
||||
is responsible for its ongoing maintenance and improvement. BIND is open
|
||||
source software licensed under the terms of the Mozilla Public License,
|
||||
source software licenced under the terms of the Mozilla Public License,
|
||||
version 2.0.
|
||||
|
||||
For a summary of features introduced in past major releases of BIND, see
|
||||
@@ -102,19 +99,12 @@ If you prefer, you may also submit code by opening a GitLab Issue and
|
||||
including your patch as an attachment, preferably generated by git
|
||||
format-patch.
|
||||
|
||||
BIND 9.14 features
|
||||
BIND 9.13 features
|
||||
|
||||
BIND 9.14.0 is the first release from a new stable branch of BIND 9,
|
||||
incorporating all changes from the 9.13 development branch, updating the
|
||||
most recent stable branch, 9.12. These changes include:
|
||||
BIND 9.13 is the newest development branch of BIND 9. It includes a number
|
||||
of changes from BIND 9.12 and earlier releases. New features include:
|
||||
|
||||
* A new "plugin" mechanism has been added to allow query functionality
|
||||
to be extended using dynamically loadable libraries. The "filter-aaaa"
|
||||
feature has been removed from named and is now implemented as a
|
||||
plugin.
|
||||
* QNAME minimization, as described in RFC 7816, is now supported.
|
||||
* Socket and task code has been refactored to improve performance on
|
||||
most modern machines.
|
||||
* "Root key sentinel" support, enabling validating resolvers to indicate
|
||||
via a special query which trust anchors are configured for the root
|
||||
zone.
|
||||
@@ -127,8 +117,6 @@ most recent stable branch, 9.12. These changes include:
|
||||
which DNSSEC validation should not be performed.
|
||||
* The default value of "dnssec-validation" is now "auto".
|
||||
* IDNA2008 is now supported when linking with libidn2.
|
||||
* "named -V" now outputs the default paths for files used by named and
|
||||
other tools.
|
||||
|
||||
In addition, workarounds that were formerly in place to enable resolution
|
||||
of domains whose authoritative servers did not respond to EDNS queries
|
||||
@@ -137,40 +125,12 @@ have been removed. See https://dnsflagday.net for more details.
|
||||
Cryptographic support has been modernized. BIND now uses the best
|
||||
available pseudo-random number generator for the platform on which it's
|
||||
built. Very old versions of OpenSSL are no longer supported. Cryptography
|
||||
is now mandatory: building BIND without DNSSEC is no longer supported.
|
||||
is now mandatory: building BIND without DNSSEC is now longer supported.
|
||||
|
||||
Special code to support certain legacy operating systems has also been
|
||||
removed; see the file PLATFORMS.md for details of supported platforms. In
|
||||
addition to OpenSSL, BIND now requires support for IPv6, threads, and
|
||||
standard atomic operations provided by the C compiler. Non-threaded builds
|
||||
are no longer supported.
|
||||
|
||||
BIND 9.14.1
|
||||
|
||||
BIND 9.14.1 is a maintenance release, and addresses security
|
||||
vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.
|
||||
|
||||
BIND 9.14.2
|
||||
|
||||
BIND 9.14.2 is a maintenance release.
|
||||
|
||||
BIND 9.14.3
|
||||
|
||||
BIND 9.14.3 is a maintenance release, and addresses the security
|
||||
vulnerability disclosed in CVE-2019-6471.
|
||||
|
||||
BIND 9.14.4
|
||||
|
||||
BIND 9.14.4 is a maintenance release, and also adds support for the new
|
||||
MaxMind GeoIP2 geolocation API when built with configure --with-geoip2.
|
||||
|
||||
BIND 9.14.5
|
||||
|
||||
BIND 9.14.5 is a maintenance release.
|
||||
|
||||
BIND 9.14.6
|
||||
|
||||
BIND 9.14.6 is a maintenance release.
|
||||
standard atomic operations provided by the C compiler.
|
||||
|
||||
Building BIND
|
||||
|
||||
@@ -201,7 +161,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
|
||||
Several environment variables that can be set before running configure
|
||||
will affect compilation:
|
||||
|
||||
Variable Description
|
||||
Variable Description
|
||||
CC The C compiler to use. configure tries to figure out the
|
||||
right one for supported systems.
|
||||
C compiler flags. Defaults to include -g and/or -O2 as
|
||||
@@ -229,21 +189,30 @@ if you have Xcode already installed you can run "xcode-select --install".
|
||||
This will add /usr/include to the system and install the compiler and
|
||||
other tools so that they can be easily found.
|
||||
|
||||
Dependencies
|
||||
|
||||
Portions of BIND that are written in Python, including dnssec-keymgr,
|
||||
dnssec-coverage, dnssec-checkds, and some of the system tests, require the
|
||||
'argparse' and 'ply' modules to be available. 'argparse' is a standard
|
||||
module as of Python 2.7 and Python 3.2. 'ply' is available from https://
|
||||
pypi.python.org/pypi/ply.
|
||||
|
||||
Compile-time options
|
||||
|
||||
To see a full list of configuration options, run configure --help.
|
||||
|
||||
On most platforms, BIND 9 is built with multithreading support, allowing
|
||||
it to take advantage of multiple CPUs. You can configure this by
|
||||
specifying --enable-threads or --disable-threads on the configure command
|
||||
line. The default is to enable threads, except on some older operating
|
||||
systems on which threads are known to have had problems in the past.
|
||||
(Note: Prior to BIND 9.10, the default was to disable threads on Linux
|
||||
systems; this has now been reversed. On Linux systems, the threaded build
|
||||
is known to change BIND's behavior with respect to file permissions; it
|
||||
may be necessary to specify a user with the -u option when running named.)
|
||||
|
||||
To build shared libraries, specify --with-libtool on the configure command
|
||||
line.
|
||||
|
||||
Certain compiled-in constants and default settings can be increased to
|
||||
values better suited to large servers with abundant memory resources (e.g,
|
||||
64-bit servers with 12G or more of memory) by specifying --with-tuning=
|
||||
large on the configure command line. This can improve performance on big
|
||||
servers, but will consume more memory and may degrade performance on
|
||||
smaller systems.
|
||||
|
||||
For the server to support DNSSEC, you need to build it with crypto
|
||||
support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
|
||||
installed. If the OpenSSL library is installed in a nonstandard location,
|
||||
@@ -275,18 +244,17 @@ github.com/farsightsec/fstrm and libprotobuf-c https://
|
||||
developers.google.com/protocol-buffers, and BIND must be configured with
|
||||
--enable-dnstap.
|
||||
|
||||
Certain compiled-in constants and default settings can be increased to
|
||||
values better suited to large servers with abundant memory resources (e.g,
|
||||
64-bit servers with 12G or more of memory) by specifying --with-tuning=
|
||||
large on the configure command line. This can improve performance on big
|
||||
servers, but will consume more memory and may degrade performance on
|
||||
smaller systems.
|
||||
|
||||
On Linux, process capabilities are managed in user space using the libcap
|
||||
library, which can be installed on most Linux systems via the libcap-dev
|
||||
or libcap-devel module. Process capability support can also be disabled by
|
||||
configuring with --disable-linux-caps.
|
||||
|
||||
Portions of BIND that are written in Python, including dnssec-keymgr,
|
||||
dnssec-coverage, dnssec-checkds, and some of the system tests, require the
|
||||
'argparse' and 'ply' modules to be available. 'argparse' is a standard
|
||||
module as of Python 2.7 and Python 3.2. 'ply' is available from https://
|
||||
pypi.python.org/pypi/ply.
|
||||
|
||||
On some platforms it is necessary to explicitly request large file support
|
||||
to handle files bigger than 2GB. This can be done by using
|
||||
--enable-largefile on the configure command line.
|
||||
@@ -296,10 +264,6 @@ specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
|
||||
command line. By default, fixed rrset-order is disabled to reduce memory
|
||||
footprint.
|
||||
|
||||
The --enable-querytrace option causes named to log every step of
|
||||
processing every query. This should only be enabled when debugging,
|
||||
because it has a significant negative impact on query performance.
|
||||
|
||||
make install will install named and the various BIND 9 libraries. By
|
||||
default, installation is into /usr/local, but this can be changed with the
|
||||
--prefix option when running configure.
|
||||
@@ -353,7 +317,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
|
||||
changes listed first. Change notes include tags indicating the category of
|
||||
the change that was made; these categories are:
|
||||
|
||||
Category Description
|
||||
Category Description
|
||||
[func] New feature
|
||||
[bug] General bug fix
|
||||
[security] Fix for a significant security flaw
|
||||
@@ -381,46 +345,26 @@ releases (i.e., those with version numbers ending in zero). Some new
|
||||
functionality may be backported to older releases on a case-by-case basis.
|
||||
All other change types may be applied to all currently-supported releases.
|
||||
|
||||
Bug report identifiers
|
||||
|
||||
Most notes in the CHANGES file include a reference to a bug report or
|
||||
issue number. Prior to 2018, these were usually of the form [RT #NNN] and
|
||||
referred to entries in the "bind9-bugs" RT database, which was not open to
|
||||
the public. More recent entries use the form [GL #NNN] or, less often, [GL
|
||||
!NNN], which, respectively, refer to issues or merge requests in the
|
||||
Gitlab database. Most of these are publicly readable, unless they include
|
||||
information which is confidential or security senstive.
|
||||
|
||||
To look up a Gitlab issue by its number, use the URL https://
|
||||
gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
|
||||
use https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN.
|
||||
|
||||
In rare cases, an issue or merge request number may be followed with the
|
||||
letter "P". This indicates that the information is in the private ISC
|
||||
Gitlab instance, which is not visible to the public.
|
||||
|
||||
Acknowledgments
|
||||
|
||||
* The original development of BIND 9 was underwritten by the following
|
||||
organizations:
|
||||
|
||||
Sun Microsystems, Inc.
|
||||
Hewlett Packard
|
||||
Compaq Computer Corporation
|
||||
IBM
|
||||
Process Software Corporation
|
||||
Silicon Graphics, Inc.
|
||||
Network Associates, Inc.
|
||||
U.S. Defense Information Systems Agency
|
||||
USENIX Association
|
||||
Stichting NLnet - NLnet Foundation
|
||||
Nominum, Inc.
|
||||
Sun Microsystems, Inc.
|
||||
Hewlett Packard
|
||||
Compaq Computer Corporation
|
||||
IBM
|
||||
Process Software Corporation
|
||||
Silicon Graphics, Inc.
|
||||
Network Associates, Inc.
|
||||
U.S. Defense Information Systems Agency
|
||||
USENIX Association
|
||||
Stichting NLnet - NLnet Foundation
|
||||
Nominum, Inc.
|
||||
|
||||
* This product includes software developed by the OpenSSL Project for
|
||||
use in the OpenSSL Toolkit. http://www.OpenSSL.org/
|
||||
|
||||
* This product includes cryptographic software written by Eric Young
|
||||
(eay@cryptsoft.com)
|
||||
|
||||
* This product includes software written by Tim Hudson
|
||||
(tjh@cryptsoft.com)
|
||||
|
||||
@@ -15,10 +15,9 @@
|
||||
1. [Introduction](#intro)
|
||||
1. [Reporting bugs and getting help](#help)
|
||||
1. [Contributing to BIND](#contrib)
|
||||
1. [BIND 9.14 features](#features)
|
||||
1. [BIND 9.13 features](#features)
|
||||
1. [Building BIND](#build)
|
||||
1. [macOS](#macos)
|
||||
1. [Dependencies](#dependencies)
|
||||
1. [Compile-time options](#opts)
|
||||
1. [Automated testing](#testing)
|
||||
1. [Documentation](#doc)
|
||||
@@ -48,7 +47,7 @@ used in versions 4 and 8. Internet Systems Consortium
|
||||
corporation dedicated to providing software and services in support of the
|
||||
Internet infrastructure, developed BIND 9 and is responsible for its
|
||||
ongoing maintenance and improvement. BIND is open source software
|
||||
licensed under the terms of the Mozilla Public License, version 2.0.
|
||||
licenced under the terms of the Mozilla Public License, version 2.0.
|
||||
|
||||
For a summary of features introduced in past major releases of BIND,
|
||||
see the file [HISTORY](HISTORY.md).
|
||||
@@ -117,18 +116,13 @@ If you prefer, you may also submit code by opening a
|
||||
including your patch as an attachment, preferably generated by
|
||||
`git format-patch`.
|
||||
|
||||
### <a name="features"/> BIND 9.14 features
|
||||
### <a name="features"/> BIND 9.13 features
|
||||
|
||||
BIND 9.14.0 is the first release from a new stable branch of BIND 9,
|
||||
incorporating all changes from the 9.13 development branch, updating
|
||||
the most recent stable branch, 9.12. These changes include:
|
||||
BIND 9.13 is the newest development branch of BIND 9. It includes a
|
||||
number of changes from BIND 9.12 and earlier releases. New features
|
||||
include:
|
||||
|
||||
* A new "plugin" mechanism has been added to allow query functionality
|
||||
to be extended using dynamically loadable libraries. The "filter-aaaa"
|
||||
feature has been removed from named and is now implemented as a plugin.
|
||||
* QNAME minimization, as described in RFC 7816, is now supported.
|
||||
* Socket and task code has been refactored to improve performance on most
|
||||
modern machines.
|
||||
* "Root key sentinel" support, enabling validating resolvers to indicate
|
||||
via a special query which trust anchors are configured for the root zone.
|
||||
* Secondary zones can now be configured as "mirror" zones; their contents
|
||||
@@ -140,8 +134,6 @@ the most recent stable branch, 9.12. These changes include:
|
||||
DNSSEC validation should not be performed.
|
||||
* The default value of "dnssec-validation" is now "auto".
|
||||
* IDNA2008 is now supported when linking with `libidn2`.
|
||||
* "named -V" now outputs the default paths for files used by named
|
||||
and other tools.
|
||||
|
||||
In addition, workarounds that were formerly in place to enable resolution
|
||||
of domains whose authoritative servers did not respond to EDNS queries
|
||||
@@ -151,42 +143,14 @@ for more details.
|
||||
Cryptographic support has been modernized. BIND now uses the
|
||||
best available pseudo-random number generator for the platform on which
|
||||
it's built. Very old versions of OpenSSL are no longer supported.
|
||||
Cryptography is now mandatory: building BIND without DNSSEC is no
|
||||
Cryptography is now mandatory: building BIND without DNSSEC is now
|
||||
longer supported.
|
||||
|
||||
Special code to support certain legacy operating systems has also
|
||||
been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
|
||||
of supported platforms. In addition to OpenSSL, BIND now requires
|
||||
support for IPv6, threads, and standard atomic operations provided
|
||||
by the C compiler. Non-threaded builds are no longer supported.
|
||||
|
||||
#### BIND 9.14.1
|
||||
|
||||
BIND 9.14.1 is a maintenance release, and addresses security
|
||||
vulnerabilities disclosed in CVE-2018-5743 and CVE-2019-6467.
|
||||
|
||||
#### BIND 9.14.2
|
||||
|
||||
BIND 9.14.2 is a maintenance release.
|
||||
|
||||
#### BIND 9.14.3
|
||||
|
||||
BIND 9.14.3 is a maintenance release, and addresses the security
|
||||
vulnerability disclosed in CVE-2019-6471.
|
||||
|
||||
#### BIND 9.14.4
|
||||
|
||||
BIND 9.14.4 is a maintenance release, and also adds support for
|
||||
the new MaxMind GeoIP2 geolocation API when built with
|
||||
`configure --with-geoip2`.
|
||||
|
||||
#### BIND 9.14.5
|
||||
|
||||
BIND 9.14.5 is a maintenance release.
|
||||
|
||||
#### BIND 9.14.6
|
||||
|
||||
BIND 9.14.6 is a maintenance release.
|
||||
by the C compiler.
|
||||
|
||||
### <a name="build"/> Building BIND
|
||||
|
||||
@@ -239,21 +203,31 @@ or if you have Xcode already installed you can run "xcode-select --install".
|
||||
This will add /usr/include to the system and install the compiler and other
|
||||
tools so that they can be easily found.
|
||||
|
||||
### <a name="dependencies"/> Dependencies
|
||||
|
||||
Portions of BIND that are written in Python, including
|
||||
`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
|
||||
system tests, require the 'argparse' and 'ply' modules to be available.
|
||||
'argparse' is a standard module as of Python 2.7 and Python 3.2.
|
||||
'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
|
||||
|
||||
#### <a name="opts"/> Compile-time options
|
||||
|
||||
To see a full list of configuration options, run `configure --help`.
|
||||
|
||||
On most platforms, BIND 9 is built with multithreading support, allowing it
|
||||
to take advantage of multiple CPUs. You can configure this by specifying
|
||||
`--enable-threads` or `--disable-threads` on the `configure` command line.
|
||||
The default is to enable threads, except on some older operating systems on
|
||||
which threads are known to have had problems in the past. (Note: Prior to
|
||||
BIND 9.10, the default was to disable threads on Linux systems; this has
|
||||
now been reversed. On Linux systems, the threaded build is known to change
|
||||
BIND's behavior with respect to file permissions; it may be necessary to
|
||||
specify a user with the -u option when running `named`.)
|
||||
|
||||
To build shared libraries, specify `--with-libtool` on the `configure`
|
||||
command line.
|
||||
|
||||
Certain compiled-in constants and default settings can be increased to
|
||||
values better suited to large servers with abundant memory resources (e.g,
|
||||
64-bit servers with 12G or more of memory) by specifying
|
||||
`--with-tuning=large` on the `configure` command line. This can improve
|
||||
performance on big servers, but will consume more memory and may degrade
|
||||
performance on smaller systems.
|
||||
|
||||
For the server to support DNSSEC, you need to build it with crypto support.
|
||||
To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed. If the
|
||||
OpenSSL library is installed in a nonstandard location, specify the prefix
|
||||
@@ -288,18 +262,17 @@ and libprotobuf-c
|
||||
[https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
|
||||
and BIND must be configured with `--enable-dnstap`.
|
||||
|
||||
Certain compiled-in constants and default settings can be increased to
|
||||
values better suited to large servers with abundant memory resources (e.g,
|
||||
64-bit servers with 12G or more of memory) by specifying
|
||||
`--with-tuning=large` on the `configure` command line. This can improve
|
||||
performance on big servers, but will consume more memory and may degrade
|
||||
performance on smaller systems.
|
||||
|
||||
On Linux, process capabilities are managed in user space using
|
||||
the `libcap` library, which can be installed on most Linux systems via
|
||||
the `libcap-dev` or `libcap-devel` module. Process capability support can
|
||||
also be disabled by configuring with `--disable-linux-caps`.
|
||||
|
||||
Portions of BIND that are written in Python, including
|
||||
`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
|
||||
system tests, require the 'argparse' and 'ply' modules to be available.
|
||||
'argparse' is a standard module as of Python 2.7 and Python 3.2.
|
||||
'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
|
||||
|
||||
On some platforms it is necessary to explicitly request large file support
|
||||
to handle files bigger than 2GB. This can be done by using
|
||||
`--enable-largefile` on the `configure` command line.
|
||||
@@ -309,10 +282,6 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
|
||||
configure command line. By default, fixed rrset-order is disabled to
|
||||
reduce memory footprint.
|
||||
|
||||
The `--enable-querytrace` option causes `named` to log every step of
|
||||
processing every query. This should only be enabled when debugging, because
|
||||
it has a significant negative impact on query performance.
|
||||
|
||||
`make install` will install `named` and the various BIND 9 libraries. By
|
||||
default, installation is into /usr/local, but this can be changed with the
|
||||
`--prefix` option when running `configure`.
|
||||
@@ -389,25 +358,6 @@ releases (i.e., those with version numbers ending in zero). Some new
|
||||
functionality may be backported to older releases on a case-by-case basis.
|
||||
All other change types may be applied to all currently-supported releases.
|
||||
|
||||
#### Bug report identifiers
|
||||
|
||||
Most notes in the CHANGES file include a reference to a bug report or
|
||||
issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
|
||||
and referred to entries in the "bind9-bugs" RT database, which was not open
|
||||
to the public. More recent entries use the form `[GL #NNN]` or, less often,
|
||||
`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
|
||||
Gitlab database. Most of these are publicly readable, unless they include
|
||||
information which is confidential or security senstive.
|
||||
|
||||
To look up a Gitlab issue by its number, use the URL
|
||||
[https://gitlab.isc.org/isc-projects/bind9/issues/NNN](https://gitlab.isc.org/isc-projects/bind9/issues).
|
||||
To look up a merge request, use
|
||||
[https://gitlab.isc.org/isc-projects/bind9/merge_requests/NNN](https://gitlab.isc.org/isc-projects/bind9/merge_requests).
|
||||
|
||||
In rare cases, an issue or merge request number may be followed with the
|
||||
letter "P". This indicates that the information is in the private ISC
|
||||
Gitlab instance, which is not visible to the public.
|
||||
|
||||
### <a name="ack"/> Acknowledgments
|
||||
|
||||
* The original development of BIND 9 was underwritten by the
|
||||
|
||||
Vendored
-2
@@ -291,8 +291,6 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
|
||||
m4_include([m4/ax_check_openssl.m4])
|
||||
m4_include([m4/ax_posix_shell.m4])
|
||||
m4_include([m4/ax_pthread.m4])
|
||||
m4_include([m4/ax_restore_flags.m4])
|
||||
m4_include([m4/ax_save_flags.m4])
|
||||
m4_include([m4/libtool.m4])
|
||||
m4_include([m4/ltoptions.m4])
|
||||
m4_include([m4/ltsugar.m4])
|
||||
|
||||
+1
-1
@@ -12,7 +12,7 @@ VPATH = @srcdir@
|
||||
top_srcdir = @top_srcdir@
|
||||
|
||||
SUBDIRS = named rndc dig delv dnssec tools nsupdate check confgen \
|
||||
@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
|
||||
@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
|
||||
TARGETS =
|
||||
|
||||
@BIND9_MAKE_RULES@
|
||||
|
||||
@@ -21,7 +21,7 @@ CINCLUDES = ${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES}
|
||||
CDEFINES = -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
|
||||
CWARNINGS =
|
||||
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
|
||||
@@ -66,7 +66,7 @@ named-checkzone.@O@: named-checkzone.c
|
||||
named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
|
||||
${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
|
||||
export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
|
||||
export LIBS0="${BIND9LIBS} ${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
|
||||
export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
|
||||
${FINALBUILDCMD}
|
||||
|
||||
named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -39,7 +39,7 @@
|
||||
named-checkconf \- named configuration file syntax checking tool
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBnamed\-checkconf\fR\ 'u
|
||||
\fBnamed\-checkconf\fR [\fB\-chjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
|
||||
\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBnamed\-checkconf\fR
|
||||
@@ -79,13 +79,6 @@ When loading a zonefile read the journal if it exists\&.
|
||||
List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c
|
||||
.RS 4
|
||||
Check "core" configuration only\&. This suppresses the loading of plugin modules, and causes all parameters to
|
||||
\fBplugin\fR
|
||||
statements to be ignored\&.
|
||||
.RE
|
||||
.PP
|
||||
\-p
|
||||
.RS 4
|
||||
Print out the
|
||||
@@ -143,5 +136,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -46,8 +46,6 @@
|
||||
|
||||
static const char *program = "named-checkconf";
|
||||
|
||||
static bool loadplugins = true;
|
||||
|
||||
isc_log_t *logc = NULL;
|
||||
|
||||
#define CHECK(r)\
|
||||
@@ -63,7 +61,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
|
||||
|
||||
static void
|
||||
usage(void) {
|
||||
fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
|
||||
fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
|
||||
"[named.conf]\n", program);
|
||||
exit(1);
|
||||
}
|
||||
@@ -564,7 +562,7 @@ main(int argc, char **argv) {
|
||||
/*
|
||||
* Process memory debugging argument first.
|
||||
*/
|
||||
#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
|
||||
#define CMDLINE_FLAGS "dhjlm:t:pvxz"
|
||||
while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (c) {
|
||||
case 'm':
|
||||
@@ -589,10 +587,6 @@ main(int argc, char **argv) {
|
||||
|
||||
while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
|
||||
switch (c) {
|
||||
case 'c':
|
||||
loadplugins = false;
|
||||
break;
|
||||
|
||||
case 'd':
|
||||
debug++;
|
||||
break;
|
||||
@@ -683,10 +677,9 @@ main(int argc, char **argv) {
|
||||
ISC_R_SUCCESS)
|
||||
exit(1);
|
||||
|
||||
result = bind9_check_namedconf(config, loadplugins, logc, mctx);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
result = bind9_check_namedconf(config, logc, mctx);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
exit_status = 1;
|
||||
}
|
||||
|
||||
if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
|
||||
result = load_zones_fromconfig(config, mctx, list_zones);
|
||||
|
||||
@@ -40,7 +40,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -53,7 +52,7 @@
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>named-checkconf</command>
|
||||
<arg choice="opt" rep="norepeat"><option>-chjlvz</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-p</option>
|
||||
<arg choice="opt" rep="norepeat"><option>-x</option>
|
||||
</arg></arg>
|
||||
@@ -115,17 +114,6 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-c</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Check "core" configuration only. This suppresses the loading
|
||||
of plugin modules, and causes all parameters to
|
||||
<command>plugin</command> statements to be ignored.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-p</term>
|
||||
<listitem>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -33,7 +33,7 @@
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">named-checkconf</code>
|
||||
[<code class="option">-chjlvz</code>]
|
||||
[<code class="option">-hjlvz</code>]
|
||||
[<code class="option">-p</code>
|
||||
[<code class="option">-x</code>
|
||||
]]
|
||||
@@ -88,14 +88,6 @@
|
||||
(e.g. master or slave).
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-c</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Check "core" configuration only. This suppresses the loading
|
||||
of plugin modules, and causes all parameters to
|
||||
<span class="command"><strong>plugin</strong></span> statements to be ignored.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-p</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -43,7 +43,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -29,7 +29,7 @@ ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCLIBS = ../../lib/isccc/libisccc.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
BIND9LIBS = ../../lib/bind9/libbind9.@A@
|
||||
|
||||
ISCCFGDEPLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -37,7 +37,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -44,7 +44,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -23,7 +23,7 @@ CDEFINES = -DVERSION=\"${VERSION}\" \
|
||||
CWARNINGS =
|
||||
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
IRSLIBS = ../../lib/irs/libirs.@A@
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -437,5 +437,5 @@ RFC5155\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+2
-2
@@ -743,8 +743,8 @@ setup_dnsseckeys(dns_client_t *client) {
|
||||
|
||||
isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
|
||||
isc_buffer_add(&b, sizeof(anchortext) - 1);
|
||||
result = cfg_parse_buffer(parser, &b, NULL, 0,
|
||||
&cfg_type_bindkeys, 0, &bindkeys);
|
||||
result = cfg_parse_buffer(parser, &b, &cfg_type_bindkeys,
|
||||
&bindkeys);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fatal("Unable to parse built-in keys");
|
||||
}
|
||||
|
||||
@@ -39,7 +39,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
+1
-1
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
+1
-1
@@ -25,7 +25,7 @@ CDEFINES = -DVERSION=\"${VERSION}\"
|
||||
CWARNINGS =
|
||||
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
BIND9LIBS = ../../lib/bind9/libbind9.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
|
||||
|
||||
+24
-38
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -74,9 +74,7 @@ will perform an NS query for "\&." (the root)\&.
|
||||
It is possible to set per\-user defaults for
|
||||
\fBdig\fR
|
||||
via
|
||||
${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
|
||||
\fB\-r\fR
|
||||
option disables this feature, for scripts that need predictable behaviour\&.
|
||||
${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
|
||||
.PP
|
||||
The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
|
||||
\fB\-t\fR
|
||||
@@ -176,6 +174,11 @@ reads a list of lookup requests to process from the given
|
||||
using the command\-line interface\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i
|
||||
.RS 4
|
||||
Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
|
||||
.RE
|
||||
.PP
|
||||
\-k \fIkeyfile\fR
|
||||
.RS 4
|
||||
Sign queries using TSIG using a key read from the given file\&. Key files can be generated using
|
||||
@@ -205,12 +208,6 @@ The domain name to query\&. This is useful to distinguish the
|
||||
from other arguments\&.
|
||||
.RE
|
||||
.PP
|
||||
\-r
|
||||
.RS 4
|
||||
Do not read options from
|
||||
${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
|
||||
.RE
|
||||
.PP
|
||||
\-t \fItype\fR
|
||||
.RS 4
|
||||
The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
|
||||
@@ -249,7 +246,9 @@ arguments\&.
|
||||
\fBdig\fR
|
||||
automatically performs a lookup for a name like
|
||||
94\&.2\&.0\&.192\&.in\-addr\&.arpa
|
||||
and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
|
||||
and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the
|
||||
\fB\-i\fR
|
||||
option)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-y \fI[hmac:]\fR\fIkeyname:secret\fR
|
||||
@@ -361,20 +360,14 @@ Display [do not display] the CLASS when printing the record\&.
|
||||
.PP
|
||||
\fB+[no]cmd\fR
|
||||
.RS 4
|
||||
Toggles the printing of the initial comment in the output, identifying the version of
|
||||
Toggles the printing of the initial comment in the output identifying the version of
|
||||
\fBdig\fR
|
||||
and the query options that have been applied\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. The default is to print this comment\&.
|
||||
and the query options that have been applied\&. This comment is printed by default\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]comments\fR
|
||||
.RS 4
|
||||
Toggles the display of some comment lines in the output, containing information about the packet header and OPT pseudosection, and the names of the response section\&. The default is to print these comments\&.
|
||||
.sp
|
||||
Other types of comments in the output are not affected by this option, but can be controlled using other command line switches\&. These include
|
||||
\fB+[no]cmd\fR,
|
||||
\fB+[no]question\fR,
|
||||
\fB+[no]stats\fR, and
|
||||
\fB+[no]rrcomments\fR\&.
|
||||
Toggle the display of comment lines in the output\&. The default is to print comments\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]cookie\fR\fB[=####]\fR
|
||||
@@ -475,16 +468,12 @@ option is enabled\&. If short form answers are requested, the default is not to
|
||||
.PP
|
||||
\fB+[no]idnin\fR
|
||||
.RS 4
|
||||
Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
|
||||
.sp
|
||||
The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
|
||||
Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]idnout\fR
|
||||
.RS 4
|
||||
Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
|
||||
.sp
|
||||
The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
|
||||
Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]ignore\fR
|
||||
@@ -567,12 +556,12 @@ would cause a 48\-byte query to be padded to 64 bytes\&. The default block size
|
||||
.PP
|
||||
\fB+[no]qr\fR
|
||||
.RS 4
|
||||
Toggles the display of the query message as it is sent\&. By default, the query is not printed\&.
|
||||
Print [do not print] the query as it is sent\&. By default, the query is not printed\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]question\fR
|
||||
.RS 4
|
||||
Toggles the display of the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
|
||||
Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]raflag\fR
|
||||
@@ -590,11 +579,11 @@ A synonym for
|
||||
.RS 4
|
||||
Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
|
||||
\fBdig\fR
|
||||
normally sends recursive queries\&. Recursion is automatically disabled when using the
|
||||
normally sends recursive queries\&. Recursion is automatically disabled when the
|
||||
\fI+nssearch\fR
|
||||
option, and when using
|
||||
or
|
||||
\fI+trace\fR
|
||||
except for an initial recursive query to get the list of root servers\&.
|
||||
query options are used\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+retry=T\fR
|
||||
@@ -625,7 +614,7 @@ determines if the name will be treated as relative or not and hence whether a se
|
||||
.PP
|
||||
\fB+[no]short\fR
|
||||
.RS 4
|
||||
Provide a terse answer\&. The default is to print the answer in a verbose form\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&.
|
||||
Provide a terse answer\&. The default is to print the answer in a verbose form\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]showsearch\fR
|
||||
@@ -655,7 +644,7 @@ causes fields not to be split at all\&. The default is 56 characters, or 44 char
|
||||
.PP
|
||||
\fB+[no]stats\fR
|
||||
.RS 4
|
||||
Toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics as a comment after each lookup\&.
|
||||
This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&.
|
||||
.RE
|
||||
.PP
|
||||
\fB+[no]subnet=addr[/prefix\-length]\fR
|
||||
@@ -806,10 +795,7 @@ has been built with IDN (internationalized domain name) support, it can accept a
|
||||
appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
|
||||
\fI+noidnin\fR
|
||||
and
|
||||
\fI+noidnout\fR
|
||||
or define the
|
||||
\fBIDN_DISABLE\fR
|
||||
environment variable\&.
|
||||
\fI+noidnout\fR\&.
|
||||
.SH "FILES"
|
||||
.PP
|
||||
/etc/resolv\&.conf
|
||||
@@ -830,5 +816,5 @@ There are probably too many query options\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+12
-19
@@ -175,13 +175,11 @@ help(void) {
|
||||
" +bufsize=### (Set EDNS0 Max UDP packet size)\n"
|
||||
" +[no]cdflag (Set checking disabled flag in query)\n"
|
||||
" +[no]class (Control display of class in records)\n"
|
||||
" +[no]cmd (Control display of command line -\n"
|
||||
" global option)\n"
|
||||
" +[no]comments (Control display of packet header\n"
|
||||
" and section name comments)\n"
|
||||
" +[no]cmd (Control display of command line)\n"
|
||||
" +[no]comments (Control display of comment lines)\n"
|
||||
" +[no]cookie (Add a COOKIE option to the request)\n"
|
||||
" +[no]crypto (Control display of cryptographic\n"
|
||||
" fields in records)\n"
|
||||
" +[no]crypto (Control display of cryptographic "
|
||||
"fields in records)\n"
|
||||
" +[no]defname (Use search list (+[no]search))\n"
|
||||
" +[no]dnssec (Request DNSSEC records)\n"
|
||||
" +domain=### (Set default domainname)\n"
|
||||
@@ -197,13 +195,11 @@ help(void) {
|
||||
" +[no]identify (ID responders in short answers)\n"
|
||||
#ifdef HAVE_LIBIDN2
|
||||
" +[no]idnin (Parse IDN names [default=on on tty])\n"
|
||||
" +[no]idnout (Convert IDN response "
|
||||
"[default=on on tty])\n"
|
||||
" +[no]idnout (Convert IDN response [default=on on tty])\n"
|
||||
#endif
|
||||
" +[no]ignore (Don't revert to TCP for TC responses.)\n"
|
||||
" +[no]keepalive (Request EDNS TCP keepalive)\n"
|
||||
" +[no]keepopen (Keep the TCP socket open between "
|
||||
"queries)\n"
|
||||
" +[no]keepopen (Keep the TCP socket open between queries)\n"
|
||||
" +[no]mapped (Allow mapped IPv4 over IPv6)\n"
|
||||
" +[no]multiline (Print records in an expanded format)\n"
|
||||
" +ndots=### (Set search NDOTS value)\n"
|
||||
@@ -222,7 +218,7 @@ help(void) {
|
||||
"comments)\n"
|
||||
" +[no]search (Set whether to use searchlist)\n"
|
||||
" +[no]short (Display nothing except short\n"
|
||||
" form of answers - global option)\n"
|
||||
" form of answer)\n"
|
||||
" +[no]showsearch (Search with intermediate results)\n"
|
||||
" +[no]split=## (Split hex/base64 fields into chunks)\n"
|
||||
" +[no]stats (Control display of statistics)\n"
|
||||
@@ -230,13 +226,11 @@ help(void) {
|
||||
" +[no]tcflag (Set TC flag in query (+[no]tcflag))\n"
|
||||
" +[no]tcp (TCP mode (+[no]vc))\n"
|
||||
" +timeout=### (Set query timeout) [5]\n"
|
||||
" +[no]trace (Trace delegation down from root "
|
||||
"[+dnssec])\n"
|
||||
" +[no]trace (Trace delegation down from root [+dnssec])\n"
|
||||
" +tries=### (Set number of UDP attempts) [3]\n"
|
||||
" +[no]ttlid (Control display of ttls in records)\n"
|
||||
" +[no]ttlunits (Display TTLs in human-readable units)\n"
|
||||
" +[no]unknownformat (Print RDATA in RFC 3597 \"unknown\" "
|
||||
"format)\n"
|
||||
" +[no]unknownformat (Print RDATA in RFC 3597 \"unknown\" format)\n"
|
||||
" +[no]vc (TCP mode (+[no]tcp))\n"
|
||||
" +[no]zflag (Set Z flag in query)\n"
|
||||
" global d-opts and servers (before host name) affect all queries.\n"
|
||||
@@ -508,9 +502,8 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
|
||||
check_result(result, "dns_master_stylecreate");
|
||||
|
||||
if (query->lookup->cmdline[0] != 0) {
|
||||
if (!short_form && printcmd) {
|
||||
if (!short_form)
|
||||
fputs(query->lookup->cmdline, stdout);
|
||||
}
|
||||
query->lookup->cmdline[0]=0;
|
||||
}
|
||||
debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
|
||||
@@ -533,7 +526,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
|
||||
check_result(result, "isc_buffer_allocate");
|
||||
|
||||
if (query->lookup->comments && !short_form) {
|
||||
if (query->lookup->cmdline[0] != 0 && printcmd)
|
||||
if (query->lookup->cmdline[0] != 0)
|
||||
printf("; %s\n", query->lookup->cmdline);
|
||||
if (msg == query->lookup->sendmsg)
|
||||
printf(";; Sending:\n");
|
||||
@@ -1452,7 +1445,7 @@ plus_option(char *option, bool is_batchfile,
|
||||
lookup->trace = state;
|
||||
lookup->trace_root = state;
|
||||
if (state) {
|
||||
lookup->recurse = true;
|
||||
lookup->recurse = false;
|
||||
lookup->identify = true;
|
||||
lookup->comments = false;
|
||||
lookup->rrcomments = 0;
|
||||
|
||||
+15
-31
@@ -52,7 +52,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -593,11 +592,9 @@
|
||||
<listitem>
|
||||
<para>
|
||||
Toggles the printing of the initial comment in the
|
||||
output, identifying the version of <command>dig</command>
|
||||
and the query options that have been applied. This option
|
||||
always has global effect; it cannot be set globally
|
||||
and then overridden on a per-lookup basis. The default
|
||||
is to print this comment.
|
||||
output identifying the version of <command>dig</command>
|
||||
and the query options that have been applied. This
|
||||
comment is printed by default.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -606,18 +603,8 @@
|
||||
<term><option>+[no]comments</option></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Toggles the display of some comment lines in the output,
|
||||
containing information about the packet header and
|
||||
OPT pseudosection, and the names of the response
|
||||
section. The default is to print these comments.
|
||||
</para>
|
||||
<para>
|
||||
Other types of comments in the output are not affected by
|
||||
this option, but can be controlled using other command
|
||||
line switches. These include <command>+[no]cmd</command>,
|
||||
<command>+[no]question</command>,
|
||||
<command>+[no]stats</command>, and
|
||||
<command>+[no]rrcomments</command>.
|
||||
Toggle the display of comment lines in the output.
|
||||
The default is to print comments.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -967,8 +954,8 @@
|
||||
<term><option>+[no]qr</option></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Toggles the display of the query message as it is sent.
|
||||
By default, the query is not printed.
|
||||
Print [do not print] the query as it is sent. By
|
||||
default, the query is not printed.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -977,7 +964,7 @@
|
||||
<term><option>+[no]question</option></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Toggles the display of the question section of a query
|
||||
Print [do not print] the question section of a query
|
||||
when an answer is returned. The default is to print
|
||||
the question section as a comment.
|
||||
</para>
|
||||
@@ -1012,10 +999,8 @@
|
||||
in the query. This bit is set by default, which means
|
||||
<command>dig</command> normally sends recursive
|
||||
queries. Recursion is automatically disabled when
|
||||
using the <parameter>+nssearch</parameter> option, and
|
||||
when using <parameter>+trace</parameter> except for
|
||||
an initial recursive query to get the list of root
|
||||
servers.
|
||||
the <parameter>+nssearch</parameter> or
|
||||
<parameter>+trace</parameter> query options are used.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -1068,9 +1053,7 @@
|
||||
<listitem>
|
||||
<para>
|
||||
Provide a terse answer. The default is to print the
|
||||
answer in a verbose form. This option always has global
|
||||
effect; it cannot be set globally and then overridden on
|
||||
a per-lookup basis.
|
||||
answer in a verbose form.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -1115,9 +1098,10 @@
|
||||
<term><option>+[no]stats</option></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Toggles the printing of statistics: when the query was made,
|
||||
the size of the reply and so on. The default behavior is to
|
||||
print the query statistics as a comment after each lookup.
|
||||
This query option toggles the printing of statistics:
|
||||
when the query was made, the size of the reply and
|
||||
so on. The default behavior is to print the query
|
||||
statistics.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
+32
-60
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -106,10 +106,9 @@
|
||||
|
||||
<p>
|
||||
It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
|
||||
<code class="filename">${HOME}/.digrc</code>. This file is read and any
|
||||
options in it are applied before the command line arguments.
|
||||
The <code class="option">-r</code> option disables this feature, for
|
||||
scripts that need predictable behaviour.
|
||||
<code class="filename">${HOME}/.digrc</code>. This file is read and
|
||||
any options in it
|
||||
are applied before the command line arguments.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
@@ -228,6 +227,14 @@
|
||||
<span class="command"><strong>dig</strong></span> using the command-line interface.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-i</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
|
||||
domain, which is no longer in use. Obsolete bit string
|
||||
label queries (RFC 2874) are not attempted.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -267,13 +274,6 @@
|
||||
the <em class="parameter"><code>name</code></em> from other arguments.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-r</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Do not read options from <code class="filename">${HOME}/.digrc</code>.
|
||||
This is useful for scripts that need predictable behaviour.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -324,7 +324,8 @@
|
||||
<code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
|
||||
query type and class to PTR and IN respectively. IPv6
|
||||
addresses are looked up using nibble format under the
|
||||
IP6.ARPA domain.
|
||||
IP6.ARPA domain (but see also the <code class="option">-i</code>
|
||||
option).
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
|
||||
@@ -481,28 +482,16 @@
|
||||
<dd>
|
||||
<p>
|
||||
Toggles the printing of the initial comment in the
|
||||
output, identifying the version of <span class="command"><strong>dig</strong></span>
|
||||
and the query options that have been applied. This option
|
||||
always has global effect; it cannot be set globally
|
||||
and then overridden on a per-lookup basis. The default
|
||||
is to print this comment.
|
||||
output identifying the version of <span class="command"><strong>dig</strong></span>
|
||||
and the query options that have been applied. This
|
||||
comment is printed by default.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]comments</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Toggles the display of some comment lines in the output,
|
||||
containing information about the packet header and
|
||||
OPT pseudosection, and the names of the response
|
||||
section. The default is to print these comments.
|
||||
</p>
|
||||
<p>
|
||||
Other types of comments in the output are not affected by
|
||||
this option, but can be controlled using other command
|
||||
line switches. These include <span class="command"><strong>+[no]cmd</strong></span>,
|
||||
<span class="command"><strong>+[no]question</strong></span>,
|
||||
<span class="command"><strong>+[no]stats</strong></span>, and
|
||||
<span class="command"><strong>+[no]rrcomments</strong></span>.
|
||||
Toggle the display of comment lines in the output.
|
||||
The default is to print comments.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]cookie[<span class="optional">=####</span>]</code></span></dt>
|
||||
@@ -642,13 +631,7 @@
|
||||
<p>
|
||||
Process [do not process] IDN domain names on input.
|
||||
This requires IDN SUPPORT to have been enabled at
|
||||
compile time.
|
||||
</p>
|
||||
<p>
|
||||
The default is to process IDN input when standard output
|
||||
is a tty. The IDN processing on input is disabled when
|
||||
dig output is redirected to files, pipes, and other
|
||||
non-tty file descriptors.
|
||||
compile time. The default is to process IDN input.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
|
||||
@@ -656,13 +639,7 @@
|
||||
<p>
|
||||
Convert [do not convert] puny code on output.
|
||||
This requires IDN SUPPORT to have been enabled at
|
||||
compile time.
|
||||
</p>
|
||||
<p>
|
||||
The default is to process puny code on output when
|
||||
standard output is a tty. The puny code processing on
|
||||
output is disabled when dig output is redirected to
|
||||
files, pipes, and other non-tty file descriptors.
|
||||
compile time. The default is to convert output.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
|
||||
@@ -769,14 +746,14 @@
|
||||
<dt><span class="term"><code class="option">+[no]qr</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Toggles the display of the query message as it is sent.
|
||||
By default, the query is not printed.
|
||||
Print [do not print] the query as it is sent. By
|
||||
default, the query is not printed.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]question</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Toggles the display of the question section of a query
|
||||
Print [do not print] the question section of a query
|
||||
when an answer is returned. The default is to print
|
||||
the question section as a comment.
|
||||
</p>
|
||||
@@ -802,10 +779,8 @@
|
||||
in the query. This bit is set by default, which means
|
||||
<span class="command"><strong>dig</strong></span> normally sends recursive
|
||||
queries. Recursion is automatically disabled when
|
||||
using the <em class="parameter"><code>+nssearch</code></em> option, and
|
||||
when using <em class="parameter"><code>+trace</code></em> except for
|
||||
an initial recursive query to get the list of root
|
||||
servers.
|
||||
the <em class="parameter"><code>+nssearch</code></em> or
|
||||
<em class="parameter"><code>+trace</code></em> query options are used.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+retry=T</code></span></dt>
|
||||
@@ -846,9 +821,7 @@
|
||||
<dd>
|
||||
<p>
|
||||
Provide a terse answer. The default is to print the
|
||||
answer in a verbose form. This option always has global
|
||||
effect; it cannot be set globally and then overridden on
|
||||
a per-lookup basis.
|
||||
answer in a verbose form.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]showsearch</code></span></dt>
|
||||
@@ -881,9 +854,10 @@
|
||||
<dt><span class="term"><code class="option">+[no]stats</code></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Toggles the printing of statistics: when the query was made,
|
||||
the size of the reply and so on. The default behavior is to
|
||||
print the query statistics as a comment after each lookup.
|
||||
This query option toggles the printing of statistics:
|
||||
when the query was made, the size of the reply and
|
||||
so on. The default behavior is to print the query
|
||||
statistics.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term"><code class="option">+[no]subnet=addr[/prefix-length]</code></span></dt>
|
||||
@@ -1087,9 +1061,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
reply from the server.
|
||||
If you'd like to turn off the IDN support for some reason, use
|
||||
parameters <em class="parameter"><code>+noidnin</code></em> and
|
||||
<em class="parameter"><code>+noidnout</code></em> or define
|
||||
the <code class="envar">IDN_DISABLE</code> environment variable.
|
||||
|
||||
<em class="parameter"><code>+noidnout</code></em>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
+52
-86
@@ -1390,7 +1390,8 @@ setup_libs(void) {
|
||||
isc_mempool_setfreemax(commctx, 6);
|
||||
isc_mempool_setfillcount(commctx, 2);
|
||||
|
||||
isc_mutex_init(&lookup_lock);
|
||||
result = isc_mutex_init(&lookup_lock);
|
||||
check_result(result, "isc_mutex_init");
|
||||
}
|
||||
|
||||
typedef struct dig_ednsoptname {
|
||||
@@ -1399,7 +1400,6 @@ typedef struct dig_ednsoptname {
|
||||
} dig_ednsoptname_t;
|
||||
|
||||
dig_ednsoptname_t optnames[] = {
|
||||
{ 1, "LLQ" }, /* draft-sekar-dns-llq */
|
||||
{ 3, "NSID" }, /* RFC 5001 */
|
||||
{ 5, "DAU" }, /* RFC 6975 */
|
||||
{ 6, "DHU" }, /* RFC 6975 */
|
||||
@@ -1412,8 +1412,6 @@ dig_ednsoptname_t optnames[] = {
|
||||
{ 12, "PAD" }, /* shorthand */
|
||||
{ 13, "CHAIN" }, /* RFC 7901 */
|
||||
{ 14, "KEY-TAG" }, /* RFC 8145 */
|
||||
{ 16, "CLIENT-TAG" }, /* draft-bellis-dnsop-edns-tags */
|
||||
{ 17, "SERVER-TAG" }, /* draft-bellis-dnsop-edns-tags */
|
||||
{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
|
||||
};
|
||||
|
||||
@@ -2192,14 +2190,12 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
lookup->sendmsg->id = (dns_messageid_t)isc_random16();
|
||||
lookup->sendmsg->opcode = lookup->opcode;
|
||||
lookup->msgcounter = 0;
|
||||
|
||||
/*
|
||||
* If this is a trace request, completely disallow recursion after
|
||||
* looking up the root name servers, since it's meaningless for traces.
|
||||
* If this is a trace request, completely disallow recursion, since
|
||||
* it's meaningless for traces.
|
||||
*/
|
||||
if ((lookup->trace || lookup->ns_search_only) && !lookup->trace_root) {
|
||||
if (lookup->trace || (lookup->ns_search_only && !lookup->trace_root))
|
||||
lookup->recurse = false;
|
||||
}
|
||||
|
||||
if (lookup->recurse &&
|
||||
lookup->rdtype != dns_rdatatype_axfr &&
|
||||
@@ -2735,6 +2731,27 @@ send_tcp_connect(dig_query_t *query) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (specified_source &&
|
||||
(isc_sockaddr_pf(&query->sockaddr) !=
|
||||
isc_sockaddr_pf(&bind_address))) {
|
||||
printf(";; Skipping server %s, incompatible "
|
||||
"address family\n", query->servname);
|
||||
query->waiting_connect = false;
|
||||
if (ISC_LINK_LINKED(query, link))
|
||||
next = ISC_LIST_NEXT(query, link);
|
||||
else
|
||||
next = NULL;
|
||||
l = query->lookup;
|
||||
clear_query(query);
|
||||
if (next == NULL) {
|
||||
printf(";; No acceptable nameservers\n");
|
||||
check_next_lookup(l);
|
||||
return;
|
||||
}
|
||||
send_tcp_connect(next);
|
||||
return;
|
||||
}
|
||||
|
||||
INSIST(query->sock == NULL);
|
||||
|
||||
if (keep != NULL && isc_sockaddr_equal(&keepaddr, &query->sockaddr)) {
|
||||
@@ -2885,36 +2902,6 @@ send_udp(dig_query_t *query) {
|
||||
sendcount++;
|
||||
}
|
||||
|
||||
/*%
|
||||
* If there are more servers available for querying within 'lookup', initiate a
|
||||
* TCP or UDP query to the next available server and return true; otherwise,
|
||||
* return false.
|
||||
*/
|
||||
static bool
|
||||
try_next_server(dig_lookup_t *lookup) {
|
||||
dig_query_t *current_query, *next_query;
|
||||
|
||||
current_query = lookup->current_query;
|
||||
if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
next_query = ISC_LIST_NEXT(current_query, link);
|
||||
if (next_query == NULL) {
|
||||
return (false);
|
||||
}
|
||||
|
||||
debug("trying next server...");
|
||||
|
||||
if (lookup->tcp_mode) {
|
||||
send_tcp_connect(next_query);
|
||||
} else {
|
||||
send_udp(next_query);
|
||||
}
|
||||
|
||||
return (true);
|
||||
}
|
||||
|
||||
/*%
|
||||
* IO timeout handler, used for both connect and recv timeouts. If
|
||||
* retries are still allowed, either resend the UDP packet or queue a
|
||||
@@ -2923,7 +2910,7 @@ try_next_server(dig_lookup_t *lookup) {
|
||||
static void
|
||||
connect_timeout(isc_task_t *task, isc_event_t *event) {
|
||||
dig_lookup_t *l = NULL;
|
||||
dig_query_t *query = NULL;
|
||||
dig_query_t *query = NULL, *cq;
|
||||
|
||||
UNUSED(task);
|
||||
REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
|
||||
@@ -2943,14 +2930,18 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (try_next_server(l)) {
|
||||
if (l->tcp_mode) {
|
||||
if (query->sock != NULL) {
|
||||
if ((query != NULL) && (query->lookup->current_query != NULL) &&
|
||||
ISC_LINK_LINKED(query->lookup->current_query, link) &&
|
||||
(ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
|
||||
debug("trying next server...");
|
||||
cq = query->lookup->current_query;
|
||||
if (!l->tcp_mode)
|
||||
send_udp(ISC_LIST_NEXT(cq, link));
|
||||
else {
|
||||
if (query->sock != NULL)
|
||||
isc_socket_cancel(query->sock, NULL,
|
||||
ISC_SOCKCANCEL_ALL);
|
||||
} else {
|
||||
clear_query(query);
|
||||
}
|
||||
send_tcp_connect(ISC_LIST_NEXT(cq, link));
|
||||
}
|
||||
UNLOCK_LOOKUP;
|
||||
return;
|
||||
@@ -2996,27 +2987,6 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
|
||||
UNLOCK_LOOKUP;
|
||||
}
|
||||
|
||||
/*%
|
||||
* Called when a peer closes a TCP socket prematurely.
|
||||
*/
|
||||
static void
|
||||
requeue_or_update_exitcode(dig_lookup_t *lookup) {
|
||||
if (lookup->eoferr == 0U) {
|
||||
/*
|
||||
* Peer closed the connection prematurely for the first time
|
||||
* for this lookup. Try again, keeping track of this failure.
|
||||
*/
|
||||
dig_lookup_t *requeued_lookup = requeue_lookup(lookup, true);
|
||||
requeued_lookup->eoferr++;
|
||||
} else {
|
||||
/*
|
||||
* Peer closed the connection prematurely and it happened
|
||||
* previously for this lookup. Indicate an error.
|
||||
*/
|
||||
exitcode = 9;
|
||||
}
|
||||
}
|
||||
|
||||
/*%
|
||||
* Event handler for the TCP recv which gets the length header of TCP
|
||||
* packets. Start the next recv of length bytes.
|
||||
@@ -3028,7 +2998,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
|
||||
isc_region_t r;
|
||||
isc_result_t result;
|
||||
dig_query_t *query = NULL;
|
||||
dig_lookup_t *l;
|
||||
dig_lookup_t *l, *n;
|
||||
uint16_t length;
|
||||
|
||||
REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
|
||||
@@ -3067,8 +3037,9 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
|
||||
sockcount--;
|
||||
debug("sockcount=%d", sockcount);
|
||||
INSIST(sockcount >= 0);
|
||||
if (sevent->result == ISC_R_EOF) {
|
||||
requeue_or_update_exitcode(l);
|
||||
if (sevent->result == ISC_R_EOF && l->eoferr == 0U) {
|
||||
n = requeue_lookup(l, true);
|
||||
n->eoferr++;
|
||||
}
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
@@ -3427,7 +3398,7 @@ process_cookie(dig_lookup_t *l, dns_message_t *msg,
|
||||
}
|
||||
|
||||
INSIST(msg->cc_ok == 0 && msg->cc_bad == 0);
|
||||
if (len >= 8 && optlen >= 8U) {
|
||||
if (optlen >= len && optlen >= 8U) {
|
||||
if (isc_safe_memequal(isc_buffer_current(optbuf), sent, 8)) {
|
||||
msg->cc_ok = 1;
|
||||
} else {
|
||||
@@ -3514,7 +3485,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
dig_lookup_t *n, *l;
|
||||
bool docancel = false;
|
||||
bool match = true;
|
||||
bool done_process_opt = false;
|
||||
unsigned int parseflags;
|
||||
dns_messageid_t id;
|
||||
unsigned int msgflags;
|
||||
@@ -3570,8 +3540,9 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
debug("sockcount=%d", sockcount);
|
||||
INSIST(sockcount >= 0);
|
||||
}
|
||||
if (sevent->result == ISC_R_EOF) {
|
||||
requeue_or_update_exitcode(l);
|
||||
if (sevent->result == ISC_R_EOF && l->eoferr == 0U) {
|
||||
n = requeue_lookup(l, true);
|
||||
n->eoferr++;
|
||||
}
|
||||
isc_event_free(&event);
|
||||
clear_query(query);
|
||||
@@ -3808,7 +3779,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
UNLOCK_LOOKUP;
|
||||
return;
|
||||
}
|
||||
done_process_opt = true;
|
||||
}
|
||||
if ((msg->rcode == dns_rcode_servfail && !l->servfail_stops) ||
|
||||
(check_ra && (msg->flags & DNS_MESSAGEFLAG_RA) == 0 && l->recurse))
|
||||
@@ -3898,17 +3868,13 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
}
|
||||
}
|
||||
|
||||
if (!done_process_opt) {
|
||||
if (l->cookie != NULL) {
|
||||
if (msg->opt == NULL) {
|
||||
printf(";; expected opt record in response\n");
|
||||
} else {
|
||||
process_opt(l, msg);
|
||||
}
|
||||
} else if (l->sendcookie && msg->opt != NULL) {
|
||||
if (l->cookie != NULL) {
|
||||
if (msg->opt == NULL)
|
||||
printf(";; expected opt record in response\n");
|
||||
else
|
||||
process_opt(l, msg);
|
||||
}
|
||||
}
|
||||
} else if (l->sendcookie && msg->opt != NULL)
|
||||
process_opt(l, msg);
|
||||
if (!l->doing_xfr || l->xfr_q == query) {
|
||||
if (msg->rcode == dns_rcode_nxdomain &&
|
||||
(l->origin != NULL || l->need_search)) {
|
||||
@@ -4233,7 +4199,7 @@ destroy_libs(void) {
|
||||
}
|
||||
|
||||
UNLOCK_LOOKUP;
|
||||
isc_mutex_destroy(&lookup_lock);
|
||||
DESTROYLOCK(&lookup_lock);
|
||||
debug("Removing log context");
|
||||
isc_log_destroy(&lctx);
|
||||
|
||||
|
||||
+8
-3
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -112,6 +112,11 @@ Print debugging traces\&. Equivalent to the
|
||||
verbose option\&.
|
||||
.RE
|
||||
.PP
|
||||
\-i
|
||||
.RS 4
|
||||
Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l
|
||||
.RS 4
|
||||
List zone: The
|
||||
@@ -252,7 +257,7 @@ If
|
||||
\fBhost\fR
|
||||
has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
|
||||
\fBhost\fR
|
||||
appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
|
||||
appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
|
||||
\fBIDN_DISABLE\fR
|
||||
environment variable\&. The IDN support is disabled if the variable is set when
|
||||
\fBhost\fR
|
||||
@@ -269,5 +274,5 @@ runs\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+9
-11
@@ -151,7 +151,6 @@ show_usage(void) {
|
||||
" -s a SERVFAIL response should stop query\n"
|
||||
" -t specifies the query type\n"
|
||||
" -T enables TCP/IP mode\n"
|
||||
" -U enables UDP mode\n"
|
||||
" -v enables verbose output\n"
|
||||
" -V print version number and exit\n"
|
||||
" -w specifies to wait forever for a reply\n"
|
||||
@@ -625,29 +624,28 @@ pre_parse_args(int argc, char **argv) {
|
||||
case 'a': break;
|
||||
case 'A': break;
|
||||
case 'c': break;
|
||||
case 'C': break;
|
||||
case 'd': break;
|
||||
case 'D':
|
||||
if (debugging)
|
||||
debugtiming = true;
|
||||
debugging = true;
|
||||
break;
|
||||
case 'i': break;
|
||||
case 'l': break;
|
||||
case 'n': break;
|
||||
case 'N': break;
|
||||
case 'r': break;
|
||||
case 'R': break;
|
||||
case 's': break;
|
||||
case 't': break;
|
||||
case 'T': break;
|
||||
case 'U': break;
|
||||
case 'v': break;
|
||||
case 'V':
|
||||
version();
|
||||
exit(0);
|
||||
break;
|
||||
case 'w': break;
|
||||
case 'C': break;
|
||||
case 'D':
|
||||
if (debugging)
|
||||
debugtiming = true;
|
||||
debugging = true;
|
||||
break;
|
||||
case 'N': break;
|
||||
case 'R': break;
|
||||
case 'T': break;
|
||||
case 'W': break;
|
||||
default:
|
||||
show_usage();
|
||||
|
||||
@@ -47,7 +47,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
+11
-2
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -138,6 +138,15 @@
|
||||
Equivalent to the <code class="option">-v</code> verbose option.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-i</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Obsolete.
|
||||
Use the IP6.INT domain for reverse lookups of IPv6
|
||||
addresses as defined in RFC1886 and deprecated in RFC4159.
|
||||
The default is to use IP6.ARPA as specified in RFC3596.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-l</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -302,7 +311,7 @@
|
||||
<span class="command"><strong>host</strong></span> appropriately converts character encoding of
|
||||
domain name before sending a request to DNS server or displaying a
|
||||
reply from the server.
|
||||
If you'd like to turn off the IDN support for some reason, define
|
||||
If you'd like to turn off the IDN support for some reason, defines
|
||||
the <code class="envar">IDN_DISABLE</code> environment variable.
|
||||
The IDN support is disabled if the variable is set when
|
||||
<span class="command"><strong>host</strong></span> runs.
|
||||
|
||||
+2
-13
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -277,17 +277,6 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
|
||||
.PP
|
||||
\fBnslookup\fR
|
||||
returns with an exit status of 1 if any query failed, and 0 otherwise\&.
|
||||
.SH "IDN SUPPORT"
|
||||
.PP
|
||||
If
|
||||
\fBnslookup\fR
|
||||
has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
|
||||
\fBnslookup\fR
|
||||
appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
|
||||
\fBIDN_DISABLE\fR
|
||||
environment variable\&. The IDN support is disabled if the variable is set when
|
||||
\fBnslookup\fR
|
||||
runs or when the standard output is not a tty\&.
|
||||
.SH "FILES"
|
||||
.PP
|
||||
/etc/resolv\&.conf
|
||||
@@ -301,5 +290,5 @@ runs or when the standard output is not a tty\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+1
-21
@@ -879,29 +879,12 @@ get_next_command(void) {
|
||||
isc_mem_free(mctx, buf);
|
||||
}
|
||||
|
||||
ISC_PLATFORM_NORETURN_PRE static void
|
||||
usage(void) ISC_PLATFORM_NORETURN_POST;
|
||||
|
||||
static void
|
||||
usage(void) {
|
||||
fprintf(stderr, "Usage:\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] # interactive mode using default server\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] - server # interactive mode using 'server'\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] host # just look up 'host' using default server\n");
|
||||
fprintf(stderr,
|
||||
" nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
static void
|
||||
parse_args(int argc, char **argv) {
|
||||
bool have_lookup = false;
|
||||
|
||||
usesearch = true;
|
||||
for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
|
||||
for (argc--, argv++; argc > 0; argc--, argv++) {
|
||||
debug("main parsing %s", argv[0]);
|
||||
if (argv[0][0] == '-') {
|
||||
if (strncasecmp(argv[0], "-ver", 4) == 0) {
|
||||
@@ -917,9 +900,6 @@ parse_args(int argc, char **argv) {
|
||||
in_use = true;
|
||||
addlookup(argv[0]);
|
||||
} else {
|
||||
if (argv[1] != NULL) {
|
||||
usage();
|
||||
}
|
||||
set_nameserver(argv[0]);
|
||||
check_ra = false;
|
||||
}
|
||||
|
||||
@@ -71,7 +71,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
+3
-20
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -362,31 +362,14 @@ nslookup -query=hinfo -timeout=10
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
|
||||
|
||||
<p>
|
||||
If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
|
||||
domain name) support, it can accept and display non-ASCII domain names.
|
||||
<span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
|
||||
domain name before sending a request to DNS server or displaying a
|
||||
reply from the server.
|
||||
If you'd like to turn off the IDN support for some reason, define
|
||||
the <code class="envar">IDN_DISABLE</code> environment variable.
|
||||
The IDN support is disabled if the variable is set when
|
||||
<span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
|
||||
a tty.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.12"></a><h2>FILES</h2>
|
||||
<a name="id-1.11"></a><h2>FILES</h2>
|
||||
|
||||
<p><code class="filename">/etc/resolv.conf</code>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.13"></a><h2>SEE ALSO</h2>
|
||||
<a name="id-1.12"></a><h2>SEE ALSO</h2>
|
||||
|
||||
<p><span class="citerefentry">
|
||||
<span class="refentrytitle">dig</span>(1)
|
||||
|
||||
@@ -20,7 +20,7 @@ CINCLUDES = ${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
|
||||
CDEFINES = -DVERSION=\"${VERSION}\"
|
||||
CWARNINGS =
|
||||
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
ISCNOSYMLIBS = ../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
|
||||
.sp
|
||||
The
|
||||
\fIalgorithm\fR
|
||||
must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c \fIclass\fR
|
||||
@@ -293,5 +293,5 @@ RFC 7344\&.
|
||||
.RE
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+17
-11
@@ -86,7 +86,7 @@ static dns_rdataclass_t rdclass = dns_rdataclass_in;
|
||||
* List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
|
||||
* from -a arguments. The size of the array is an arbitrary limit.
|
||||
*/
|
||||
static dns_dsdigest_t dtype[8];
|
||||
static uint8_t dtype[8];
|
||||
|
||||
static const char *startstr = NULL; /* from which we derive notbefore */
|
||||
static isc_stdtime_t notbefore = 0; /* restrict sig inception times */
|
||||
@@ -129,7 +129,7 @@ static int nkey; /* number of child zone DNSKEY records */
|
||||
typedef struct keyinfo {
|
||||
dns_rdata_t rdata;
|
||||
dst_key_t *dst;
|
||||
dns_secalg_t algo;
|
||||
uint8_t algo;
|
||||
dns_keytag_t tag;
|
||||
} keyinfo_t;
|
||||
|
||||
@@ -482,6 +482,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
|
||||
dns_rdata_ds_t ds;
|
||||
dns_rdata_t dsrdata = DNS_RDATA_INIT;
|
||||
dns_rdata_t newdsrdata = DNS_RDATA_INIT;
|
||||
dns_rdatatype_t keytype;
|
||||
bool c;
|
||||
|
||||
dns_rdataset_current(dsset, &dsrdata);
|
||||
@@ -492,8 +493,12 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
|
||||
continue;
|
||||
}
|
||||
|
||||
/* allow for both DNSKEY and CDNSKEY */
|
||||
keytype = ki->rdata.type;
|
||||
ki->rdata.type = dns_rdatatype_dnskey;
|
||||
result = dns_ds_buildrdata(name, &ki->rdata, ds.digest_type,
|
||||
dsbuf, &newdsrdata);
|
||||
ki->rdata.type = keytype;
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
vbprintf(3, "dns_ds_buildrdata("
|
||||
"keytag=%d, algo=%d, digest=%d): %s\n",
|
||||
@@ -568,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
|
||||
ki->algo = dnskey.algorithm;
|
||||
|
||||
dns_rdata_toregion(keyrdata, &r);
|
||||
ki->tag = dst_region_computeid(&r);
|
||||
ki->tag = dst_region_computeid(&r, ki->algo);
|
||||
|
||||
ki->dst = NULL;
|
||||
if (!match_key_dsset(ki, dsset, strictness)) {
|
||||
@@ -614,12 +619,12 @@ free_keytable(keyinfo_t **keytable_p) {
|
||||
* otherwise the key algorithm. This is used by the signature coverage
|
||||
* check functions below.
|
||||
*/
|
||||
static dns_secalg_t *
|
||||
static uint8_t *
|
||||
matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
|
||||
dns_rdataset_t *sigset)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_secalg_t *algo;
|
||||
uint8_t *algo;
|
||||
int i;
|
||||
|
||||
algo = isc_mem_get(mctx, nkey);
|
||||
@@ -702,7 +707,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
|
||||
* fetched from the child zone, any working signature is enough.
|
||||
*/
|
||||
static bool
|
||||
signed_loose(dns_secalg_t *algo) {
|
||||
signed_loose(uint8_t *algo) {
|
||||
bool ok = false;
|
||||
int i;
|
||||
for (i = 0; i < nkey; i++) {
|
||||
@@ -721,7 +726,7 @@ signed_loose(dns_secalg_t *algo) {
|
||||
* RRset.
|
||||
*/
|
||||
static bool
|
||||
signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
|
||||
signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
|
||||
isc_result_t result;
|
||||
bool all_ok = true;
|
||||
|
||||
@@ -821,6 +826,7 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
|
||||
return (ISC_R_NOSPACE);
|
||||
}
|
||||
|
||||
cdnskey->type = dns_rdatatype_dnskey;
|
||||
rdata = rdata_get();
|
||||
result = dns_ds_buildrdata(name, cdnskey, dtype[i],
|
||||
r.base, rdata);
|
||||
@@ -844,14 +850,14 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
|
||||
*/
|
||||
static int
|
||||
cmp_dtype(const void *ap, const void *bp) {
|
||||
int a = *(const dns_dsdigest_t *)ap;
|
||||
int b = *(const dns_dsdigest_t *)bp;
|
||||
int a = *(const uint8_t *)ap;
|
||||
int b = *(const uint8_t *)bp;
|
||||
return (a - b);
|
||||
}
|
||||
|
||||
static void
|
||||
add_dtype(const char *dn) {
|
||||
dns_dsdigest_t dt;
|
||||
uint8_t dt;
|
||||
unsigned i, n;
|
||||
|
||||
dt = strtodsdigest(dn);
|
||||
@@ -936,7 +942,7 @@ consistent_digests(dns_rdataset_t *dsset) {
|
||||
dns_rdata_t *arrdata;
|
||||
dns_rdata_ds_t *ds;
|
||||
dns_keytag_t key_tag;
|
||||
dns_secalg_t algorithm;
|
||||
uint8_t algorithm;
|
||||
bool match;
|
||||
int i, j, n, d;
|
||||
|
||||
|
||||
@@ -40,7 +40,6 @@
|
||||
<copyright>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -144,9 +143,9 @@
|
||||
record. This option has no effect when using CDS records.
|
||||
</para>
|
||||
<para>
|
||||
The <replaceable>algorithm</replaceable> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
The <replaceable>algorithm</replaceable> must be one of SHA-1
|
||||
(SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
|
||||
values are case insensitive. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -129,9 +129,9 @@
|
||||
record. This option has no effect when using CDS records.
|
||||
</p>
|
||||
<p>
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
|
||||
(SHA1), SHA-256 (SHA256), or SHA-384 (SHA384). These
|
||||
values are case insensitive. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
</p>
|
||||
</dd>
|
||||
|
||||
+46
-105
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -39,103 +39,61 @@
|
||||
dnssec-dsfromkey \- DNSSEC DS RR generation tool
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
|
||||
\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
|
||||
.HP \w'\fBdnssec\-dsfromkey\fR\ 'u
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
|
||||
\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
The
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
|
||||
\fB\-l\fR
|
||||
option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
|
||||
\fB\-C\fR
|
||||
it outputs CDS (Child DS) RRs\&.
|
||||
.PP
|
||||
The input keys can be specified in a number of ways:
|
||||
.PP
|
||||
By default,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads a key file named like
|
||||
Knnnn\&.+aaa+iiiii\&.key, as generated by
|
||||
\fBdnssec\-keygen\fR\&.
|
||||
.PP
|
||||
With the
|
||||
\fB\-f \fR\fB\fIfile\fR\fR
|
||||
option,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
|
||||
.PP
|
||||
With the
|
||||
\fB\-s\fR
|
||||
option,
|
||||
\fBdnssec\-dsfromkey\fR
|
||||
reads a
|
||||
keyset\-
|
||||
file, as generated by
|
||||
\fBdnssec\-keygen\fR\fB\-C\fR\&.
|
||||
outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-1
|
||||
.RS 4
|
||||
An abbreviation for
|
||||
\fB\-a SHA1\fR
|
||||
Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
|
||||
.RE
|
||||
.PP
|
||||
\-2
|
||||
.RS 4
|
||||
An abbreviation for
|
||||
\fB\-a SHA\-256\fR
|
||||
Use SHA\-256 as the digest algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-a \fIalgorithm\fR
|
||||
.RS 4
|
||||
Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
|
||||
.sp
|
||||
The
|
||||
\fIalgorithm\fR
|
||||
must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
|
||||
.RE
|
||||
.PP
|
||||
\-A
|
||||
.RS 4
|
||||
Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
|
||||
\fB\-f\fR
|
||||
zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-c \fIclass\fR
|
||||
.RS 4
|
||||
Specifies the DNS class (default is IN)\&. Useful only in
|
||||
\fB\-s\fR
|
||||
keyset or
|
||||
\fB\-f\fR
|
||||
zone file mode\&.
|
||||
Select the digest algorithm\&. The value of
|
||||
\fBalgorithm\fR
|
||||
must be one of SHA\-1 (SHA1), SHA\-256 (SHA256) or SHA\-384 (SHA384)\&. These values are case insensitive\&.
|
||||
.RE
|
||||
.PP
|
||||
\-C
|
||||
.RS 4
|
||||
Generate CDS records rather than DS records\&. This is mutually exclusive with the
|
||||
\fB\-l\fR
|
||||
option for generating DLV records\&.
|
||||
Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-T \fITTL\fR
|
||||
.RS 4
|
||||
Specifies the TTL of the DS records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-K \fIdirectory\fR
|
||||
.RS 4
|
||||
Look for key files (or, in keyset mode,
|
||||
keyset\-
|
||||
files) in
|
||||
\fBdirectory\fR\&.
|
||||
.RE
|
||||
.PP
|
||||
\-f \fIfile\fR
|
||||
.RS 4
|
||||
Zone file mode:
|
||||
\fBdnssec\-dsfromkey\fR\*(Aqs final
|
||||
\fIdnsname\fR
|
||||
argument is the DNS domain name of a zone whose master file can be read from
|
||||
Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
|
||||
\fBfile\fR\&. If the zone name is the same as
|
||||
\fBfile\fR, then it may be omitted\&.
|
||||
.sp
|
||||
If
|
||||
\fIfile\fR
|
||||
is
|
||||
\fBfile\fR
|
||||
is set to
|
||||
"\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
|
||||
\fBdig\fR
|
||||
command as input, as in:
|
||||
@@ -143,41 +101,26 @@ command as input, as in:
|
||||
\fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
|
||||
.RE
|
||||
.PP
|
||||
\-h
|
||||
\-A
|
||||
.RS 4
|
||||
Prints usage information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-K \fIdirectory\fR
|
||||
.RS 4
|
||||
Look for key files or
|
||||
keyset\-
|
||||
files in
|
||||
\fBdirectory\fR\&.
|
||||
Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-l \fIdomain\fR
|
||||
.RS 4
|
||||
Generate a DLV set instead of a DS set\&. The specified
|
||||
\fIdomain\fR
|
||||
is appended to the name for each record in the set\&. This is mutually exclusive with the
|
||||
\fB\-C\fR
|
||||
option for generating CDS records\&.
|
||||
\fBdomain\fR
|
||||
is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
|
||||
.RE
|
||||
.PP
|
||||
\-s
|
||||
.RS 4
|
||||
Keyset mode:
|
||||
\fBdnssec\-dsfromkey\fR\*(Aqs final
|
||||
\fIdnsname\fR
|
||||
argument is the DNS domain name used to locate a
|
||||
keyset\-
|
||||
file\&.
|
||||
Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
|
||||
.RE
|
||||
.PP
|
||||
\-T \fITTL\fR
|
||||
\-c \fIclass\fR
|
||||
.RS 4
|
||||
Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
|
||||
Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v \fIlevel\fR
|
||||
@@ -185,6 +128,11 @@ Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
|
||||
Sets the debugging level\&.
|
||||
.RE
|
||||
.PP
|
||||
\-h
|
||||
.RS 4
|
||||
Prints usage information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-V
|
||||
.RS 4
|
||||
Prints version information\&.
|
||||
@@ -193,16 +141,16 @@ Prints version information\&.
|
||||
.PP
|
||||
To build the SHA\-256 DS RR from the
|
||||
\fBKexample\&.com\&.+003+26160\fR
|
||||
keyfile name, you can issue the following command:
|
||||
keyfile name, the following command would be issued:
|
||||
.PP
|
||||
\fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
|
||||
.PP
|
||||
The command would print something like:
|
||||
.PP
|
||||
\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
|
||||
\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
|
||||
.SH "FILES"
|
||||
.PP
|
||||
The keyfile can be designated by the key identification
|
||||
The keyfile can be designed by the key identification
|
||||
Knnnn\&.+aaa+iiiii
|
||||
or the full file name
|
||||
Knnnn\&.+aaa+iiiii\&.key
|
||||
@@ -222,20 +170,13 @@ A keyfile error can give a "file not found" even if the file exists\&.
|
||||
\fBdnssec-keygen\fR(8),
|
||||
\fBdnssec-signzone\fR(8),
|
||||
BIND 9 Administrator Reference Manual,
|
||||
RFC 3658
|
||||
(DS RRs),
|
||||
RFC 4431
|
||||
(DLV RRs),
|
||||
RFC 4509
|
||||
(SHA\-256 for DS RRs),
|
||||
RFC 6605
|
||||
(SHA\-384 for DS RRs),
|
||||
RFC 7344
|
||||
(CDS and CDNSKEY RRs)\&.
|
||||
RFC 3658,
|
||||
RFC 4431\&.
|
||||
RFC 4509\&.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -235,7 +235,7 @@ logkey(dns_rdata_t *rdata)
|
||||
}
|
||||
|
||||
static void
|
||||
emit(dns_dsdigest_t dtype, bool showall, char *lookaside,
|
||||
emit(unsigned int dtype, bool showall, char *lookaside,
|
||||
bool cds, dns_rdata_t *rdata)
|
||||
{
|
||||
isc_result_t result;
|
||||
@@ -318,27 +318,30 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
|
||||
static void
|
||||
usage(void) {
|
||||
fprintf(stderr, "Usage:\n");
|
||||
fprintf(stderr, " %s [options] keyfile\n\n", program);
|
||||
fprintf(stderr, " %s [options] -f zonefile [zonename]\n\n", program);
|
||||
fprintf(stderr, " %s [options] -s dnsname\n\n", program);
|
||||
fprintf(stderr, " %s [-h|-V]\n\n", program);
|
||||
fprintf(stderr, " %s options [-K dir] keyfile\n\n", program);
|
||||
fprintf(stderr, " %s options [-K dir] [-c class] -s dnsname\n\n",
|
||||
program);
|
||||
fprintf(stderr, " %s options -f zonefile (as zone name)\n\n", program);
|
||||
fprintf(stderr, " %s options -f zonefile zonename\n\n", program);
|
||||
fprintf(stderr, "Version: %s\n", VERSION);
|
||||
fprintf(stderr, "Options:\n"
|
||||
" -1: digest algorithm SHA-1\n"
|
||||
" -2: digest algorithm SHA-256\n"
|
||||
" -a algorithm: digest algorithm (SHA-1, SHA-256 or SHA-384)\n"
|
||||
" -A: include all keys in DS set, not just KSKs (-f only)\n"
|
||||
" -c class: rdata class for DS set (default IN) (-f or -s only)\n"
|
||||
" -C: print CDS records\n"
|
||||
" -f zonefile: read keys from a zone file\n"
|
||||
" -h: print help information\n"
|
||||
" -K directory: where to find key or keyset files\n"
|
||||
" -l zone: print DLV records in the given lookaside zone\n"
|
||||
" -s: read keys from keyset-<dnsname> file\n"
|
||||
" -T: TTL of output records (omitted by default)\n"
|
||||
" -v level: verbosity\n"
|
||||
" -V: print version information\n");
|
||||
fprintf(stderr, "Output: DS, DLV, or CDS RRs\n");
|
||||
fprintf(stderr, "Options:\n");
|
||||
fprintf(stderr, " -v <verbose level>\n");
|
||||
fprintf(stderr, " -V: print version information\n");
|
||||
fprintf(stderr, " -K <directory>: directory in which to find "
|
||||
"key file or keyset file\n");
|
||||
fprintf(stderr, " -a algorithm: digest algorithm "
|
||||
"(SHA-1, SHA-256, GOST or SHA-384)\n");
|
||||
fprintf(stderr, " -1: use SHA-1\n");
|
||||
fprintf(stderr, " -2: use SHA-256\n");
|
||||
fprintf(stderr, " -C: print CDS record\n");
|
||||
fprintf(stderr, " -l: add lookaside zone and print DLV records\n");
|
||||
fprintf(stderr, " -s: read keyset from keyset-<dnsname> file\n");
|
||||
fprintf(stderr, " -c class: rdata class for DS set (default: IN)\n");
|
||||
fprintf(stderr, " -T TTL\n");
|
||||
fprintf(stderr, " -f file: read keyset from zone file\n");
|
||||
fprintf(stderr, " -A: when used with -f, "
|
||||
"include all keys in DS set, not just KSKs\n");
|
||||
fprintf(stderr, "Output: DS or DLV RRs\n");
|
||||
|
||||
exit (-1);
|
||||
}
|
||||
@@ -350,7 +353,7 @@ main(int argc, char **argv) {
|
||||
char *lookaside = NULL;
|
||||
char *endp;
|
||||
int ch;
|
||||
dns_dsdigest_t dtype = DNS_DSDIGEST_SHA1;
|
||||
unsigned int dtype = DNS_DSDIGEST_SHA1;
|
||||
bool cds = false;
|
||||
bool both = true;
|
||||
bool usekeyset = false;
|
||||
|
||||
@@ -41,7 +41,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -49,108 +48,56 @@
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>dnssec-dsfromkey</command>
|
||||
<group choice="opt">
|
||||
<arg choice="plain"><option>-1</option></arg>
|
||||
<arg choice="plain"><option>-2</option></arg>
|
||||
<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
|
||||
</group>
|
||||
<group>
|
||||
<arg choice="plain" rep="norepeat"><option>-C</option></arg>
|
||||
<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
|
||||
</group>
|
||||
<arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-1</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-2</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-C</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
|
||||
<arg choice="req" rep="norepeat">keyfile</arg>
|
||||
</cmdsynopsis>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>dnssec-dsfromkey</command>
|
||||
<group choice="opt">
|
||||
<arg choice="plain"><option>-1</option></arg>
|
||||
<arg choice="plain"><option>-2</option></arg>
|
||||
<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
|
||||
</group>
|
||||
<group>
|
||||
<arg choice="plain" rep="norepeat"><option>-C</option></arg>
|
||||
<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
|
||||
</group>
|
||||
<arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-A</option></arg>
|
||||
<arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat">dnsname</arg>
|
||||
</cmdsynopsis>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>dnssec-dsfromkey</command>
|
||||
<group choice="opt">
|
||||
<arg choice="plain"><option>-1</option></arg>
|
||||
<arg choice="plain"><option>-2</option></arg>
|
||||
<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
|
||||
</group>
|
||||
<group>
|
||||
<arg choice="plain" rep="norepeat"><option>-C</option></arg>
|
||||
<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
|
||||
</group>
|
||||
<arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg choice="req" rep="norepeat">-s</arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-1</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-2</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-s</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-A</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
|
||||
<arg choice="req" rep="norepeat">dnsname</arg>
|
||||
</cmdsynopsis>
|
||||
</cmdsynopsis>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>dnssec-dsfromkey</command>
|
||||
<group choice="opt">
|
||||
<arg choice="plain" rep="norepeat"><option>-h</option></arg>
|
||||
<arg choice="plain" rep="norepeat"><option>-V</option></arg>
|
||||
</group>
|
||||
</cmdsynopsis>
|
||||
<arg choice="opt" rep="norepeat"><option>-h</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-V</option></arg>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
|
||||
<refsection><info><title>DESCRIPTION</title></info>
|
||||
|
||||
<para>
|
||||
The <command>dnssec-dsfromkey</command> command outputs DS (Delegation
|
||||
Signer) resource records (RRs) and other similarly-constructed RRs:
|
||||
with the <option>-l</option> option it outputs DLV (DNSSEC Lookaside
|
||||
Validation) RRs; or with the <option>-C</option> it outputs CDS (Child
|
||||
DS) RRs.
|
||||
<para><command>dnssec-dsfromkey</command>
|
||||
outputs the Delegation Signer (DS) resource record (RR), as defined in
|
||||
RFC 3658 and RFC 4509, for the given key(s).
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The input keys can be specified in a number of ways:
|
||||
</para>
|
||||
|
||||
<para>
|
||||
By default, <command>dnssec-dsfromkey</command> reads a key file
|
||||
named like <filename>Knnnn.+aaa+iiiii.key</filename>, as generated
|
||||
by <command>dnssec-keygen</command>.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
With the <option>-f <replaceable>file</replaceable></option>
|
||||
option, <command>dnssec-dsfromkey</command> reads keys from a zone file
|
||||
or partial zone file (which can contain just the DNSKEY records).
|
||||
</para>
|
||||
|
||||
<para>
|
||||
With the <option>-s</option>
|
||||
option, <command>dnssec-dsfromkey</command> reads
|
||||
a <filename>keyset-</filename> file, as generated
|
||||
by <command>dnssec-keygen</command> <option>-C</option>.
|
||||
</para>
|
||||
|
||||
</refsection>
|
||||
|
||||
<refsection><info><title>OPTIONS</title></info>
|
||||
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>-1</term>
|
||||
<listitem>
|
||||
<para>
|
||||
An abbreviation for <option>-a SHA1</option>
|
||||
Use SHA-1 as the digest algorithm (the default is to use
|
||||
both SHA-1 and SHA-256).
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -159,7 +106,7 @@
|
||||
<term>-2</term>
|
||||
<listitem>
|
||||
<para>
|
||||
An abbreviation for <option>-a SHA-256</option>
|
||||
Use SHA-256 as the digest algorithm.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -168,49 +115,40 @@
|
||||
<term>-a <replaceable class="parameter">algorithm</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specify a digest algorithm to use when converting DNSKEY
|
||||
records to DS records. This option can be repeated, so
|
||||
that multiple DS records are created for each DNSKEY
|
||||
record.
|
||||
</para>
|
||||
<para>
|
||||
The <replaceable>algorithm</replaceable> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
Select the digest algorithm. The value of
|
||||
<option>algorithm</option> must be one of SHA-1 (SHA1),
|
||||
SHA-256 (SHA256) or SHA-384 (SHA384).
|
||||
These values are case insensitive.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-A</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records
|
||||
and printed. Useful only in <option>-f</option> zone file mode.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-c <replaceable class="parameter">class</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in <option>-s</option> keyset or <option>-f</option>
|
||||
zone file mode.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-C</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with the <option>-l</option> option for generating DLV
|
||||
records.
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with generating lookaside records.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-T <replaceable class="parameter">TTL</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the TTL of the DS records.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-K <replaceable class="parameter">directory</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Look for key files (or, in keyset mode,
|
||||
<filename>keyset-</filename> files) in
|
||||
<option>directory</option>.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -219,14 +157,13 @@
|
||||
<term>-f <replaceable class="parameter">file</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Zone file mode: <command>dnssec-dsfromkey</command>'s
|
||||
final <replaceable>dnsname</replaceable> argument is
|
||||
the DNS domain name of a zone whose master file can be read
|
||||
Zone file mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a zone master file, which can be read
|
||||
from <option>file</option>. If the zone name is the same as
|
||||
<option>file</option>, then it may be omitted.
|
||||
</para>
|
||||
<para>
|
||||
If <replaceable>file</replaceable> is <literal>"-"</literal>, then
|
||||
If <option>file</option> is set to <literal>"-"</literal>, then
|
||||
the zone data is read from the standard input. This makes it
|
||||
possible to use the output of the <command>dig</command>
|
||||
command as input, as in:
|
||||
@@ -238,33 +175,26 @@
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-h</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Prints usage information.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-K <replaceable class="parameter">directory</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Look for key files or <filename>keyset-</filename> files in
|
||||
<option>directory</option>.
|
||||
</para>
|
||||
</listitem>
|
||||
<term>-A</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Include ZSKs when generating DS records. Without this option,
|
||||
only keys which have the KSK flag set will be converted to DS
|
||||
records and printed. Useful only in zone file mode.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-l <replaceable class="parameter">domain</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<replaceable>domain</replaceable> is appended to the name for each
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<option>domain</option> is appended to the name for each
|
||||
record in the set.
|
||||
This is mutually exclusive with the <option>-C</option> option
|
||||
for generating CDS records.
|
||||
The DNSSEC Lookaside Validation (DLV) RR is described
|
||||
in RFC 4431. This is mutually exclusive with generating
|
||||
CDS records.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -273,18 +203,18 @@
|
||||
<term>-s</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Keyset mode: <command>dnssec-dsfromkey</command>'s
|
||||
final <replaceable>dnsname</replaceable> argument is the DNS
|
||||
domain name used to locate a <filename>keyset-</filename> file.
|
||||
Keyset mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a keyset file.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-T <replaceable class="parameter">TTL</replaceable></term>
|
||||
<term>-c <replaceable class="parameter">class</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in keyset or zone file mode.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -298,6 +228,15 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-h</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Prints usage information.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-V</term>
|
||||
<listitem>
|
||||
@@ -314,22 +253,21 @@
|
||||
<para>
|
||||
To build the SHA-256 DS RR from the
|
||||
<userinput>Kexample.com.+003+26160</userinput>
|
||||
keyfile name, you can issue the following command:
|
||||
keyfile name, the following command would be issued:
|
||||
</para>
|
||||
<para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
|
||||
</para>
|
||||
<para>
|
||||
The command would print something like:
|
||||
</para>
|
||||
<para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</userinput>
|
||||
<para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
|
||||
</para>
|
||||
|
||||
</refsection>
|
||||
|
||||
<refsection><info><title>FILES</title></info>
|
||||
|
||||
<para>
|
||||
The keyfile can be designated by the key identification
|
||||
The keyfile can be designed by the key identification
|
||||
<filename>Knnnn.+aaa+iiiii</filename> or the full file name
|
||||
<filename>Knnnn.+aaa+iiiii.key</filename> as generated by
|
||||
<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
|
||||
@@ -357,11 +295,9 @@
|
||||
<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citetitle>BIND 9 Administrator Reference Manual</citetitle>,
|
||||
<citetitle>RFC 3658</citetitle> (DS RRs),
|
||||
<citetitle>RFC 4431</citetitle> (DLV RRs),
|
||||
<citetitle>RFC 4509</citetitle> (SHA-256 for DS RRs),
|
||||
<citetitle>RFC 6605</citetitle> (SHA-384 for DS RRs),
|
||||
<citetitle>RFC 7344</citetitle> (CDS and CDNSKEY RRs).
|
||||
<citetitle>RFC 3658</citetitle>,
|
||||
<citetitle>RFC 4431</citetitle>.
|
||||
<citetitle>RFC 4509</citetitle>.
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -33,167 +33,105 @@
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
[<code class="option">-1</code>]
|
||||
[<code class="option">-2</code>]
|
||||
[<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
|
||||
[<code class="option">-C</code>]
|
||||
[<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
{keyfile}
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-A</code>]
|
||||
{<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
|
||||
[dnsname]
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-1</code>
|
||||
| <code class="option">-2</code>
|
||||
| <code class="option">-a <em class="replaceable"><code>alg</code></em></code>
|
||||
]
|
||||
[
|
||||
<code class="option">-C</code>
|
||||
| <code class="option">-l <em class="replaceable"><code>domain</code></em></code>
|
||||
]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
{-s}
|
||||
[<code class="option">-1</code>]
|
||||
[<code class="option">-2</code>]
|
||||
[<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
[<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
|
||||
[<code class="option">-s</code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
|
||||
[<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
|
||||
[<code class="option">-A</code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
{dnsname}
|
||||
</p></div>
|
||||
</p></div>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-dsfromkey</code>
|
||||
[
|
||||
<code class="option">-h</code>
|
||||
| <code class="option">-V</code>
|
||||
]
|
||||
</p></div>
|
||||
[<code class="option">-h</code>]
|
||||
[<code class="option">-V</code>]
|
||||
</p></div>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.7"></a><h2>DESCRIPTION</h2>
|
||||
|
||||
<p>
|
||||
The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
|
||||
Signer) resource records (RRs) and other similarly-constructed RRs:
|
||||
with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
|
||||
Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
|
||||
DS) RRs.
|
||||
<p><span class="command"><strong>dnssec-dsfromkey</strong></span>
|
||||
outputs the Delegation Signer (DS) resource record (RR), as defined in
|
||||
RFC 3658 and RFC 4509, for the given key(s).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
The input keys can be specified in a number of ways:
|
||||
</p>
|
||||
|
||||
<p>
|
||||
By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
|
||||
named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
|
||||
by <span class="command"><strong>dnssec-keygen</strong></span>.
|
||||
</p>
|
||||
|
||||
<p>
|
||||
With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
|
||||
option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
|
||||
or partial zone file (which can contain just the DNSKEY records).
|
||||
</p>
|
||||
|
||||
<p>
|
||||
With the <code class="option">-s</code>
|
||||
option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
|
||||
a <code class="filename">keyset-</code> file, as generated
|
||||
by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.8"></a><h2>OPTIONS</h2>
|
||||
|
||||
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term">-1</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
An abbreviation for <code class="option">-a SHA1</code>
|
||||
Use SHA-1 as the digest algorithm (the default is to use
|
||||
both SHA-1 and SHA-256).
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-2</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
An abbreviation for <code class="option">-a SHA-256</code>
|
||||
Use SHA-256 as the digest algorithm.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specify a digest algorithm to use when converting DNSKEY
|
||||
records to DS records. This option can be repeated, so
|
||||
that multiple DS records are created for each DNSKEY
|
||||
record.
|
||||
</p>
|
||||
<p>
|
||||
The <em class="replaceable"><code>algorithm</code></em> must be one of
|
||||
SHA-1, SHA-256, or SHA-384. These values are case insensitive,
|
||||
and the hyphen may be omitted. If no algorithm is specified,
|
||||
the default is SHA-256.
|
||||
Select the digest algorithm. The value of
|
||||
<code class="option">algorithm</code> must be one of SHA-1 (SHA1),
|
||||
SHA-256 (SHA256) or SHA-384 (SHA384).
|
||||
These values are case insensitive.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-A</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Include ZSKs when generating DS records. Without this option, only
|
||||
keys which have the KSK flag set will be converted to DS records
|
||||
and printed. Useful only in <code class="option">-f</code> zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in <code class="option">-s</code> keyset or <code class="option">-f</code>
|
||||
zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-C</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with the <code class="option">-l</code> option for generating DLV
|
||||
records.
|
||||
Generate CDS records rather than DS records. This is mutually
|
||||
exclusive with generating lookaside records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the TTL of the DS records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Look for key files (or, in keyset mode,
|
||||
<code class="filename">keyset-</code> files) in
|
||||
<code class="option">directory</code>.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
|
||||
final <em class="replaceable"><code>dnsname</code></em> argument is
|
||||
the DNS domain name of a zone whose master file can be read
|
||||
Zone file mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a zone master file, which can be read
|
||||
from <code class="option">file</code>. If the zone name is the same as
|
||||
<code class="option">file</code>, then it may be omitted.
|
||||
</p>
|
||||
<p>
|
||||
If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
|
||||
If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
|
||||
the zone data is read from the standard input. This makes it
|
||||
possible to use the output of the <span class="command"><strong>dig</strong></span>
|
||||
command as input, as in:
|
||||
@@ -202,41 +140,37 @@
|
||||
<strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-h</span></dt>
|
||||
<dt><span class="term">-A</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints usage information.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Look for key files or <code class="filename">keyset-</code> files in
|
||||
<code class="option">directory</code>.
|
||||
</p>
|
||||
</dd>
|
||||
<p>
|
||||
Include ZSKs when generating DS records. Without this option,
|
||||
only keys which have the KSK flag set will be converted to DS
|
||||
records and printed. Useful only in zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<em class="replaceable"><code>domain</code></em> is appended to the name for each
|
||||
Generate a DLV set instead of a DS set. The specified
|
||||
<code class="option">domain</code> is appended to the name for each
|
||||
record in the set.
|
||||
This is mutually exclusive with the <code class="option">-C</code> option
|
||||
for generating CDS records.
|
||||
The DNSSEC Lookaside Validation (DLV) RR is described
|
||||
in RFC 4431. This is mutually exclusive with generating
|
||||
CDS records.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-s</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
|
||||
final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
|
||||
domain name used to locate a <code class="filename">keyset-</code> file.
|
||||
Keyset mode: in place of the keyfile name, the argument is
|
||||
the DNS domain name of a keyset file.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
|
||||
<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the TTL of the DS records. By default the TTL is omitted.
|
||||
Specifies the DNS class (default is IN). Useful only
|
||||
in keyset or zone file mode.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
|
||||
@@ -245,6 +179,12 @@
|
||||
Sets the debugging level.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-h</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints usage information.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-V</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -260,23 +200,22 @@
|
||||
<p>
|
||||
To build the SHA-256 DS RR from the
|
||||
<strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
|
||||
keyfile name, you can issue the following command:
|
||||
keyfile name, the following command would be issued:
|
||||
</p>
|
||||
<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
|
||||
</p>
|
||||
<p>
|
||||
The command would print something like:
|
||||
</p>
|
||||
<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
|
||||
<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.10"></a><h2>FILES</h2>
|
||||
|
||||
<p>
|
||||
The keyfile can be designated by the key identification
|
||||
The keyfile can be designed by the key identification
|
||||
<code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
|
||||
<code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
|
||||
<span class="refentrytitle">dnssec-keygen</span>(8).
|
||||
@@ -306,11 +245,9 @@
|
||||
<span class="refentrytitle">dnssec-signzone</span>(8)
|
||||
</span>,
|
||||
<em class="citetitle">BIND 9 Administrator Reference Manual</em>,
|
||||
<em class="citetitle">RFC 3658</em> (DS RRs),
|
||||
<em class="citetitle">RFC 4431</em> (DLV RRs),
|
||||
<em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
|
||||
<em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
|
||||
<em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
|
||||
<em class="citetitle">RFC 3658</em>,
|
||||
<em class="citetitle">RFC 4431</em>.
|
||||
<em class="citetitle">RFC 4509</em>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -134,5 +134,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -38,7 +38,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
|
||||
.RS 4
|
||||
Selects the cryptographic algorithm\&. The value of
|
||||
\fBalgorithm\fR
|
||||
must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
|
||||
must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
|
||||
.sp
|
||||
If no algorithm is specified, then RSASHA1 will be used by default, unless the
|
||||
\fB\-3\fR
|
||||
@@ -63,9 +63,9 @@ option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
|
||||
\fB\-3\fR
|
||||
is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
|
||||
.sp
|
||||
These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
|
||||
These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
|
||||
\fB\-3\fR
|
||||
option, then NSEC3RSASHA1 will be used instead\&.
|
||||
option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
|
||||
.sp
|
||||
As of BIND 9\&.12\&.0, this option is mandatory except when using the
|
||||
\fB\-S\fR
|
||||
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -64,7 +64,7 @@ usage(void) {
|
||||
fprintf(stderr, " name: owner of the key\n");
|
||||
fprintf(stderr, "Other options:\n");
|
||||
fprintf(stderr, " -a algorithm: \n"
|
||||
" DH | RSASHA1 |\n"
|
||||
" RSA | RSAMD5 | DH | RSASHA1 |\n"
|
||||
" NSEC3RSASHA1 |\n"
|
||||
" RSASHA256 | RSASHA512 |\n"
|
||||
" ECDSAP256SHA256 | ECDSAP384SHA384\n");
|
||||
@@ -382,14 +382,22 @@ main(int argc, char **argv) {
|
||||
fatal("no algorithm specified");
|
||||
}
|
||||
|
||||
r.base = algname;
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&alg, &r);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("unknown algorithm %s", algname);
|
||||
}
|
||||
if (alg == DST_ALG_DH) {
|
||||
options |= DST_TYPE_KEY;
|
||||
if (strcasecmp(algname, "RSA") == 0) {
|
||||
fprintf(stderr, "The use of RSA (RSAMD5) is not "
|
||||
"recommended.\nIf you still wish to "
|
||||
"use RSA (RSAMD5) please specify "
|
||||
"\"-a RSAMD5\"\n");
|
||||
if (freeit != NULL)
|
||||
free(freeit);
|
||||
return (1);
|
||||
} else {
|
||||
r.base = algname;
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&alg, &r);
|
||||
if (ret != ISC_R_SUCCESS)
|
||||
fatal("unknown algorithm %s", algname);
|
||||
if (alg == DST_ALG_DH)
|
||||
options |= DST_TYPE_KEY;
|
||||
}
|
||||
|
||||
if (use_nsec3) {
|
||||
@@ -631,10 +639,10 @@ main(int argc, char **argv) {
|
||||
|
||||
if (setdel)
|
||||
dst_key_settime(key, DST_TIME_DELETE, deltime);
|
||||
if (setsyncadd)
|
||||
dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
|
||||
if (setsyncdel)
|
||||
dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
|
||||
if (setsyncadd)
|
||||
dst_key_settime(key, DST_TIME_SYNCPUBLISH, syncadd);
|
||||
if (setsyncdel)
|
||||
dst_key_settime(key, DST_TIME_SYNCDELETE, syncdel);
|
||||
|
||||
} else {
|
||||
if (setpub || setact || setrev || setinact ||
|
||||
|
||||
@@ -43,7 +43,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -106,7 +105,7 @@
|
||||
<listitem>
|
||||
<para>
|
||||
Selects the cryptographic algorithm. The value of
|
||||
<option>algorithm</option> must be one of RSASHA1,
|
||||
<option>algorithm</option> must be one of RSAMD5, RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
</para>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2008-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -89,8 +89,8 @@
|
||||
<dd>
|
||||
<p>
|
||||
Selects the cryptographic algorithm. The value of
|
||||
<code class="option">algorithm</code> must be one of RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
<code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
|
||||
DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
|
||||
</p>
|
||||
<p>
|
||||
@@ -103,9 +103,9 @@
|
||||
<p>
|
||||
These values are case insensitive. In some cases, abbreviations
|
||||
are supported, such as ECDSA256 for ECDSAP256SHA256 and
|
||||
ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
|
||||
ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
|
||||
along with the <code class="option">-3</code> option, then NSEC3RSASHA1
|
||||
will be used instead.
|
||||
or NSEC3DSA will be used instead.
|
||||
</p>
|
||||
<p>
|
||||
As of BIND 9.12.0, this option is mandatory except when using
|
||||
|
||||
+50
-49
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -39,7 +39,7 @@
|
||||
dnssec-keygen \- DNSSEC key generation tool
|
||||
.SH "SYNOPSIS"
|
||||
.HP \w'\fBdnssec\-keygen\fR\ 'u
|
||||
\fBdnssec\-keygen\fR [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {name}
|
||||
\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBdnssec\-keygen\fR
|
||||
@@ -58,24 +58,17 @@ may be preferable to direct use of
|
||||
\fBdnssec\-keygen\fR\&.
|
||||
.SH "OPTIONS"
|
||||
.PP
|
||||
\-3
|
||||
.RS 4
|
||||
Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
|
||||
\fBdnssec\-keygen \-3a RSASHA1\fR
|
||||
specifies the NSEC3RSASHA1 algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-a \fIalgorithm\fR
|
||||
.RS 4
|
||||
Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
|
||||
\fBalgorithm\fR
|
||||
must be one of RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
|
||||
must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
|
||||
\fB\-T KEY\fR
|
||||
option as well\&.
|
||||
.sp
|
||||
These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
|
||||
These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
|
||||
\fB\-3\fR
|
||||
option, then NSEC3RSASHA1 will be used instead\&.
|
||||
option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
|
||||
.sp
|
||||
This parameter
|
||||
\fImust\fR
|
||||
@@ -90,15 +83,29 @@ to generate TSIG keys\&.
|
||||
.PP
|
||||
\-b \fIkeysize\fR
|
||||
.RS 4
|
||||
Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 4096 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
|
||||
Specifies the number of bits in the key\&. The choice of key size depends on the algorithm used\&. RSA keys must be between 1024 and 2048 bits\&. Diffie Hellman keys must be between 128 and 4096 bits\&. DSA keys must be between 512 and 1024 bits and an exact multiple of 64\&. HMAC keys must be between 1 and 512 bits\&. Elliptic curve algorithms don\*(Aqt need this parameter\&.
|
||||
.sp
|
||||
If the key size is not specified, some algorithms have pre\-defined defaults\&. For example, RSA keys for use as DNSSEC zone signing keys have a default size of 1024 bits; RSA keys for use as key signing keys (KSKs, generated with
|
||||
\fB\-f KSK\fR) default to 2048 bits\&.
|
||||
.RE
|
||||
.PP
|
||||
\-n \fInametype\fR
|
||||
.RS 4
|
||||
Specifies the owner type of the key\&. The value of
|
||||
\fBnametype\fR
|
||||
must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
|
||||
.RE
|
||||
.PP
|
||||
\-3
|
||||
.RS 4
|
||||
Use an NSEC3\-capable algorithm to generate a DNSSEC key\&. If this option is used with an algorithm that has both NSEC and NSEC3 versions, then the NSEC3 version will be used; for example,
|
||||
\fBdnssec\-keygen \-3a RSASHA1\fR
|
||||
specifies the NSEC3RSASHA1 algorithm\&.
|
||||
.RE
|
||||
.PP
|
||||
\-C
|
||||
.RS 4
|
||||
Compatibility mode: generates an old\-style key, without any timing metadata\&. By default,
|
||||
Compatibility mode: generates an old\-style key, without any metadata\&. By default,
|
||||
\fBdnssec\-keygen\fR
|
||||
will include the key\*(Aqs creation date in the metadata stored with the private key, and other dates may be set there as well (publication date, activation date, etc)\&. Keys that include this data may be incompatible with older versions of BIND; the
|
||||
\fB\-C\fR
|
||||
@@ -143,6 +150,11 @@ Prints a short summary of the options and arguments to
|
||||
Sets the directory in which the key files are to be written\&.
|
||||
.RE
|
||||
.PP
|
||||
\-k
|
||||
.RS 4
|
||||
Deprecated in favor of \-T KEY\&.
|
||||
.RE
|
||||
.PP
|
||||
\-L \fIttl\fR
|
||||
.RS 4
|
||||
Sets the default TTL to use for this key when it is converted into a DNSKEY RR\&. If the key is imported into a zone, this is the TTL that will be used for it, unless there was already a DNSKEY RRset in place, in which case the existing TTL would take precedence\&. If this value is not set and there is no existing DNSKEY RRset, the TTL will default to the SOA TTL\&. Setting the default TTL to
|
||||
@@ -152,17 +164,9 @@ none
|
||||
is the same as leaving it unset\&.
|
||||
.RE
|
||||
.PP
|
||||
\-n \fInametype\fR
|
||||
.RS 4
|
||||
Specifies the owner type of the key\&. The value of
|
||||
\fBnametype\fR
|
||||
must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY)\&. These values are case insensitive\&. Defaults to ZONE for DNSKEY generation\&.
|
||||
.RE
|
||||
.PP
|
||||
\-p \fIprotocol\fR
|
||||
.RS 4
|
||||
Sets the protocol value for the generated key, for use with
|
||||
\fB\-T KEY\fR\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
|
||||
Sets the protocol value for the generated key\&. The protocol is a number between 0 and 255\&. The default is 3 (DNSSEC)\&. Other possible values for this argument are listed in RFC 2535 and its successors\&.
|
||||
.RE
|
||||
.PP
|
||||
\-q
|
||||
@@ -189,25 +193,27 @@ Specifies the strength value of the key\&. The strength is a number between 0 an
|
||||
Specifies the resource record type to use for the key\&.
|
||||
\fBrrtype\fR
|
||||
must be either DNSKEY or KEY\&. The default is DNSKEY when using a DNSSEC algorithm, but it can be overridden to KEY for use with SIG(0)\&.
|
||||
Specifying any TSIG algorithm (HMAC\-* or DH) with
|
||||
\fB\-a\fR
|
||||
forces this option to KEY\&.
|
||||
.RE
|
||||
.PP
|
||||
\-t \fItype\fR
|
||||
.RS 4
|
||||
Indicates the use of the key, for use with
|
||||
\fB\-T KEY\fR\&.
|
||||
Indicates the use of the key\&.
|
||||
\fBtype\fR
|
||||
must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF\&. The default is AUTHCONF\&. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data\&.
|
||||
.RE
|
||||
.PP
|
||||
\-V
|
||||
.RS 4
|
||||
Prints version information\&.
|
||||
.RE
|
||||
.PP
|
||||
\-v \fIlevel\fR
|
||||
.RS 4
|
||||
Sets the debugging level\&.
|
||||
.RE
|
||||
.PP
|
||||
\-V
|
||||
.RS 4
|
||||
Prints version information\&.
|
||||
.RE
|
||||
.SH "TIMING OPTIONS"
|
||||
.PP
|
||||
Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS\&. If the argument begins with a \*(Aq+\*(Aq or \*(Aq\-\*(Aq, it is interpreted as an offset from the present time\&. For convenience, if such an offset is followed by one of the suffixes \*(Aqy\*(Aq, \*(Aqmo\*(Aq, \*(Aqw\*(Aq, \*(Aqd\*(Aq, \*(Aqh\*(Aq, or \*(Aqmi\*(Aq, then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively\&. Without a suffix, the offset is computed in seconds\&. To explicitly prevent a date from being set, use \*(Aqnone\*(Aq or \*(Aqnever\*(Aq\&.
|
||||
@@ -308,39 +314,34 @@ contains the private key\&.
|
||||
.PP
|
||||
The
|
||||
\&.key
|
||||
file contains a DNSKEY or KEY record\&. When a zone is being signed by
|
||||
\fBnamed\fR
|
||||
or
|
||||
\fBdnssec\-signzone\fR\fB\-S\fR, DNSKEY records are included automatically\&. In other cases, the
|
||||
\&.key
|
||||
file can be inserted into a zone file manually or with a
|
||||
\fB$INCLUDE\fR
|
||||
statement\&.
|
||||
file contains a DNS KEY record that can be inserted into a zone file (directly or with a $INCLUDE statement)\&.
|
||||
.PP
|
||||
The
|
||||
\&.private
|
||||
file contains algorithm\-specific fields\&. For obvious security reasons, this file does not have general read permission\&.
|
||||
.PP
|
||||
Both
|
||||
\&.key
|
||||
and
|
||||
\&.private
|
||||
files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
|
||||
.SH "EXAMPLE"
|
||||
.PP
|
||||
To generate an ECDSAP256SHA256 zone\-signing key for the zone
|
||||
\fBexample\&.com\fR, issue the command:
|
||||
To generate a 768\-bit DSA key for the domain
|
||||
\fBexample\&.com\fR, the following command would be issued:
|
||||
.PP
|
||||
\fBdnssec\-keygen \-a ECDSAP256SHA256 example\&.com\fR
|
||||
\fBdnssec\-keygen \-a DSA \-b 768 \-n ZONE example\&.com\fR
|
||||
.PP
|
||||
The command would print a string of the form:
|
||||
.PP
|
||||
\fBKexample\&.com\&.+013+26160\fR
|
||||
\fBKexample\&.com\&.+003+26160\fR
|
||||
.PP
|
||||
In this example,
|
||||
\fBdnssec\-keygen\fR
|
||||
creates the files
|
||||
Kexample\&.com\&.+013+26160\&.key
|
||||
Kexample\&.com\&.+003+26160\&.key
|
||||
and
|
||||
Kexample\&.com\&.+013+26160\&.private\&.
|
||||
.PP
|
||||
To generate a matching key\-signing key, issue the command:
|
||||
.PP
|
||||
\fBdnssec\-keygen \-a ECDSAP256SHA256 \-f KSK example\&.com\fR
|
||||
Kexample\&.com\&.+003+26160\&.private\&.
|
||||
.SH "SEE ALSO"
|
||||
.PP
|
||||
\fBdnssec-signzone\fR(8),
|
||||
@@ -353,5 +354,5 @@ RFC 4034\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+28
-10
@@ -79,12 +79,14 @@ usage(void) {
|
||||
fprintf(stderr, "Options:\n");
|
||||
fprintf(stderr, " -K <directory>: write keys into directory\n");
|
||||
fprintf(stderr, " -a <algorithm>:\n");
|
||||
fprintf(stderr, " RSASHA1 | NSEC3RSASHA1 |\n");
|
||||
fprintf(stderr, " RSA | RSAMD5 | RSASHA1 | NSEC3RSASHA1"
|
||||
" |\n");
|
||||
fprintf(stderr, " RSASHA256 | RSASHA512 |\n");
|
||||
fprintf(stderr, " ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
|
||||
fprintf(stderr, " ED25519 | ED448 | DH\n");
|
||||
fprintf(stderr, " -3: use NSEC3-capable algorithm\n");
|
||||
fprintf(stderr, " -b <key size in bits>:\n");
|
||||
fprintf(stderr, " RSAMD5:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " RSASHA1:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " NSEC3RSASHA1:\t[1024..%d]\n", MAX_RSA);
|
||||
fprintf(stderr, " RSASHA256:\t[1024..%d]\n", MAX_RSA);
|
||||
@@ -241,7 +243,7 @@ main(int argc, char **argv) {
|
||||
/*
|
||||
* Process memory debugging argument first.
|
||||
*/
|
||||
#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:L:m:n:P:p:qR:r:S:s:T:t:" \
|
||||
#define CMDLINE_FLAGS "3A:a:b:Cc:D:d:E:eFf:Gg:hI:i:K:kL:m:n:P:p:qR:r:S:s:T:t:" \
|
||||
"v:V"
|
||||
while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
|
||||
switch (ch) {
|
||||
@@ -322,6 +324,11 @@ main(int argc, char **argv) {
|
||||
fatal("cannot open directory %s: %s",
|
||||
directory, isc_result_totext(ret));
|
||||
break;
|
||||
case 'k':
|
||||
fatal("The -k option has been deprecated.\n"
|
||||
"To generate a key-signing key, use -f KSK.\n"
|
||||
"To generate a key with TYPE=KEY, use -T KEY.\n");
|
||||
break;
|
||||
case 'L':
|
||||
ttl = strtottl(isc_commandline_argument);
|
||||
setttl = true;
|
||||
@@ -501,14 +508,23 @@ main(int argc, char **argv) {
|
||||
fatal("no algorithm specified");
|
||||
}
|
||||
|
||||
r.base = algname;
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&alg, &r);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("unknown algorithm %s", algname);
|
||||
}
|
||||
if (alg == DST_ALG_DH) {
|
||||
options |= DST_TYPE_KEY;
|
||||
if (strcasecmp(algname, "RSA") == 0) {
|
||||
fprintf(stderr, "The use of RSA (RSAMD5) is not "
|
||||
"recommended.\nIf you still wish to "
|
||||
"use RSA (RSAMD5) please specify "
|
||||
"\"-a RSAMD5\"\n");
|
||||
INSIST(freeit == NULL);
|
||||
return (1);
|
||||
} else {
|
||||
r.base = algname;
|
||||
r.length = strlen(algname);
|
||||
ret = dns_secalg_fromtext(&alg, &r);
|
||||
if (ret != ISC_R_SUCCESS) {
|
||||
fatal("unknown algorithm %s", algname);
|
||||
}
|
||||
if (alg == DST_ALG_DH) {
|
||||
options |= DST_TYPE_KEY;
|
||||
}
|
||||
}
|
||||
|
||||
if (!dst_algorithm_supported(alg)) {
|
||||
@@ -682,6 +698,7 @@ main(int argc, char **argv) {
|
||||
}
|
||||
|
||||
switch (alg) {
|
||||
case DNS_KEYALG_RSAMD5:
|
||||
case DNS_KEYALG_RSASHA1:
|
||||
case DNS_KEYALG_NSEC3RSASHA1:
|
||||
case DNS_KEYALG_RSASHA256:
|
||||
@@ -763,6 +780,7 @@ main(int argc, char **argv) {
|
||||
}
|
||||
|
||||
switch(alg) {
|
||||
case DNS_KEYALG_RSAMD5:
|
||||
case DNS_KEYALG_RSASHA1:
|
||||
case DNS_KEYALG_NSEC3RSASHA1:
|
||||
case DNS_KEYALG_RSASHA256:
|
||||
|
||||
@@ -50,7 +50,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -58,10 +57,11 @@
|
||||
<refsynopsisdiv>
|
||||
<cmdsynopsis sepchar=" ">
|
||||
<command>dnssec-keygen</command>
|
||||
<arg choice="opt" rep="norepeat"><option>-3</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
|
||||
<arg rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-b <replaceable class="parameter">keysize</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-3</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-A <replaceable class="parameter">date/offset</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-C</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-D <replaceable class="parameter">date/offset</replaceable></option></arg>
|
||||
@@ -76,7 +76,6 @@
|
||||
<arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-k</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-L <replaceable class="parameter">ttl</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-n <replaceable class="parameter">nametype</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-P <replaceable class="parameter">date/offset</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-P sync <replaceable class="parameter">date/offset</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
|
||||
@@ -87,6 +86,7 @@
|
||||
<arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-V</option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
|
||||
<arg choice="opt" rep="norepeat"><option>-z</option></arg>
|
||||
<arg choice="req" rep="norepeat">name</arg>
|
||||
</cmdsynopsis>
|
||||
</refsynopsisdiv>
|
||||
@@ -117,26 +117,12 @@
|
||||
|
||||
|
||||
<variablelist>
|
||||
|
||||
<varlistentry>
|
||||
<term>-3</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key.
|
||||
If this option is used with an algorithm that has both
|
||||
NSEC and NSEC3 versions, then the NSEC3 version will be
|
||||
used; for example, <command>dnssec-keygen -3a RSASHA1</command>
|
||||
specifies the NSEC3RSASHA1 algorithm.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-a <replaceable class="parameter">algorithm</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value
|
||||
of <option>algorithm</option> must be one of RSASHA1,
|
||||
of <option>algorithm</option> must be one of RSAMD5, RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying
|
||||
@@ -170,9 +156,11 @@
|
||||
<para>
|
||||
Specifies the number of bits in the key. The choice of key
|
||||
size depends on the algorithm used. RSA keys must be
|
||||
between 1024 and 4096 bits. Diffie Hellman keys must be between
|
||||
128 and 4096 bits. Elliptic curve algorithms don't need this
|
||||
parameter.
|
||||
between 1024 and 2048 bits. Diffie Hellman keys must be between
|
||||
128 and 4096 bits. DSA keys must be between 512 and 1024
|
||||
bits and an exact multiple of 64. HMAC keys must be
|
||||
between 1 and 512 bits. Elliptic curve algorithms don't need
|
||||
this parameter.
|
||||
</para>
|
||||
<para>
|
||||
If the key size is not specified, some algorithms have
|
||||
@@ -184,16 +172,43 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-n <replaceable class="parameter">nametype</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the owner type of the key. The value of
|
||||
<option>nametype</option> must either be ZONE (for a DNSSEC
|
||||
zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
|
||||
with a host (KEY)), USER (for a key associated with a
|
||||
user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-3</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key.
|
||||
If this option is used with an algorithm that has both
|
||||
NSEC and NSEC3 versions, then the NSEC3 version will be
|
||||
used; for example, <command>dnssec-keygen -3a RSASHA1</command>
|
||||
specifies the NSEC3RSASHA1 algorithm.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-C</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Compatibility mode: generates an old-style key, without any
|
||||
timing metadata. By default, <command>dnssec-keygen</command>
|
||||
will include the key's creation date in the metadata stored with
|
||||
the private key, and other dates may be set there as well
|
||||
(publication date, activation date, etc). Keys that include this
|
||||
data may be incompatible with older versions of BIND; the
|
||||
Compatibility mode: generates an old-style key, without
|
||||
any metadata. By default, <command>dnssec-keygen</command>
|
||||
will include the key's creation date in the metadata stored
|
||||
with the private key, and other dates may be set there as well
|
||||
(publication date, activation date, etc). Keys that include
|
||||
this data may be incompatible with older versions of BIND; the
|
||||
<option>-C</option> option suppresses them.
|
||||
</para>
|
||||
</listitem>
|
||||
@@ -277,6 +292,15 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-k</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Deprecated in favor of -T KEY.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-L <replaceable class="parameter">ttl</replaceable></term>
|
||||
<listitem>
|
||||
@@ -293,28 +317,14 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-n <replaceable class="parameter">nametype</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Specifies the owner type of the key. The value of
|
||||
<option>nametype</option> must either be ZONE (for a DNSSEC
|
||||
zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
|
||||
with a host (KEY)), USER (for a key associated with a
|
||||
user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-p <replaceable class="parameter">protocol</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Sets the protocol value for the generated key, for use
|
||||
with <option>-T KEY</option>. The protocol is a number between 0
|
||||
and 255. The default is 3 (DNSSEC). Other possible values for
|
||||
this argument are listed in RFC 2535 and its successors.
|
||||
Sets the protocol value for the generated key. The protocol
|
||||
is a number between 0 and 255. The default is 3 (DNSSEC).
|
||||
Other possible values for this argument are listed in
|
||||
RFC 2535 and its successors.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -372,6 +382,10 @@
|
||||
<option>rrtype</option> must be either DNSKEY or KEY. The
|
||||
default is DNSKEY when using a DNSSEC algorithm, but it can be
|
||||
overridden to KEY for use with SIG(0).
|
||||
<para>
|
||||
</para>
|
||||
Specifying any TSIG algorithm (HMAC-* or DH) with
|
||||
<option>-a</option> forces this option to KEY.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -380,20 +394,10 @@
|
||||
<term>-t <replaceable class="parameter">type</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Indicates the use of the key, for use with <option>-T
|
||||
KEY</option>. <option>type</option> must be one of AUTHCONF,
|
||||
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
|
||||
refers to the ability to authenticate data, and CONF the ability
|
||||
to encrypt data.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-V</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Prints version information.
|
||||
Indicates the use of the key. <option>type</option> must be
|
||||
one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
|
||||
is AUTHCONF. AUTH refers to the ability to authenticate
|
||||
data, and CONF the ability to encrypt data.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -407,6 +411,15 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-V</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Prints version information.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
</variablelist>
|
||||
</refsection>
|
||||
|
||||
@@ -571,12 +584,10 @@
|
||||
key.
|
||||
</para>
|
||||
<para>
|
||||
The <filename>.key</filename> file contains a DNSKEY or KEY record.
|
||||
When a zone is being signed by <command>named</command>
|
||||
or <command>dnssec-signzone</command> <option>-S</option>, DNSKEY
|
||||
records are included automatically. In other cases,
|
||||
the <filename>.key</filename> file can be inserted into a zone file
|
||||
manually or with a <userinput>$INCLUDE</userinput> statement.
|
||||
The <filename>.key</filename> file contains a DNS KEY record
|
||||
that
|
||||
can be inserted into a zone file (directly or with a $INCLUDE
|
||||
statement).
|
||||
</para>
|
||||
<para>
|
||||
The <filename>.private</filename> file contains
|
||||
@@ -584,33 +595,32 @@
|
||||
fields. For obvious security reasons, this file does not have
|
||||
general read permission.
|
||||
</para>
|
||||
<para>
|
||||
Both <filename>.key</filename> and <filename>.private</filename>
|
||||
files are generated for symmetric cryptography algorithms such as
|
||||
HMAC-MD5, even though the public and private key are equivalent.
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
<refsection><info><title>EXAMPLE</title></info>
|
||||
|
||||
<para>
|
||||
To generate an ECDSAP256SHA256 zone-signing key for the zone
|
||||
<userinput>example.com</userinput>, issue the command:
|
||||
To generate a 768-bit DSA key for the domain
|
||||
<userinput>example.com</userinput>, the following command would be
|
||||
issued:
|
||||
</para>
|
||||
<para>
|
||||
<userinput>dnssec-keygen -a ECDSAP256SHA256 example.com</userinput>
|
||||
<para><userinput>dnssec-keygen -a DSA -b 768 -n ZONE example.com</userinput>
|
||||
</para>
|
||||
<para>
|
||||
The command would print a string of the form:
|
||||
</para>
|
||||
<para><userinput>Kexample.com.+013+26160</userinput>
|
||||
<para><userinput>Kexample.com.+003+26160</userinput>
|
||||
</para>
|
||||
<para>
|
||||
In this example, <command>dnssec-keygen</command> creates
|
||||
the files <filename>Kexample.com.+013+26160.key</filename>
|
||||
the files <filename>Kexample.com.+003+26160.key</filename>
|
||||
and
|
||||
<filename>Kexample.com.+013+26160.private</filename>.
|
||||
</para>
|
||||
<para>
|
||||
To generate a matching key-signing key, issue the command:
|
||||
</para>
|
||||
<para>
|
||||
<userinput>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</userinput>
|
||||
<filename>Kexample.com.+003+26160.private</filename>.
|
||||
</para>
|
||||
</refsection>
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2005, 2007-2012, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -33,10 +33,11 @@
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p>
|
||||
<code class="command">dnssec-keygen</code>
|
||||
[<code class="option">-3</code>]
|
||||
[<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
|
||||
[<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
|
||||
[<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
|
||||
[<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
|
||||
[<code class="option">-3</code>]
|
||||
[<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
|
||||
[<code class="option">-C</code>]
|
||||
[<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
|
||||
[<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
|
||||
@@ -51,7 +52,6 @@
|
||||
[<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
|
||||
[<code class="option">-k</code>]
|
||||
[<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
|
||||
[<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
|
||||
[<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
|
||||
[<code class="option">-P sync <em class="replaceable"><code>date/offset</code></em></code>]
|
||||
[<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
|
||||
@@ -62,6 +62,7 @@
|
||||
[<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
|
||||
[<code class="option">-V</code>]
|
||||
[<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
|
||||
[<code class="option">-z</code>]
|
||||
{name}
|
||||
</p></div>
|
||||
</div>
|
||||
@@ -94,22 +95,12 @@
|
||||
|
||||
|
||||
<div class="variablelist"><dl class="variablelist">
|
||||
<dt><span class="term">-3</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key.
|
||||
If this option is used with an algorithm that has both
|
||||
NSEC and NSEC3 versions, then the NSEC3 version will be
|
||||
used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
|
||||
specifies the NSEC3RSASHA1 algorithm.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Selects the cryptographic algorithm. For DNSSEC keys, the value
|
||||
of <code class="option">algorithm</code> must be one of RSASHA1,
|
||||
NSEC3RSASHA1, RSASHA256, RSASHA512,
|
||||
of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
|
||||
DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
|
||||
ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448. For
|
||||
TKEY, the value must be DH (Diffie Hellman); specifying
|
||||
his value will automatically set the <code class="option">-T KEY</code>
|
||||
@@ -118,9 +109,9 @@
|
||||
<p>
|
||||
These values are case insensitive. In some cases, abbreviations
|
||||
are supported, such as ECDSA256 for ECDSAP256SHA256 and
|
||||
ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
|
||||
ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
|
||||
along with the <code class="option">-3</code> option, then NSEC3RSASHA1
|
||||
will be used instead.
|
||||
or NSEC3DSA will be used instead.
|
||||
</p>
|
||||
<p>
|
||||
This parameter <span class="emphasis"><em>must</em></span> be specified except
|
||||
@@ -139,9 +130,11 @@
|
||||
<p>
|
||||
Specifies the number of bits in the key. The choice of key
|
||||
size depends on the algorithm used. RSA keys must be
|
||||
between 1024 and 4096 bits. Diffie Hellman keys must be between
|
||||
128 and 4096 bits. Elliptic curve algorithms don't need this
|
||||
parameter.
|
||||
between 1024 and 2048 bits. Diffie Hellman keys must be between
|
||||
128 and 4096 bits. DSA keys must be between 512 and 1024
|
||||
bits and an exact multiple of 64. HMAC keys must be
|
||||
between 1 and 512 bits. Elliptic curve algorithms don't need
|
||||
this parameter.
|
||||
</p>
|
||||
<p>
|
||||
If the key size is not specified, some algorithms have
|
||||
@@ -151,15 +144,36 @@
|
||||
<code class="option">-f KSK</code>) default to 2048 bits.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the owner type of the key. The value of
|
||||
<code class="option">nametype</code> must either be ZONE (for a DNSSEC
|
||||
zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
|
||||
with a host (KEY)), USER (for a key associated with a
|
||||
user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-3</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Use an NSEC3-capable algorithm to generate a DNSSEC key.
|
||||
If this option is used with an algorithm that has both
|
||||
NSEC and NSEC3 versions, then the NSEC3 version will be
|
||||
used; for example, <span class="command"><strong>dnssec-keygen -3a RSASHA1</strong></span>
|
||||
specifies the NSEC3RSASHA1 algorithm.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-C</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Compatibility mode: generates an old-style key, without any
|
||||
timing metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
|
||||
will include the key's creation date in the metadata stored with
|
||||
the private key, and other dates may be set there as well
|
||||
(publication date, activation date, etc). Keys that include this
|
||||
data may be incompatible with older versions of BIND; the
|
||||
Compatibility mode: generates an old-style key, without
|
||||
any metadata. By default, <span class="command"><strong>dnssec-keygen</strong></span>
|
||||
will include the key's creation date in the metadata stored
|
||||
with the private key, and other dates may be set there as well
|
||||
(publication date, activation date, etc). Keys that include
|
||||
this data may be incompatible with older versions of BIND; the
|
||||
<code class="option">-C</code> option suppresses them.
|
||||
</p>
|
||||
</dd>
|
||||
@@ -220,6 +234,12 @@
|
||||
Sets the directory in which the key files are to be written.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-k</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Deprecated in favor of -T KEY.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
@@ -233,24 +253,13 @@
|
||||
or <code class="literal">none</code> is the same as leaving it unset.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Specifies the owner type of the key. The value of
|
||||
<code class="option">nametype</code> must either be ZONE (for a DNSSEC
|
||||
zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated
|
||||
with a host (KEY)), USER (for a key associated with a
|
||||
user(KEY)) or OTHER (DNSKEY). These values are case
|
||||
insensitive. Defaults to ZONE for DNSKEY generation.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Sets the protocol value for the generated key, for use
|
||||
with <code class="option">-T KEY</code>. The protocol is a number between 0
|
||||
and 255. The default is 3 (DNSSEC). Other possible values for
|
||||
this argument are listed in RFC 2535 and its successors.
|
||||
Sets the protocol value for the generated key. The protocol
|
||||
is a number between 0 and 255. The default is 3 (DNSSEC).
|
||||
Other possible values for this argument are listed in
|
||||
RFC 2535 and its successors.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-q</span></dt>
|
||||
@@ -297,21 +306,20 @@
|
||||
default is DNSKEY when using a DNSSEC algorithm, but it can be
|
||||
overridden to KEY for use with SIG(0).
|
||||
</p>
|
||||
<p>
|
||||
</p>
|
||||
<p>
|
||||
Specifying any TSIG algorithm (HMAC-* or DH) with
|
||||
<code class="option">-a</code> forces this option to KEY.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Indicates the use of the key, for use with <code class="option">-T
|
||||
KEY</code>. <code class="option">type</code> must be one of AUTHCONF,
|
||||
NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH
|
||||
refers to the ability to authenticate data, and CONF the ability
|
||||
to encrypt data.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-V</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints version information.
|
||||
Indicates the use of the key. <code class="option">type</code> must be
|
||||
one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
|
||||
is AUTHCONF. AUTH refers to the ability to authenticate
|
||||
data, and CONF the ability to encrypt data.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
|
||||
@@ -320,6 +328,12 @@
|
||||
Sets the debugging level.
|
||||
</p>
|
||||
</dd>
|
||||
<dt><span class="term">-V</span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Prints version information.
|
||||
</p>
|
||||
</dd>
|
||||
</dl></div>
|
||||
</div>
|
||||
|
||||
@@ -462,12 +476,10 @@
|
||||
key.
|
||||
</p>
|
||||
<p>
|
||||
The <code class="filename">.key</code> file contains a DNSKEY or KEY record.
|
||||
When a zone is being signed by <span class="command"><strong>named</strong></span>
|
||||
or <span class="command"><strong>dnssec-signzone</strong></span> <code class="option">-S</code>, DNSKEY
|
||||
records are included automatically. In other cases,
|
||||
the <code class="filename">.key</code> file can be inserted into a zone file
|
||||
manually or with a <strong class="userinput"><code>$INCLUDE</code></strong> statement.
|
||||
The <code class="filename">.key</code> file contains a DNS KEY record
|
||||
that
|
||||
can be inserted into a zone file (directly or with a $INCLUDE
|
||||
statement).
|
||||
</p>
|
||||
<p>
|
||||
The <code class="filename">.private</code> file contains
|
||||
@@ -475,34 +487,33 @@
|
||||
fields. For obvious security reasons, this file does not have
|
||||
general read permission.
|
||||
</p>
|
||||
<p>
|
||||
Both <code class="filename">.key</code> and <code class="filename">.private</code>
|
||||
files are generated for symmetric cryptography algorithms such as
|
||||
HMAC-MD5, even though the public and private key are equivalent.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
<div class="refsection">
|
||||
<a name="id-1.11"></a><h2>EXAMPLE</h2>
|
||||
|
||||
<p>
|
||||
To generate an ECDSAP256SHA256 zone-signing key for the zone
|
||||
<strong class="userinput"><code>example.com</code></strong>, issue the command:
|
||||
To generate a 768-bit DSA key for the domain
|
||||
<strong class="userinput"><code>example.com</code></strong>, the following command would be
|
||||
issued:
|
||||
</p>
|
||||
<p>
|
||||
<strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 example.com</code></strong>
|
||||
<p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
|
||||
</p>
|
||||
<p>
|
||||
The command would print a string of the form:
|
||||
</p>
|
||||
<p><strong class="userinput"><code>Kexample.com.+013+26160</code></strong>
|
||||
<p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
|
||||
</p>
|
||||
<p>
|
||||
In this example, <span class="command"><strong>dnssec-keygen</strong></span> creates
|
||||
the files <code class="filename">Kexample.com.+013+26160.key</code>
|
||||
the files <code class="filename">Kexample.com.+003+26160.key</code>
|
||||
and
|
||||
<code class="filename">Kexample.com.+013+26160.private</code>.
|
||||
</p>
|
||||
<p>
|
||||
To generate a matching key-signing key, issue the command:
|
||||
</p>
|
||||
<p>
|
||||
<strong class="userinput"><code>dnssec-keygen -a ECDSAP256SHA256 -f KSK example.com</code></strong>
|
||||
<code class="filename">Kexample.com.+003+26160.private</code>.
|
||||
</p>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -99,5 +99,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -57,13 +57,13 @@ usage(void) {
|
||||
#else
|
||||
fprintf(stderr, " -E engine: specify OpenSSL engine\n");
|
||||
#endif
|
||||
fprintf(stderr, " -f: force overwrite\n");
|
||||
fprintf(stderr, " -h: help\n");
|
||||
fprintf(stderr, " -f: force overwrite\n");
|
||||
fprintf(stderr, " -K directory: use directory for key files\n");
|
||||
fprintf(stderr, " -r: remove old keyfiles after "
|
||||
fprintf(stderr, " -h: help\n");
|
||||
fprintf(stderr, " -r: remove old keyfiles after "
|
||||
"creating revoked version\n");
|
||||
fprintf(stderr, " -v level: set level of verbosity\n");
|
||||
fprintf(stderr, " -V: print version information\n");
|
||||
fprintf(stderr, " -v level: set level of verbosity\n");
|
||||
fprintf(stderr, " -V: print version information\n");
|
||||
fprintf(stderr, "Output:\n");
|
||||
fprintf(stderr, " K<name>+<alg>+<new id>.key, "
|
||||
"K<name>+<alg>+<new id>.private\n");
|
||||
@@ -239,7 +239,7 @@ main(int argc, char **argv) {
|
||||
* Remove old key file, if told to (and if
|
||||
* it isn't the same as the new file)
|
||||
*/
|
||||
if (removefile) {
|
||||
if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
|
||||
isc_buffer_init(&buf, oldname, sizeof(oldname));
|
||||
dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
|
||||
dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
|
||||
|
||||
@@ -38,7 +38,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009, 2011, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -200,5 +200,5 @@ RFC 5011\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -40,7 +40,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2009-2011, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -415,9 +415,9 @@ Specify which keys should be used to sign the zone\&. If no keys are specified,
|
||||
.PP
|
||||
The following command signs the
|
||||
\fBexample\&.com\fR
|
||||
zone with the ECDSAP256SHA256 key generated by key generated by
|
||||
zone with the DSA key generated by
|
||||
\fBdnssec\-keygen\fR
|
||||
(Kexample\&.com\&.+013+17247)\&. Because the
|
||||
(Kexample\&.com\&.+003+17247)\&. Because the
|
||||
\fB\-S\fR
|
||||
option is not being used, the zone\*(Aqs keys must be in the master file (db\&.example\&.com)\&. This invocation looks for
|
||||
dsset
|
||||
@@ -428,7 +428,7 @@ files, in the current directory, so that DS records can be imported from them (\
|
||||
.\}
|
||||
.nf
|
||||
% dnssec\-signzone \-g \-o example\&.com db\&.example\&.com \e
|
||||
Kexample\&.com\&.+013+17247
|
||||
Kexample\&.com\&.+003+17247
|
||||
db\&.example\&.com\&.signed
|
||||
%
|
||||
.fi
|
||||
@@ -468,5 +468,5 @@ RFC 4641\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -3874,11 +3874,9 @@ main(int argc, char *argv[]) {
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
isc_mutex_init(&namelock);
|
||||
|
||||
if (printstats) {
|
||||
isc_mutex_init(&statslock);
|
||||
}
|
||||
RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
|
||||
if (printstats)
|
||||
RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
|
||||
|
||||
presign();
|
||||
TIME_NOW(&sign_start);
|
||||
@@ -3936,9 +3934,9 @@ main(int argc, char *argv[]) {
|
||||
check_result(result, "dns_master_dumptostream3");
|
||||
}
|
||||
|
||||
isc_mutex_destroy(&namelock);
|
||||
DESTROYLOCK(&namelock);
|
||||
if (printstats)
|
||||
isc_mutex_destroy(&statslock);
|
||||
DESTROYLOCK(&statslock);
|
||||
|
||||
if (!output_stdout) {
|
||||
result = isc_stdio_close(outfp);
|
||||
|
||||
@@ -50,7 +50,6 @@
|
||||
<year>2016</year>
|
||||
<year>2017</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -788,16 +787,15 @@
|
||||
|
||||
<para>
|
||||
The following command signs the <userinput>example.com</userinput>
|
||||
zone with the ECDSAP256SHA256 key generated by key generated by
|
||||
<command>dnssec-keygen</command> (Kexample.com.+013+17247).
|
||||
Because the <command>-S</command> option is not being used,
|
||||
the zone's keys must be in the master file
|
||||
zone with the DSA key generated by <command>dnssec-keygen</command>
|
||||
(Kexample.com.+003+17247). Because the <command>-S</command> option
|
||||
is not being used, the zone's keys must be in the master file
|
||||
(<filename>db.example.com</filename>). This invocation looks
|
||||
for <filename>dsset</filename> files, in the current directory,
|
||||
so that DS records can be imported from them (<command>-g</command>).
|
||||
</para>
|
||||
<programlisting>% dnssec-signzone -g -o example.com db.example.com \
|
||||
Kexample.com.+013+17247
|
||||
Kexample.com.+003+17247
|
||||
db.example.com.signed
|
||||
%</programlisting>
|
||||
<para>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2009, 2011-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -624,16 +624,15 @@
|
||||
|
||||
<p>
|
||||
The following command signs the <strong class="userinput"><code>example.com</code></strong>
|
||||
zone with the ECDSAP256SHA256 key generated by key generated by
|
||||
<span class="command"><strong>dnssec-keygen</strong></span> (Kexample.com.+013+17247).
|
||||
Because the <span class="command"><strong>-S</strong></span> option is not being used,
|
||||
the zone's keys must be in the master file
|
||||
zone with the DSA key generated by <span class="command"><strong>dnssec-keygen</strong></span>
|
||||
(Kexample.com.+003+17247). Because the <span class="command"><strong>-S</strong></span> option
|
||||
is not being used, the zone's keys must be in the master file
|
||||
(<code class="filename">db.example.com</code>). This invocation looks
|
||||
for <code class="filename">dsset</code> files, in the current directory,
|
||||
so that DS records can be imported from them (<span class="command"><strong>-g</strong></span>).
|
||||
</p>
|
||||
<pre class="programlisting">% dnssec-signzone -g -o example.com db.example.com \
|
||||
Kexample.com.+013+17247
|
||||
Kexample.com.+003+17247
|
||||
db.example.com.signed
|
||||
%</pre>
|
||||
<p>
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -113,5 +113,5 @@ RFC 4033\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
@@ -37,7 +37,6 @@
|
||||
<year>2015</year>
|
||||
<year>2016</year>
|
||||
<year>2018</year>
|
||||
<year>2019</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
|
||||
<!--
|
||||
- Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- This Source Code Form is subject to the terms of the Mozilla Public
|
||||
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="..\dnssec-cds.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
@@ -1,112 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|@PLATFORM@">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>@PLATFORM@</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|@PLATFORM@">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>@PLATFORM@</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{0EB1727E-2BBD-47A6-AD12-418F9DEB0531}</ProjectGuid>
|
||||
<Keyword>Win32Proj</Keyword>
|
||||
<RootNamespace>cds</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'" Label="Configuration">
|
||||
<ConfigurationType>Application</ConfigurationType>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<WholeProgramOptimization>true</WholeProgramOptimization>
|
||||
<CharacterSet>MultiByte</CharacterSet>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings">
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
|
||||
<LinkIncremental>true</LinkIncremental>
|
||||
<OutDir>..\..\..\Build\$(Configuration)\</OutDir>
|
||||
<IntDir>.\$(Configuration)\</IntDir>
|
||||
<TargetName>dnssec-$(ProjectName)</TargetName>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
<LinkIncremental>false</LinkIncremental>
|
||||
<OutDir>..\..\..\Build\$(Configuration)\</OutDir>
|
||||
<IntDir>.\$(Configuration)\</IntDir>
|
||||
<TargetName>dnssec-$(ProjectName)</TargetName>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|@PLATFORM@'">
|
||||
<ClCompile>
|
||||
<PrecompiledHeader>
|
||||
</PrecompiledHeader>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<Optimization>Disabled</Optimization>
|
||||
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
|
||||
<AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
|
||||
<ObjectFileName>.\$(Configuration)\</ObjectFileName>
|
||||
<ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
|
||||
<BrowseInformation>true</BrowseInformation>
|
||||
<AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
<CompileAs>CompileAsC</CompileAs>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
|
||||
<ClCompile>
|
||||
<WarningLevel>Level3</WarningLevel>
|
||||
<PrecompiledHeader>
|
||||
</PrecompiledHeader>
|
||||
<Optimization>MaxSpeed</Optimization>
|
||||
<FunctionLevelLinking>true</FunctionLevelLinking>
|
||||
<IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
|
||||
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
|
||||
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
|
||||
<WholeProgramOptimization>false</WholeProgramOptimization>
|
||||
<StringPooling>true</StringPooling>
|
||||
<PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
|
||||
<AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
|
||||
<ObjectFileName>.\$(Configuration)\</ObjectFileName>
|
||||
<ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
|
||||
<AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
|
||||
<CompileAs>CompileAsC</CompileAs>
|
||||
</ClCompile>
|
||||
<Link>
|
||||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>false</GenerateDebugInformation>
|
||||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
|
||||
<LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
|
||||
<AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="..\dnssec-cds.c" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets">
|
||||
</ImportGroup>
|
||||
</Project>
|
||||
@@ -1,3 +0,0 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
</Project>
|
||||
+4
-10
@@ -46,14 +46,13 @@ CINCLUDES = -I${srcdir}/include -I${srcdir}/unix/include -I. \
|
||||
${NS_INCLUDES} ${DNS_INCLUDES} \
|
||||
${BIND9_INCLUDES} ${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
|
||||
${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
|
||||
${DBDRIVER_INCLUDES} ${MAXMINDDB_CFLAGS} \
|
||||
@OPENSSL_INCLUDES@
|
||||
${DBDRIVER_INCLUDES} @OPENSSL_INCLUDES@
|
||||
|
||||
CDEFINES = @CONTRIB_DLZ@
|
||||
|
||||
CWARNINGS =
|
||||
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ ${MAXMINDDB_LIBS} @DNS_CRYPTO_LIBS@
|
||||
DNSLIBS = ../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
|
||||
ISCCFGLIBS = ../../lib/isccfg/libisccfg.@A@
|
||||
ISCCCLIBS = ../../lib/isccc/libisccc.@A@
|
||||
ISCLIBS = ../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
|
||||
@@ -86,11 +85,9 @@ SUBDIRS = unix
|
||||
TARGETS = named@EXEEXT@
|
||||
|
||||
GEOIPLINKOBJS = geoip.@O@
|
||||
GEOIP2LINKOBJS = geoip.@O@
|
||||
|
||||
OBJS = builtin.@O@ config.@O@ control.@O@ \
|
||||
controlconf.@O@ fuzz.@O@ \
|
||||
@GEOIPLINKOBJS@ @GEOIP2LINKOBJS@ \
|
||||
controlconf.@O@ fuzz.@O@ @GEOIPLINKOBJS@ \
|
||||
log.@O@ logconf.@O@ main.@O@ \
|
||||
server.@O@ statschannel.@O@ \
|
||||
tkeyconf.@O@ tsigconf.@O@ zoneconf.@O@ \
|
||||
@@ -101,11 +98,9 @@ UOBJS = unix/os.@O@ unix/dlz_dlopen_driver.@O@
|
||||
SYMOBJS = symtbl.@O@
|
||||
|
||||
GEOIPLINKSRCS = geoip.c
|
||||
GEOIP2LINKSRCS = geoip.c
|
||||
|
||||
SRCS = builtin.c config.c control.c \
|
||||
controlconf.c fuzz.c \
|
||||
@GEOIPLINKSRCS@ @GEOIP2LINKSRCS@ \
|
||||
controlconf.c fuzz.c @GEOIPLINKSRCS@ \
|
||||
log.c logconf.c main.c \
|
||||
server.c statschannel.c \
|
||||
tkeyconf.c tsigconf.c zoneconf.c \
|
||||
@@ -137,7 +132,6 @@ config.@O@: config.c
|
||||
-DDYNDB_LIBDIR=\"@libdir@/bind\" \
|
||||
-DNAMED_LOCALSTATEDIR=\"${localstatedir}\" \
|
||||
-DNAMED_SYSCONFDIR=\"${sysconfdir}\" \
|
||||
-DMAXMINDDB_PREFIX=\"@MAXMINDDB_PREFIX@\" \
|
||||
-c ${srcdir}/config.c
|
||||
|
||||
server.@O@: server.c
|
||||
|
||||
+40
-69
@@ -15,15 +15,6 @@
|
||||
<xsl:template match="statistics[@version="3.11"]">
|
||||
<html>
|
||||
<head>
|
||||
<script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
|
||||
<script type="text/javascript">
|
||||
$(function($) {
|
||||
var wid=0;
|
||||
$('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });
|
||||
$('table.zones').css('min-width', wid );
|
||||
});
|
||||
</script>
|
||||
|
||||
<xsl:if test="system-property('xsl:vendor')!='Transformiix'">
|
||||
<!-- Non Mozilla specific markup -->
|
||||
<script type="text/javascript" src="https://www.google.com/jsapi"/>
|
||||
@@ -230,22 +221,6 @@
|
||||
background-color: rgb(1,169,206);
|
||||
color: #ffffff;
|
||||
}
|
||||
table.zones {
|
||||
border: 1px solid grey;
|
||||
}
|
||||
table.zones td {
|
||||
text-align: right;
|
||||
font-family: monospace;
|
||||
}
|
||||
table.zones td:nth-child(2) {
|
||||
text-align: center;
|
||||
}
|
||||
table.zones td:nth-child(3) {
|
||||
text-align: left;
|
||||
}
|
||||
table.zones tr:hover{
|
||||
background-color: #99ddff;
|
||||
}
|
||||
|
||||
td, th {
|
||||
padding-right: 5px;
|
||||
@@ -318,25 +293,25 @@
|
||||
<hr/>
|
||||
<h2>Server Status</h2>
|
||||
<table class="info">
|
||||
<tr class="odd">
|
||||
<tr>
|
||||
<th>Boot time:</th>
|
||||
<td>
|
||||
<xsl:value-of select="server/boot-time"/>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<tr>
|
||||
<th>Last reconfigured:</th>
|
||||
<td>
|
||||
<xsl:value-of select="server/config-time"/>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<tr>
|
||||
<th>Current time:</th>
|
||||
<td>
|
||||
<xsl:value-of select="server/current-time"/>
|
||||
</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<tr>
|
||||
<th>Server version:</th>
|
||||
<td>
|
||||
<xsl:value-of select="server/version"/>
|
||||
@@ -355,13 +330,7 @@
|
||||
<table class="counters">
|
||||
<xsl:for-each select="server/counters[@type="opcode"]/counter[. > 0 or substring(@name,1,3) != 'RES']">
|
||||
<xsl:sort select="." data-type="number" order="descending"/>
|
||||
<xsl:variable name="css-class0">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
<xsl:otherwise>odd</xsl:otherwise>
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class0}">
|
||||
<tr>
|
||||
<th>
|
||||
<xsl:value-of select="@name"/>
|
||||
</th>
|
||||
@@ -642,13 +611,13 @@
|
||||
<br/>
|
||||
</xsl:if>
|
||||
</xsl:for-each>
|
||||
<xsl:if test="traffic//udp/counters[@type="request-size"]/counter[.>0] or traffic//udp/counters[@type="response-size"]/counter[.>0] or traffic//tcp/counters[@type="request-size"]/counter[.>0] or traffic//tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:if test="traffic/udp/counters[@type="request-size"]/counter[.>0] or traffic/udp/counters[@type="response-size"]/counter[.>0] or traffic/tcp/counters[@type="request-size"]/counter[.>0] or traffic/tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<h2>Traffic Size Statistics</h2>
|
||||
</xsl:if>
|
||||
<xsl:if test="traffic//udp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:if test="traffic/udp/counters[@type="request-size"]/counter[.>0]">
|
||||
<h4>UDP Requests Received</h4>
|
||||
<table class="counters">
|
||||
<xsl:for-each select="traffic//udp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:for-each select="traffic/udp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:variable name="css-class7">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
@@ -656,7 +625,6 @@
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class7}">
|
||||
<th><xsl:value-of select="local-name(../../..)"/></th>
|
||||
<th>
|
||||
<xsl:value-of select="@name"/>
|
||||
</th>
|
||||
@@ -668,10 +636,10 @@
|
||||
</table>
|
||||
<br/>
|
||||
</xsl:if>
|
||||
<xsl:if test="traffic//udp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:if test="traffic/udp/counters[@type="response-size"]/counter[.>0]">
|
||||
<h4>UDP Responses Sent</h4>
|
||||
<table class="counters">
|
||||
<xsl:for-each select="traffic//udp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:for-each select="traffic/udp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:variable name="css-class7">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
@@ -679,7 +647,6 @@
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class7}">
|
||||
<th><xsl:value-of select="local-name(../../..)"/></th>
|
||||
<th>
|
||||
<xsl:value-of select="@name"/>
|
||||
</th>
|
||||
@@ -691,10 +658,10 @@
|
||||
</table>
|
||||
<br/>
|
||||
</xsl:if>
|
||||
<xsl:if test="traffic//tcp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:if test="traffic/tcp/counters[@type="request-size"]/counter[.>0]">
|
||||
<h4>TCP Requests Received</h4>
|
||||
<table class="counters">
|
||||
<xsl:for-each select="traffic//tcp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:for-each select="traffic/tcp/counters[@type="request-size"]/counter[.>0]">
|
||||
<xsl:variable name="css-class7">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
@@ -702,7 +669,6 @@
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class7}">
|
||||
<th><xsl:value-of select="local-name(../../..)"/></th>
|
||||
<th>
|
||||
<xsl:value-of select="@name"/>
|
||||
</th>
|
||||
@@ -714,10 +680,10 @@
|
||||
</table>
|
||||
<br/>
|
||||
</xsl:if>
|
||||
<xsl:if test="traffic//tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:if test="traffic/tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<h4>TCP Responses Sent</h4>
|
||||
<table class="counters">
|
||||
<xsl:for-each select="traffic//tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:for-each select="traffic/tcp/counters[@type="response-size"]/counter[.>0]">
|
||||
<xsl:variable name="css-class7">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
@@ -725,7 +691,6 @@
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class7}">
|
||||
<th><xsl:value-of select="local-name(../../..)"/></th>
|
||||
<th>
|
||||
<xsl:value-of select="@name"/>
|
||||
</th>
|
||||
@@ -759,29 +724,35 @@
|
||||
</table>
|
||||
<br/>
|
||||
</xsl:if>
|
||||
<xsl:if test="views/view/zones/zone">
|
||||
<xsl:for-each select="views/view">
|
||||
<xsl:for-each select="views/view">
|
||||
<xsl:if test="zones/zone">
|
||||
<h3>Zones for View <xsl:value-of select="@name"/></h3>
|
||||
<table class="zones">
|
||||
<thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>
|
||||
<tbody>
|
||||
<xsl:for-each select="zones/zone">
|
||||
<xsl:variable name="css-class15">
|
||||
<xsl:choose>
|
||||
<xsl:when test="position() mod 2 = 0">even</xsl:when>
|
||||
<xsl:otherwise>odd</xsl:otherwise>
|
||||
</xsl:choose>
|
||||
</xsl:variable>
|
||||
<tr class="{$css-class15}">
|
||||
<td><xsl:value-of select="@name"/></td>
|
||||
<td><xsl:value-of select="@rdataclass"/></td>
|
||||
<td><xsl:value-of select="type"/></td>
|
||||
<td><xsl:value-of select="serial"/></td></tr>
|
||||
</xsl:for-each>
|
||||
</tbody>
|
||||
<tr>
|
||||
<th>Name</th>
|
||||
<th>Class</th>
|
||||
<th>Type</th>
|
||||
<th>Serial</th>
|
||||
</tr>
|
||||
<xsl:for-each select="zones/zone">
|
||||
<tr>
|
||||
<td>
|
||||
<xsl:value-of select="@name"/>
|
||||
</td>
|
||||
<td>
|
||||
<xsl:value-of select="@rdataclass"/>
|
||||
</td>
|
||||
<td>
|
||||
<xsl:value-of select="type"/>
|
||||
</td>
|
||||
<td>
|
||||
<xsl:value-of select="serial"/>
|
||||
</td>
|
||||
</tr>
|
||||
</xsl:for-each>
|
||||
</table>
|
||||
</xsl:for-each>
|
||||
</xsl:if>
|
||||
</xsl:if>
|
||||
</xsl:for-each>
|
||||
<xsl:if test="views/view[zones/zone/counters[@type="qtype"]/counter >0]">
|
||||
<h2>Received QTYPES per view/zone</h2>
|
||||
<xsl:for-each select="views/view[zones/zone/counters[@type="qtype"]/counter >0]">
|
||||
|
||||
+36
-65
@@ -20,15 +20,6 @@ static char xslmsg[] =
|
||||
" <xsl:template match=\"statistics[@version="3.11"]\">\n"
|
||||
" <html>\n"
|
||||
" <head>\n"
|
||||
" <script type=\"text/javascript\" src=\"https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js\"></script>\n"
|
||||
" <script type=\"text/javascript\">\n"
|
||||
" $(function($) {\n"
|
||||
" var wid=0;\n"
|
||||
" $('table.zones').each(function(i) { if( $(this).width() > wid ) wid = $(this).width(); return true; });\n"
|
||||
" $('table.zones').css('min-width', wid );\n"
|
||||
" });\n"
|
||||
" </script>\n"
|
||||
"\n"
|
||||
" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
|
||||
" <!-- Non Mozilla specific markup -->\n"
|
||||
" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
|
||||
@@ -235,22 +226,6 @@ static char xslmsg[] =
|
||||
" background-color: rgb(1,169,206);\n"
|
||||
" color: #ffffff;\n"
|
||||
" }\n"
|
||||
" table.zones {\n"
|
||||
" border: 1px solid grey;\n"
|
||||
" }\n"
|
||||
" table.zones td {\n"
|
||||
" text-align: right;\n"
|
||||
" font-family: monospace;\n"
|
||||
" }\n"
|
||||
" table.zones td:nth-child(2) {\n"
|
||||
" text-align: center;\n"
|
||||
" }\n"
|
||||
" table.zones td:nth-child(3) {\n"
|
||||
" text-align: left;\n"
|
||||
" }\n"
|
||||
" table.zones tr:hover{\n"
|
||||
" background-color: #99ddff;\n"
|
||||
" }\n"
|
||||
"\n"
|
||||
" td, th {\n"
|
||||
" padding-right: 5px;\n"
|
||||
@@ -323,25 +298,25 @@ static char xslmsg[] =
|
||||
" <hr/>\n"
|
||||
" <h2>Server Status</h2>\n"
|
||||
" <table class=\"info\">\n"
|
||||
" <tr class=\"odd\">\n"
|
||||
" <tr>\n"
|
||||
" <th>Boot time:</th>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"server/boot-time\"/>\n"
|
||||
" </td>\n"
|
||||
" </tr>\n"
|
||||
" <tr class=\"even\">\n"
|
||||
" <tr>\n"
|
||||
" <th>Last reconfigured:</th>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"server/config-time\"/>\n"
|
||||
" </td>\n"
|
||||
" </tr>\n"
|
||||
" <tr class=\"odd\">\n"
|
||||
" <tr>\n"
|
||||
" <th>Current time:</th>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"server/current-time\"/>\n"
|
||||
" </td>\n"
|
||||
" </tr>\n"
|
||||
" <tr class=\"even\">\n"
|
||||
" <tr>\n"
|
||||
" <th>Server version:</th>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"server/version\"/>\n"
|
||||
@@ -360,13 +335,7 @@ static char xslmsg[] =
|
||||
" <table class=\"counters\">\n"
|
||||
" <xsl:for-each select=\"server/counters[@type="opcode"]/counter[. > 0 or substring(@name,1,3) != 'RES']\">\n"
|
||||
" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
|
||||
" <xsl:variable name=\"css-class0\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
" <xsl:otherwise>odd</xsl:otherwise>\n"
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class0}\">\n"
|
||||
" <tr>\n"
|
||||
" <th>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </th>\n"
|
||||
@@ -647,13 +616,13 @@ static char xslmsg[] =
|
||||
" <br/>\n"
|
||||
" </xsl:if>\n"
|
||||
" </xsl:for-each>\n"
|
||||
" <xsl:if test=\"traffic//udp/counters[@type="request-size"]/counter[.>0] or traffic//udp/counters[@type="response-size"]/counter[.>0] or traffic//tcp/counters[@type="request-size"]/counter[.>0] or traffic//tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:if test=\"traffic/udp/counters[@type="request-size"]/counter[.>0] or traffic/udp/counters[@type="response-size"]/counter[.>0] or traffic/tcp/counters[@type="request-size"]/counter[.>0] or traffic/tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <h2>Traffic Size Statistics</h2>\n"
|
||||
" </xsl:if>\n"
|
||||
" <xsl:if test=\"traffic//udp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:if test=\"traffic/udp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <h4>UDP Requests Received</h4>\n"
|
||||
" <table class=\"counters\">\n"
|
||||
" <xsl:for-each select=\"traffic//udp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:for-each select=\"traffic/udp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:variable name=\"css-class7\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
@@ -661,7 +630,6 @@ static char xslmsg[] =
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class7}\">\n"
|
||||
" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
|
||||
" <th>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </th>\n"
|
||||
@@ -673,10 +641,10 @@ static char xslmsg[] =
|
||||
" </table>\n"
|
||||
" <br/>\n"
|
||||
" </xsl:if>\n"
|
||||
" <xsl:if test=\"traffic//udp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:if test=\"traffic/udp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <h4>UDP Responses Sent</h4>\n"
|
||||
" <table class=\"counters\">\n"
|
||||
" <xsl:for-each select=\"traffic//udp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:for-each select=\"traffic/udp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:variable name=\"css-class7\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
@@ -684,7 +652,6 @@ static char xslmsg[] =
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class7}\">\n"
|
||||
" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
|
||||
" <th>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </th>\n"
|
||||
@@ -696,10 +663,10 @@ static char xslmsg[] =
|
||||
" </table>\n"
|
||||
" <br/>\n"
|
||||
" </xsl:if>\n"
|
||||
" <xsl:if test=\"traffic//tcp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:if test=\"traffic/tcp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <h4>TCP Requests Received</h4>\n"
|
||||
" <table class=\"counters\">\n"
|
||||
" <xsl:for-each select=\"traffic//tcp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:for-each select=\"traffic/tcp/counters[@type="request-size"]/counter[.>0]\">\n"
|
||||
" <xsl:variable name=\"css-class7\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
@@ -707,7 +674,6 @@ static char xslmsg[] =
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class7}\">\n"
|
||||
" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
|
||||
" <th>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </th>\n"
|
||||
@@ -719,10 +685,10 @@ static char xslmsg[] =
|
||||
" </table>\n"
|
||||
" <br/>\n"
|
||||
" </xsl:if>\n"
|
||||
" <xsl:if test=\"traffic//tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:if test=\"traffic/tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <h4>TCP Responses Sent</h4>\n"
|
||||
" <table class=\"counters\">\n"
|
||||
" <xsl:for-each select=\"traffic//tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:for-each select=\"traffic/tcp/counters[@type="response-size"]/counter[.>0]\">\n"
|
||||
" <xsl:variable name=\"css-class7\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
@@ -730,7 +696,6 @@ static char xslmsg[] =
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class7}\">\n"
|
||||
" <th><xsl:value-of select=\"local-name(../../..)\"/></th>\n"
|
||||
" <th>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </th>\n"
|
||||
@@ -764,29 +729,35 @@ static char xslmsg[] =
|
||||
" </table>\n"
|
||||
" <br/>\n"
|
||||
" </xsl:if>\n"
|
||||
" <xsl:if test=\"views/view/zones/zone\">\n"
|
||||
" <xsl:for-each select=\"views/view\">\n"
|
||||
" <xsl:if test=\"zones/zone\">\n"
|
||||
" <h3>Zones for View <xsl:value-of select=\"@name\"/></h3>\n"
|
||||
" <table class=\"zones\">\n"
|
||||
" <thead><tr><th>Name</th><th>Class</th><th>Type</th><th>Serial</th></tr></thead>\n"
|
||||
" <tbody>\n"
|
||||
" <tr>\n"
|
||||
" <th>Name</th>\n"
|
||||
" <th>Class</th>\n"
|
||||
" <th>Type</th>\n"
|
||||
" <th>Serial</th>\n"
|
||||
" </tr>\n"
|
||||
" <xsl:for-each select=\"zones/zone\">\n"
|
||||
" <xsl:variable name=\"css-class15\">\n"
|
||||
" <xsl:choose>\n"
|
||||
" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
|
||||
" <xsl:otherwise>odd</xsl:otherwise>\n"
|
||||
" </xsl:choose>\n"
|
||||
" </xsl:variable>\n"
|
||||
" <tr class=\"{$css-class15}\">\n"
|
||||
" <td><xsl:value-of select=\"@name\"/></td>\n"
|
||||
" <td><xsl:value-of select=\"@rdataclass\"/></td>\n"
|
||||
" <td><xsl:value-of select=\"type\"/></td>\n"
|
||||
" <td><xsl:value-of select=\"serial\"/></td></tr>\n"
|
||||
" <tr>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"@name\"/>\n"
|
||||
" </td>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"@rdataclass\"/>\n"
|
||||
" </td>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"type\"/>\n"
|
||||
" </td>\n"
|
||||
" <td>\n"
|
||||
" <xsl:value-of select=\"serial\"/>\n"
|
||||
" </td>\n"
|
||||
" </tr>\n"
|
||||
" </xsl:for-each>\n"
|
||||
" </tbody>\n"
|
||||
" </table>\n"
|
||||
" </xsl:for-each>\n"
|
||||
" </xsl:if>\n"
|
||||
" </xsl:for-each>\n"
|
||||
" <xsl:if test=\"views/view[zones/zone/counters[@type="qtype"]/counter >0]\">\n"
|
||||
" <h2>Received QTYPES per view/zone</h2>\n"
|
||||
" <xsl:for-each select=\"views/view[zones/zone/counters[@type="qtype"]/counter >0]\">\n"
|
||||
|
||||
+10
-10
@@ -66,11 +66,6 @@ options {\n\
|
||||
#ifndef WIN32
|
||||
" files unlimited;\n"
|
||||
#endif
|
||||
#if defined(HAVE_GEOIP2) && !defined(WIN32)
|
||||
" geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
|
||||
#elif defined(HAVE_GEOIP2)
|
||||
" geoip-directory \".\";\n"
|
||||
#endif
|
||||
"\
|
||||
# has-old-clients <obsolete>;\n\
|
||||
heartbeat-interval 60;\n\
|
||||
@@ -160,7 +155,13 @@ options {\n\
|
||||
fetch-quota-params 100 0.1 0.3 0.7;\n\
|
||||
fetches-per-server 0;\n\
|
||||
fetches-per-zone 0;\n\
|
||||
glue-cache yes;\n\
|
||||
filter-aaaa-on-v4 no;\n\
|
||||
filter-aaaa-on-v6 no;\n\
|
||||
filter-aaaa { any; };\n"
|
||||
#ifdef HAVE_GEOIP
|
||||
" geoip-use-ecs yes;\n"
|
||||
#endif
|
||||
" glue-cache yes;\n\
|
||||
lame-ttl 600;\n"
|
||||
#ifdef HAVE_LMDB
|
||||
" lmdb-mapsize 32M;\n"
|
||||
@@ -325,9 +326,9 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
|
||||
|
||||
isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
|
||||
isc_buffer_add(&b, sizeof(defaultconf) - 1);
|
||||
return (cfg_parse_buffer(parser, &b, __FILE__, 0,
|
||||
&cfg_type_namedconf,
|
||||
CFG_PCTX_NODEPRECATED, conf));
|
||||
return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
|
||||
&cfg_type_namedconf,
|
||||
CFG_PCTX_NODEPRECATED, conf));
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
@@ -884,7 +885,6 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
|
||||
|
||||
INSIST(keycount == addrcount);
|
||||
INSIST(keycount == dscpcount);
|
||||
|
||||
ipkl->addrs = addrs;
|
||||
ipkl->dscps = dscps;
|
||||
|
||||
+67
-69
@@ -152,11 +152,16 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
"received control channel command '%s'",
|
||||
cmdline);
|
||||
|
||||
/*
|
||||
* After the lengthy "halt" and "stop", the commands are
|
||||
* handled in alphabetical order of the NAMED_COMMAND_ macros.
|
||||
*/
|
||||
if (command_compare(command, NAMED_COMMAND_HALT)) {
|
||||
if (command_compare(command, NAMED_COMMAND_RELOAD)) {
|
||||
result = named_server_reloadcommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
|
||||
result = named_server_reconfigcommand(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
|
||||
result = named_server_refreshcommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
|
||||
result = named_server_retransfercommand(named_g_server,
|
||||
lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_HALT)) {
|
||||
#ifdef HAVE_LIBSCF
|
||||
/*
|
||||
* If we are managed by smf(5), AND in chroot, then
|
||||
@@ -201,90 +206,83 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
|
||||
named_os_shutdownmsg(cmdline, *text);
|
||||
isc_app_shutdown();
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
|
||||
command_compare(command, NAMED_COMMAND_MODZONE)) {
|
||||
result = named_server_changezone(named_g_server, cmdline, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
|
||||
result = named_server_delzone(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
|
||||
command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
|
||||
result = named_server_dnstap(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
|
||||
result = named_server_dumpstats(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
|
||||
result = named_server_togglequerylog(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
|
||||
named_server_dumpdb(named_g_server, lex, text);
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
|
||||
result = named_server_dumpstats(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
|
||||
result = named_server_dumpsecroots(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
|
||||
result = named_server_setdebuglevel(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
|
||||
named_g_debuglevel = 0;
|
||||
isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
|
||||
result = named_server_flushcache(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
|
||||
result = named_server_flushnode(named_g_server, lex, false);
|
||||
} else if (command_compare(command, NAMED_COMMAND_FLUSHTREE)) {
|
||||
result = named_server_flushnode(named_g_server, lex, true);
|
||||
} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
|
||||
result = named_server_status(named_g_server, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
|
||||
result = named_server_tsiglist(named_g_server, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
|
||||
result = named_server_tsigdelete(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
|
||||
result = named_server_freeze(named_g_server, true, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
|
||||
command_compare(command, NAMED_COMMAND_SIGN)) {
|
||||
result = named_server_rekey(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
|
||||
result = named_server_mkeys(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
|
||||
result = named_server_notifycommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
|
||||
named_g_debuglevel = 0;
|
||||
isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
|
||||
result = named_server_freeze(named_g_server, true, lex,
|
||||
text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_UNFREEZE) ||
|
||||
command_compare(command, NAMED_COMMAND_THAW)) {
|
||||
result = named_server_freeze(named_g_server, false, lex,
|
||||
text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_NTA)) {
|
||||
result = named_server_nta(named_g_server, lex, readonly, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NULL)) {
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
|
||||
result = named_server_togglequerylog(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
|
||||
result = named_server_reconfigcommand(named_g_server);
|
||||
named_server_scan_interfaces(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
|
||||
result = named_server_sync(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
|
||||
result = named_server_dumprecursing(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_REFRESH)) {
|
||||
result = named_server_refreshcommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
|
||||
result = named_server_reloadcommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
|
||||
result = named_server_retransfercommand(named_g_server,
|
||||
lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
|
||||
named_server_scan_interfaces(named_g_server);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_SECROOTS)) {
|
||||
result = named_server_dumpsecroots(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
|
||||
result = named_server_servestale(named_g_server, lex, text);
|
||||
isc_timermgr_poke(named_g_timermgr);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NULL)) {
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
|
||||
result = named_server_notifycommand(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
|
||||
result = named_server_validation(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SIGN) ||
|
||||
command_compare(command, NAMED_COMMAND_LOADKEYS)) {
|
||||
result = named_server_rekey(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
|
||||
command_compare(command, NAMED_COMMAND_MODZONE)) {
|
||||
result = named_server_changezone(named_g_server, cmdline, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
|
||||
result = named_server_delzone(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SHOWZONE)) {
|
||||
result = named_server_showzone(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SIGNING)) {
|
||||
result = named_server_signing(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
|
||||
result = named_server_status(named_g_server, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SYNC)) {
|
||||
result = named_server_sync(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TCPTIMEOUTS)) {
|
||||
result = named_server_tcptimeouts(lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
|
||||
result = named_server_testgen(lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_THAW) ||
|
||||
command_compare(command, NAMED_COMMAND_UNFREEZE)) {
|
||||
result = named_server_freeze(named_g_server, false, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TIMERPOKE)) {
|
||||
isc_timermgr_poke(named_g_timermgr);
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NAMED_COMMAND_TRACE)) {
|
||||
result = named_server_setdebuglevel(named_g_server, lex);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
|
||||
result = named_server_tsigdelete(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
|
||||
result = named_server_tsiglist(named_g_server, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_VALIDATION)) {
|
||||
result = named_server_validation(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
|
||||
result = named_server_zonestatus(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_NTA)) {
|
||||
result = named_server_nta(named_g_server, lex, readonly, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TESTGEN)) {
|
||||
result = named_server_testgen(lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
|
||||
result = named_server_mkeys(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_DNSTAP) ||
|
||||
command_compare(command, NAMED_COMMAND_DNSTAPREOPEN)) {
|
||||
result = named_server_dnstap(named_g_server, lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_TCPTIMEOUTS)) {
|
||||
result = named_server_tcptimeouts(lex, text);
|
||||
} else if (command_compare(command, NAMED_COMMAND_SERVESTALE)) {
|
||||
result = named_server_servestale(named_g_server, lex, text);
|
||||
} else {
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@
|
||||
#ifdef ENABLE_AFL
|
||||
#include <named/globals.h>
|
||||
#include <named/server.h>
|
||||
#include <errno.h>
|
||||
#include <sys/errno.h>
|
||||
|
||||
#include <isc/app.h>
|
||||
#include <isc/condition.h>
|
||||
|
||||
+20
-124
@@ -13,27 +13,20 @@
|
||||
|
||||
#include <config.h>
|
||||
|
||||
#if defined(HAVE_GEOIP2)
|
||||
#include <maxminddb.h>
|
||||
#elif defined(HAVE_GEOIP)
|
||||
#include <GeoIP.h>
|
||||
#include <GeoIPCity.h>
|
||||
#endif
|
||||
|
||||
#include <isc/print.h>
|
||||
#include <isc/string.h>
|
||||
#include <isc/util.h>
|
||||
|
||||
#include <dns/geoip.h>
|
||||
|
||||
#include <named/log.h>
|
||||
#include <named/geoip.h>
|
||||
|
||||
static dns_geoip_databases_t geoip_table;
|
||||
#include <dns/geoip.h>
|
||||
|
||||
#ifdef HAVE_GEOIP
|
||||
static dns_geoip_databases_t geoip_table = {
|
||||
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
|
||||
};
|
||||
|
||||
#if defined(HAVE_GEOIP)
|
||||
static void
|
||||
init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
|
||||
init_geoip_db(GeoIP **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
|
||||
GeoIPOptions method, const char *name)
|
||||
{
|
||||
char *info;
|
||||
@@ -41,7 +34,7 @@ init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
|
||||
|
||||
REQUIRE(dbp != NULL);
|
||||
|
||||
db = (GeoIP *)*dbp;
|
||||
db = *dbp;
|
||||
|
||||
if (db != NULL) {
|
||||
GeoIP_delete(db);
|
||||
@@ -79,97 +72,32 @@ init_geoip_db(void **dbp, GeoIPDBTypes edition, GeoIPDBTypes fallback,
|
||||
|
||||
*dbp = db;
|
||||
return;
|
||||
|
||||
fail:
|
||||
if (fallback != 0) {
|
||||
if (fallback != 0)
|
||||
init_geoip_db(dbp, fallback, 0, method, name);
|
||||
}
|
||||
|
||||
}
|
||||
#elif defined(HAVE_GEOIP2)
|
||||
static MMDB_s geoip_country, geoip_city, geoip_as, geoip_isp, geoip_domain;
|
||||
|
||||
static MMDB_s *
|
||||
open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
|
||||
char pathbuf[PATH_MAX];
|
||||
unsigned int n;
|
||||
int ret;
|
||||
|
||||
n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
|
||||
if (n >= sizeof(pathbuf)) {
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
|
||||
"GeoIP2 database '%s/%s': path too long",
|
||||
dir, dbfile);
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
|
||||
if (ret == MMDB_SUCCESS) {
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
|
||||
"opened GeoIP2 database '%s'", pathbuf);
|
||||
return (mmdb);
|
||||
}
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
|
||||
"unable to open GeoIP2 database '%s' (status %d)",
|
||||
pathbuf, ret);
|
||||
|
||||
return (NULL);
|
||||
}
|
||||
#endif /* HAVE_GEOIP2 */
|
||||
|
||||
#endif /* HAVE_GEOIP */
|
||||
|
||||
void
|
||||
named_geoip_init(void) {
|
||||
#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
|
||||
if (named_g_geoip == NULL) {
|
||||
named_g_geoip = &geoip_table;
|
||||
}
|
||||
#if defined(HAVE_GEOIP)
|
||||
GeoIP_cleanup();
|
||||
#endif
|
||||
#else
|
||||
#ifndef HAVE_GEOIP
|
||||
return;
|
||||
#else
|
||||
GeoIP_cleanup();
|
||||
if (named_g_geoip == NULL)
|
||||
named_g_geoip = &geoip_table;
|
||||
#endif
|
||||
}
|
||||
|
||||
void
|
||||
named_geoip_load(char *dir) {
|
||||
#if defined(HAVE_GEOIP2)
|
||||
REQUIRE(dir != NULL);
|
||||
#ifndef HAVE_GEOIP
|
||||
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
|
||||
"looking for GeoIP2 databases in '%s'", dir);
|
||||
UNUSED(dir);
|
||||
|
||||
named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
|
||||
&geoip_country);
|
||||
if (named_g_geoip->country == NULL) {
|
||||
named_g_geoip->country = open_geoip2(dir,
|
||||
"GeoLite2-Country.mmdb",
|
||||
&geoip_country);
|
||||
}
|
||||
|
||||
named_g_geoip->city = open_geoip2(dir, "GeoIP2-City.mmdb",
|
||||
&geoip_city);
|
||||
if (named_g_geoip->city == NULL) {
|
||||
named_g_geoip->city = open_geoip2(dir, "GeoLite2-City.mmdb",
|
||||
&geoip_city);
|
||||
}
|
||||
|
||||
named_g_geoip->as = open_geoip2(dir, "GeoIP2-ASN.mmdb", &geoip_as);
|
||||
if (named_g_geoip->as == NULL) {
|
||||
named_g_geoip->as = open_geoip2(dir, "GeoLite2-ASN.mmdb",
|
||||
&geoip_as);
|
||||
}
|
||||
|
||||
named_g_geoip->isp = open_geoip2(dir, "GeoIP2-ISP.mmdb", &geoip_isp);
|
||||
named_g_geoip->domain = open_geoip2(dir, "GeoIP2-Domain.mmdb",
|
||||
&geoip_domain);
|
||||
#elif defined(HAVE_GEOIP)
|
||||
return;
|
||||
#else
|
||||
GeoIPOptions method;
|
||||
|
||||
#ifdef _WIN32
|
||||
@@ -213,37 +141,5 @@ named_geoip_load(char *dir) {
|
||||
method, "Domain");
|
||||
init_geoip_db(&named_g_geoip->netspeed, GEOIP_NETSPEED_EDITION, 0,
|
||||
method, "NetSpeed");
|
||||
#else
|
||||
UNUSED(dir);
|
||||
|
||||
return;
|
||||
#endif
|
||||
}
|
||||
|
||||
void
|
||||
named_geoip_shutdown(void) {
|
||||
#ifdef HAVE_GEOIP2
|
||||
if (named_g_geoip->country != NULL) {
|
||||
MMDB_close(named_g_geoip->country);
|
||||
named_g_geoip->country = NULL;
|
||||
}
|
||||
if (named_g_geoip->city != NULL) {
|
||||
MMDB_close(named_g_geoip->city);
|
||||
named_g_geoip->city = NULL;
|
||||
}
|
||||
if (named_g_geoip->as != NULL) {
|
||||
MMDB_close(named_g_geoip->as);
|
||||
named_g_geoip->as = NULL;
|
||||
}
|
||||
if (named_g_geoip->isp != NULL) {
|
||||
MMDB_close(named_g_geoip->isp);
|
||||
named_g_geoip->isp = NULL;
|
||||
}
|
||||
if (named_g_geoip->domain != NULL) {
|
||||
MMDB_close(named_g_geoip->domain);
|
||||
named_g_geoip->domain = NULL;
|
||||
}
|
||||
#endif /* HAVE_GEOIP2 */
|
||||
|
||||
dns_geoip_shutdown();
|
||||
#endif /* HAVE_GEOIP */
|
||||
}
|
||||
|
||||
@@ -9,15 +9,18 @@
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
#pragma once
|
||||
#ifndef _GEOIP_H
|
||||
#define _GEOIP_H
|
||||
|
||||
#ifdef HAVE_GEOIP
|
||||
#include <GeoIP.h>
|
||||
#include <GeoIPCity.h>
|
||||
#endif /* HAVE_GEOIP */
|
||||
|
||||
void named_geoip_init(void);
|
||||
void named_geoip_load(char *dir);
|
||||
|
||||
#ifdef HAVE_GEOIP
|
||||
extern dns_geoip_databases_t *named_g_geoip;
|
||||
|
||||
void
|
||||
named_geoip_init(void);
|
||||
|
||||
void
|
||||
named_geoip_load(char *dir);
|
||||
|
||||
void
|
||||
named_geoip_shutdown(void);
|
||||
#endif /* HAVE_GEOIP */
|
||||
#endif
|
||||
|
||||
@@ -90,8 +90,7 @@ EXTERN cfg_obj_t * named_g_config INIT(NULL);
|
||||
EXTERN const cfg_obj_t * named_g_defaults INIT(NULL);
|
||||
EXTERN const char * named_g_conffile INIT(NAMED_SYSCONFDIR
|
||||
"/named.conf");
|
||||
EXTERN const char * named_g_defaultbindkeys INIT(NAMED_SYSCONFDIR
|
||||
"/bind.keys");
|
||||
EXTERN cfg_obj_t * named_g_bindkeys INIT(NULL);
|
||||
EXTERN const char * named_g_keyfile INIT(NAMED_SYSCONFDIR
|
||||
"/rndc.key");
|
||||
|
||||
@@ -154,7 +153,7 @@ EXTERN bool named_g_keepstderr INIT(false);
|
||||
|
||||
EXTERN unsigned int named_g_tat_interval INIT(24*3600);
|
||||
|
||||
#if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
|
||||
#ifdef HAVE_GEOIP
|
||||
EXTERN dns_geoip_databases_t *named_g_geoip INIT(NULL);
|
||||
#endif
|
||||
|
||||
|
||||
@@ -78,7 +78,6 @@ struct named_server {
|
||||
|
||||
isc_mutex_t reload_event_lock;
|
||||
isc_event_t * reload_event;
|
||||
bool reload_in_progress;
|
||||
|
||||
bool flushonshutdown;
|
||||
|
||||
|
||||
+59
-98
@@ -358,7 +358,7 @@ save_command_line(int argc, char *argv[]) {
|
||||
* nearly always be fine.
|
||||
*/
|
||||
if (quoted || isalnum(*src & 0xff) ||
|
||||
*src == ',' || *src == '-' || *src == '_' ||
|
||||
*src == '-' || *src == '_' ||
|
||||
*src == '.' || *src == '/') {
|
||||
*dst++ = *src++;
|
||||
quoted = false;
|
||||
@@ -445,98 +445,6 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
|
||||
*ret = 0;
|
||||
}
|
||||
|
||||
static void
|
||||
printversion(bool verbose) {
|
||||
char rndcconf[PATH_MAX], *dot = NULL;
|
||||
|
||||
printf("%s %s%s%s <id:%s>\n",
|
||||
named_g_product, named_g_version,
|
||||
(*named_g_description != '\0') ? " " : "",
|
||||
named_g_description, named_g_srcid);
|
||||
|
||||
if (!verbose) {
|
||||
return;
|
||||
}
|
||||
|
||||
printf("running on %s\n", named_os_uname());
|
||||
printf("built by %s with %s\n",
|
||||
named_g_builder, named_g_configargs);
|
||||
#ifdef __clang__
|
||||
printf("compiled by CLANG %s\n", __VERSION__);
|
||||
#else
|
||||
#if defined(__ICC) || defined(__INTEL_COMPILER)
|
||||
printf("compiled by ICC %s\n", __VERSION__);
|
||||
#else
|
||||
#ifdef __GNUC__
|
||||
printf("compiled by GCC %s\n", __VERSION__);
|
||||
#endif
|
||||
#endif
|
||||
#endif
|
||||
#ifdef _MSC_VER
|
||||
printf("compiled by MSVC %d\n", _MSC_VER);
|
||||
#endif
|
||||
#ifdef __SUNPRO_C
|
||||
printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
|
||||
#endif
|
||||
printf("compiled with OpenSSL version: %s\n",
|
||||
OPENSSL_VERSION_TEXT);
|
||||
#if !defined(LIBRESSL_VERSION_NUMBER) && \
|
||||
OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
|
||||
printf("linked to OpenSSL version: %s\n",
|
||||
OpenSSL_version(OPENSSL_VERSION));
|
||||
|
||||
#else
|
||||
printf("linked to OpenSSL version: %s\n",
|
||||
SSLeay_version(SSLEAY_VERSION));
|
||||
#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
|
||||
#ifdef HAVE_LIBXML2
|
||||
printf("compiled with libxml2 version: %s\n",
|
||||
LIBXML_DOTTED_VERSION);
|
||||
printf("linked to libxml2 version: %s\n",
|
||||
xmlParserVersion);
|
||||
#endif
|
||||
#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
|
||||
printf("compiled with libjson-c version: %s\n",
|
||||
JSON_C_VERSION);
|
||||
printf("linked to libjson-c version: %s\n",
|
||||
json_c_version());
|
||||
#endif
|
||||
#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
|
||||
printf("compiled with zlib version: %s\n",
|
||||
ZLIB_VERSION);
|
||||
printf("linked to zlib version: %s\n",
|
||||
zlibVersion());
|
||||
#endif
|
||||
printf("threads support is enabled\n\n");
|
||||
|
||||
|
||||
/*
|
||||
* The default rndc.conf and rndc.key paths are in the same
|
||||
* directory, but named only has rndc.key defined internally.
|
||||
* We construct the rndc.conf path from it. (We could use
|
||||
* NAMED_SYSCONFDIR here but the result would look wrong on
|
||||
* Windows.)
|
||||
*/
|
||||
strlcpy(rndcconf, named_g_keyfile, sizeof(rndcconf));
|
||||
dot = strrchr(rndcconf, '.');
|
||||
if (dot != NULL) {
|
||||
size_t len = dot - rndcconf + 1;
|
||||
snprintf(dot + 1, PATH_MAX - len, "conf");
|
||||
}
|
||||
|
||||
/*
|
||||
* Print default configuration paths.
|
||||
*/
|
||||
printf("default paths:\n");
|
||||
printf(" named configuration: %s\n", named_g_conffile);
|
||||
printf(" rndc configuration: %s\n", rndcconf);
|
||||
printf(" DNSSEC root key: %s\n", named_g_defaultbindkeys);
|
||||
printf(" nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
|
||||
printf(" named PID file: %s\n", named_g_defaultpidfile);
|
||||
printf(" named lock file: %s\n", named_g_defaultlockfile);
|
||||
|
||||
}
|
||||
|
||||
static void
|
||||
parse_fuzz_arg(void) {
|
||||
if (!strncmp(isc_commandline_argument, "client:", 7)) {
|
||||
@@ -611,9 +519,6 @@ parse_T_opt(char *option) {
|
||||
maxudp = 1460;
|
||||
} else if (!strncmp(option, "maxudp=", 7)) {
|
||||
maxudp = atoi(option + 7);
|
||||
if (maxudp <= 0) {
|
||||
named_main_earlyfatal("bad maxudp");
|
||||
}
|
||||
} else if (!strncmp(option, "mkeytimers=", 11)) {
|
||||
p = strtok_r(option + 11, "/", &last);
|
||||
if (p == NULL) {
|
||||
@@ -765,10 +670,66 @@ parse_command_line(int argc, char *argv[]) {
|
||||
named_g_username = isc_commandline_argument;
|
||||
break;
|
||||
case 'v':
|
||||
printversion(false);
|
||||
printf("%s %s%s%s <id:%s>\n",
|
||||
named_g_product, named_g_version,
|
||||
(*named_g_description != '\0') ? " " : "",
|
||||
named_g_description, named_g_srcid);
|
||||
exit(0);
|
||||
case 'V':
|
||||
printversion(true);
|
||||
printf("%s %s%s%s <id:%s>\n",
|
||||
named_g_product, named_g_version,
|
||||
(*named_g_description != '\0') ? " " : "",
|
||||
named_g_description, named_g_srcid);
|
||||
printf("running on %s\n", named_os_uname());
|
||||
printf("built by %s with %s\n",
|
||||
named_g_builder, named_g_configargs);
|
||||
#ifdef __clang__
|
||||
printf("compiled by CLANG %s\n", __VERSION__);
|
||||
#else
|
||||
#if defined(__ICC) || defined(__INTEL_COMPILER)
|
||||
printf("compiled by ICC %s\n", __VERSION__);
|
||||
#else
|
||||
#ifdef __GNUC__
|
||||
printf("compiled by GCC %s\n", __VERSION__);
|
||||
#endif
|
||||
#endif
|
||||
#endif
|
||||
#ifdef _MSC_VER
|
||||
printf("compiled by MSVC %d\n", _MSC_VER);
|
||||
#endif
|
||||
#ifdef __SUNPRO_C
|
||||
printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
|
||||
#endif
|
||||
printf("compiled with OpenSSL version: %s\n",
|
||||
OPENSSL_VERSION_TEXT);
|
||||
#if !defined(LIBRESSL_VERSION_NUMBER) && \
|
||||
OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
|
||||
printf("linked to OpenSSL version: %s\n",
|
||||
OpenSSL_version(OPENSSL_VERSION));
|
||||
|
||||
#else
|
||||
printf("linked to OpenSSL version: %s\n",
|
||||
SSLeay_version(SSLEAY_VERSION));
|
||||
#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
|
||||
#ifdef HAVE_LIBXML2
|
||||
printf("compiled with libxml2 version: %s\n",
|
||||
LIBXML_DOTTED_VERSION);
|
||||
printf("linked to libxml2 version: %s\n",
|
||||
xmlParserVersion);
|
||||
#endif
|
||||
#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
|
||||
printf("compiled with libjson-c version: %s\n",
|
||||
JSON_C_VERSION);
|
||||
printf("linked to libjson-c version: %s\n",
|
||||
json_c_version());
|
||||
#endif
|
||||
#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
|
||||
printf("compiled with zlib version: %s\n",
|
||||
ZLIB_VERSION);
|
||||
printf("linked to zlib version: %s\n",
|
||||
zlibVersion());
|
||||
#endif
|
||||
printf("threads support is enabled\n");
|
||||
exit(0);
|
||||
case 'x':
|
||||
/* Obsolete. No longer in use. Ignore. */
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
+58
-73
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" This Source Code Form is subject to the terms of the Mozilla Public
|
||||
.\" License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
@@ -10,12 +10,12 @@
|
||||
.\" Title: named.conf
|
||||
.\" Author:
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 2019-07-21
|
||||
.\" Date: 2018-06-21
|
||||
.\" Manual: BIND9
|
||||
.\" Source: ISC
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "NAMED\&.CONF" "5" "2019\-07\-21" "ISC" "BIND9"
|
||||
.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
@@ -199,7 +199,6 @@ options {
|
||||
] [ dscp \fIinteger\fR ];
|
||||
alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
|
||||
* ) ] [ dscp \fIinteger\fR ];
|
||||
answer\-cookie \fIboolean\fR;
|
||||
attach\-cache \fIstring\fR;
|
||||
auth\-nxdomain \fIboolean\fR; // default changed
|
||||
auto\-dnssec ( allow | maintain | off );
|
||||
@@ -209,9 +208,9 @@ options {
|
||||
bindkeys\-file \fIquoted_string\fR;
|
||||
blackhole { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
cache\-file \fIquoted_string\fR;
|
||||
catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
|
||||
[ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
|
||||
port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
\fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
|
||||
in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
|
||||
check\-dup\-records ( fail | warn | ignore );
|
||||
@@ -227,7 +226,7 @@ options {
|
||||
check\-wildcard \fIboolean\fR;
|
||||
cleaning\-interval \fIinteger\fR;
|
||||
clients\-per\-query \fIinteger\fR;
|
||||
cookie\-algorithm ( aes | sha1 | sha256 | siphash24 );
|
||||
cookie\-algorithm ( aes | sha1 | sha256 );
|
||||
cookie\-secret \fIstring\fR;
|
||||
coresize ( default | unlimited | \fIsizeval\fR );
|
||||
datasize ( default | unlimited | \fIsizeval\fR );
|
||||
@@ -265,15 +264,12 @@ options {
|
||||
dnssec\-secure\-to\-insecure \fIboolean\fR;
|
||||
dnssec\-update\-mode ( maintain | no\-resign );
|
||||
dnssec\-validation ( yes | no | auto );
|
||||
dnstap { ( all | auth | client | forwarder |
|
||||
resolver | update ) [ ( query | response ) ];
|
||||
\&.\&.\&. };
|
||||
dnstap\-identity ( \fIquoted_string\fR | none |
|
||||
hostname );
|
||||
dnstap\-output ( file | unix ) \fIquoted_string\fR [
|
||||
size ( unlimited | \fIsize\fR ) ] [ versions (
|
||||
unlimited | \fIinteger\fR ) ] [ suffix ( increment
|
||||
| timestamp ) ];
|
||||
dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
|
||||
response ) ]; \&.\&.\&. };
|
||||
dnstap\-identity ( \fIquoted_string\fR | none | hostname );
|
||||
dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
|
||||
\fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
|
||||
increment | timestamp ) ];
|
||||
dnstap\-version ( \fIquoted_string\fR | none );
|
||||
dscp \fIinteger\fR;
|
||||
dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
|
||||
@@ -289,6 +285,9 @@ options {
|
||||
fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
|
||||
fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
|
||||
files ( default | unlimited | \fIsizeval\fR );
|
||||
filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
|
||||
filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
|
||||
flush\-zones\-on\-shutdown \fIboolean\fR;
|
||||
forward ( first | only );
|
||||
forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
|
||||
@@ -344,8 +343,6 @@ options {
|
||||
memstatistics \fIboolean\fR;
|
||||
memstatistics\-file \fIquoted_string\fR;
|
||||
message\-compression \fIboolean\fR;
|
||||
min\-cache\-ttl \fIttlval\fR;
|
||||
min\-ncache\-ttl \fIttlval\fR;
|
||||
min\-refresh\-time \fIinteger\fR;
|
||||
min\-retry\-time \fIinteger\fR;
|
||||
minimal\-any \fIboolean\fR;
|
||||
@@ -409,18 +406,18 @@ options {
|
||||
resolver\-retry\-interval \fIinteger\fR;
|
||||
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
|
||||
\fIinteger\fR;
|
||||
response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
|
||||
\fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
|
||||
\fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
|
||||
nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
policy ( cname | disabled | drop | given | no\-op | nodata |
|
||||
nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
|
||||
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
|
||||
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
|
||||
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
|
||||
[ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
|
||||
dnsrps\-options { \fIunspecified\-text\fR } ];
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
|
||||
qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
|
||||
dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
|
||||
} ];
|
||||
root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
|
||||
root\-key\-sentinel \fIboolean\fR;
|
||||
rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
|
||||
@@ -481,18 +478,6 @@ options {
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "PLUGIN"
|
||||
.sp
|
||||
.if n \{\
|
||||
.RS 4
|
||||
.\}
|
||||
.nf
|
||||
plugin ( query ) \fIstring\fR [ { \fIunspecified\-text\fR
|
||||
} ];
|
||||
.fi
|
||||
.if n \{\
|
||||
.RE
|
||||
.\}
|
||||
.SH "SERVER"
|
||||
.sp
|
||||
.if n \{\
|
||||
@@ -592,9 +577,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
auth\-nxdomain \fIboolean\fR; // default changed
|
||||
auto\-dnssec ( allow | maintain | off );
|
||||
cache\-file \fIquoted_string\fR;
|
||||
catalog\-zones { zone \fIstring\fR [ default\-masters [ port \fIinteger\fR ]
|
||||
[ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
catalog\-zones { zone \fIquoted_string\fR [ default\-masters [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fImasters\fR | \fIipv4_address\fR [
|
||||
port \fIinteger\fR ] | \fIipv6_address\fR [ port \fIinteger\fR ] ) [ key
|
||||
\fIstring\fR ]; \&.\&.\&. } ] [ zone\-directory \fIquoted_string\fR ] [
|
||||
in\-memory \fIboolean\fR ] [ min\-update\-interval \fIttlval\fR ]; \&.\&.\&. };
|
||||
check\-dup\-records ( fail | warn | ignore );
|
||||
@@ -647,9 +632,8 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
dnssec\-secure\-to\-insecure \fIboolean\fR;
|
||||
dnssec\-update\-mode ( maintain | no\-resign );
|
||||
dnssec\-validation ( yes | no | auto );
|
||||
dnstap { ( all | auth | client | forwarder |
|
||||
resolver | update ) [ ( query | response ) ];
|
||||
\&.\&.\&. };
|
||||
dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
|
||||
response ) ]; \&.\&.\&. };
|
||||
dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
|
||||
\fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
|
||||
@@ -663,6 +647,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
fetch\-quota\-params \fIinteger\fR \fIfixedpoint\fR \fIfixedpoint\fR \fIfixedpoint\fR;
|
||||
fetches\-per\-server \fIinteger\fR [ ( drop | fail ) ];
|
||||
fetches\-per\-zone \fIinteger\fR [ ( drop | fail ) ];
|
||||
filter\-aaaa { \fIaddress_match_element\fR; \&.\&.\&. };
|
||||
filter\-aaaa\-on\-v4 ( break\-dnssec | \fIboolean\fR );
|
||||
filter\-aaaa\-on\-v6 ( break\-dnssec | \fIboolean\fR );
|
||||
forward ( first | only );
|
||||
forwarders [ port \fIinteger\fR ] [ dscp \fIinteger\fR ] { ( \fIipv4_address\fR
|
||||
| \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
|
||||
@@ -703,8 +690,6 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
max\-udp\-size \fIinteger\fR;
|
||||
max\-zone\-ttl ( unlimited | \fIttlval\fR );
|
||||
message\-compression \fIboolean\fR;
|
||||
min\-cache\-ttl \fIttlval\fR;
|
||||
min\-ncache\-ttl \fIttlval\fR;
|
||||
min\-refresh\-time \fIinteger\fR;
|
||||
min\-retry\-time \fIinteger\fR;
|
||||
minimal\-any \fIboolean\fR;
|
||||
@@ -723,8 +708,6 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
nta\-lifetime \fIttlval\fR;
|
||||
nta\-recheck \fIttlval\fR;
|
||||
nxdomain\-redirect \fIstring\fR;
|
||||
plugin ( query ) \fIstring\fR [ {
|
||||
\fIunspecified\-text\fR } ];
|
||||
preferred\-glue \fIstring\fR;
|
||||
prefetch \fIinteger\fR [ \fIinteger\fR ];
|
||||
provide\-ixfr \fIboolean\fR;
|
||||
@@ -762,18 +745,18 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
resolver\-retry\-interval \fIinteger\fR;
|
||||
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
|
||||
\fIinteger\fR;
|
||||
response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
|
||||
\fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
|
||||
\fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
|
||||
nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
response\-policy { zone \fIquoted_string\fR [ log \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
policy ( cname | disabled | drop | given | no\-op | nodata |
|
||||
nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
|
||||
recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
|
||||
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
|
||||
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
|
||||
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
|
||||
[ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
|
||||
nsdname\-enable \fIboolean\fR ] [ dnsrps\-enable \fIboolean\fR ] [
|
||||
dnsrps\-options { \fIunspecified\-text\fR } ];
|
||||
nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ break\-dnssec \fIboolean\fR ] [
|
||||
max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [
|
||||
min\-ns\-dots \fIinteger\fR ] [ nsip\-wait\-recurse \fIboolean\fR ] [
|
||||
qname\-wait\-recurse \fIboolean\fR ] [ recursive\-only \fIboolean\fR ] [
|
||||
nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
|
||||
dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
|
||||
} ];
|
||||
root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
|
||||
root\-key\-sentinel \fIboolean\fR;
|
||||
rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
|
||||
@@ -909,7 +892,9 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR
|
||||
| * ) ] [ dscp \fIinteger\fR ];
|
||||
notify\-to\-soa \fIboolean\fR;
|
||||
pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR
|
||||
pubkey \fIinteger\fR
|
||||
\fIinteger\fR
|
||||
\fIinteger\fR
|
||||
request\-expire \fIboolean\fR;
|
||||
request\-ixfr \fIboolean\fR;
|
||||
serial\-update\-method ( date | increment | unixtime );
|
||||
@@ -929,10 +914,10 @@ view \fIstring\fR [ \fIclass\fR ] {
|
||||
static\-stub | stub );
|
||||
update\-check\-ksk \fIboolean\fR;
|
||||
update\-policy ( local | { ( deny | grant ) \fIstring\fR (
|
||||
6to4\-self | external | krb5\-self | krb5\-selfsub |
|
||||
krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
|
||||
name | self | selfsub | selfwild | subdomain | tcp\-self
|
||||
| wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
|
||||
6to4\-self | external | krb5\-self | krb5\-subdomain |
|
||||
ms\-self | ms\-subdomain | name | self | selfsub |
|
||||
selfwild | subdomain | tcp\-self | wildcard | zonesub )
|
||||
[ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
|
||||
use\-alt\-transfer\-source \fIboolean\fR;
|
||||
zero\-no\-soa\-ttl \fIboolean\fR;
|
||||
zone\-statistics ( full | terse | none | \fIboolean\fR );
|
||||
@@ -1015,6 +1000,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ]
|
||||
[ dscp \fIinteger\fR ];
|
||||
notify\-to\-soa \fIboolean\fR;
|
||||
pubkey \fIinteger\fR \fIinteger\fR
|
||||
request\-expire \fIboolean\fR;
|
||||
request\-ixfr \fIboolean\fR;
|
||||
serial\-update\-method ( date | increment | unixtime );
|
||||
@@ -1034,10 +1020,9 @@ zone \fIstring\fR [ \fIclass\fR ] {
|
||||
stub );
|
||||
update\-check\-ksk \fIboolean\fR;
|
||||
update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
|
||||
external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
|
||||
| ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
|
||||
| subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
|
||||
\fIrrtypelist\fR; \&.\&.\&. };
|
||||
external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
|
||||
| name | self | selfsub | selfwild | subdomain | tcp\-self |
|
||||
wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
|
||||
use\-alt\-transfer\-source \fIboolean\fR;
|
||||
zero\-no\-soa\-ttl \fIboolean\fR;
|
||||
zone\-statistics ( full | terse | none | \fIboolean\fR );
|
||||
@@ -1062,5 +1047,5 @@ BIND 9 Administrator Reference Manual\&.
|
||||
\fBInternet Systems Consortium, Inc\&.\fR
|
||||
.SH "COPYRIGHT"
|
||||
.br
|
||||
Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright \(co 2004-2018 Internet Systems Consortium, Inc. ("ISC")
|
||||
.br
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user