Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 cvs2git
|
0ba8784cb9 |
@@ -1,239 +1,4 @@
|
||||
|
||||
--- 9.4.0a4 released ---
|
||||
|
||||
2009. [bug] libbind: coverity fixes. [RT #15808]
|
||||
|
||||
2008. [func] It is now posssible to enable/disable DNSSEC
|
||||
validation from rndc. This is useful for the
|
||||
mobile hosts where the current connection point
|
||||
breaks DNSSEC (firewall/proxy). [RT #15592]
|
||||
|
||||
rndc validation newstate [view]
|
||||
|
||||
2007. [func] It is now possible to explicitly enable DNSSEC
|
||||
validation. default dnssec-validation no; to
|
||||
be changed to yes in 9.5.0. [RT #15674]
|
||||
|
||||
2006. [security] Allow-query-cache and allow-recursion now default
|
||||
to the builtin acls "localnets" and "localhost".
|
||||
|
||||
This is being done to make caching servers less
|
||||
attractive as reflective amplifying targets for
|
||||
spoofed traffic. This still leave authoritative
|
||||
servers exposed.
|
||||
|
||||
The best fix is for full BCP 38 deployment to
|
||||
remove spoofed traffic.
|
||||
|
||||
2005. [bug] libbind: Retransmission timeouts should be
|
||||
based on which attempt it is to the nameserver
|
||||
and not the nameserver itself. [RT #13548]
|
||||
|
||||
2004. [bug] dns_tsig_sign() could pass a NULL pointer to
|
||||
dst_context_destroy() when cleaning up after a
|
||||
error. [RT #15835]
|
||||
|
||||
2003. [bug] libbind: The DNS name/address lookup functions could
|
||||
occasionally follow a random pointer due to
|
||||
structures not being completely zeroed. [RT #15806]
|
||||
|
||||
2002. [bug] libbind: tighten the constraints on when
|
||||
struct addrinfo._ai_pad exists. [RT #15783]
|
||||
|
||||
2001. [func] Check the KSK flag when updating a secure dynamic zone.
|
||||
New zone option "update-check-ksk yes;". [RT #15817]
|
||||
|
||||
2000. [bug] memmove()/strtol() fix was incomplete. [RT #15812]
|
||||
|
||||
1999. [func] Implement "rrset-order fixed". [RT #13662]
|
||||
|
||||
1998. [bug] Restrict handling of fifos as sockets to just SunOS.
|
||||
This allows named to connect to entropy gathering
|
||||
daemons that use fifos instead of sockets. [RT #15840]
|
||||
|
||||
1997. [bug] Named was failing to replace negative cache entries
|
||||
when a positive one for the type was learnt.
|
||||
[RT #15818]
|
||||
|
||||
1996. [bug] nsupdate: if a zone has been specified it should
|
||||
appear in the output of 'show'. [RT #15797]
|
||||
|
||||
1995. [bug] 'host' was reporting multiple "is an alias" messages.
|
||||
[RT #15702]
|
||||
|
||||
1994. [port] OpenSSL 0.9.8 support. [RT #15694]
|
||||
|
||||
1993. [bug] Log messsage, via syslog, were missing the space
|
||||
after the timestamp if "print-time yes" was specified.
|
||||
[RT #15844]
|
||||
|
||||
1992. [bug] Not all incoming zone transfer messages included the
|
||||
view. [RT #15825]
|
||||
|
||||
1991. [cleanup] The configuration data, once read, should be treated
|
||||
as readonly. Expand the use of const to enforce this
|
||||
at compile time. [RT #15813]
|
||||
|
||||
1990. [bug] libbind: isc's override of broken gettimeofday()
|
||||
implementions was not always effective.
|
||||
[RT #15709]
|
||||
|
||||
1989. [bug] win32: don't check the service password when
|
||||
re-installing. [RT #15882]
|
||||
|
||||
1988. [bug] Remove a bus error from the SHA256/SHA512 support.
|
||||
[RT #15878]
|
||||
|
||||
1987. [func] DS/DLV SHA256 digest algorithm support. [RT #15608]
|
||||
|
||||
1986. [func] Report when a zone is removed. [RT #15849]
|
||||
|
||||
1985. [protocol] DLV has now been assigned a official type code of
|
||||
32769. [RT #15807]
|
||||
|
||||
Note: care should be taken to ensure you upgrade
|
||||
both named and dnssec-signzone at the same time for
|
||||
zones with DLV records where named is the master
|
||||
server for the zone. Also any zones that contain
|
||||
DLV records should be removed when upgrading a slave
|
||||
zone. You do not however have to upgrade all
|
||||
servers for a zone with DLV records simultaniously.
|
||||
|
||||
1984. [func] dig, nslookup and host now advertise a 4096 byte
|
||||
EDNS UDP buffer size by default. [RT #15855]
|
||||
|
||||
1983. [func] Two new update policies. "selfsub" and "selfwild".
|
||||
[RT #12895]
|
||||
|
||||
1982. [bug] DNSKEY was being accepted on the parent side of
|
||||
a delegation. KEY is still accepted there for
|
||||
RFC 3007 validated updates. [RT #15620]
|
||||
|
||||
1981. [bug] win32: condition.c:wait() could fail to reattain
|
||||
the mutex lock.
|
||||
|
||||
1980. [func] dnssec-signzone: output the SOA record as the
|
||||
first record in the signed zone. [RT #15758]
|
||||
|
||||
1979. [port] linux: allow named to drop core after changing
|
||||
user ids. [RT #15753]
|
||||
|
||||
1978. [port] Handle systems which have a broken recvmsg().
|
||||
[RT #15742]
|
||||
|
||||
1977. [bug] Silence noisy log message. [RT #15704]
|
||||
|
||||
1976. [bug] Handle systems with no IPv4 addresses. [RT #15695]
|
||||
|
||||
1975. [bug] libbind: isc_gethexstring() could misparse multi-line
|
||||
hex strings with comments. [RT #15814]
|
||||
|
||||
1974. [doc] List each of the zone types and associated zone
|
||||
options seperately in the ARM.
|
||||
|
||||
1973. [func] TSIG HMACSHA1, HMACSHA224, HMACSHA256, HMACSHA384 and
|
||||
HMACSHA512 support. [RT #13606]
|
||||
|
||||
1972. [contrib] DBUS dynamic forwarders integation from
|
||||
Jason Vas Dias <jvdias@redhat.com>.
|
||||
|
||||
1971. [port] linux: make detection of missing IF_NAMESIZE more
|
||||
robust. [RT #15443]
|
||||
|
||||
1970. [bug] nsupdate: adjust UDP timeout when falling back to
|
||||
unsigned SOA query. [RT #15775]
|
||||
|
||||
1969. [bug] win32: the socket code was freeing the socket
|
||||
structure too early. [RT #15776]
|
||||
|
||||
1968. [bug] Missing lock in resolver.c:validated(). [RT #15739]
|
||||
|
||||
1967. [func] dig/nslookup/host: warn about missing "QR". [RT #15779]
|
||||
|
||||
1966. [bug] Don't set CD when we have fallen back to plain DNS.
|
||||
[RT #15727]
|
||||
|
||||
1965. [func] Suppress spurious "recusion requested but not
|
||||
available" warning with 'dig +qr'. [RT #15780].
|
||||
|
||||
1964. [func] Seperate out MX and SRV to CNAME checks. [RT #15723]
|
||||
|
||||
1963. [port] Tru64 4.0E doesn't support send() and recv().
|
||||
[RT #15586]
|
||||
|
||||
1962. [bug] Named failed to clear old update-policy when it
|
||||
was removed. [RT #15491]
|
||||
|
||||
1961. [bug] Check the port and address of responses forwarded
|
||||
to dispatch. [RT #15474]
|
||||
|
||||
1960. [bug] Update code should set NSEC ttls from SOA MINIMUM.
|
||||
[RT #15465]
|
||||
|
||||
1959. [func] Control the zeroing of the negative response TTL to
|
||||
a soa query. Defaults "zero-no-soa-ttl yes;" and
|
||||
"zero-no-soa-ttl-cache no;". [RT #15460]
|
||||
|
||||
1958. [bug] Named failed to update the zone's secure state
|
||||
until the zone was reloaded. [RT #15412]
|
||||
|
||||
1957. [bug] Dig mishandled responses to class ANY queries.
|
||||
[RT #15402]
|
||||
|
||||
1956. [bug] Improve cross compile support, 'gen' is now built
|
||||
by native compiler. See README for additional
|
||||
cross compile support information. [RT #15148]
|
||||
|
||||
1955. [bug] Pre-allocate the cache cleaning interator. [RT #14998]
|
||||
|
||||
1954. [func] Named now falls back to advertising EDNS with a
|
||||
512 byte receive buffer if the initial EDNS queries
|
||||
fail. [RT #14852]
|
||||
|
||||
1953. [func] The maximum EDNS UDP response named will send can
|
||||
now be set in named.conf (max-udp-size). This is
|
||||
independent of the advertised receive buffer
|
||||
(edns-udp-size). [RT #14852]
|
||||
|
||||
1952. [port] hpux: tell the linker to build a runtime link
|
||||
path "-Wl,+b:". [RT #14816].
|
||||
|
||||
1951. [security] Drop queries from particular well known ports.
|
||||
Don't return FORMERR to queries from particular
|
||||
well known ports. [RT #15636]
|
||||
|
||||
1950. [port] Solaris 2.5.1 and earlier cannot bind() then connect()
|
||||
a TCP socket. This prevents the source address being
|
||||
set for TCP connections. [RT #15628]
|
||||
|
||||
1949. [func] Addition memory leakage checks. [RT #15544]
|
||||
|
||||
1948. [bug] If was possible to trigger a REQUIRE failure in
|
||||
xfrin.c:maybe_free() if named ran out of memory.
|
||||
[RT #15568]
|
||||
|
||||
1947. [func] It is now possible to configure named to accept
|
||||
expired RRSIGs. Default "dnssec-accept-expired no;".
|
||||
Setting "dnssec-accept-expired yes;" leaves named
|
||||
vulnerable to replay attacks. [RT #14685]
|
||||
|
||||
1946. [bug] resume_dslookup() could trigger a REQUIRE failure
|
||||
when using forwarders. [RT #15549]
|
||||
|
||||
1945. [cleanup] dnssec-keygen: RSA (RSAMD5) is nolonger recommended.
|
||||
To generate a RSAMD5 key you must explicitly request
|
||||
RSAMD5. [RT #13780]
|
||||
|
||||
1944. [cleanup] isc_hash_create() does not need a read/write lock.
|
||||
[RT #15522]
|
||||
|
||||
1943. [bug] Set the loadtime after rolling forward the journal.
|
||||
[RT #15647]
|
||||
|
||||
1597. [func] Allow notify-source and query-source to be specified
|
||||
on a per server basis similar to transfer-source.
|
||||
[RT #6496]
|
||||
|
||||
--- 9.4.0a3 released ---
|
||||
|
||||
1942. [bug] If the name of a DNSKEY match that of one in
|
||||
@@ -1252,6 +1017,8 @@
|
||||
1598. [func] Specify that certain parts of the namespace must
|
||||
be secure (dnssec-must-be-secure).
|
||||
|
||||
1597. [placeholder] rt6496a
|
||||
|
||||
1596. [func] Accept 'notify-source' style syntax for query-source.
|
||||
|
||||
1595. [func] New notify type 'master-only'. Enable notify for
|
||||
@@ -1790,8 +1557,8 @@
|
||||
|
||||
1414. [func] Support for KSK flag.
|
||||
|
||||
1413. [func] Explicitly request the (re-)generation of DS records
|
||||
from keysets (dnssec-signzone -g).
|
||||
1413. [func] Explictly request the (re-)generation of DS records from
|
||||
keysets (dnssec-signzone -g).
|
||||
|
||||
1412. [func] You can now specify servers to be tried if a nameserver
|
||||
has IPv6 address and you only support IPv4 or the
|
||||
@@ -6040,7 +5807,7 @@
|
||||
<isc/bufferlist.h>, <isc/task.h>, <isc/mem.h> or
|
||||
<isc/net.h>.
|
||||
|
||||
119. [cleanup] structure definitions for generic rdata structures do
|
||||
119. [cleanup] structure definitions for generic rdata stuctures do
|
||||
not have _generic_ in their names.
|
||||
|
||||
118. [cleanup] libdns.a is now namespace-clean, on NetBSD, excepting
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
Copyright (C) 1996-2003 Internet Software Consortium.
|
||||
|
||||
Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$Id: COPYRIGHT,v 1.9.18.2 2006/01/04 00:37:23 marka Exp $
|
||||
$Id: COPYRIGHT,v 1.9.18.1 2005/01/10 23:50:57 marka Exp $
|
||||
|
||||
Portions Copyright (C) 1996-2001 Nominum, Inc.
|
||||
|
||||
|
||||
@@ -4,36 +4,26 @@ Frequently Asked Questions about BIND 9
|
||||
|
||||
Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads?
|
||||
|
||||
A: Linux threads do not fully implement the Posix threads (pthreads) standard. In
|
||||
particular, setuid() operates only on the current thread, not the full process.
|
||||
Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on
|
||||
all other supported platforms. setuid() cannot be called before creating
|
||||
threads, since the server does not start listening on reserved ports until
|
||||
after threads have started.
|
||||
A: Linux threads do not fully implement the Posix threads (pthreads) standard.
|
||||
In particular, setuid() operates only on the current thread, not the full
|
||||
process. Because of this limitation, BIND 9 cannot use setuid() on Linux as
|
||||
it can on all other supported platforms. setuid() cannot be called before
|
||||
creating threads, since the server does not start listening on reserved
|
||||
ports until after threads have started.
|
||||
|
||||
In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve
|
||||
capabilities across a setuid() call is present. This allows BIND 9 to call
|
||||
setuid() early, while retaining the ability to bind reserved ports. This is a
|
||||
Linux-specific hack.
|
||||
setuid() early, while retaining the ability to bind reserved ports. This is
|
||||
a Linux-specific hack.
|
||||
|
||||
On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of
|
||||
a security risk than a root process that has not dropped privileges.
|
||||
On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less
|
||||
of a security risk than a root process that has not dropped privileges.
|
||||
|
||||
If Linux threads ever work correctly, this restriction will go away.
|
||||
|
||||
Configuring BIND9 with the --disable-threads option (the default) causes a
|
||||
non-threaded version to be built, which will allow -u to be used.
|
||||
|
||||
Q: Why do I get the following errors:
|
||||
|
||||
general: errno2result.c:109: unexpected error:
|
||||
general: unable to convert errno to isc_result: 14: Bad address
|
||||
client: UDP client handler shutting down due to fatal receive error: unexpected error
|
||||
|
||||
A: This is the result of a Linux kernel bug.
|
||||
|
||||
See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
|
||||
|
||||
Q: Why does named log the warning message "no TTL specified - using SOA MINTTL
|
||||
instead"?
|
||||
|
||||
@@ -50,26 +40,23 @@ A: Your zone file is illegal according to RFC1035. It must either have a line
|
||||
Q: Why do I see 5 (or more) copies of named on Linux?
|
||||
|
||||
A: Linux threads each show up as a process under ps. The approximate number of
|
||||
threads running is n+4, where n is the number of CPUs. Note that the amount of
|
||||
memory used is not cumulative; if each process is using 10M of memory, only a
|
||||
total of 10M is used.
|
||||
|
||||
Newer versions of Linux's ps command hide the individual threads and require -L
|
||||
to display them.
|
||||
threads running is n+4, where n is the number of CPUs. Note that the amount
|
||||
of memory used is not cumulative; if each process is using 10M of memory,
|
||||
only a total of 10M is used.
|
||||
|
||||
Q: Why does BIND 9 log "permission denied" errors accessing its configuration
|
||||
files or zones on my Linux system even though it is running as root?
|
||||
|
||||
A: On Linux, BIND 9 drops most of its root privileges on startup. This including
|
||||
the privilege to open files owned by other users. Therefore, if the server is
|
||||
running as root, the configuration files and zone files should also be owned by
|
||||
root.
|
||||
A: On Linux, BIND 9 drops most of its root privileges on startup. This
|
||||
including the privilege to open files owned by other users. Therefore, if
|
||||
the server is running as root, the configuration files and zone files should
|
||||
also be owned by root.
|
||||
|
||||
Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar:
|
||||
ran out of space"?
|
||||
Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file
|
||||
bar: ran out of space"?
|
||||
|
||||
A: This is often caused by TXT records with missing close quotes. Check that all
|
||||
TXT records containing quoted strings have both open and close quotes.
|
||||
A: This is often caused by TXT records with missing close quotes. Check that
|
||||
all TXT records containing quoted strings have both open and close quotes.
|
||||
|
||||
Q: How do I produce a usable core file from a multithreaded named on Linux?
|
||||
|
||||
@@ -81,16 +68,16 @@ A: If the Linux kernel is 2.4.7 or newer, multithreaded core dumps are usable
|
||||
|
||||
Q: How do I restrict people from looking up the server version?
|
||||
|
||||
A: Put a "version" option containing something other than the real version in the
|
||||
"options" section of named.conf. Note doing this will not prevent attacks and
|
||||
may impede people trying to diagnose problems with your server. Also it is
|
||||
possible to "fingerprint" nameservers to determine their version.
|
||||
A: Put a "version" option containing something other than the real version in
|
||||
the "options" section of named.conf. Note doing this will not prevent
|
||||
attacks and may impede people trying to diagnose problems with your server.
|
||||
Also it is possible to "fingerprint" nameservers to determine their version.
|
||||
|
||||
Q: How do I restrict only remote users from looking up the server version?
|
||||
|
||||
A: The following view statement will intercept lookups as the internal view that
|
||||
holds the version information will be matched last. The caveats of the previous
|
||||
answer still apply, of course.
|
||||
A: The following view statement will intercept lookups as the internal view
|
||||
that holds the version information will be matched last. The caveats of the
|
||||
previous answer still apply, of course.
|
||||
|
||||
view "chaos" chaos {
|
||||
match-clients { <those to be refused>; };
|
||||
@@ -104,45 +91,48 @@ A: The following view statement will intercept lookups as the internal view that
|
||||
Q: What do "no source of entropy found" or "could not open entropy source foo"
|
||||
mean?
|
||||
|
||||
A: The server requires a source of entropy to perform certain operations, mostly
|
||||
DNSSEC related. These messages indicate that you have no source of entropy. On
|
||||
systems with /dev/random or an equivalent, it is used by default. A source of
|
||||
entropy can also be defined using the random-device option in named.conf.
|
||||
A: The server requires a source of entropy to perform certain operations,
|
||||
mostly DNSSEC related. These messages indicate that you have no source of
|
||||
entropy. On systems with /dev/random or an equivalent, it is used by
|
||||
default. A source of entropy can also be defined using the random-device
|
||||
option in named.conf.
|
||||
|
||||
Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why?
|
||||
|
||||
A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed
|
||||
under /usr. Check that the correct named is running.
|
||||
|
||||
Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm
|
||||
sure I have the keys set up correctly, but the server is rejecting the TSIG.
|
||||
Why?
|
||||
Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers.
|
||||
I'm sure I have the keys set up correctly, but the server is rejecting the
|
||||
TSIG. Why?
|
||||
|
||||
A: This may be a clock skew problem. Check that the the clocks on the client and
|
||||
server are properly synchronised (e.g., using ntp).
|
||||
A: This may be a clock skew problem. Check that the the clocks on the client
|
||||
and server are properly synchronised (e.g., using ntp).
|
||||
|
||||
Q: I'm trying to compile BIND 9, and "make" is failing due to files not being
|
||||
found. Why?
|
||||
|
||||
A: Using a parallel or distributed "make" to build BIND 9 is not supported, and
|
||||
doesn't work. If you are using one of these, use normal make or gmake instead.
|
||||
doesn't work. If you are using one of these, use normal make or gmake
|
||||
instead.
|
||||
|
||||
Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error
|
||||
messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's
|
||||
wrong?
|
||||
Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging
|
||||
error messages like "notify to 10.0.0.1#53 failed: unexpected end of input".
|
||||
What's wrong?
|
||||
|
||||
A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND
|
||||
8.2.4. It can be safely ignored - the notify has been acted on by the slave
|
||||
despite the error message.
|
||||
A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in
|
||||
BIND 8.2.4. It can be safely ignored - the notify has been acted on by the
|
||||
slave despite the error message.
|
||||
|
||||
Q: I keep getting log messages like the following. Why?
|
||||
|
||||
Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update
|
||||
failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
|
||||
failed: 'RRset exists (value dependent)' prerequisite not satisfied
|
||||
(NXRRSET)
|
||||
|
||||
A: DNS updates allow the update request to test to see if certain conditions are
|
||||
met prior to proceeding with the update. The message above is saying that
|
||||
conditions were not met and the update is not proceeding. See doc/rfc/
|
||||
A: DNS updates allow the update request to test to see if certain conditions
|
||||
are met prior to proceeding with the update. The message above is saying
|
||||
that conditions were not met and the update is not proceeding. See doc/rfc/
|
||||
rfc2136.txt for more details on prerequisites.
|
||||
|
||||
Q: I keep getting log messages like the following. Why?
|
||||
@@ -150,11 +140,11 @@ Q: I keep getting log messages like the following. Why?
|
||||
Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
|
||||
|
||||
A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update
|
||||
protocol. Windows 2000 machines have a habit of sending dynamic update requests
|
||||
to DNS servers without being specifically configured to do so. If the update
|
||||
requests are coming from a Windows 2000 machine, see http://
|
||||
support.microsoft.com/support/kb/articles/q246/8/04.asp for information about
|
||||
how to turn them off.
|
||||
protocol. Windows 2000 machines have a habit of sending dynamic update
|
||||
requests to DNS servers without being specifically configured to do so. If
|
||||
the update requests are coming from a Windows 2000 machine, see http://
|
||||
support.microsoft.com/support/kb/articles/q246/8/04.asp for information
|
||||
about how to turn them off.
|
||||
|
||||
Q: I see a log message like the following. Why?
|
||||
|
||||
@@ -162,59 +152,59 @@ Q: I see a log message like the following. Why?
|
||||
|
||||
A: You are most likely running named as a non-root user, and that user does not
|
||||
have permission to write in /var/run. The common ways of fixing this are to
|
||||
create a /var/run/named directory owned by the named user and set pid-file to "
|
||||
/var/run/named/named.pid", or set pid-file to "named.pid", which will put the
|
||||
file in the directory specified by the directory option (which, in this case,
|
||||
must be writable by the named user).
|
||||
create a /var/run/named directory owned by the named user and set pid-file
|
||||
to "/var/run/named/named.pid", or set pid-file to "named.pid", which will
|
||||
put the file in the directory specified by the directory option (which, in
|
||||
this case, must be writable by the named user).
|
||||
|
||||
Q: When I do a "dig . ns", many of the A records for the root servers are missing.
|
||||
Why?
|
||||
Q: When I do a "dig . ns", many of the A records for the root servers are
|
||||
missing. Why?
|
||||
|
||||
A: This is normal and harmless. It is a somewhat confusing side effect of the way
|
||||
BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid
|
||||
promoting glue into answers.
|
||||
A: This is normal and harmless. It is a somewhat confusing side effect of the
|
||||
way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to
|
||||
avoid promoting glue into answers.
|
||||
|
||||
When BIND 9 first starts up and primes its cache, it receives the root server
|
||||
addresses as additional data in an authoritative response from a root server,
|
||||
and these records are eligible for inclusion as additional data in responses.
|
||||
Subsequently it receives a subset of the root server addresses as additional
|
||||
data in a non-authoritative (referral) response from a root server. This causes
|
||||
the addresses to now be considered non-authoritative (glue) data, which is not
|
||||
eligible for inclusion in responses.
|
||||
When BIND 9 first starts up and primes its cache, it receives the root
|
||||
server addresses as additional data in an authoritative response from a root
|
||||
server, and these records are eligible for inclusion as additional data in
|
||||
responses. Subsequently it receives a subset of the root server addresses as
|
||||
additional data in a non-authoritative (referral) response from a root
|
||||
server. This causes the addresses to now be considered non-authoritative
|
||||
(glue) data, which is not eligible for inclusion in responses.
|
||||
|
||||
The server does have a complete set of root server addresses cached at all
|
||||
times, it just may not include all of them as additional data, depending on
|
||||
whether they were last received as answers or as glue. You can always look up
|
||||
the addresses with explicit queries like "dig a.root-servers.net A".
|
||||
whether they were last received as answers or as glue. You can always look
|
||||
up the addresses with explicit queries like "dig a.root-servers.net A".
|
||||
|
||||
Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why?
|
||||
|
||||
A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages
|
||||
larger than 16K are not handled properly. This can be worked around by setting
|
||||
the option "transfer-format one-answer;". Also check whether your zone contains
|
||||
domain names with embedded spaces or other special characters, like "John\
|
||||
032Doe\213s\032Computer", since such names have been known to cause Windows
|
||||
2000 slaves to incorrectly reject the zone.
|
||||
A: This may be caused by a bug in the Windows 2000 DNS server where DNS
|
||||
messages larger than 16K are not handled properly. This can be worked around
|
||||
by setting the option "transfer-format one-answer;". Also check whether your
|
||||
zone contains domain names with embedded spaces or other special characters,
|
||||
like "John\032Doe\213s\032Computer", since such names have been known to
|
||||
cause Windows 2000 slaves to incorrectly reject the zone.
|
||||
|
||||
Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
|
||||
|
||||
A: A zone can be updated either by editing zone files and reloading the server or
|
||||
by dynamic update, but not both. If you have enabled dynamic update for a zone
|
||||
using the "allow-update" option, you are not supposed to edit the zone file by
|
||||
hand, and the server will not attempt to reload it.
|
||||
A: A zone can be updated either by editing zone files and reloading the server
|
||||
or by dynamic update, but not both. If you have enabled dynamic update for a
|
||||
zone using the "allow-update" option, you are not supposed to edit the zone
|
||||
file by hand, and the server will not attempt to reload it.
|
||||
|
||||
Q: I can query the nameserver from the nameserver but not from other machines.
|
||||
Why?
|
||||
|
||||
A: This is usually the result of the firewall configuration stopping the queries
|
||||
and / or the replies.
|
||||
A: This is usually the result of the firewall configuration stopping the
|
||||
queries and / or the replies.
|
||||
|
||||
Q: How can I make a server a slave for both an internal and an external view at
|
||||
the same time? When I tried, both views on the slave were transferred from the
|
||||
same view on the master.
|
||||
the same time? When I tried, both views on the slave were transferred from
|
||||
the same view on the master.
|
||||
|
||||
A: You will need to give the master and slave multiple IP addresses and use those
|
||||
to make sure you reach the correct view on the other machine.
|
||||
A: You will need to give the master and slave multiple IP addresses and use
|
||||
those to make sure you reach the correct view on the other machine.
|
||||
|
||||
Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
|
||||
internal:
|
||||
@@ -242,8 +232,8 @@ A: You will need to give the master and slave multiple IP addresses and use thos
|
||||
transfer-source 10.0.1.4;
|
||||
query-source address 10.0.1.4;
|
||||
|
||||
You put the external address on the alias so that all the other dns clients on
|
||||
these boxes see the internal view by default.
|
||||
You put the external address on the alias so that all the other dns clients
|
||||
on these boxes see the internal view by default.
|
||||
|
||||
A: BIND 9.3 and later: Use TSIG to select the appropriate view.
|
||||
|
||||
@@ -258,7 +248,7 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
|
||||
};
|
||||
view "external" {
|
||||
match-clients { key external; any; };
|
||||
server 10.0.1.2 { keys external; };
|
||||
server 10.0.0.2 { keys external; };
|
||||
recursion no;
|
||||
...
|
||||
};
|
||||
@@ -274,7 +264,7 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
|
||||
};
|
||||
view "external" {
|
||||
match-clients { key external; any; };
|
||||
server 10.0.1.1 { keys external; };
|
||||
server 10.0.0.1 { keys external; };
|
||||
recursion no;
|
||||
...
|
||||
};
|
||||
@@ -282,8 +272,8 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
|
||||
Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
|
||||
|
||||
A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
|
||||
certain interrupts as a source of random events. You can make this permanent by
|
||||
setting rand_irqs in /etc/rc.conf.
|
||||
certain interrupts as a source of random events. You can make this permanent
|
||||
by setting rand_irqs in /etc/rc.conf.
|
||||
|
||||
/etc/rc.conf
|
||||
rand_irqs="3 14 15"
|
||||
@@ -293,33 +283,34 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
|
||||
Q: Why is named listening on UDP port other than 53?
|
||||
|
||||
A: Named uses a system selected port to make queries of other nameservers. This
|
||||
behaviour can be overridden by using query-source to lock down the port and/or
|
||||
address. See also notify-source and transfer-source.
|
||||
behaviour can be overridden by using query-source to lock down the port and/
|
||||
or address. See also notify-source and transfer-source.
|
||||
|
||||
Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other
|
||||
data" when transferring a zone. What does this mean?
|
||||
Q: I get error messages like "multiple RRs of singleton type" and "CNAME and
|
||||
other data" when transferring a zone. What does this mean?
|
||||
|
||||
A: These indicate a malformed master zone. You can identify the exact records
|
||||
involved by transferring the zone using dig then running named-checkzone on it.
|
||||
involved by transferring the zone using dig then running named-checkzone on
|
||||
it.
|
||||
|
||||
dig axfr example.com @master-server > tmp
|
||||
named-checkzone example.com tmp
|
||||
|
||||
A CNAME record cannot exist with the same name as another record except for the
|
||||
DNSSEC records which prove its existance (NSEC).
|
||||
A CNAME record cannot exist with the same name as another record except for
|
||||
the DNSSEC records which prove its existance (NSEC).
|
||||
|
||||
RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data
|
||||
should be present; this ensures that the data for a canonical name and its
|
||||
aliases cannot be different. This rule also insures that a cached CNAME can be
|
||||
used without checking with an authoritative server for other RR types."
|
||||
aliases cannot be different. This rule also insures that a cached CNAME can
|
||||
be used without checking with an authoritative server for other RR types."
|
||||
|
||||
Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is
|
||||
the last line of named.conf.
|
||||
Q: I get error messages like "named.conf:99: unexpected end of input" where 99
|
||||
is the last line of named.conf.
|
||||
|
||||
A: Some text editors (notepad and wordpad) fail to put a line title indication
|
||||
(e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a
|
||||
blank line to the end of the file. Named expects to see EOF immediately after
|
||||
EOL and treats text files where this is not met as truncated.
|
||||
(e.g. CR/LF) on the last line of a text file. This can be fixed by "adding"
|
||||
a blank line to the end of the file. Named expects to see EOF immediately
|
||||
after EOL and treats text files where this is not met as truncated.
|
||||
|
||||
Q: I get warning messages like "zone example.com/IN: refresh: failure trying
|
||||
master 1.2.3.4#53: timed out".
|
||||
@@ -328,15 +319,15 @@ A: Check that you can make UDP queries from the slave to the master
|
||||
|
||||
dig +norec example.com soa @1.2.3.4
|
||||
|
||||
You could be generating queries faster than the slave can cope with. Lower the
|
||||
serial query rate.
|
||||
You could be generating queries faster than the slave can cope with. Lower
|
||||
the serial query rate.
|
||||
|
||||
serial-query-rate 5; // default 20
|
||||
|
||||
Q: How do I share a dynamic zone between multiple views?
|
||||
|
||||
A: You choose one view to be master and the second a slave and transfer the zone
|
||||
between views.
|
||||
A: You choose one view to be master and the second a slave and transfer the
|
||||
zone between views.
|
||||
|
||||
Master 10.0.1.1:
|
||||
key "external" {
|
||||
@@ -379,14 +370,14 @@ Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master
|
||||
file primaries/wireless.ietf56.ietf.org: no owner".
|
||||
|
||||
A: This error is produced when a line in the master file contains leading white
|
||||
space (tab/space) but the is no current record owner name to inherit the name
|
||||
from. Usually this is the result of putting white space before a comment.
|
||||
Forgeting the "@" for the SOA record or indenting the master file.
|
||||
space (tab/space) but the is no current record owner name to inherit the
|
||||
name from. Usually this is the result of putting white space before a
|
||||
comment. Forgeting the "@" for the SOA record or indenting the master file.
|
||||
|
||||
Q: Why are my logs in GMT (UTC).
|
||||
|
||||
A: You are running chrooted (-t) and have not supplied local timzone information
|
||||
in the chroot area.
|
||||
A: You are running chrooted (-t) and have not supplied local timzone
|
||||
information in the chroot area.
|
||||
|
||||
FreeBSD: /etc/localtime
|
||||
Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
|
||||
@@ -404,23 +395,23 @@ Q: I get "rndc: connect failed: connection refused" when I try to run rndc.
|
||||
|
||||
A: This is usually a configuration error.
|
||||
|
||||
First ensure that named is running and no errors are being reported at startup
|
||||
(/var/log/messages or equivalent). Running "named -g <usual arguments>" from a
|
||||
title can help at this point.
|
||||
First ensure that named is running and no errors are being reported at
|
||||
startup (/var/log/messages or equivalent). Running "named -g <usual
|
||||
arguments>" from a title can help at this point.
|
||||
|
||||
Secondly ensure that named is configured to use rndc either by "rndc-confgen
|
||||
-a", rndc-confgen or manually. The Administrators Reference manual has details
|
||||
on how to do this.
|
||||
-a", rndc-confgen or manually. The Administrators Reference manual has
|
||||
details on how to do this.
|
||||
|
||||
Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/
|
||||
rndc.conf for the default server. Update /etc/rndc.conf if necessary so that
|
||||
the default server listed in /etc/rndc.conf matches the addresses used in
|
||||
named.conf. "localhost" has two address (127.0.0.1 and ::1).
|
||||
|
||||
If you use "rndc-confgen -a" and named is running with -t or -u ensure that /
|
||||
etc/rndc.conf has the correct ownership and that a copy is in the chroot area.
|
||||
You can do this by re-running "rndc-confgen -a" with appropriate -t and -u
|
||||
arguments.
|
||||
If you use "rndc-confgen -a" and named is running with -t or -u ensure that
|
||||
/etc/rndc.conf has the correct ownership and that a copy is in the chroot
|
||||
area. You can do this by re-running "rndc-confgen -a" with appropriate -t
|
||||
and -u arguments.
|
||||
|
||||
Q: I don't get RRSIG's returned when I use "dig +dnssec".
|
||||
|
||||
@@ -428,11 +419,12 @@ A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
|
||||
|
||||
Q: I get "Error 1067" when starting named under Windows.
|
||||
|
||||
A: This is the service manager saying that named exited. You need to examine the
|
||||
Application log in the EventViewer to find out why.
|
||||
A: This is the service manager saying that named exited. You need to examine
|
||||
the Application log in the EventViewer to find out why.
|
||||
|
||||
Common causes are that you failed to create "named.conf" (usually "C:\windows\
|
||||
dns\etc\named.conf") or failed to specify the directory in named.conf.
|
||||
Common causes are that you failed to create "named.conf" (usually "C:\
|
||||
windows\dns\etc\named.conf") or failed to specify the directory in
|
||||
named.conf.
|
||||
|
||||
options {
|
||||
Directory "C:\windows\dns\etc";
|
||||
@@ -447,11 +439,11 @@ A: These indicate a filesystem permission error preventing named creating /
|
||||
|
||||
"dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
|
||||
|
||||
Named needs write permission on the directory containing the file. Named writes
|
||||
the new cache file to a temporary file then renames it to the name specified in
|
||||
named.conf to ensure that the contents are always complete. This is to prevent
|
||||
named loading a partial zone in the event of power failure or similar
|
||||
interrupting the write of the master file.
|
||||
Named needs write permission on the directory containing the file. Named
|
||||
writes the new cache file to a temporary file then renames it to the name
|
||||
specified in named.conf to ensure that the contents are always complete.
|
||||
This is to prevent named loading a partial zone in the event of power
|
||||
failure or similar interrupting the write of the master file.
|
||||
|
||||
Note file names are relative to the directory specified in options and any
|
||||
chroot directory ([<chroot dir>/][<options dir>]).
|
||||
@@ -497,8 +489,8 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
|
||||
|
||||
If you are not using these private addresses then a client has queried for
|
||||
them. You can just ignore the messages, get the offending client to stop
|
||||
sending you these messages as they are most probably leaking them or setup your
|
||||
own zones empty zones to serve answers to these queries.
|
||||
sending you these messages as they are most probably leaking them or setup
|
||||
your own zones empty zones to serve answers to these queries.
|
||||
|
||||
zone "10.IN-ADDR.ARPA" {
|
||||
type master;
|
||||
@@ -531,102 +523,3 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
|
||||
|
||||
Future versions of named are likely to do this automatically.
|
||||
|
||||
Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
|
||||
|
||||
Why can't named update slave zone database files?
|
||||
|
||||
Why can't named create DDNS journal files or update the master zones from
|
||||
journals?
|
||||
|
||||
Why can't named create custom log files?
|
||||
|
||||
A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
|
||||
|
||||
Red Hat have adopted the National Security Agency's SELinux security policy (
|
||||
see http://www.nsa.gov/selinux ) and recommendations for BIND security , which
|
||||
are more secure than running named in a chroot and make use of the bind-chroot
|
||||
environment unecessary .
|
||||
|
||||
By default, named is not allowed by the SELinux policy to write, create or
|
||||
delete any files EXCEPT in these directories:
|
||||
|
||||
$ROOTDIR/var/named/slaves
|
||||
$ROOTDIR/var/named/data
|
||||
$ROOTDIR/var/tmp
|
||||
|
||||
|
||||
where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed.
|
||||
|
||||
The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var
|
||||
/named directory, the default location for master zone database files.
|
||||
|
||||
SELinux policy overrules file access permissions - so even if all the files
|
||||
under /var/named have ownership named:named and mode rw-rw-r--, named will
|
||||
still not be able to write or create files except in the directories above,
|
||||
with SELinux in Enforcing mode.
|
||||
|
||||
So, to allow named to update slave or DDNS zone files, it is best to locate
|
||||
them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as:
|
||||
|
||||
zone "slave.zone." IN {
|
||||
type slave;
|
||||
file "slaves/slave.zone.db";
|
||||
...
|
||||
};
|
||||
zone "ddns.zone." IN {
|
||||
type master;
|
||||
allow-updates {...};
|
||||
file "slaves/ddns.zone.db";
|
||||
};
|
||||
|
||||
|
||||
To allow named to create its cache dump and statistics files, for example, you
|
||||
could use named.conf options statements such as:
|
||||
|
||||
options {
|
||||
...
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
...
|
||||
};
|
||||
|
||||
|
||||
You can also tell SELinux to allow named to update any zone database files, by
|
||||
setting the SELinux tunable boolean parameter 'named_write_master_zones=1',
|
||||
using the system-config-securitylevel GUI, using the 'setsebool' command, or in
|
||||
/etc/selinux/targeted/booleans.
|
||||
|
||||
You can disable SELinux protection for named entirely by setting the
|
||||
'named_disable_trans=1' SELinux tunable boolean parameter.
|
||||
|
||||
The SELinux named policy defines these SELinux contexts for named:
|
||||
|
||||
named_zone_t : for zone database files - $ROOTDIR/var/named/*
|
||||
named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
|
||||
named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
|
||||
|
||||
|
||||
If you want to retain use of the SELinux policy for named, and put named files
|
||||
in different locations, you can do so by changing the context of the custom
|
||||
file locations .
|
||||
|
||||
To create a custom configuration file location, eg. '/root/named.conf', to use
|
||||
with the 'named -c' option, do:
|
||||
|
||||
# chcon system_u:object_r:named_conf_t /root/named.conf
|
||||
|
||||
|
||||
To create a custom modifiable named data location, eg. '/var/log/named' for a
|
||||
log file, do:
|
||||
|
||||
# chcon system_u:object_r:named_cache_t /var/log/named
|
||||
|
||||
|
||||
To create a custom zone file location, eg. /root/zones/, do:
|
||||
|
||||
# chcon system_u:object_r:named_zone_t /root/zones/{.,*}
|
||||
|
||||
|
||||
See these man-pages for more information : selinux(8), named_selinux(8), chcon
|
||||
(1), setsebool(8)
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -17,7 +17,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: FAQ.xml,v 1.4.4.5 2006/02/27 21:10:29 marka Exp $ -->
|
||||
<!-- $Id: FAQ.xml,v 1.4.4.3 2005/11/02 22:53:33 marka Exp $ -->
|
||||
|
||||
<article class="faq">
|
||||
<title>Frequently Asked Questions about BIND 9</title>
|
||||
@@ -64,26 +64,6 @@
|
||||
</answer>
|
||||
</qandaentry>
|
||||
|
||||
<qandaentry>
|
||||
<question>
|
||||
<para>
|
||||
Why do I get the following errors:
|
||||
<programlisting>general: errno2result.c:109: unexpected error:
|
||||
general: unable to convert errno to isc_result: 14: Bad address
|
||||
client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting>
|
||||
</para>
|
||||
</question>
|
||||
<answer>
|
||||
<para>
|
||||
This is the result of a Linux kernel bug.
|
||||
</para>
|
||||
<para>
|
||||
See:
|
||||
<ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2">http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2</ulink>
|
||||
</para>
|
||||
</answer>
|
||||
</qandaentry>
|
||||
|
||||
<qandaentry>
|
||||
<question>
|
||||
<para>
|
||||
@@ -125,10 +105,6 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlis
|
||||
is not cumulative; if each process is using 10M of memory,
|
||||
only a total of 10M is used.
|
||||
</para>
|
||||
<para>
|
||||
Newer versions of Linux's ps command hide the individual threads
|
||||
and require -L to display them.
|
||||
</para>
|
||||
</answer>
|
||||
</qandaentry>
|
||||
|
||||
@@ -540,7 +516,7 @@ Master 10.0.1.1:
|
||||
};
|
||||
view "external" {
|
||||
match-clients { key external; any; };
|
||||
server 10.0.1.2 { keys external; };
|
||||
server 10.0.0.2 { keys external; };
|
||||
recursion no;
|
||||
...
|
||||
};
|
||||
@@ -556,7 +532,7 @@ Slave 10.0.1.2:
|
||||
};
|
||||
view "external" {
|
||||
match-clients { key external; any; };
|
||||
server 10.0.1.1 { keys external; };
|
||||
server 10.0.0.1 { keys external; };
|
||||
recursion no;
|
||||
...
|
||||
};</programlisting>
|
||||
@@ -1021,177 +997,11 @@ empty:
|
||||
1 3600 1200 604800 10800 )
|
||||
@ 10800 IN NS <name-of-server>.</programlisting>
|
||||
</informalexample>
|
||||
<para>
|
||||
<note>
|
||||
Future versions of named are likely to do this automatically.
|
||||
</note>
|
||||
</para>
|
||||
</answer>
|
||||
</qandaentry>
|
||||
|
||||
<qandaentry>
|
||||
<question>
|
||||
<para>
|
||||
I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
|
||||
</para>
|
||||
<para>
|
||||
Why can't named update slave zone database files?
|
||||
</para>
|
||||
<para>
|
||||
Why can't named create DDNS journal files or update
|
||||
the master zones from journals?
|
||||
</para>
|
||||
<para>
|
||||
Why can't named create custom log files?
|
||||
</para>
|
||||
</question>
|
||||
|
||||
<answer>
|
||||
<para>
|
||||
Red Hat Security Enhanced Linux (SELinux) policy security
|
||||
protections :
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Red Hat have adopted the National Security Agency's
|
||||
SELinux security policy ( see http://www.nsa.gov/selinux
|
||||
) and recommendations for BIND security , which are more
|
||||
secure than running named in a chroot and make use of
|
||||
the bind-chroot environment unecessary .
|
||||
</para>
|
||||
|
||||
<para>
|
||||
By default, named is not allowed by the SELinux policy
|
||||
to write, create or delete any files EXCEPT in these
|
||||
directories:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
$ROOTDIR/var/named/slaves
|
||||
$ROOTDIR/var/named/data
|
||||
$ROOTDIR/var/tmp
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
where $ROOTDIR may be set in /etc/sysconfig/named if
|
||||
bind-chroot is installed.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The SELinux policy particularly does NOT allow named to modify
|
||||
the $ROOTDIR/var/named directory, the default location for master
|
||||
zone database files.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
SELinux policy overrules file access permissions - so
|
||||
even if all the files under /var/named have ownership
|
||||
named:named and mode rw-rw-r--, named will still not be
|
||||
able to write or create files except in the directories
|
||||
above, with SELinux in Enforcing mode.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
So, to allow named to update slave or DDNS zone files,
|
||||
it is best to locate them in $ROOTDIR/var/named/slaves,
|
||||
with named.conf zone statements such as:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
zone "slave.zone." IN {
|
||||
type slave;
|
||||
file "slaves/slave.zone.db";
|
||||
...
|
||||
};
|
||||
zone "ddns.zone." IN {
|
||||
type master;
|
||||
allow-updates {...};
|
||||
file "slaves/ddns.zone.db";
|
||||
};
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
To allow named to create its cache dump and statistics
|
||||
files, for example, you could use named.conf options
|
||||
statements such as:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
options {
|
||||
...
|
||||
dump-file "/var/named/data/cache_dump.db";
|
||||
statistics-file "/var/named/data/named_stats.txt";
|
||||
...
|
||||
};
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You can also tell SELinux to allow named to update any
|
||||
zone database files, by setting the SELinux tunable boolean
|
||||
parameter 'named_write_master_zones=1', using the
|
||||
system-config-securitylevel GUI, using the 'setsebool'
|
||||
command, or in /etc/selinux/targeted/booleans.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You can disable SELinux protection for named entirely by
|
||||
setting the 'named_disable_trans=1' SELinux tunable boolean
|
||||
parameter.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
The SELinux named policy defines these SELinux contexts for named:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
named_zone_t : for zone database files - $ROOTDIR/var/named/*
|
||||
named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
|
||||
named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
If you want to retain use of the SELinux policy for named,
|
||||
and put named files in different locations, you can do
|
||||
so by changing the context of the custom file locations
|
||||
.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
To create a custom configuration file location, eg.
|
||||
'/root/named.conf', to use with the 'named -c' option,
|
||||
do:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
# chcon system_u:object_r:named_conf_t /root/named.conf
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
To create a custom modifiable named data location, eg.
|
||||
'/var/log/named' for a log file, do:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
# chcon system_u:object_r:named_cache_t /var/log/named
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
To create a custom zone file location, eg. /root/zones/, do:
|
||||
<informalexample>
|
||||
<programlisting>
|
||||
# chcon system_u:object_r:named_zone_t /root/zones/{.,*}
|
||||
</programlisting>
|
||||
</informalexample>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
See these man-pages for more information : selinux(8),
|
||||
named_selinux(8), chcon(1), setsebool(8)
|
||||
</para>
|
||||
</answer>
|
||||
</qandaentry>
|
||||
</qandaset>
|
||||
</article>
|
||||
|
||||
@@ -401,23 +401,10 @@ Building
|
||||
Enable DNSSEC signature chasing support in dig.
|
||||
-DDIG_SIGCHASE=1 (sets -DDIG_SIGCHASE_TD=1 and
|
||||
-DDIG_SIGCHASE_BU=1)
|
||||
Disable dropping queries from particular well known ports.
|
||||
-DNS_CLIENT_DROPPORT=0
|
||||
|
||||
LDFLAGS
|
||||
Linker flags. Defaults to empty string.
|
||||
|
||||
The following need to be set when cross compiling.
|
||||
|
||||
BUILD_CC
|
||||
The native C compiler.
|
||||
BUILD_CFLAGS (optional)
|
||||
BUILD_CPPFLAGS (optional)
|
||||
Possible Settings:
|
||||
-DNEED_OPTARG=1 (optarg is not declared in <unistd.h>)
|
||||
BUILD_LDFLAGS (optional)
|
||||
BUILD_LIBS (optional)
|
||||
|
||||
To build shared libraries, specify "--with-libtool" on the
|
||||
configure command line.
|
||||
|
||||
|
||||
+25
-56
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: check-tool.c,v 1.10.18.13 2006/01/07 00:23:34 marka Exp $ */
|
||||
/* $Id: check-tool.c,v 1.10.18.10 2005/09/30 08:22:58 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -71,9 +71,7 @@ unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
|
||||
DNS_ZONEOPT_MANYERRORS |
|
||||
DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKINTEGRITY |
|
||||
DNS_ZONEOPT_CHECKWILDCARD |
|
||||
DNS_ZONEOPT_WARNMXCNAME |
|
||||
DNS_ZONEOPT_WARNSRVCNAME;
|
||||
DNS_ZONEOPT_CHECKWILDCARD;
|
||||
|
||||
/*
|
||||
* This needs to match the list in bin/named/log.c.
|
||||
@@ -130,11 +128,10 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
|
||||
case 0:
|
||||
if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
|
||||
dns_zone_log(zone, ISC_LOG_ERROR,
|
||||
"%s/NS '%s' (out of zone) "
|
||||
"%s/NS '%s' (out of zone) "
|
||||
"is a CNAME (illegal)",
|
||||
ownerbuf, namebuf);
|
||||
/* XXX950 make fatal for 9.5.0 */
|
||||
/* answer = ISC_FALSE; */
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
break;
|
||||
case EAI_NONAME:
|
||||
@@ -144,8 +141,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
|
||||
dns_zone_log(zone, ISC_LOG_ERROR, "%s/NS '%s' (out of zone) "
|
||||
"has no addresses records (A or AAAA)",
|
||||
ownerbuf, namebuf);
|
||||
/* XXX950 make fatal for 9.5.0 */
|
||||
return (ISC_TRUE);
|
||||
return (ISC_FALSE);
|
||||
|
||||
default:
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
@@ -179,8 +175,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
|
||||
ownerbuf, namebuf,
|
||||
inet_ntop(AF_INET, rdata.data,
|
||||
addrbuf, sizeof(addrbuf)));
|
||||
/* XXX950 make fatal for 9.5.0 */
|
||||
/* answer = ISC_FALSE; */
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
dns_rdata_reset(&rdata);
|
||||
result = dns_rdataset_next(a);
|
||||
@@ -208,8 +203,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
|
||||
ownerbuf, namebuf,
|
||||
inet_ntop(AF_INET6, rdata.data,
|
||||
addrbuf, sizeof(addrbuf)));
|
||||
/* XXX950 make fatal for 9.5.0. */
|
||||
/* answer = ISC_FALSE; */
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
dns_rdata_reset(&rdata);
|
||||
result = dns_rdataset_next(aaaa);
|
||||
@@ -252,8 +246,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
|
||||
ownerbuf, namebuf, type,
|
||||
inet_ntop(cur->ai_family, ptr,
|
||||
addrbuf, sizeof(addrbuf)));
|
||||
/* XXX950 make fatal for 9.5.0. */
|
||||
/* answer = ISC_FALSE; */
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
}
|
||||
freeaddrinfo(ai);
|
||||
@@ -270,8 +263,6 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
char namebuf[DNS_NAME_FORMATSIZE + 1];
|
||||
char ownerbuf[DNS_NAME_FORMATSIZE];
|
||||
int result;
|
||||
int level = ISC_LOG_ERROR;
|
||||
isc_boolean_t answer = ISC_TRUE;
|
||||
|
||||
memset(&hints, 0, sizeof(hints));
|
||||
hints.ai_flags = AI_CANONNAME;
|
||||
@@ -291,21 +282,13 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
dns_name_format(name, namebuf, sizeof(namebuf) - 1);
|
||||
switch (result) {
|
||||
case 0:
|
||||
if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
|
||||
if ((zone_options & DNS_ZONEOPT_WARNMXCNAME) != 0)
|
||||
level = ISC_LOG_WARNING;
|
||||
if ((zone_options & DNS_ZONEOPT_IGNOREMXCNAME) == 0) {
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
"%s/MX '%s' (out of zone) "
|
||||
"is a CNAME (illegal)",
|
||||
ownerbuf, namebuf);
|
||||
if (level == ISC_LOG_ERROR)
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
}
|
||||
if (strcasecmp(ai->ai_canonname, namebuf) != 0)
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
"%s/MX '%s' (out of zone) "
|
||||
"is a CNAME (illegal)",
|
||||
ownerbuf, namebuf);
|
||||
freeaddrinfo(ai);
|
||||
return (answer);
|
||||
|
||||
break;
|
||||
case EAI_NONAME:
|
||||
#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
|
||||
case EAI_NODATA:
|
||||
@@ -313,8 +296,7 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
dns_zone_log(zone, ISC_LOG_ERROR, "%s/MX '%s' (out of zone) "
|
||||
"has no addresses records (A or AAAA)",
|
||||
ownerbuf, namebuf);
|
||||
/* XXX950 make fatal for 9.5.0. */
|
||||
return (ISC_TRUE);
|
||||
return (ISC_FALSE);
|
||||
|
||||
default:
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
@@ -322,9 +304,8 @@ checkmx(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
namebuf, gai_strerror(result));
|
||||
return (ISC_TRUE);
|
||||
}
|
||||
#else
|
||||
return (ISC_TRUE);
|
||||
#endif
|
||||
return (ISC_TRUE);
|
||||
}
|
||||
|
||||
static isc_boolean_t
|
||||
@@ -334,8 +315,6 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
char namebuf[DNS_NAME_FORMATSIZE + 1];
|
||||
char ownerbuf[DNS_NAME_FORMATSIZE];
|
||||
int result;
|
||||
int level = ISC_LOG_ERROR;
|
||||
isc_boolean_t answer = ISC_TRUE;
|
||||
|
||||
memset(&hints, 0, sizeof(hints));
|
||||
hints.ai_flags = AI_CANONNAME;
|
||||
@@ -355,21 +334,13 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
dns_name_format(name, namebuf, sizeof(namebuf) - 1);
|
||||
switch (result) {
|
||||
case 0:
|
||||
if (strcasecmp(ai->ai_canonname, namebuf) != 0) {
|
||||
if ((zone_options & DNS_ZONEOPT_WARNSRVCNAME) != 0)
|
||||
level = ISC_LOG_WARNING;
|
||||
if ((zone_options & DNS_ZONEOPT_IGNORESRVCNAME) == 0) {
|
||||
dns_zone_log(zone, level,
|
||||
"%s/SRV '%s' (out of zone) "
|
||||
"is a CNAME (illegal)",
|
||||
ownerbuf, namebuf);
|
||||
if (level == ISC_LOG_ERROR)
|
||||
answer = ISC_FALSE;
|
||||
}
|
||||
}
|
||||
if (strcasecmp(ai->ai_canonname, namebuf) != 0)
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
"%s/SRV '%s' (out of zone) "
|
||||
"is a CNAME (illegal)",
|
||||
ownerbuf, namebuf);
|
||||
freeaddrinfo(ai);
|
||||
return (answer);
|
||||
|
||||
break;
|
||||
case EAI_NONAME:
|
||||
#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
|
||||
case EAI_NODATA:
|
||||
@@ -377,8 +348,7 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
dns_zone_log(zone, ISC_LOG_ERROR, "%s/SRV '%s' (out of zone) "
|
||||
"has no addresses records (A or AAAA)",
|
||||
ownerbuf, namebuf);
|
||||
/* XXX950 make fatal for 9.5.0. */
|
||||
return (ISC_TRUE);
|
||||
return (ISC_FALSE);
|
||||
|
||||
default:
|
||||
dns_zone_log(zone, ISC_LOG_WARNING,
|
||||
@@ -386,9 +356,8 @@ checksrv(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner) {
|
||||
namebuf, gai_strerror(result));
|
||||
return (ISC_TRUE);
|
||||
}
|
||||
#else
|
||||
return (ISC_TRUE);
|
||||
#endif
|
||||
return (ISC_TRUE);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
|
||||
+31
-68
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named-checkconf.c,v 1.28.18.14 2006/02/28 03:10:47 marka Exp $ */
|
||||
/* $Id: named-checkconf.c,v 1.28.18.11 2005/09/18 07:58:03 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -66,7 +66,7 @@ usage(void) {
|
||||
|
||||
/*% directory callback */
|
||||
static isc_result_t
|
||||
directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
|
||||
directory_callback(const char *clausename, cfg_obj_t *obj, void *arg) {
|
||||
isc_result_t result;
|
||||
const char *directory;
|
||||
|
||||
@@ -91,7 +91,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
|
||||
}
|
||||
|
||||
static isc_boolean_t
|
||||
get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
get_maps(cfg_obj_t **maps, const char *name, cfg_obj_t **obj) {
|
||||
int i;
|
||||
for (i = 0;; i++) {
|
||||
if (maps[i] == NULL)
|
||||
@@ -102,11 +102,11 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
}
|
||||
|
||||
static isc_boolean_t
|
||||
get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *checknames;
|
||||
const cfg_obj_t *type;
|
||||
const cfg_obj_t *value;
|
||||
get_checknames(cfg_obj_t **maps, cfg_obj_t **obj) {
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *checknames;
|
||||
cfg_obj_t *type;
|
||||
cfg_obj_t *value;
|
||||
isc_result_t result;
|
||||
int i;
|
||||
|
||||
@@ -135,7 +135,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
config_get(cfg_obj_t **maps, const char *name, cfg_obj_t **obj) {
|
||||
int i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
@@ -148,23 +148,22 @@ config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
|
||||
/*% configure the zone */
|
||||
static isc_result_t
|
||||
configure_zone(const char *vclass, const char *view,
|
||||
const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, isc_mem_t *mctx)
|
||||
configure_zone(const char *vclass, const char *view, cfg_obj_t *zconfig,
|
||||
cfg_obj_t *vconfig, cfg_obj_t *config, isc_mem_t *mctx)
|
||||
{
|
||||
int i = 0;
|
||||
isc_result_t result;
|
||||
const char *zclass;
|
||||
const char *zname;
|
||||
const char *zfile;
|
||||
const cfg_obj_t *maps[4];
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *classobj = NULL;
|
||||
const cfg_obj_t *typeobj = NULL;
|
||||
const cfg_obj_t *fileobj = NULL;
|
||||
const cfg_obj_t *dbobj = NULL;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
const cfg_obj_t *fmtobj = NULL;
|
||||
cfg_obj_t *maps[4];
|
||||
cfg_obj_t *zoptions = NULL;
|
||||
cfg_obj_t *classobj = NULL;
|
||||
cfg_obj_t *typeobj = NULL;
|
||||
cfg_obj_t *fileobj = NULL;
|
||||
cfg_obj_t *dbobj = NULL;
|
||||
cfg_obj_t *obj = NULL;
|
||||
cfg_obj_t *fmtobj = NULL;
|
||||
dns_masterformat_t masterformat;
|
||||
|
||||
zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_MANYERRORS;
|
||||
@@ -226,42 +225,6 @@ configure_zone(const char *vclass, const char *view,
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
if (get_maps(maps, "check-mx-cname", &obj)) {
|
||||
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
|
||||
zone_options |= DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
|
||||
zone_options &= ~DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
|
||||
zone_options |= DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else
|
||||
INSIST(0);
|
||||
} else {
|
||||
zone_options |= DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
if (get_maps(maps, "check-srv-cname", &obj)) {
|
||||
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
|
||||
zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
|
||||
zone_options &= ~DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
|
||||
zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else
|
||||
INSIST(0);
|
||||
} else {
|
||||
zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
if (get_maps(maps, "check-sibling", &obj)) {
|
||||
if (cfg_obj_asboolean(obj))
|
||||
@@ -310,12 +273,12 @@ configure_zone(const char *vclass, const char *view,
|
||||
|
||||
/*% configure a view */
|
||||
static isc_result_t
|
||||
configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
|
||||
const cfg_obj_t *vconfig, isc_mem_t *mctx)
|
||||
configure_view(const char *vclass, const char *view, cfg_obj_t *config,
|
||||
cfg_obj_t *vconfig, isc_mem_t *mctx)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *voptions;
|
||||
const cfg_obj_t *zonelist;
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *voptions;
|
||||
cfg_obj_t *zonelist;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
isc_result_t tresult;
|
||||
|
||||
@@ -333,7 +296,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *zconfig = cfg_listelt_value(element);
|
||||
cfg_obj_t *zconfig = cfg_listelt_value(element);
|
||||
tresult = configure_zone(vclass, view, zconfig, vconfig,
|
||||
config, mctx);
|
||||
if (tresult != ISC_R_SUCCESS)
|
||||
@@ -345,11 +308,11 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
|
||||
|
||||
/*% load zones from the configuration */
|
||||
static isc_result_t
|
||||
load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) {
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *classobj;
|
||||
const cfg_obj_t *views;
|
||||
const cfg_obj_t *vconfig;
|
||||
load_zones_fromconfig(cfg_obj_t *config, isc_mem_t *mctx) {
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *classobj;
|
||||
cfg_obj_t *views;
|
||||
cfg_obj_t *vconfig;
|
||||
const char *vclass;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
isc_result_t tresult;
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -13,7 +13,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: named-checkzone.8,v 1.18.18.15 2006/01/07 03:40:23 marka Exp $
|
||||
.\" $Id: named-checkzone.8,v 1.18.18.13 2005/10/13 02:52:58 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -30,9 +30,9 @@
|
||||
named\-checkzone, named\-compilezone \- zone file validity checking or converting tool
|
||||
.SH "SYNOPSIS"
|
||||
.HP 16
|
||||
\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
|
||||
\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
|
||||
.HP 18
|
||||
\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
|
||||
\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBnamed\-checkzone\fR
|
||||
@@ -141,13 +141,6 @@ Specify whether MX records should be checked to see if they are addresses. Possi
|
||||
(default) and
|
||||
\fB"ignore"\fR.
|
||||
.TP
|
||||
\-M \fImode\fR
|
||||
Check if a MX record refers to a CNAME. Possible modes are
|
||||
\fB"fail"\fR,
|
||||
\fB"warn"\fR
|
||||
(default) and
|
||||
\fB"ignore"\fR.
|
||||
.TP
|
||||
\-n \fImode\fR
|
||||
Specify whether NS records should be checked to see if they are addresses. Possible modes are
|
||||
\fB"fail"\fR
|
||||
@@ -171,13 +164,6 @@ Specify the style of the dumped zone file. Possible styles are
|
||||
\fBnamed\-checkzone\fR
|
||||
this does not cause any effects unless it dumps the zone contents. It also does not have any meaning if the output format is not text.
|
||||
.TP
|
||||
\-S \fImode\fR
|
||||
Check if a SRV record refers to a CNAME. Possible modes are
|
||||
\fB"fail"\fR,
|
||||
\fB"warn"\fR
|
||||
(default) and
|
||||
\fB"ignore"\fR.
|
||||
.TP
|
||||
\-t \fIdirectory\fR
|
||||
chroot to
|
||||
\fIdirectory\fR
|
||||
|
||||
+31
-59
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named-checkzone.c,v 1.29.18.14 2006/01/07 00:23:34 marka Exp $ */
|
||||
/* $Id: named-checkzone.c,v 1.29.18.12 2005/09/18 07:58:03 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -77,8 +77,7 @@ usage(void) {
|
||||
"[-f inputformat] [-F outputformat] "
|
||||
"[-t directory] [-w directory] [-k (ignore|warn|fail)] "
|
||||
"[-n (ignore|warn|fail)] [-m (ignore|warn|fail)] "
|
||||
"[-i (full|local|none)] [-M (ignore|warn|fail)] "
|
||||
"[-S (ignore|warn|fail)] [-W (ignore|warn)] "
|
||||
"[-i (full|local|none)] [-W (ignore|warn)] "
|
||||
"zonename filename\n", prog_name);
|
||||
exit(1);
|
||||
}
|
||||
@@ -135,10 +134,8 @@ main(int argc, char **argv) {
|
||||
DNS_ZONEOPT_CHECKWILDCARD);
|
||||
}
|
||||
|
||||
#define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
|
||||
|
||||
while ((c = isc_commandline_parse(argc, argv,
|
||||
"c:df:i:jk:m:n:qst:o:vw:DF:M:S:W:"))
|
||||
"c:df:i:jk:m:n:qst:o:vw:DF:W:"))
|
||||
!= EOF) {
|
||||
switch (c) {
|
||||
case 'c':
|
||||
@@ -150,31 +147,35 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
|
||||
case 'i':
|
||||
if (ARGCMP("full")) {
|
||||
if (!strcmp(isc_commandline_argument, "full")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKINTEGRITY |
|
||||
DNS_ZONEOPT_CHECKSIBLING;
|
||||
docheckmx = ISC_TRUE;
|
||||
docheckns = ISC_TRUE;
|
||||
dochecksrv = ISC_TRUE;
|
||||
} else if (ARGCMP("full-sibling")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"full-sibling")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
|
||||
docheckmx = ISC_TRUE;
|
||||
docheckns = ISC_TRUE;
|
||||
dochecksrv = ISC_TRUE;
|
||||
} else if (ARGCMP("local")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"local")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
|
||||
zone_options |= DNS_ZONEOPT_CHECKSIBLING;
|
||||
docheckmx = ISC_FALSE;
|
||||
docheckns = ISC_FALSE;
|
||||
dochecksrv = ISC_FALSE;
|
||||
} else if (ARGCMP("local-sibling")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"local-sibling")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
|
||||
docheckmx = ISC_FALSE;
|
||||
docheckns = ISC_FALSE;
|
||||
dochecksrv = ISC_FALSE;
|
||||
} else if (ARGCMP("none")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"none")) {
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
|
||||
docheckmx = ISC_FALSE;
|
||||
@@ -200,13 +201,15 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
|
||||
case 'k':
|
||||
if (ARGCMP("warn")) {
|
||||
if (!strcmp(isc_commandline_argument, "warn")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKNAMES;
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
|
||||
} else if (ARGCMP("fail")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"fail")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKNAMESFAIL;
|
||||
} else if (ARGCMP("ignore")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"ignore")) {
|
||||
zone_options &= ~(DNS_ZONEOPT_CHECKNAMES |
|
||||
DNS_ZONEOPT_CHECKNAMESFAIL);
|
||||
} else {
|
||||
@@ -217,13 +220,13 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
|
||||
case 'n':
|
||||
if (ARGCMP("ignore")) {
|
||||
if (!strcmp(isc_commandline_argument, "ignore")) {
|
||||
zone_options &= ~(DNS_ZONEOPT_CHECKNS|
|
||||
DNS_ZONEOPT_FATALNS);
|
||||
} else if (ARGCMP("warn")) {
|
||||
} else if (!strcmp(isc_commandline_argument, "warn")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKNS;
|
||||
zone_options &= ~DNS_ZONEOPT_FATALNS;
|
||||
} else if (ARGCMP("fail")) {
|
||||
} else if (!strcmp(isc_commandline_argument, "fail")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKNS|
|
||||
DNS_ZONEOPT_FATALNS;
|
||||
} else {
|
||||
@@ -234,13 +237,15 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
|
||||
case 'm':
|
||||
if (ARGCMP("warn")) {
|
||||
if (!strcmp(isc_commandline_argument, "warn")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKMX;
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
|
||||
} else if (ARGCMP("fail")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"fail")) {
|
||||
zone_options |= DNS_ZONEOPT_CHECKMX |
|
||||
DNS_ZONEOPT_CHECKMXFAIL;
|
||||
} else if (ARGCMP("ignore")) {
|
||||
} else if (!strcmp(isc_commandline_argument,
|
||||
"ignore")) {
|
||||
zone_options &= ~(DNS_ZONEOPT_CHECKMX |
|
||||
DNS_ZONEOPT_CHECKMXFAIL);
|
||||
} else {
|
||||
@@ -271,9 +276,10 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
|
||||
case 's':
|
||||
if (ARGCMP("full"))
|
||||
if (strcmp(isc_commandline_argument, "full") == 0)
|
||||
outputstyle = &dns_master_style_full;
|
||||
else if (ARGCMP("default")) {
|
||||
else if (strcmp(isc_commandline_argument,
|
||||
"default") == 0) {
|
||||
outputstyle = &dns_master_style_default;
|
||||
} else {
|
||||
fprintf(stderr,
|
||||
@@ -299,44 +305,10 @@ main(int argc, char **argv) {
|
||||
dumpzone++;
|
||||
break;
|
||||
|
||||
case 'M':
|
||||
if (ARGCMP("fail")) {
|
||||
zone_options &= ~DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else if (ARGCMP("warn")) {
|
||||
zone_options |= DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else if (ARGCMP("ignore")) {
|
||||
zone_options |= DNS_ZONEOPT_WARNMXCNAME;
|
||||
zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -M: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
case 'S':
|
||||
if (ARGCMP("fail")) {
|
||||
zone_options &= ~DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else if (ARGCMP("warn")) {
|
||||
zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else if (ARGCMP("ignore")) {
|
||||
zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
|
||||
zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
|
||||
} else {
|
||||
fprintf(stderr, "invalid argument to -S: %s\n",
|
||||
isc_commandline_argument);
|
||||
exit(1);
|
||||
}
|
||||
break;
|
||||
|
||||
case 'W':
|
||||
if (ARGCMP("warn"))
|
||||
if (!strcmp(isc_commandline_argument, "warn"))
|
||||
zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
|
||||
else if (ARGCMP("ignore"))
|
||||
else if (!strcmp(isc_commandline_argument, "ignore"))
|
||||
zone_options &= ~DNS_ZONEOPT_CHECKWILDCARD;
|
||||
break;
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -18,7 +18,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: named-checkzone.docbook,v 1.11.18.13 2006/01/07 00:23:34 marka Exp $ -->
|
||||
<!-- $Id: named-checkzone.docbook,v 1.11.18.11 2005/08/25 00:05:41 marka Exp $ -->
|
||||
<refentry id="man.named-checkzone">
|
||||
<refentryinfo>
|
||||
<date>June 13, 2000</date>
|
||||
@@ -34,7 +34,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
<copyright>
|
||||
@@ -64,11 +63,9 @@
|
||||
<arg><option>-i <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-k <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-m <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-M <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-n <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-o <replaceable class="parameter">filename</replaceable></option></arg>
|
||||
<arg><option>-s <replaceable class="parameter">style</replaceable></option></arg>
|
||||
<arg><option>-S <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg><option>-w <replaceable class="parameter">directory</replaceable></option></arg>
|
||||
<arg><option>-D</option></arg>
|
||||
@@ -83,7 +80,6 @@
|
||||
<arg><option>-q</option></arg>
|
||||
<arg><option>-v</option></arg>
|
||||
<arg><option>-c <replaceable class="parameter">class</replaceable></option></arg>
|
||||
<arg><option>-C <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
<arg><option>-f <replaceable class="parameter">format</replaceable></option></arg>
|
||||
<arg><option>-F <replaceable class="parameter">format</replaceable></option></arg>
|
||||
<arg><option>-i <replaceable class="parameter">mode</replaceable></option></arg>
|
||||
@@ -268,18 +264,6 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-M <replaceable class="parameter">mode</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Check if a MX record refers to a CNAME.
|
||||
Possible modes are <command>"fail"</command>,
|
||||
<command>"warn"</command> (default) and
|
||||
<command>"ignore"</command>.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-n <replaceable class="parameter">mode</replaceable></term>
|
||||
<listitem>
|
||||
@@ -325,18 +309,6 @@
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-S <replaceable class="parameter">mode</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Check if a SRV record refers to a CNAME.
|
||||
Possible modes are <command>"fail"</command>,
|
||||
<command>"warn"</command> (default) and
|
||||
<command>"ignore"</command>.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-t <replaceable class="parameter">directory</replaceable></term>
|
||||
<listitem>
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -14,7 +14,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: named-checkzone.html,v 1.11.18.20 2006/01/07 03:40:23 marka Exp $ -->
|
||||
<!-- $Id: named-checkzone.html,v 1.11.18.18 2005/10/13 02:52:58 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -29,11 +29,11 @@
|
||||
</div>
|
||||
<div class="refsynopsisdiv">
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">named-checkzone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">named-compilezone</code> [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526157"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2526129"></a><h2>DESCRIPTION</h2>
|
||||
<p><span><strong class="command">named-checkzone</strong></span>
|
||||
checks the syntax and integrity of a zone file. It performs the
|
||||
same checks as <span><strong class="command">named</strong></span> does when loading a
|
||||
@@ -53,7 +53,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526193"></a><h2>OPTIONS</h2>
|
||||
<a name="id2526164"></a><h2>OPTIONS</h2>
|
||||
<div class="variablelist"><dl>
|
||||
<dt><span class="term">-d</span></dt>
|
||||
<dd><p>
|
||||
@@ -149,13 +149,6 @@
|
||||
<span><strong class="command">"warn"</strong></span> (default) and
|
||||
<span><strong class="command">"ignore"</strong></span>.
|
||||
</p></dd>
|
||||
<dt><span class="term">-M <em class="replaceable"><code>mode</code></em></span></dt>
|
||||
<dd><p>
|
||||
Check if a MX record refers to a CNAME.
|
||||
Possible modes are <span><strong class="command">"fail"</strong></span>,
|
||||
<span><strong class="command">"warn"</strong></span> (default) and
|
||||
<span><strong class="command">"ignore"</strong></span>.
|
||||
</p></dd>
|
||||
<dt><span class="term">-n <em class="replaceable"><code>mode</code></em></span></dt>
|
||||
<dd><p>
|
||||
Specify whether NS records should be checked to see if they
|
||||
@@ -186,13 +179,6 @@
|
||||
It also does not have any meaning if the output format
|
||||
is not text.
|
||||
</p></dd>
|
||||
<dt><span class="term">-S <em class="replaceable"><code>mode</code></em></span></dt>
|
||||
<dd><p>
|
||||
Check if a SRV record refers to a CNAME.
|
||||
Possible modes are <span><strong class="command">"fail"</strong></span>,
|
||||
<span><strong class="command">"warn"</strong></span> (default) and
|
||||
<span><strong class="command">"ignore"</strong></span>.
|
||||
</p></dd>
|
||||
<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
|
||||
<dd><p>
|
||||
chroot to <code class="filename">directory</code> so that
|
||||
@@ -233,21 +219,21 @@
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526792"></a><h2>RETURN VALUES</h2>
|
||||
<a name="id2526710"></a><h2>RETURN VALUES</h2>
|
||||
<p><span><strong class="command">named-checkzone</strong></span>
|
||||
returns an exit status of 1 if
|
||||
errors were detected and 0 otherwise.
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526804"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2526722"></a><h2>SEE ALSO</h2>
|
||||
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
|
||||
<em class="citetitle">RFC 1035</em>,
|
||||
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526828"></a><h2>AUTHOR</h2>
|
||||
<a name="id2526746"></a><h2>AUTHOR</h2>
|
||||
<p><span class="corpauthor">Internet Systems Consortium</span>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
+3
-5
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -13,7 +13,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: dig.1,v 1.23.18.15 2006/01/28 02:15:40 marka Exp $
|
||||
.\" $Id: dig.1,v 1.23.18.13 2005/10/26 06:02:01 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -30,7 +30,7 @@
|
||||
dig \- DNS lookup utility
|
||||
.SH "SYNOPSIS"
|
||||
.HP 4
|
||||
\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
|
||||
\fBdig\fR [@server] [\fB\-b\ \fR\fB\fIaddress\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIfilename\fR\fR] [\fB\-k\ \fR\fB\fIfilename\fR\fR] [\fB\-p\ \fR\fB\fIport#\fR\fR] [\fB\-q\ \fR\fB\fIname\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-x\ \fR\fB\fIaddr\fR\fR] [\fB\-y\ \fR\fB\fIname:key\fR\fR] [\fB\-4\fR] [\fB\-6\fR] [name] [type] [class] [queryopt...]
|
||||
.HP 4
|
||||
\fBdig\fR [\fB\-h\fR]
|
||||
.HP 4
|
||||
@@ -180,8 +180,6 @@ and their responses using transaction signatures (TSIG), specify a TSIG key file
|
||||
option. You can also specify the TSIG key itself on the command line using the
|
||||
\fB\-y\fR
|
||||
option;
|
||||
\fIhmac\fR
|
||||
is the type of the TSIG, default HMAC\-MD5,
|
||||
\fIname\fR
|
||||
is the name of the TSIG key and
|
||||
\fIkey\fR
|
||||
|
||||
+10
-79
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: dig.c,v 1.186.18.24 2006/01/27 02:50:50 marka Exp $ */
|
||||
/* $Id: dig.c,v 1.186.18.21 2005/10/14 01:28:19 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -42,7 +42,6 @@
|
||||
#include <dns/rdatatype.h>
|
||||
#include <dns/rdataclass.h>
|
||||
#include <dns/result.h>
|
||||
#include <dns/tsig.h>
|
||||
|
||||
#include <bind9/getaddresses.h>
|
||||
|
||||
@@ -153,7 +152,7 @@ help(void) {
|
||||
" -t type (specify query type)\n"
|
||||
" -c class (specify query class)\n"
|
||||
" -k keyfile (specify tsig key file)\n"
|
||||
" -y [hmac:]name:key (specify named base64 tsig key)\n"
|
||||
" -y name:key (specify named base64 tsig key)\n"
|
||||
" -4 (use IPv4 query transport only)\n"
|
||||
" -6 (use IPv6 query transport only)\n"
|
||||
" d-opt is of the form +keyword[=value], where keyword is:\n"
|
||||
@@ -492,8 +491,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
|
||||
msg->counts[DNS_SECTION_AUTHORITY],
|
||||
msg->counts[DNS_SECTION_ADDITIONAL]);
|
||||
|
||||
if (msg != query->lookup->sendmsg &&
|
||||
(msg->flags & DNS_MESSAGEFLAG_RD) != 0 &&
|
||||
if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0 &&
|
||||
(msg->flags & DNS_MESSAGEFLAG_RA) == 0)
|
||||
printf(";; WARNING: recusion requested "
|
||||
"but not available\n");
|
||||
@@ -1106,7 +1104,7 @@ static isc_boolean_t
|
||||
dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
isc_boolean_t *open_type_class, isc_boolean_t config_only)
|
||||
{
|
||||
char opt, *value, *ptr, *ptr2, *ptr3;
|
||||
char opt, *value, *ptr;
|
||||
isc_result_t result;
|
||||
isc_boolean_t value_from_next;
|
||||
isc_textregion_t tr;
|
||||
@@ -1296,83 +1294,16 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
|
||||
value);
|
||||
return (value_from_next);
|
||||
case 'y':
|
||||
ptr = next_token(&value,":"); /* hmac type or name */
|
||||
ptr = next_token(&value,":");
|
||||
if (ptr == NULL) {
|
||||
usage();
|
||||
}
|
||||
ptr2 = next_token(&value, ":"); /* name or secret */
|
||||
if (ptr2 == NULL)
|
||||
usage();
|
||||
ptr3 = next_token(&value,":"); /* secret or NULL */
|
||||
if (ptr3 != NULL) {
|
||||
if (strcasecmp(ptr, "hmac-md5") == 0) {
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-md5-", 9) == 0) {
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = parse_uint(&ptr[9],
|
||||
"digest-bits [0..128]",
|
||||
128);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(ptr, "hmac-sha1") == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-sha1-", 10) == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
digestbits = parse_uint(&ptr[10],
|
||||
"digest-bits [0..160]",
|
||||
160);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(ptr, "hmac-sha224") == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-sha224-", 12) == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
digestbits = parse_uint(&ptr[12],
|
||||
"digest-bits [0..224]",
|
||||
224);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(ptr, "hmac-sha256") == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-sha256-", 12) == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
digestbits = parse_uint(&ptr[12],
|
||||
"digest-bits [0..256]",
|
||||
256);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(ptr, "hmac-sha384") == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-sha384-", 12) == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
digestbits = parse_uint(&ptr[12],
|
||||
"digest-bits [0..384]",
|
||||
384);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else if (strcasecmp(ptr, "hmac-sha512") == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
digestbits = 0;
|
||||
} else if (strncasecmp(ptr, "hmac-sha512-", 12) == 0) {
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
digestbits = parse_uint(&ptr[12],
|
||||
"digest-bits [0..512]",
|
||||
512);
|
||||
digestbits = (digestbits + 7) & ~0x7U;
|
||||
} else {
|
||||
fprintf(stderr, ";; Warning, ignoring "
|
||||
"invalid TSIG algorithm %s\n", ptr);
|
||||
return (value_from_next);
|
||||
}
|
||||
ptr = ptr2;
|
||||
ptr2 = ptr3;
|
||||
} else {
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
digestbits = 0;
|
||||
}
|
||||
strncpy(keynametext, ptr, sizeof(keynametext));
|
||||
keynametext[sizeof(keynametext)-1]=0;
|
||||
strncpy(keysecret, ptr2, sizeof(keysecret));
|
||||
ptr = next_token(&value, "");
|
||||
if (ptr == NULL)
|
||||
usage();
|
||||
strncpy(keysecret, ptr, sizeof(keysecret));
|
||||
keysecret[sizeof(keysecret)-1]=0;
|
||||
return (value_from_next);
|
||||
case 'x':
|
||||
|
||||
+3
-5
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -18,7 +18,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: dig.docbook,v 1.17.18.13 2006/01/27 23:57:44 marka Exp $ -->
|
||||
<!-- $Id: dig.docbook,v 1.17.18.11 2005/10/26 04:57:21 marka Exp $ -->
|
||||
<refentry id="man.dig">
|
||||
|
||||
<refentryinfo>
|
||||
@@ -40,7 +40,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
<copyright>
|
||||
@@ -64,7 +63,7 @@
|
||||
<arg><option>-q <replaceable class="parameter">name</replaceable></option></arg>
|
||||
<arg><option>-t <replaceable class="parameter">type</replaceable></option></arg>
|
||||
<arg><option>-x <replaceable class="parameter">addr</replaceable></option></arg>
|
||||
<arg><option>-y <replaceable class="parameter"><optional>hmac:</optional>name:key</replaceable></option></arg>
|
||||
<arg><option>-y <replaceable class="parameter">name:key</replaceable></option></arg>
|
||||
<arg><option>-4</option></arg>
|
||||
<arg><option>-6</option></arg>
|
||||
<arg choice="opt">name</arg>
|
||||
@@ -282,7 +281,6 @@
|
||||
responses using transaction signatures (TSIG), specify a TSIG key file
|
||||
using the <option>-k</option> option. You can also specify the TSIG
|
||||
key itself on the command line using the <option>-y</option> option;
|
||||
<parameter>hmac</parameter> is the type of the TSIG, default HMAC-MD5,
|
||||
<parameter>name</parameter> is the name of the TSIG key and
|
||||
<parameter>key</parameter> is the actual key. The key is a
|
||||
base-64
|
||||
|
||||
+12
-13
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -14,7 +14,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: dig.html,v 1.13.18.19 2006/01/28 02:15:40 marka Exp $ -->
|
||||
<!-- $Id: dig.html,v 1.13.18.17 2005/10/26 06:02:01 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -29,12 +29,12 @@
|
||||
</div>
|
||||
<div class="refsynopsisdiv">
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p><code class="command">dig</code> [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">dig</code> [@server] [<code class="option">-b <em class="replaceable"><code>address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-k <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port#</code></em></code>] [<code class="option">-q <em class="replaceable"><code>name</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-x <em class="replaceable"><code>addr</code></em></code>] [<code class="option">-y <em class="replaceable"><code>name:key</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [name] [type] [class] [queryopt...]</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">dig</code> [<code class="option">-h</code>]</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">dig</code> [global-queryopt...] [query...]</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526001"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525995"></a><h2>DESCRIPTION</h2>
|
||||
<p><span><strong class="command">dig</strong></span>
|
||||
(domain information groper) is a flexible tool
|
||||
for interrogating DNS name servers. It performs DNS lookups and
|
||||
@@ -73,7 +73,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526056"></a><h2>SIMPLE USAGE</h2>
|
||||
<a name="id2526051"></a><h2>SIMPLE USAGE</h2>
|
||||
<p>
|
||||
A typical invocation of <span><strong class="command">dig</strong></span> looks like:
|
||||
</p>
|
||||
@@ -119,7 +119,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526215"></a><h2>OPTIONS</h2>
|
||||
<a name="id2526210"></a><h2>OPTIONS</h2>
|
||||
<p>
|
||||
The <code class="option">-b</code> option sets the source IP address of the query
|
||||
to <em class="parameter"><code>address</code></em>. This must be a valid
|
||||
@@ -200,7 +200,6 @@
|
||||
responses using transaction signatures (TSIG), specify a TSIG key file
|
||||
using the <code class="option">-k</code> option. You can also specify the TSIG
|
||||
key itself on the command line using the <code class="option">-y</code> option;
|
||||
<em class="parameter"><code>hmac</code></em> is the type of the TSIG, default HMAC-MD5,
|
||||
<em class="parameter"><code>name</code></em> is the name of the TSIG key and
|
||||
<em class="parameter"><code>key</code></em> is the actual key. The key is a
|
||||
base-64
|
||||
@@ -219,7 +218,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526418"></a><h2>QUERY OPTIONS</h2>
|
||||
<a name="id2526408"></a><h2>QUERY OPTIONS</h2>
|
||||
<p><span><strong class="command">dig</strong></span>
|
||||
provides a number of query options which affect
|
||||
the way in which lookups are made and the results displayed. Some of
|
||||
@@ -538,7 +537,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527675"></a><h2>MULTIPLE QUERIES</h2>
|
||||
<a name="id2527734"></a><h2>MULTIPLE QUERIES</h2>
|
||||
<p>
|
||||
The BIND 9 implementation of <span><strong class="command">dig </strong></span>
|
||||
supports
|
||||
@@ -584,7 +583,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527737"></a><h2>IDN SUPPORT</h2>
|
||||
<a name="id2527796"></a><h2>IDN SUPPORT</h2>
|
||||
<p>
|
||||
If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
|
||||
domain name) support, it can accept and display non-ASCII domain names.
|
||||
@@ -598,14 +597,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527760"></a><h2>FILES</h2>
|
||||
<a name="id2527818"></a><h2>FILES</h2>
|
||||
<p><code class="filename">/etc/resolv.conf</code>
|
||||
</p>
|
||||
<p><code class="filename">${HOME}/.digrc</code>
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527777"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2527835"></a><h2>SEE ALSO</h2>
|
||||
<p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
|
||||
@@ -613,7 +612,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527814"></a><h2>BUGS</h2>
|
||||
<a name="id2527873"></a><h2>BUGS</h2>
|
||||
<p>
|
||||
There are probably too many query options.
|
||||
</p>
|
||||
|
||||
+8
-37
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: dighost.c,v 1.259.18.32 2006/02/17 00:14:21 marka Exp $ */
|
||||
/* $Id: dighost.c,v 1.259.18.28 2005/10/14 01:28:19 marka Exp $ */
|
||||
|
||||
/*! \file
|
||||
* \note
|
||||
@@ -161,8 +161,6 @@ int fatalexit = 0;
|
||||
char keynametext[MXNAME];
|
||||
char keyfile[MXNAME] = "";
|
||||
char keysecret[MXNAME] = "";
|
||||
dns_name_t *hmacname = NULL;
|
||||
unsigned int digestbits = 0;
|
||||
isc_buffer_t *namebuf = NULL;
|
||||
dns_tsigkey_t *key = NULL;
|
||||
isc_boolean_t validated = ISC_TRUE;
|
||||
@@ -892,15 +890,14 @@ setup_text_key(void) {
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto failure;
|
||||
|
||||
result = dns_tsigkey_create(&keyname, hmacname, secretstore,
|
||||
secretsize, ISC_FALSE, NULL, 0, 0, mctx,
|
||||
result = dns_tsigkey_create(&keyname, dns_tsig_hmacmd5_name,
|
||||
secretstore, secretsize,
|
||||
ISC_FALSE, NULL, 0, 0, mctx,
|
||||
NULL, &key);
|
||||
failure:
|
||||
if (result != ISC_R_SUCCESS)
|
||||
printf(";; Couldn't create key %s: %s\n",
|
||||
keynametext, isc_result_totext(result));
|
||||
else
|
||||
dst_key_setbits(key->key, digestbits);
|
||||
|
||||
isc_mem_free(mctx, secretstore);
|
||||
dns_name_invalidate(&keyname);
|
||||
@@ -921,31 +918,8 @@ setup_file_key(void) {
|
||||
goto failure;
|
||||
}
|
||||
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
default:
|
||||
printf(";; Couldn't create key %s: bad algorithm\n",
|
||||
keynametext);
|
||||
goto failure;
|
||||
}
|
||||
result = dns_tsigkey_createfromkey(dst_key_name(dstkey), hmacname,
|
||||
result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
|
||||
dns_tsig_hmacmd5_name,
|
||||
dstkey, ISC_FALSE, NULL, 0, 0,
|
||||
mctx, NULL, &key);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
@@ -1946,7 +1920,7 @@ setup_lookup(dig_lookup_t *lookup) {
|
||||
check_result(result, "dns_message_renderbegin");
|
||||
if (lookup->udpsize > 0 || lookup->dnssec || lookup->edns > -1) {
|
||||
if (lookup->udpsize == 0)
|
||||
lookup->udpsize = 4096;
|
||||
lookup->udpsize = 2048;
|
||||
if (lookup->edns < 0)
|
||||
lookup->edns = 0;
|
||||
add_opt(lookup->sendmsg, lookup->udpsize,
|
||||
@@ -2825,9 +2799,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
|
||||
"(< header size) message received\n");
|
||||
}
|
||||
|
||||
if (result == ISC_R_SUCCESS && (msgflags & DNS_MESSAGEFLAG_QR) == 0)
|
||||
printf(";; Warning: query response not set\n");
|
||||
|
||||
if (!match) {
|
||||
isc_buffer_invalidate(&query->recvbuf);
|
||||
isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
|
||||
|
||||
+4
-36
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: host.c,v 1.94.18.13 2006/03/02 23:48:49 marka Exp $ */
|
||||
/* $Id: host.c,v 1.94.18.11 2005/08/25 00:43:25 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -39,7 +39,6 @@
|
||||
#include <dns/rdataclass.h>
|
||||
#include <dns/rdataset.h>
|
||||
#include <dns/rdatatype.h>
|
||||
#include <dns/rdatastruct.h>
|
||||
|
||||
#include <dig/dig.h>
|
||||
|
||||
@@ -356,32 +355,6 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset, dns_name_t *owner,
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static void
|
||||
chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
|
||||
isc_result_t result;
|
||||
dns_rdataset_t *rdataset;
|
||||
dns_rdata_cname_t cname;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
unsigned int i = msg->counts[DNS_SECTION_ANSWER];
|
||||
|
||||
while (i-- > 0) {
|
||||
rdataset = NULL;
|
||||
result = dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
|
||||
dns_rdatatype_cname, 0, NULL,
|
||||
&rdataset);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
return;
|
||||
result = dns_rdataset_first(rdataset);
|
||||
check_result(result, "dns_rdataset_first");
|
||||
dns_rdata_reset(&rdata);
|
||||
dns_rdataset_current(rdataset, &rdata);
|
||||
result = dns_rdata_tostruct(&rdata, &cname, NULL);
|
||||
check_result(result, "dns_rdata_tostruct");
|
||||
dns_name_copy(&cname.cname, qname, NULL);
|
||||
dns_rdata_freestruct(&cname);
|
||||
}
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
|
||||
isc_boolean_t did_flag = ISC_FALSE;
|
||||
@@ -420,15 +393,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
|
||||
if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
|
||||
char namestr[DNS_NAME_FORMATSIZE];
|
||||
dig_lookup_t *lookup;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
|
||||
/* Add AAAA and MX lookups. */
|
||||
dns_fixedname_init(&fixed);
|
||||
name = dns_fixedname_name(&fixed);
|
||||
dns_name_copy(query->lookup->name, name, NULL);
|
||||
chase_cnamechain(msg, name);
|
||||
dns_name_format(name, namestr, sizeof(namestr));
|
||||
|
||||
dns_name_format(query->lookup->name, namestr, sizeof(namestr));
|
||||
lookup = clone_lookup(query->lookup, ISC_FALSE);
|
||||
if (lookup != NULL) {
|
||||
strncpy(lookup->textname, namestr,
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: dig.h,v 1.82.18.16 2006/01/27 23:57:44 marka Exp $ */
|
||||
/* $Id: dig.h,v 1.82.18.14 2005/08/25 00:43:26 marka Exp $ */
|
||||
|
||||
#ifndef DIG_H
|
||||
#define DIG_H
|
||||
@@ -257,8 +257,6 @@ extern isc_sockaddr_t bind_address;
|
||||
extern char keynametext[MXNAME];
|
||||
extern char keyfile[MXNAME];
|
||||
extern char keysecret[MXNAME];
|
||||
extern dns_name_t *hmacname;
|
||||
extern unsigned int digestbits;
|
||||
#ifdef DIG_SIGCHASE
|
||||
extern char trustedkey[MXNAME];
|
||||
#endif
|
||||
|
||||
+3
-3
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -12,7 +12,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: nslookup.1,v 1.1.10.8 2006/01/06 01:48:03 marka Exp $
|
||||
.\" $Id: nslookup.1,v 1.1.10.7 2005/10/13 02:52:59 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -147,7 +147,7 @@ Change the default TCP/UDP name server port to
|
||||
\fBquerytype=\fR\fIvalue\fR
|
||||
.TP
|
||||
\fBtype=\fR\fIvalue\fR
|
||||
Change the type of the information query.
|
||||
Change the top of the information query.
|
||||
.sp
|
||||
(Default = A; abbreviations = q, ty)
|
||||
.TP
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
- purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -17,7 +17,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: nslookup.docbook,v 1.4.2.7 2006/01/06 00:01:43 marka Exp $ -->
|
||||
<!-- $Id: nslookup.docbook,v 1.4.2.5 2005/08/25 00:33:36 marka Exp $ -->
|
||||
<!--
|
||||
- Copyright (c) 1985, 1989
|
||||
- The Regents of the University of California. All rights reserved.
|
||||
@@ -71,7 +71,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -386,7 +385,7 @@ nslookup -query=hinfo -timeout=10
|
||||
<term><constant>type=</constant><replaceable>value</replaceable></term>
|
||||
<listitem>
|
||||
<para>
|
||||
Change the type of the information query.
|
||||
Change the top of the information query.
|
||||
</para>
|
||||
<para>
|
||||
(Default = A; abbreviations = q, ty)
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
- purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -13,7 +13,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: nslookup.html,v 1.1.10.13 2006/01/06 01:48:03 marka Exp $ -->
|
||||
<!-- $Id: nslookup.html,v 1.1.10.12 2005/10/13 02:52:59 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -31,7 +31,7 @@
|
||||
<div class="cmdsynopsis"><p><code class="command">nslookup</code> [<code class="option">-option</code>] [name | -] [server]</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525985"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525981"></a><h2>DESCRIPTION</h2>
|
||||
<p><span><strong class="command">Nslookup</strong></span>
|
||||
is a program to query Internet domain name servers. <span><strong class="command">Nslookup</strong></span>
|
||||
has two modes: interactive and non-interactive. Interactive mode allows
|
||||
@@ -43,7 +43,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526001"></a><h2>ARGUMENTS</h2>
|
||||
<a name="id2525997"></a><h2>ARGUMENTS</h2>
|
||||
<p>
|
||||
Interactive mode is entered in the following cases:
|
||||
</p>
|
||||
@@ -76,7 +76,7 @@ nslookup -query=hinfo -timeout=10
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526042"></a><h2>INTERACTIVE COMMANDS</h2>
|
||||
<a name="id2526039"></a><h2>INTERACTIVE COMMANDS</h2>
|
||||
<div class="variablelist"><dl>
|
||||
<dt><span class="term">host [<span class="optional">server</span>]</span></dt>
|
||||
<dd>
|
||||
@@ -231,7 +231,7 @@ nslookup -query=hinfo -timeout=10
|
||||
<dt><span class="term"><code class="constant">type=</code><em class="replaceable"><code>value</code></em></span></dt>
|
||||
<dd>
|
||||
<p>
|
||||
Change the type of the information query.
|
||||
Change the top of the information query.
|
||||
</p>
|
||||
<p>
|
||||
(Default = A; abbreviations = q, ty)
|
||||
@@ -288,19 +288,19 @@ nslookup -query=hinfo -timeout=10
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2528906"></a><h2>FILES</h2>
|
||||
<a name="id2528835"></a><h2>FILES</h2>
|
||||
<p><code class="filename">/etc/resolv.conf</code>
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2528918"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2528846"></a><h2>SEE ALSO</h2>
|
||||
<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2528952"></a><h2>Author</h2>
|
||||
<a name="id2528881"></a><h2>Author</h2>
|
||||
<p>
|
||||
Andrew Cherenson
|
||||
</p>
|
||||
|
||||
+6
-100
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Portions Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Portions Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
* Portions Copyright (C) 1995-2000 by Network Associates, Inc.
|
||||
*
|
||||
@@ -16,7 +16,7 @@
|
||||
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: dnssec-keygen.c,v 1.66.18.7 2006/01/27 02:50:50 marka Exp $ */
|
||||
/* $Id: dnssec-keygen.c,v 1.66.18.4 2005/09/18 07:58:05 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -49,9 +49,7 @@
|
||||
const char *program = "dnssec-keygen";
|
||||
int verbose;
|
||||
|
||||
static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 | HMAC-MD5 |"
|
||||
" HMAC-SHA1 | HMAC-SHA224 | HMAC-SHA256 | "
|
||||
" HMAC-SHA384 | HMAC-SHA512";
|
||||
static const char *algs = "RSA | RSAMD5 | DH | DSA | RSASHA1 | HMAC-MD5";
|
||||
|
||||
static isc_boolean_t
|
||||
dsa_size_ok(int size) {
|
||||
@@ -72,16 +70,10 @@ usage(void) {
|
||||
fprintf(stderr, " DH:\t\t[128..4096]\n");
|
||||
fprintf(stderr, " DSA:\t\t[512..1024] and divisible by 64\n");
|
||||
fprintf(stderr, " HMAC-MD5:\t[1..512]\n");
|
||||
fprintf(stderr, " HMAC-SHA1:\t[1..160]\n");
|
||||
fprintf(stderr, " HMAC-SHA224:\t[1..224]\n");
|
||||
fprintf(stderr, " HMAC-SHA256:\t[1..256]\n");
|
||||
fprintf(stderr, " HMAC-SHA384:\t[1..384]\n");
|
||||
fprintf(stderr, " HMAC-SHA512:\t[1..512]\n");
|
||||
fprintf(stderr, " -n nametype: ZONE | HOST | ENTITY | USER | OTHER\n");
|
||||
fprintf(stderr, " name: owner of the key\n");
|
||||
fprintf(stderr, "Other options:\n");
|
||||
fprintf(stderr, " -c <class> (default: IN)\n");
|
||||
fprintf(stderr, " -d <digest bits> (0 => max, default)\n");
|
||||
fprintf(stderr, " -e use large exponent (RSAMD5/RSASHA1 only)\n");
|
||||
fprintf(stderr, " -f keyflag: KSK\n");
|
||||
fprintf(stderr, " -g <generator> use specified generator "
|
||||
@@ -125,7 +117,6 @@ main(int argc, char **argv) {
|
||||
isc_entropy_t *ectx = NULL;
|
||||
dns_rdataclass_t rdclass;
|
||||
int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
|
||||
int dbits = 0;
|
||||
|
||||
if (argc == 1)
|
||||
usage();
|
||||
@@ -135,7 +126,7 @@ main(int argc, char **argv) {
|
||||
dns_result_register();
|
||||
|
||||
while ((ch = isc_commandline_parse(argc, argv,
|
||||
"a:b:c:d:ef:g:kn:t:p:s:r:v:h")) != -1)
|
||||
"a:b:c:ef:g:kn:t:p:s:r:v:h")) != -1)
|
||||
{
|
||||
switch (ch) {
|
||||
case 'a':
|
||||
@@ -149,11 +140,6 @@ main(int argc, char **argv) {
|
||||
case 'c':
|
||||
classname = isc_commandline_argument;
|
||||
break;
|
||||
case 'd':
|
||||
dbits = strtol(isc_commandline_argument, &endp, 10);
|
||||
if (*endp != '\0' || dbits < 0)
|
||||
fatal("-d requires a non-negative number");
|
||||
break;
|
||||
case 'e':
|
||||
rsa_exp = 1;
|
||||
break;
|
||||
@@ -227,29 +213,9 @@ main(int argc, char **argv) {
|
||||
|
||||
if (algname == NULL)
|
||||
fatal("no algorithm was specified");
|
||||
if (strcasecmp(algname, "RSA") == 0) {
|
||||
fprintf(stderr, "The use of RSA (RSAMD5) is not recommended.\n"
|
||||
"If you still wish to use RSA (RSAMD5) please "
|
||||
"specify \"-a RSAMD5\"\n");
|
||||
return (1);
|
||||
} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
|
||||
if (strcasecmp(algname, "HMAC-MD5") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACMD5;
|
||||
} else if (strcasecmp(algname, "HMAC-SHA1") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACSHA1;
|
||||
} else if (strcasecmp(algname, "HMAC-SHA224") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACSHA224;
|
||||
} else if (strcasecmp(algname, "HMAC-SHA256") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACSHA256;
|
||||
} else if (strcasecmp(algname, "HMAC-SHA384") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACSHA384;
|
||||
} else if (strcasecmp(algname, "HMAC-SHA512") == 0) {
|
||||
options |= DST_TYPE_KEY;
|
||||
alg = DST_ALG_HMACSHA512;
|
||||
} else {
|
||||
r.base = algname;
|
||||
r.length = strlen(algname);
|
||||
@@ -296,56 +262,6 @@ main(int argc, char **argv) {
|
||||
case DST_ALG_HMACMD5:
|
||||
if (size < 1 || size > 512)
|
||||
fatal("HMAC-MD5 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 80 || dbits > 128))
|
||||
fatal("HMAC-MD5 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-MD5 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
case DST_ALG_HMACSHA1:
|
||||
if (size < 1 || size > 160)
|
||||
fatal("HMAC-SHA1 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 80 || dbits > 160))
|
||||
fatal("HMAC-SHA1 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-SHA1 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
if (size < 1 || size > 224)
|
||||
fatal("HMAC-SHA224 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 112 || dbits > 224))
|
||||
fatal("HMAC-SHA224 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-SHA224 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
if (size < 1 || size > 256)
|
||||
fatal("HMAC-SHA256 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 128 || dbits > 256))
|
||||
fatal("HMAC-SHA256 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-SHA256 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
if (size < 1 || size > 384)
|
||||
fatal("HMAC-384 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 192 || dbits > 384))
|
||||
fatal("HMAC-SHA384 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-SHA384 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
if (size < 1 || size > 512)
|
||||
fatal("HMAC-SHA512 key size %d out of range", size);
|
||||
if (dbits != 0 && (dbits < 256 || dbits > 512))
|
||||
fatal("HMAC-SHA512 digest bits %d out of range", dbits);
|
||||
if ((dbits % 8) != 0)
|
||||
fatal("HMAC-SHA512 digest bits %d not divisible by 8",
|
||||
dbits);
|
||||
break;
|
||||
}
|
||||
|
||||
@@ -392,10 +308,7 @@ main(int argc, char **argv) {
|
||||
}
|
||||
|
||||
if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
|
||||
(alg == DNS_KEYALG_DH || alg == DST_ALG_HMACMD5 ||
|
||||
alg == DST_ALG_HMACSHA1 || alg == DST_ALG_HMACSHA224 ||
|
||||
alg == DST_ALG_HMACSHA256 || alg == DST_ALG_HMACSHA384 ||
|
||||
alg == DST_ALG_HMACSHA512))
|
||||
(alg == DNS_KEYALG_DH || alg == DST_ALG_HMACMD5))
|
||||
fatal("a key with algorithm '%s' cannot be a zone key",
|
||||
algname);
|
||||
|
||||
@@ -419,11 +332,6 @@ main(int argc, char **argv) {
|
||||
break;
|
||||
case DNS_KEYALG_DSA:
|
||||
case DST_ALG_HMACMD5:
|
||||
case DST_ALG_HMACSHA1:
|
||||
case DST_ALG_HMACSHA224:
|
||||
case DST_ALG_HMACSHA256:
|
||||
case DST_ALG_HMACSHA384:
|
||||
case DST_ALG_HMACSHA512:
|
||||
param = 0;
|
||||
break;
|
||||
}
|
||||
@@ -452,8 +360,6 @@ main(int argc, char **argv) {
|
||||
exit(-1);
|
||||
}
|
||||
|
||||
dst_key_setbits(key, dbits);
|
||||
|
||||
/*
|
||||
* Try to read a key with the same name, alg and id from disk.
|
||||
* If there is one we must continue generating a new one
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Portions Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Portions Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
* Portions Copyright (C) 1995-2000 by Network Associates, Inc.
|
||||
*
|
||||
@@ -16,7 +16,7 @@
|
||||
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: dnssec-signzone.c,v 1.177.18.19 2006/02/21 23:53:34 marka Exp $ */
|
||||
/* $Id: dnssec-signzone.c,v 1.177.18.15 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -632,16 +632,6 @@ loadds(dns_name_t *name, isc_uint32_t ttl, dns_rdataset_t *dsset) {
|
||||
ttl, &ds, &tuple);
|
||||
check_result(result, "dns_difftuple_create");
|
||||
dns_diff_append(&diff, &tuple);
|
||||
|
||||
dns_rdata_reset(&ds);
|
||||
result = dns_ds_buildrdata(name, &key, DNS_DSDIGEST_SHA256,
|
||||
dsbuf, &ds);
|
||||
check_result(result, "dns_ds_buildrdata");
|
||||
|
||||
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name,
|
||||
ttl, &ds, &tuple);
|
||||
check_result(result, "dns_difftuple_create");
|
||||
dns_diff_append(&diff, &tuple);
|
||||
}
|
||||
result = dns_diff_apply(&diff, db, ver);
|
||||
check_result(result, "dns_diff_apply");
|
||||
@@ -1101,32 +1091,6 @@ postsign(void) {
|
||||
dns_dbiterator_destroy(&gdbiter);
|
||||
}
|
||||
|
||||
/*%
|
||||
* Sign the apex of the zone.
|
||||
*/
|
||||
static void
|
||||
signapex(void) {
|
||||
dns_dbnode_t *node = NULL;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
isc_result_t result;
|
||||
|
||||
dns_fixedname_init(&fixed);
|
||||
name = dns_fixedname_name(&fixed);
|
||||
result = dns_dbiterator_current(gdbiter, &node, name);
|
||||
check_result(result, "dns_dbiterator_current()");
|
||||
signname(node, name);
|
||||
dumpnode(name, node);
|
||||
cleannode(gdb, gversion, node);
|
||||
dns_db_detachnode(gdb, &node);
|
||||
result = dns_dbiterator_next(gdbiter);
|
||||
if (result == ISC_R_NOMORE)
|
||||
finished = ISC_TRUE;
|
||||
else if (result != ISC_R_SUCCESS)
|
||||
fatal("failure iterating database: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
/*%
|
||||
* Assigns a node to a worker thread. This is protected by the master task's
|
||||
* lock.
|
||||
@@ -1595,19 +1559,6 @@ writeset(const char *prefix, dns_rdatatype_t type) {
|
||||
ds.type = dns_rdatatype_dlv;
|
||||
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
|
||||
name, 0, &ds, &tuple);
|
||||
check_result(result, "dns_difftuple_create");
|
||||
dns_diff_append(&diff, &tuple);
|
||||
|
||||
dns_rdata_reset(&ds);
|
||||
result = dns_ds_buildrdata(gorigin, &rdata,
|
||||
DNS_DSDIGEST_SHA256,
|
||||
dsbuf, &ds);
|
||||
check_result(result, "dns_ds_buildrdata");
|
||||
if (type == dns_rdatatype_dlv)
|
||||
ds.type = dns_rdatatype_dlv;
|
||||
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
|
||||
name, 0, &ds, &tuple);
|
||||
|
||||
} else
|
||||
result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
|
||||
gorigin, zonettl,
|
||||
@@ -2126,6 +2077,10 @@ main(int argc, char *argv[]) {
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fatal("failed to create task: %s",
|
||||
isc_result_totext(result));
|
||||
result = isc_app_onrun(mctx, master, startworker, tasks[i]);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fatal("failed to start task: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
|
||||
RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
|
||||
@@ -2133,24 +2088,9 @@ main(int argc, char *argv[]) {
|
||||
RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
|
||||
|
||||
presign();
|
||||
signapex();
|
||||
if (!finished) {
|
||||
/*
|
||||
* There is more work to do. Spread it out over multiple
|
||||
* processors if possible.
|
||||
*/
|
||||
for (i = 0; i < (int)ntasks; i++) {
|
||||
result = isc_app_onrun(mctx, master, startworker,
|
||||
tasks[i]);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fatal("failed to start task: %s",
|
||||
isc_result_totext(result));
|
||||
}
|
||||
(void)isc_app_run();
|
||||
if (!finished)
|
||||
fatal("process aborted by user");
|
||||
} else
|
||||
isc_task_detach(&master);
|
||||
(void)isc_app_run();
|
||||
if (!finished)
|
||||
fatal("process aborted by user");
|
||||
shuttingdown = ISC_TRUE;
|
||||
for (i = 0; i < (int)ntasks; i++)
|
||||
isc_task_detach(&tasks[i]);
|
||||
|
||||
+3
-85
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: client.c,v 1.219.18.16 2006/01/05 00:10:42 marka Exp $ */
|
||||
/* $Id: client.c,v 1.219.18.13 2005/10/16 23:29:38 marka Exp $ */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
@@ -34,13 +34,12 @@
|
||||
#include <dns/dispatch.h>
|
||||
#include <dns/events.h>
|
||||
#include <dns/message.h>
|
||||
#include <dns/peer.h>
|
||||
#include <dns/rcode.h>
|
||||
#include <dns/resolver.h>
|
||||
#include <dns/rdata.h>
|
||||
#include <dns/rdataclass.h>
|
||||
#include <dns/rdatalist.h>
|
||||
#include <dns/rdataset.h>
|
||||
#include <dns/resolver.h>
|
||||
#include <dns/tsig.h>
|
||||
#include <dns/view.h>
|
||||
#include <dns/zone.h>
|
||||
@@ -192,13 +191,6 @@ struct ns_clientmgr {
|
||||
* Must be greater than any valid state.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Enable ns_client_dropport() by default.
|
||||
*/
|
||||
#ifndef NS_CLIENT_DROPPORT
|
||||
#define NS_CLIENT_DROPPORT 1
|
||||
#endif
|
||||
|
||||
unsigned int ns_client_requests;
|
||||
|
||||
static void client_read(ns_client_t *client);
|
||||
@@ -1009,34 +1001,6 @@ ns_client_send(ns_client_t *client) {
|
||||
ns_client_next(client, result);
|
||||
}
|
||||
|
||||
#if NS_CLIENT_DROPPORT
|
||||
#define DROPPORT_NO 0
|
||||
#define DROPPORT_REQUEST 1
|
||||
#define DROPPORT_RESPONSE 2
|
||||
/*%
|
||||
* ns_client_dropport determines if certain requests / responses
|
||||
* should be dropped based on the port number.
|
||||
*
|
||||
* Returns:
|
||||
* \li 0: Don't drop.
|
||||
* \li 1: Drop request.
|
||||
* \li 2: Drop (error) response.
|
||||
*/
|
||||
static int
|
||||
ns_client_dropport(in_port_t port) {
|
||||
switch (port) {
|
||||
case 7: /* echo */
|
||||
case 13: /* daytime */
|
||||
case 19: /* chargen */
|
||||
case 37: /* time */
|
||||
return (DROPPORT_REQUEST);
|
||||
case 464: /* kpasswd */
|
||||
return (DROPPORT_RESPONSE);
|
||||
}
|
||||
return (DROPPORT_NO);
|
||||
}
|
||||
#endif
|
||||
|
||||
void
|
||||
ns_client_error(ns_client_t *client, isc_result_t result) {
|
||||
dns_rcode_t rcode;
|
||||
@@ -1049,28 +1013,6 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
|
||||
message = client->message;
|
||||
rcode = dns_result_torcode(result);
|
||||
|
||||
#if NS_CLIENT_DROPPORT
|
||||
/*
|
||||
* Don't send FORMERR to ports on the drop port list.
|
||||
*/
|
||||
if (rcode == dns_rcode_formerr &&
|
||||
ns_client_dropport(isc_sockaddr_getport(&client->peeraddr)) !=
|
||||
DROPPORT_NO) {
|
||||
char buf[64];
|
||||
isc_buffer_t b;
|
||||
|
||||
isc_buffer_init(&b, buf, sizeof(buf) - 1);
|
||||
if (dns_rcode_totext(rcode, &b) != ISC_R_SUCCESS)
|
||||
isc_buffer_putstr(&b, "UNKNOWN RCODE");
|
||||
ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
|
||||
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
|
||||
"dropped error (%.*s) response: suspicious port",
|
||||
(int)isc_buffer_usedlength(&b), buf);
|
||||
ns_client_next(client, ISC_R_SUCCESS);
|
||||
return;
|
||||
}
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Message may be an in-progress reply that we had trouble
|
||||
* with, in which case QR will be set. We need to clear QR before
|
||||
@@ -1355,17 +1297,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
|
||||
|
||||
isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||
|
||||
#if NS_CLIENT_DROPPORT
|
||||
if (ns_client_dropport(isc_sockaddr_getport(&client->peeraddr)) ==
|
||||
DROPPORT_REQUEST) {
|
||||
ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
|
||||
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
|
||||
"dropped request: suspicious port");
|
||||
ns_client_next(client, ISC_R_SUCCESS);
|
||||
goto cleanup;
|
||||
}
|
||||
#endif
|
||||
|
||||
ns_client_log(client, NS_LOGCATEGORY_CLIENT,
|
||||
NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
|
||||
"%s request",
|
||||
@@ -1706,19 +1637,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
|
||||
ISC_LOG_DEBUG(3), ra ? "recursion available" :
|
||||
"recursion not available");
|
||||
|
||||
/*
|
||||
* Adjust maximum UDP response size for this client.
|
||||
*/
|
||||
if (client->udpsize > 512) {
|
||||
dns_peer_t *peer = NULL;
|
||||
isc_uint16_t udpsize = view->maxudp;
|
||||
(void) dns_peerlist_peerbyaddr(view->peers, &netaddr, &peer);
|
||||
if (peer != NULL)
|
||||
dns_peer_getmaxudp(peer, &udpsize);
|
||||
if (client->udpsize > udpsize)
|
||||
client->udpsize = udpsize;
|
||||
}
|
||||
|
||||
/*
|
||||
* Dispatch the request.
|
||||
*/
|
||||
|
||||
+46
-109
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2001-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: config.c,v 1.47.18.27 2006/03/09 23:38:20 marka Exp $ */
|
||||
/* $Id: config.c,v 1.47.18.16 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -27,7 +27,6 @@
|
||||
#include <isc/buffer.h>
|
||||
#include <isc/log.h>
|
||||
#include <isc/mem.h>
|
||||
#include <isc/parseint.h>
|
||||
#include <isc/region.h>
|
||||
#include <isc/result.h>
|
||||
#include <isc/sockaddr.h>
|
||||
@@ -80,7 +79,7 @@ options {\n\
|
||||
#endif
|
||||
"\
|
||||
recursive-clients 1000;\n\
|
||||
rrset-order {type NS order random; order cyclic; };\n\
|
||||
rrset-order {order cyclic;};\n\
|
||||
serial-queries 20;\n\
|
||||
serial-query-rate 20;\n\
|
||||
server-id none;\n\
|
||||
@@ -98,13 +97,11 @@ options {\n\
|
||||
use-id-pool true;\n\
|
||||
use-ixfr true;\n\
|
||||
edns-udp-size 4096;\n\
|
||||
max-udp-size 4096;\n\
|
||||
\n\
|
||||
/* view */\n\
|
||||
allow-notify {none;};\n\
|
||||
allow-update-forwarding {none;};\n\
|
||||
allow-query-cache { localnets; localhost; };\n\
|
||||
allow-recursion { localnets; localhost; };\n\
|
||||
allow-recursion {any;};\n\
|
||||
# allow-v6-synthesis <obsolete>;\n\
|
||||
# sortlist <none>\n\
|
||||
# topology <none>\n\
|
||||
@@ -135,12 +132,9 @@ options {\n\
|
||||
use-additional-cache true;\n\
|
||||
acache-cleaning-interval 60;\n\
|
||||
max-acache-size 0;\n\
|
||||
dnssec-enable yes;\n\
|
||||
dnssec-validation no; /* Make yes for 9.5. */ \n\
|
||||
dnssec-accept-expired no;\n\
|
||||
dnssec-enable no; /* Make yes for 9.4. */ \n\
|
||||
clients-per-query 10;\n\
|
||||
max-clients-per-query 100;\n\
|
||||
zero-no-soa-ttl-cache no;\n\
|
||||
"
|
||||
|
||||
" /* zone */\n\
|
||||
@@ -174,10 +168,6 @@ options {\n\
|
||||
check-wildcard yes;\n\
|
||||
check-sibling yes;\n\
|
||||
check-integrity yes;\n\
|
||||
check-mx-cname warn;\n\
|
||||
check-srv-cname warn;\n\
|
||||
zero-no-soa-ttl yes;\n\
|
||||
update-check-ksk yes;\n\
|
||||
};\n\
|
||||
"
|
||||
|
||||
@@ -219,7 +209,7 @@ ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
ns_config_get(cfg_obj_t **maps, const char *name, cfg_obj_t **obj) {
|
||||
int i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
@@ -231,13 +221,11 @@ ns_config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_checknames_get(const cfg_obj_t **maps, const char *which,
|
||||
const cfg_obj_t **obj)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *checknames;
|
||||
const cfg_obj_t *type;
|
||||
const cfg_obj_t *value;
|
||||
ns_checknames_get(cfg_obj_t **maps, const char *which, cfg_obj_t **obj) {
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *checknames;
|
||||
cfg_obj_t *type;
|
||||
cfg_obj_t *value;
|
||||
int i;
|
||||
|
||||
for (i = 0;; i++) {
|
||||
@@ -268,8 +256,8 @@ ns_checknames_get(const cfg_obj_t **maps, const char *which,
|
||||
}
|
||||
|
||||
int
|
||||
ns_config_listcount(const cfg_obj_t *list) {
|
||||
const cfg_listelt_t *e;
|
||||
ns_config_listcount(cfg_obj_t *list) {
|
||||
cfg_listelt_t *e;
|
||||
int i = 0;
|
||||
|
||||
for (e = cfg_list_first(list); e != NULL; e = cfg_list_next(e))
|
||||
@@ -279,7 +267,7 @@ ns_config_listcount(const cfg_obj_t *list) {
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
dns_rdataclass_t *classp) {
|
||||
isc_textregion_t r;
|
||||
isc_result_t result;
|
||||
@@ -298,7 +286,7 @@ ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
dns_rdatatype_t *typep) {
|
||||
isc_textregion_t r;
|
||||
isc_result_t result;
|
||||
@@ -317,7 +305,7 @@ ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
}
|
||||
|
||||
dns_zonetype_t
|
||||
ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
|
||||
ns_config_getzonetype(cfg_obj_t *zonetypeobj) {
|
||||
dns_zonetype_t ztype = dns_zone_none;
|
||||
const char *str;
|
||||
|
||||
@@ -334,14 +322,14 @@ ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
ns_config_getiplist(cfg_obj_t *config, cfg_obj_t *list,
|
||||
in_port_t defport, isc_mem_t *mctx,
|
||||
isc_sockaddr_t **addrsp, isc_uint32_t *countp)
|
||||
{
|
||||
int count, i = 0;
|
||||
const cfg_obj_t *addrlist;
|
||||
const cfg_obj_t *portobj;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *addrlist;
|
||||
cfg_obj_t *portobj;
|
||||
cfg_listelt_t *element;
|
||||
isc_sockaddr_t *addrs;
|
||||
in_port_t port;
|
||||
isc_result_t result;
|
||||
@@ -401,12 +389,10 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
get_masters_def(const cfg_obj_t *cctx, const char *name,
|
||||
const cfg_obj_t **ret)
|
||||
{
|
||||
get_masters_def(cfg_obj_t *cctx, const char *name, cfg_obj_t **ret) {
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *masters = NULL;
|
||||
const cfg_listelt_t *elt;
|
||||
cfg_obj_t *masters = NULL;
|
||||
cfg_listelt_t *elt;
|
||||
|
||||
result = cfg_map_get(cctx, "masters", &masters);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
@@ -414,7 +400,7 @@ get_masters_def(const cfg_obj_t *cctx, const char *name,
|
||||
for (elt = cfg_list_first(masters);
|
||||
elt != NULL;
|
||||
elt = cfg_list_next(elt)) {
|
||||
const cfg_obj_t *list;
|
||||
cfg_obj_t *list;
|
||||
const char *listname;
|
||||
|
||||
list = cfg_listelt_value(elt);
|
||||
@@ -429,24 +415,24 @@ get_masters_def(const cfg_obj_t *cctx, const char *name,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
dns_name_t ***keysp, isc_uint32_t *countp)
|
||||
ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
|
||||
isc_sockaddr_t **addrsp, dns_name_t ***keysp,
|
||||
isc_uint32_t *countp)
|
||||
{
|
||||
isc_uint32_t addrcount = 0, keycount = 0, i = 0;
|
||||
isc_uint32_t listcount = 0, l = 0, j;
|
||||
isc_uint32_t stackcount = 0, pushed = 0;
|
||||
isc_result_t result;
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *addrlist;
|
||||
const cfg_obj_t *portobj;
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *addrlist;
|
||||
cfg_obj_t *portobj;
|
||||
in_port_t port;
|
||||
dns_fixedname_t fname;
|
||||
isc_sockaddr_t *addrs = NULL;
|
||||
dns_name_t **keys = NULL;
|
||||
struct { const char *name; } *lists = NULL;
|
||||
struct {
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
in_port_t port;
|
||||
} *stack = NULL;
|
||||
|
||||
@@ -480,8 +466,8 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *addr;
|
||||
const cfg_obj_t *key;
|
||||
cfg_obj_t *addr;
|
||||
cfg_obj_t *key;
|
||||
const char *keystr;
|
||||
isc_buffer_t b;
|
||||
|
||||
@@ -706,10 +692,10 @@ ns_config_putipandkeylist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_config_getport(const cfg_obj_t *config, in_port_t *portp) {
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *portobj = NULL;
|
||||
ns_config_getport(cfg_obj_t *config, in_port_t *portp) {
|
||||
cfg_obj_t *maps[3];
|
||||
cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *portobj = NULL;
|
||||
isc_result_t result;
|
||||
int i;
|
||||
|
||||
@@ -732,65 +718,16 @@ ns_config_getport(const cfg_obj_t *config, in_port_t *portp) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
struct keyalgorithms {
|
||||
const char *str;
|
||||
enum { hmacnone, hmacmd5, hmacsha1, hmacsha224,
|
||||
hmacsha256, hmacsha384, hmacsha512 } hmac;
|
||||
isc_uint16_t size;
|
||||
} algorithms[] = {
|
||||
{ "hmac-md5", hmacmd5, 128 },
|
||||
{ "hmac-md5.sig-alg.reg.int", hmacmd5, 0 },
|
||||
{ "hmac-md5.sig-alg.reg.int.", hmacmd5, 0 },
|
||||
{ "hmac-sha1", hmacsha1, 160 },
|
||||
{ "hmac-sha224", hmacsha224, 224 },
|
||||
{ "hmac-sha256", hmacsha256, 256 },
|
||||
{ "hmac-sha384", hmacsha384, 384 },
|
||||
{ "hmac-sha512", hmacsha512, 512 },
|
||||
{ NULL, hmacnone, 0 }
|
||||
};
|
||||
|
||||
isc_result_t
|
||||
ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
|
||||
isc_uint16_t *digestbits)
|
||||
ns_config_getkeyalgorithm(const char *str, dns_name_t **name)
|
||||
{
|
||||
int i;
|
||||
size_t len = 0;
|
||||
isc_uint16_t bits;
|
||||
isc_result_t result;
|
||||
|
||||
for (i = 0; algorithms[i].str != NULL; i++) {
|
||||
len = strlen(algorithms[i].str);
|
||||
if (strncasecmp(algorithms[i].str, str, len) == 0 &&
|
||||
(str[len] == '\0' ||
|
||||
(algorithms[i].size != 0 && str[len] == '-')))
|
||||
break;
|
||||
if (strcasecmp(str, "hmac-md5") == 0 ||
|
||||
strcasecmp(str, "hmac-md5.sig-alg.reg.int") == 0 ||
|
||||
strcasecmp(str, "hmac-md5.sig-alg.reg.int.") == 0)
|
||||
{
|
||||
if (name != NULL)
|
||||
*name = dns_tsig_hmacmd5_name;
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
if (algorithms[i].str == NULL)
|
||||
return (ISC_R_NOTFOUND);
|
||||
if (str[len] == '-') {
|
||||
result = isc_parse_uint16(&bits, str + len + 1, 10);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
return (result);
|
||||
if (bits > algorithms[i].size)
|
||||
return (ISC_R_RANGE);
|
||||
} else if (algorithms[i].size == 0)
|
||||
bits = 128;
|
||||
else
|
||||
bits = algorithms[i].size;
|
||||
|
||||
if (name != NULL) {
|
||||
switch (algorithms[i].hmac) {
|
||||
case hmacmd5: *name = dns_tsig_hmacmd5_name; break;
|
||||
case hmacsha1: *name = dns_tsig_hmacsha1_name; break;
|
||||
case hmacsha224: *name = dns_tsig_hmacsha224_name; break;
|
||||
case hmacsha256: *name = dns_tsig_hmacsha256_name; break;
|
||||
case hmacsha384: *name = dns_tsig_hmacsha384_name; break;
|
||||
case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
|
||||
default:
|
||||
INSIST(0);
|
||||
}
|
||||
}
|
||||
if (digestbits != NULL)
|
||||
*digestbits = bits;
|
||||
return (ISC_R_SUCCESS);
|
||||
return (ISC_R_NOTFOUND);
|
||||
}
|
||||
|
||||
+2
-4
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2001-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: control.c,v 1.20.10.8 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: control.c,v 1.20.10.6 2005/04/29 00:55:52 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -172,8 +172,6 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
|
||||
result = ISC_R_SUCCESS;
|
||||
} else if (command_compare(command, NS_COMMAND_NOTIFY)) {
|
||||
result = ns_server_notifycommand(ns_g_server, command, text);
|
||||
} else if (command_compare(command, NS_COMMAND_VALIDATION)) {
|
||||
result = ns_server_validation(ns_g_server, command);
|
||||
} else {
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
|
||||
NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
|
||||
|
||||
+53
-55
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2001-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: controlconf.c,v 1.40.18.9 2006/02/28 03:10:47 marka Exp $ */
|
||||
/* $Id: controlconf.c,v 1.40.18.6 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -659,12 +659,10 @@ ns_controls_shutdown(ns_controls_t *controls) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
|
||||
const cfg_obj_t **objp)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
cfgkeylist_find(cfg_obj_t *keylist, const char *keyname, cfg_obj_t **objp) {
|
||||
cfg_listelt_t *element;
|
||||
const char *str;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
|
||||
for (element = cfg_list_first(keylist);
|
||||
element != NULL;
|
||||
@@ -683,13 +681,13 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
|
||||
controlkeylist_fromcfg(cfg_obj_t *keylist, isc_mem_t *mctx,
|
||||
controlkeylist_t *keyids)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
char *newstr = NULL;
|
||||
const char *str;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
controlkey_t *key = NULL;
|
||||
|
||||
for (element = cfg_list_first(keylist);
|
||||
@@ -724,11 +722,11 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
|
||||
}
|
||||
|
||||
static void
|
||||
register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
register_keys(cfg_obj_t *control, cfg_obj_t *keylist,
|
||||
controlkeylist_t *keyids, isc_mem_t *mctx, const char *socktext)
|
||||
{
|
||||
controlkey_t *keyid, *next;
|
||||
const cfg_obj_t *keydef;
|
||||
cfg_obj_t *keydef;
|
||||
char secret[1024];
|
||||
isc_buffer_t b;
|
||||
isc_result_t result;
|
||||
@@ -748,8 +746,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
ISC_LIST_UNLINK(*keyids, keyid, link);
|
||||
free_controlkey(keyid, mctx);
|
||||
} else {
|
||||
const cfg_obj_t *algobj = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
cfg_obj_t *algobj = NULL;
|
||||
cfg_obj_t *secretobj = NULL;
|
||||
const char *algstr = NULL;
|
||||
const char *secretstr = NULL;
|
||||
|
||||
@@ -760,7 +758,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
if (ns_config_getkeyalgorithm(algstr, NULL, NULL) !=
|
||||
if (ns_config_getkeyalgorithm(algstr, NULL) !=
|
||||
ISC_R_SUCCESS)
|
||||
{
|
||||
cfg_obj_log(control, ns_g_lctx,
|
||||
@@ -817,9 +815,9 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
isc_result_t result;
|
||||
cfg_parser_t *pctx = NULL;
|
||||
cfg_obj_t *config = NULL;
|
||||
const cfg_obj_t *key = NULL;
|
||||
const cfg_obj_t *algobj = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
cfg_obj_t *key = NULL;
|
||||
cfg_obj_t *algobj = NULL;
|
||||
cfg_obj_t *secretobj = NULL;
|
||||
const char *algstr = NULL;
|
||||
const char *secretstr = NULL;
|
||||
controlkey_t *keyid = NULL;
|
||||
@@ -850,7 +848,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
secretstr = cfg_obj_asstring(secretobj);
|
||||
|
||||
if (ns_config_getkeyalgorithm(algstr, NULL, NULL) != ISC_R_SUCCESS) {
|
||||
if (ns_config_getkeyalgorithm(algstr, NULL) != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(key, ns_g_lctx,
|
||||
ISC_LOG_WARNING,
|
||||
"unsupported algorithm '%s' in "
|
||||
@@ -900,13 +898,12 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
|
||||
* valid or both are NULL.
|
||||
*/
|
||||
static void
|
||||
get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
|
||||
const cfg_obj_t **global_keylistp,
|
||||
const cfg_obj_t **control_keylistp)
|
||||
get_key_info(cfg_obj_t *config, cfg_obj_t *control,
|
||||
cfg_obj_t **global_keylistp, cfg_obj_t **control_keylistp)
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *control_keylist = NULL;
|
||||
const cfg_obj_t *global_keylist = NULL;
|
||||
cfg_obj_t *control_keylist = NULL;
|
||||
cfg_obj_t *global_keylist = NULL;
|
||||
|
||||
REQUIRE(global_keylistp != NULL && *global_keylistp == NULL);
|
||||
REQUIRE(control_keylistp != NULL && *control_keylistp == NULL);
|
||||
@@ -925,15 +922,16 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
|
||||
}
|
||||
|
||||
static void
|
||||
update_listener(ns_controls_t *cp, controllistener_t **listenerp,
|
||||
const cfg_obj_t *control, const cfg_obj_t *config,
|
||||
isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
|
||||
const char *socktext, isc_sockettype_t type)
|
||||
update_listener(ns_controls_t *cp,
|
||||
controllistener_t **listenerp, cfg_obj_t *control,
|
||||
cfg_obj_t *config, isc_sockaddr_t *addr,
|
||||
cfg_aclconfctx_t *aclconfctx, const char *socktext,
|
||||
isc_sockettype_t type)
|
||||
{
|
||||
controllistener_t *listener;
|
||||
const cfg_obj_t *allow;
|
||||
const cfg_obj_t *global_keylist = NULL;
|
||||
const cfg_obj_t *control_keylist = NULL;
|
||||
cfg_obj_t *allow;
|
||||
cfg_obj_t *global_keylist = NULL;
|
||||
cfg_obj_t *control_keylist = NULL;
|
||||
dns_acl_t *new_acl = NULL;
|
||||
controlkeylist_t keys;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
@@ -1064,15 +1062,15 @@ update_listener(ns_controls_t *cp, controllistener_t **listenerp,
|
||||
|
||||
static void
|
||||
add_listener(ns_controls_t *cp, controllistener_t **listenerp,
|
||||
const cfg_obj_t *control, const cfg_obj_t *config,
|
||||
isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
|
||||
const char *socktext, isc_sockettype_t type)
|
||||
cfg_obj_t *control, cfg_obj_t *config, isc_sockaddr_t *addr,
|
||||
cfg_aclconfctx_t *aclconfctx, const char *socktext,
|
||||
isc_sockettype_t type)
|
||||
{
|
||||
isc_mem_t *mctx = cp->server->mctx;
|
||||
controllistener_t *listener;
|
||||
const cfg_obj_t *allow;
|
||||
const cfg_obj_t *global_keylist = NULL;
|
||||
const cfg_obj_t *control_keylist = NULL;
|
||||
cfg_obj_t *allow;
|
||||
cfg_obj_t *global_keylist = NULL;
|
||||
cfg_obj_t *control_keylist = NULL;
|
||||
dns_acl_t *new_acl = NULL;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
|
||||
@@ -1202,13 +1200,13 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *aclconfctx)
|
||||
{
|
||||
controllistener_t *listener;
|
||||
controllistenerlist_t new_listeners;
|
||||
const cfg_obj_t *controlslist = NULL;
|
||||
const cfg_listelt_t *element, *element2;
|
||||
cfg_obj_t *controlslist = NULL;
|
||||
cfg_listelt_t *element, *element2;
|
||||
char socktext[ISC_SOCKADDR_FORMATSIZE];
|
||||
|
||||
ISC_LIST_INIT(new_listeners);
|
||||
@@ -1230,8 +1228,8 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
for (element = cfg_list_first(controlslist);
|
||||
element != NULL;
|
||||
element = cfg_list_next(element)) {
|
||||
const cfg_obj_t *controls;
|
||||
const cfg_obj_t *inetcontrols = NULL;
|
||||
cfg_obj_t *controls;
|
||||
cfg_obj_t *inetcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
(void)cfg_map_get(controls, "inet", &inetcontrols);
|
||||
@@ -1241,9 +1239,9 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
for (element2 = cfg_list_first(inetcontrols);
|
||||
element2 != NULL;
|
||||
element2 = cfg_list_next(element2)) {
|
||||
const cfg_obj_t *control;
|
||||
const cfg_obj_t *obj;
|
||||
isc_sockaddr_t addr;
|
||||
cfg_obj_t *control;
|
||||
cfg_obj_t *obj;
|
||||
isc_sockaddr_t *addr;
|
||||
|
||||
/*
|
||||
* The parser handles BIND 8 configuration file
|
||||
@@ -1253,12 +1251,12 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
control = cfg_listelt_value(element2);
|
||||
|
||||
obj = cfg_tuple_get(control, "address");
|
||||
addr = *cfg_obj_assockaddr(obj);
|
||||
if (isc_sockaddr_getport(&addr) == 0)
|
||||
isc_sockaddr_setport(&addr,
|
||||
addr = cfg_obj_assockaddr(obj);
|
||||
if (isc_sockaddr_getport(addr) == 0)
|
||||
isc_sockaddr_setport(addr,
|
||||
NS_CONTROL_PORT);
|
||||
|
||||
isc_sockaddr_format(&addr, socktext,
|
||||
isc_sockaddr_format(addr, socktext,
|
||||
sizeof(socktext));
|
||||
|
||||
isc_log_write(ns_g_lctx,
|
||||
@@ -1269,7 +1267,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
socktext);
|
||||
|
||||
update_listener(cp, &listener, control, config,
|
||||
&addr, aclconfctx, socktext,
|
||||
addr, aclconfctx, socktext,
|
||||
isc_sockettype_tcp);
|
||||
|
||||
if (listener != NULL)
|
||||
@@ -1284,7 +1282,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
* This is a new listener.
|
||||
*/
|
||||
add_listener(cp, &listener, control,
|
||||
config, &addr, aclconfctx,
|
||||
config, addr, aclconfctx,
|
||||
socktext,
|
||||
isc_sockettype_tcp);
|
||||
|
||||
@@ -1296,8 +1294,8 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
for (element = cfg_list_first(controlslist);
|
||||
element != NULL;
|
||||
element = cfg_list_next(element)) {
|
||||
const cfg_obj_t *controls;
|
||||
const cfg_obj_t *unixcontrols = NULL;
|
||||
cfg_obj_t *controls;
|
||||
cfg_obj_t *unixcontrols = NULL;
|
||||
|
||||
controls = cfg_listelt_value(element);
|
||||
(void)cfg_map_get(controls, "unix", &unixcontrols);
|
||||
@@ -1307,8 +1305,8 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
|
||||
for (element2 = cfg_list_first(unixcontrols);
|
||||
element2 != NULL;
|
||||
element2 = cfg_list_next(element2)) {
|
||||
const cfg_obj_t *control;
|
||||
const cfg_obj_t *path;
|
||||
cfg_obj_t *control;
|
||||
cfg_obj_t *path;
|
||||
isc_sockaddr_t addr;
|
||||
isc_result_t result;
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2001, 2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: config.h,v 1.6.18.6 2006/02/28 03:10:47 marka Exp $ */
|
||||
/* $Id: config.h,v 1.6.18.3 2005/04/29 00:15:34 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_CONFIG_H
|
||||
#define NAMED_CONFIG_H 1
|
||||
@@ -31,28 +31,27 @@ isc_result_t
|
||||
ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
|
||||
|
||||
isc_result_t
|
||||
ns_config_get(const cfg_obj_t **maps, const char* name, const cfg_obj_t **obj);
|
||||
ns_config_get(cfg_obj_t **maps, const char* name, cfg_obj_t **obj);
|
||||
|
||||
isc_result_t
|
||||
ns_checknames_get(const cfg_obj_t **maps, const char* name,
|
||||
const cfg_obj_t **obj);
|
||||
ns_checknames_get(cfg_obj_t **maps, const char* name, cfg_obj_t **obj);
|
||||
|
||||
int
|
||||
ns_config_listcount(const cfg_obj_t *list);
|
||||
ns_config_listcount(cfg_obj_t *list);
|
||||
|
||||
isc_result_t
|
||||
ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
|
||||
dns_rdataclass_t *classp);
|
||||
|
||||
isc_result_t
|
||||
ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
|
||||
dns_rdatatype_t *typep);
|
||||
|
||||
dns_zonetype_t
|
||||
ns_config_getzonetype(const cfg_obj_t *zonetypeobj);
|
||||
ns_config_getzonetype(cfg_obj_t *zonetypeobj);
|
||||
|
||||
isc_result_t
|
||||
ns_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
ns_config_getiplist(cfg_obj_t *config, cfg_obj_t *list,
|
||||
in_port_t defport, isc_mem_t *mctx,
|
||||
isc_sockaddr_t **addrsp, isc_uint32_t *countp);
|
||||
|
||||
@@ -61,19 +60,18 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
isc_uint32_t count);
|
||||
|
||||
isc_result_t
|
||||
ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
|
||||
isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
dns_name_t ***keys, isc_uint32_t *countp);
|
||||
ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
|
||||
isc_sockaddr_t **addrsp, dns_name_t ***keys,
|
||||
isc_uint32_t *countp);
|
||||
|
||||
void
|
||||
ns_config_putipandkeylist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
|
||||
dns_name_t ***keys, isc_uint32_t count);
|
||||
|
||||
isc_result_t
|
||||
ns_config_getport(const cfg_obj_t *config, in_port_t *portp);
|
||||
ns_config_getport(cfg_obj_t *config, in_port_t *portp);
|
||||
|
||||
isc_result_t
|
||||
ns_config_getkeyalgorithm(const char *str, dns_name_t **name,
|
||||
isc_uint16_t *digestbits);
|
||||
ns_config_getkeyalgorithm(const char *str, dns_name_t **name);
|
||||
|
||||
#endif /* NAMED_CONFIG_H */
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2001-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: control.h,v 1.14.18.8 2006/03/09 23:46:20 marka Exp $ */
|
||||
/* $Id: control.h,v 1.14.18.5 2005/04/27 05:00:35 sra Exp $ */
|
||||
|
||||
#ifndef NAMED_CONTROL_H
|
||||
#define NAMED_CONTROL_H 1
|
||||
@@ -54,7 +54,6 @@
|
||||
#define NS_COMMAND_RECURSING "recursing"
|
||||
#define NS_COMMAND_NULL "null"
|
||||
#define NS_COMMAND_NOTIFY "notify"
|
||||
#define NS_COMMAND_VALIDATION "validation"
|
||||
|
||||
isc_result_t
|
||||
ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
|
||||
@@ -72,7 +71,7 @@ ns_controls_destroy(ns_controls_t **ctrlsp);
|
||||
*/
|
||||
|
||||
isc_result_t
|
||||
ns_controls_configure(ns_controls_t *controls, const cfg_obj_t *config,
|
||||
ns_controls_configure(ns_controls_t *controls, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *aclconfctx);
|
||||
/*%<
|
||||
* Configure zero or more command channels into 'controls'
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: globals.h,v 1.64.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: globals.h,v 1.64.18.2 2005/04/29 00:15:34 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_GLOBALS_H
|
||||
#define NAMED_GLOBALS_H 1
|
||||
@@ -77,7 +77,7 @@ EXTERN unsigned int ns_g_debuglevel INIT(0);
|
||||
* Current configuration information.
|
||||
*/
|
||||
EXTERN cfg_obj_t * ns_g_config INIT(NULL);
|
||||
EXTERN const cfg_obj_t * ns_g_defaults INIT(NULL);
|
||||
EXTERN cfg_obj_t * ns_g_defaults INIT(NULL);
|
||||
EXTERN const char * ns_g_conffile INIT(NS_SYSCONFDIR
|
||||
"/named.conf");
|
||||
EXTERN const char * ns_g_keyfile INIT(NS_SYSCONFDIR
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: logconf.h,v 1.11.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: logconf.h,v 1.11.18.2 2005/04/29 00:15:35 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_LOGCONF_H
|
||||
#define NAMED_LOGCONF_H 1
|
||||
@@ -25,7 +25,7 @@
|
||||
#include <isc/log.h>
|
||||
|
||||
isc_result_t
|
||||
ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt);
|
||||
ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt);
|
||||
/*%<
|
||||
* Set up the logging configuration in '*logconf' according to
|
||||
* the named.conf data in 'logstmt'.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: lwresd.h,v 1.13.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: lwresd.h,v 1.13.18.2 2005/04/29 00:15:36 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_LWRESD_H
|
||||
#define NAMED_LWRESD_H 1
|
||||
@@ -58,7 +58,7 @@ struct ns_lwreslistener {
|
||||
* Configure lwresd.
|
||||
*/
|
||||
isc_result_t
|
||||
ns_lwresd_configure(isc_mem_t *mctx, const cfg_obj_t *config);
|
||||
ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config);
|
||||
|
||||
isc_result_t
|
||||
ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
|
||||
@@ -75,8 +75,7 @@ ns_lwresd_shutdown(void);
|
||||
*/
|
||||
/*% create manager */
|
||||
isc_result_t
|
||||
ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,
|
||||
ns_lwresd_t **lwresdp);
|
||||
ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres, ns_lwresd_t **lwresdp);
|
||||
|
||||
/*% attach to manager */
|
||||
void
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: server.h,v 1.73.18.8 2006/03/09 23:46:20 marka Exp $ */
|
||||
/* $Id: server.h,v 1.73.18.5 2005/08/15 01:46:49 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_SERVER_H
|
||||
#define NAMED_SERVER_H 1
|
||||
@@ -219,12 +219,6 @@ ns_server_dumprecursing(ns_server_t *server);
|
||||
* Maintain a list of dispatches that require reserved ports.
|
||||
*/
|
||||
void
|
||||
ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr);
|
||||
|
||||
/*%
|
||||
* Enable or disable dnssec validation.
|
||||
*/
|
||||
isc_result_t
|
||||
ns_server_validation(ns_server_t *server, char *args);
|
||||
ns_add_reserved_dispatch(ns_server_t *server, isc_sockaddr_t *addr);
|
||||
|
||||
#endif /* NAMED_SERVER_H */
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: sortlist.h,v 1.5.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: sortlist.h,v 1.5.18.2 2005/04/29 00:15:38 marka Exp $ */
|
||||
|
||||
#ifndef NAMED_SORTLIST_H
|
||||
#define NAMED_SORTLIST_H 1
|
||||
@@ -30,7 +30,7 @@
|
||||
* Type for callback functions that rank addresses.
|
||||
*/
|
||||
typedef int
|
||||
(*dns_addressorderfunc_t)(const isc_netaddr_t *address, const void *arg);
|
||||
(*dns_addressorderfunc_t)(isc_netaddr_t *address, void *arg);
|
||||
|
||||
/*%
|
||||
* Return value type for setup_sortlist.
|
||||
@@ -42,8 +42,7 @@ typedef enum {
|
||||
} ns_sortlisttype_t;
|
||||
|
||||
ns_sortlisttype_t
|
||||
ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
|
||||
const void **argp);
|
||||
ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp);
|
||||
/*%<
|
||||
* Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
|
||||
*
|
||||
@@ -58,14 +57,14 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
|
||||
*/
|
||||
|
||||
int
|
||||
ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg);
|
||||
ns_sortlist_addrorder1(isc_netaddr_t *addr, void *arg);
|
||||
/*%<
|
||||
* Find the sort order of 'addr' in 'arg', the matching element
|
||||
* of a 1-element top-level sortlist statement.
|
||||
*/
|
||||
|
||||
int
|
||||
ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg);
|
||||
ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg);
|
||||
/*%<
|
||||
* Find the sort order of 'addr' in 'arg', a topology-like
|
||||
* ACL forming the second element in a 2-element top-level
|
||||
@@ -75,7 +74,7 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg);
|
||||
void
|
||||
ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, isc_netaddr_t *client_addr,
|
||||
dns_addressorderfunc_t *orderp,
|
||||
const void **argp);
|
||||
void **argp);
|
||||
/*%<
|
||||
* Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
|
||||
* If a sortlist statement applies, return in '*orderp' a pointer to a function
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: tkeyconf.h,v 1.10.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: tkeyconf.h,v 1.10.18.2 2005/04/29 00:15:38 marka Exp $ */
|
||||
|
||||
#ifndef NS_TKEYCONF_H
|
||||
#define NS_TKEYCONF_H 1
|
||||
@@ -30,8 +30,8 @@
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
isc_result_t
|
||||
ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
|
||||
isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
|
||||
ns_tkeyctx_fromconfig(cfg_obj_t *options, isc_mem_t *mctx, isc_entropy_t *ectx,
|
||||
dns_tkeyctx_t **tctxp);
|
||||
/*%<
|
||||
* Create a TKEY context and configure it, including the default DH key
|
||||
* and default domain, according to 'options'.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: tsigconf.h,v 1.10.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: tsigconf.h,v 1.10.18.2 2005/04/29 00:15:38 marka Exp $ */
|
||||
|
||||
#ifndef NS_TSIGCONF_H
|
||||
#define NS_TSIGCONF_H 1
|
||||
@@ -28,7 +28,7 @@
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
isc_result_t
|
||||
ns_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
|
||||
/*%<
|
||||
* Create a TSIG key ring and configure it according to the 'key'
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: zoneconf.h,v 1.19.18.5 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: zoneconf.h,v 1.19.18.3 2005/04/27 05:00:37 sra Exp $ */
|
||||
|
||||
#ifndef NS_ZONECONF_H
|
||||
#define NS_ZONECONF_H 1
|
||||
@@ -31,9 +31,8 @@
|
||||
ISC_LANG_BEGINDECLS
|
||||
|
||||
isc_result_t
|
||||
ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_zone_t *zone);
|
||||
ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
|
||||
cfg_aclconfctx_t *ac, dns_zone_t *zone);
|
||||
/*%<
|
||||
* Configure or reconfigure a zone according to the named.conf
|
||||
* data in 'cctx' and 'czone'.
|
||||
@@ -50,7 +49,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
*/
|
||||
|
||||
isc_boolean_t
|
||||
ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
|
||||
ns_zone_reusable(dns_zone_t *zone, cfg_obj_t *zconfig);
|
||||
/*%<
|
||||
* If 'zone' can be safely reconfigured according to the configuration
|
||||
* data in 'zconfig', return ISC_TRUE. If the configuration data is so
|
||||
|
||||
+26
-28
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: logconf.c,v 1.35.18.5 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: logconf.c,v 1.35.18.3 2005/08/23 02:31:31 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -43,13 +43,13 @@
|
||||
* in 'ccat' and add it to 'lctx'.
|
||||
*/
|
||||
static isc_result_t
|
||||
category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
|
||||
category_fromconf(cfg_obj_t *ccat, isc_logconfig_t *lctx) {
|
||||
isc_result_t result;
|
||||
const char *catname;
|
||||
isc_logcategory_t *category;
|
||||
isc_logmodule_t *module;
|
||||
const cfg_obj_t *destinations = NULL;
|
||||
const cfg_listelt_t *element = NULL;
|
||||
cfg_obj_t *destinations = NULL;
|
||||
cfg_listelt_t *element = NULL;
|
||||
|
||||
catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
|
||||
category = isc_log_categorybyname(ns_g_lctx, catname);
|
||||
@@ -70,7 +70,7 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *channel = cfg_listelt_value(element);
|
||||
cfg_obj_t *channel = cfg_listelt_value(element);
|
||||
const char *channelname = cfg_obj_asstring(channel);
|
||||
|
||||
result = isc_log_usechannel(lctx, channelname, category,
|
||||
@@ -91,18 +91,18 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
|
||||
* in 'cchan' and add it to 'lctx'.
|
||||
*/
|
||||
static isc_result_t
|
||||
channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
|
||||
channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
|
||||
isc_result_t result;
|
||||
isc_logdestination_t dest;
|
||||
unsigned int type;
|
||||
unsigned int flags = 0;
|
||||
int level;
|
||||
const char *channelname;
|
||||
const cfg_obj_t *fileobj = NULL;
|
||||
const cfg_obj_t *syslogobj = NULL;
|
||||
const cfg_obj_t *nullobj = NULL;
|
||||
const cfg_obj_t *stderrobj = NULL;
|
||||
const cfg_obj_t *severity = NULL;
|
||||
cfg_obj_t *fileobj = NULL;
|
||||
cfg_obj_t *syslogobj = NULL;
|
||||
cfg_obj_t *nullobj = NULL;
|
||||
cfg_obj_t *stderrobj = NULL;
|
||||
cfg_obj_t *severity = NULL;
|
||||
int i;
|
||||
|
||||
channelname = cfg_obj_asstring(cfg_map_getname(channel));
|
||||
@@ -132,10 +132,9 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
|
||||
type = ISC_LOG_TONULL;
|
||||
|
||||
if (fileobj != NULL) {
|
||||
const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
|
||||
const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
|
||||
const cfg_obj_t *versionsobj =
|
||||
cfg_tuple_get(fileobj, "versions");
|
||||
cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
|
||||
cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
|
||||
cfg_obj_t *versionsobj = cfg_tuple_get(fileobj, "versions");
|
||||
isc_int32_t versions = ISC_LOG_ROLLNEVER;
|
||||
isc_offset_t size = 0;
|
||||
|
||||
@@ -177,9 +176,9 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
|
||||
* Munge flags.
|
||||
*/
|
||||
{
|
||||
const cfg_obj_t *printcat = NULL;
|
||||
const cfg_obj_t *printsev = NULL;
|
||||
const cfg_obj_t *printtime = NULL;
|
||||
cfg_obj_t *printcat = NULL;
|
||||
cfg_obj_t *printsev = NULL;
|
||||
cfg_obj_t *printtime = NULL;
|
||||
|
||||
(void)cfg_map_get(channel, "print-category", &printcat);
|
||||
(void)cfg_map_get(channel, "print-severity", &printsev);
|
||||
@@ -245,14 +244,13 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
|
||||
ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt) {
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *channels = NULL;
|
||||
const cfg_obj_t *categories = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *channels = NULL;
|
||||
cfg_obj_t *categories = NULL;
|
||||
cfg_listelt_t *element;
|
||||
isc_boolean_t default_set = ISC_FALSE;
|
||||
isc_boolean_t unmatched_set = ISC_FALSE;
|
||||
const cfg_obj_t *catname;
|
||||
|
||||
CHECK(ns_log_setdefaultchannels(logconf));
|
||||
|
||||
@@ -261,7 +259,7 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *channel = cfg_listelt_value(element);
|
||||
cfg_obj_t *channel = cfg_listelt_value(element);
|
||||
CHECK(channel_fromconf(channel, logconf));
|
||||
}
|
||||
|
||||
@@ -270,15 +268,15 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *category = cfg_listelt_value(element);
|
||||
cfg_obj_t *category = cfg_listelt_value(element);
|
||||
CHECK(category_fromconf(category, logconf));
|
||||
if (!default_set) {
|
||||
catname = cfg_tuple_get(category, "name");
|
||||
cfg_obj_t *catname = cfg_tuple_get(category, "name");
|
||||
if (strcmp(cfg_obj_asstring(catname), "default") == 0)
|
||||
default_set = ISC_TRUE;
|
||||
}
|
||||
if (!unmatched_set) {
|
||||
catname = cfg_tuple_get(category, "name");
|
||||
cfg_obj_t *catname = cfg_tuple_get(category, "name");
|
||||
if (strcmp(cfg_obj_asstring(catname), "unmatched") == 0)
|
||||
unmatched_set = ISC_TRUE;
|
||||
}
|
||||
|
||||
+3
-3
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: lwdgabn.c,v 1.15.18.5 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: lwdgabn.c,v 1.15.18.3 2005/06/23 04:23:13 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -122,7 +122,7 @@ sort_addresses(ns_lwdclient_t *client) {
|
||||
rankedaddress *addrs;
|
||||
isc_netaddr_t remote;
|
||||
dns_addressorderfunc_t order;
|
||||
const void *arg;
|
||||
void *arg;
|
||||
ns_lwresd_t *lwresd = client->clientmgr->listener->manager;
|
||||
unsigned int i;
|
||||
isc_result_t result;
|
||||
|
||||
+11
-11
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: lwresd.c,v 1.46.18.7 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: lwresd.c,v 1.46.18.5 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file
|
||||
* \brief
|
||||
@@ -286,14 +286,14 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
|
||||
* Handle lwresd manager objects
|
||||
*/
|
||||
isc_result_t
|
||||
ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,
|
||||
ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres,
|
||||
ns_lwresd_t **lwresdp)
|
||||
{
|
||||
ns_lwresd_t *lwresd;
|
||||
const char *vname;
|
||||
dns_rdataclass_t vclass;
|
||||
const cfg_obj_t *obj, *viewobj, *searchobj;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *obj, *viewobj, *searchobj;
|
||||
cfg_listelt_t *element;
|
||||
isc_result_t result;
|
||||
|
||||
INSIST(lwresdp != NULL && *lwresdp == NULL);
|
||||
@@ -357,7 +357,7 @@ ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *search;
|
||||
cfg_obj_t *search;
|
||||
const char *searchstr;
|
||||
isc_buffer_t namebuf;
|
||||
dns_fixedname_t fname;
|
||||
@@ -752,11 +752,11 @@ configure_listener(isc_sockaddr_t *address, ns_lwresd_t *lwresd,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_lwresd_configure(isc_mem_t *mctx, const cfg_obj_t *config) {
|
||||
const cfg_obj_t *lwreslist = NULL;
|
||||
const cfg_obj_t *lwres = NULL;
|
||||
const cfg_obj_t *listenerslist = NULL;
|
||||
const cfg_listelt_t *element = NULL;
|
||||
ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
|
||||
cfg_obj_t *lwreslist = NULL;
|
||||
cfg_obj_t *lwres = NULL;
|
||||
cfg_obj_t *listenerslist = NULL;
|
||||
cfg_listelt_t *element = NULL;
|
||||
ns_lwreslistener_t *listener;
|
||||
ns_lwreslistenerlist_t newlisteners;
|
||||
isc_result_t result;
|
||||
|
||||
+4
-5
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: main.c,v 1.136.18.16 2006/01/05 01:41:28 marka Exp $ */
|
||||
/* $Id: main.c,v 1.136.18.13 2005/09/18 07:58:05 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -484,7 +484,7 @@ create_managers(void) {
|
||||
result = isc_taskmgr_create(ns_g_mctx, ns_g_cpus, 0, &ns_g_taskmgr);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
UNEXPECTED_ERROR(__FILE__, __LINE__,
|
||||
"isc_taskmgr_create() failed: %s",
|
||||
"ns_taskmgr_create() failed: %s",
|
||||
isc_result_totext(result));
|
||||
return (ISC_R_UNEXPECTED);
|
||||
}
|
||||
@@ -492,7 +492,7 @@ create_managers(void) {
|
||||
result = isc_timermgr_create(ns_g_mctx, &ns_g_timermgr);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
UNEXPECTED_ERROR(__FILE__, __LINE__,
|
||||
"isc_timermgr_create() failed: %s",
|
||||
"ns_timermgr_create() failed: %s",
|
||||
isc_result_totext(result));
|
||||
return (ISC_R_UNEXPECTED);
|
||||
}
|
||||
@@ -912,7 +912,6 @@ main(int argc, char *argv[]) {
|
||||
}
|
||||
}
|
||||
isc_mem_destroy(&ns_g_mctx);
|
||||
isc_mem_checkdestroyed(stderr);
|
||||
|
||||
ns_main_setmemstats(NULL);
|
||||
|
||||
|
||||
+2
-3
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -13,7 +13,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: named.8,v 1.20.18.9 2006/01/18 04:59:11 marka Exp $
|
||||
.\" $Id: named.8,v 1.20.18.7 2005/10/13 02:53:01 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -176,7 +176,6 @@ RFC 1034,
|
||||
RFC 1035,
|
||||
\fBrndc\fR(8),
|
||||
\fBlwresd\fR(8),
|
||||
\fBnamed.conf\fR(5),
|
||||
BIND 9 Administrator Reference Manual.
|
||||
.SH "AUTHOR"
|
||||
.PP
|
||||
|
||||
+6
-27
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
.\" purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -12,7 +12,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: named.conf.5,v 1.1.2.18 2006/03/10 00:47:37 marka Exp $
|
||||
.\" $Id: named.conf.5,v 1.1.2.15 2005/10/13 02:53:01 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -69,7 +69,6 @@ server ( \fIipv4_address\fR\fI[/prefixlen]\fR | \fIipv6_address\fR\fI[/prefixlen
|
||||
bogus \fIboolean\fR;
|
||||
edns \fIboolean\fR;
|
||||
edns\-udp\-size \fIinteger\fR;
|
||||
max\-udp\-size \fIinteger\fR;
|
||||
provide\-ixfr \fIboolean\fR;
|
||||
request\-ixfr \fIboolean\fR;
|
||||
keys \fIserver_key\fR;
|
||||
@@ -201,9 +200,7 @@ options {
|
||||
check\-names ( master | slave | response )
|
||||
( fail | warn | ignore );
|
||||
check\-mx ( fail | warn | ignore );
|
||||
check\-integrity \fIboolean\fR;
|
||||
check\-mx\-cname ( fail | warn | ignore );
|
||||
check\-srv\-cname ( fail | warn | ignore );
|
||||
integrity\-check \fIboolean\fR;
|
||||
cache\-file \fIquoted_string\fR;
|
||||
suppress\-initial\-notify \fIboolean\fR; // not yet implemented
|
||||
preferred\-glue \fIstring\fR;
|
||||
@@ -211,16 +208,13 @@ options {
|
||||
( \fIquoted_string\fR [port \fIinteger\fR] |
|
||||
\fIipv4_address\fR [port \fIinteger\fR] |
|
||||
\fIipv6_address\fR [port \fIinteger\fR] ); ...
|
||||
};
|
||||
}
|
||||
edns\-udp\-size \fIinteger\fR;
|
||||
max\-udp\-size \fIinteger\fR;
|
||||
root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ];
|
||||
disable\-algorithms \fIstring\fR { \fIstring\fR; ... };
|
||||
dnssec\-enable \fIboolean\fR;
|
||||
dnssec\-validation \fIboolean\fR;
|
||||
dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;
|
||||
dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
|
||||
dnssec\-accept\-expired \fIboolean\fR;
|
||||
empty\-server \fIstring\fR;
|
||||
empty\-contact \fIstring\fR;
|
||||
empty\-zones\-enable \fIboolean\fR;
|
||||
@@ -232,7 +226,6 @@ options {
|
||||
allow\-transfer { \fIaddress_match_element\fR; ... };
|
||||
allow\-update { \fIaddress_match_element\fR; ... };
|
||||
allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
|
||||
update\-check\-ksk \fIboolean\fR;
|
||||
notify \fInotifytype\fR;
|
||||
notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
@@ -266,8 +259,6 @@ options {
|
||||
use\-alt\-transfer\-source \fIboolean\fR;
|
||||
zone\-statistics \fIboolean\fR;
|
||||
key\-directory \fIquoted_string\fR;
|
||||
zero\-no\-soa\-ttl \fIboolean\fR;
|
||||
zero\-no\-soa\-ttl\-cache \fIboolean\fR;
|
||||
allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete
|
||||
deallocate\-on\-exit \fIboolean\fR; // obsolete
|
||||
fake\-iquery \fIboolean\fR; // obsolete
|
||||
@@ -332,9 +323,7 @@ view \fIstring\fR \fIoptional_class\fR {
|
||||
check\-names ( master | slave | response )
|
||||
( fail | warn | ignore );
|
||||
check\-mx ( fail | warn | ignore );
|
||||
check\-integrity \fIboolean\fR;
|
||||
check\-mx\-cname ( fail | warn | ignore );
|
||||
check\-srv\-cname ( fail | warn | ignore );
|
||||
integrity\-check \fIboolean\fR;
|
||||
cache\-file \fIquoted_string\fR;
|
||||
suppress\-initial\-notify \fIboolean\fR; // not yet implemented
|
||||
preferred\-glue \fIstring\fR;
|
||||
@@ -344,14 +333,11 @@ view \fIstring\fR \fIoptional_class\fR {
|
||||
\fIipv6_address\fR [port \fIinteger\fR] ); ...
|
||||
};
|
||||
edns\-udp\-size \fIinteger\fR;
|
||||
max\-udp\-size \fIinteger\fR;
|
||||
root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ];
|
||||
disable\-algorithms \fIstring\fR { \fIstring\fR; ... };
|
||||
dnssec\-enable \fIboolean\fR;
|
||||
dnssec\-validation \fIboolean\fR;
|
||||
dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;
|
||||
dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
|
||||
dnssec\-accept\-expired \fIboolean\fR;
|
||||
empty\-server \fIstring\fR;
|
||||
empty\-contact \fIstring\fR;
|
||||
empty\-zones\-enable \fIboolean\fR;
|
||||
@@ -363,7 +349,6 @@ view \fIstring\fR \fIoptional_class\fR {
|
||||
allow\-transfer { \fIaddress_match_element\fR; ... };
|
||||
allow\-update { \fIaddress_match_element\fR; ... };
|
||||
allow\-update\-forwarding { \fIaddress_match_element\fR; ... };
|
||||
update\-check\-ksk \fIboolean\fR;
|
||||
notify \fInotifytype\fR;
|
||||
notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
@@ -397,8 +382,6 @@ view \fIstring\fR \fIoptional_class\fR {
|
||||
use\-alt\-transfer\-source \fIboolean\fR;
|
||||
zone\-statistics \fIboolean\fR;
|
||||
key\-directory \fIquoted_string\fR;
|
||||
zero\-no\-soa\-ttl \fIboolean\fR;
|
||||
zero\-no\-soa\-ttl\-cache \fIboolean\fR;
|
||||
allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete
|
||||
fetch\-glue \fIboolean\fR; // obsolete
|
||||
maintain\-ixfr\-base \fIboolean\fR; // obsolete
|
||||
@@ -421,13 +404,10 @@ zone \fIstring\fR \fIoptional_class\fR {
|
||||
delegation\-only \fIboolean\fR;
|
||||
check\-names ( fail | warn | ignore );
|
||||
check\-mx ( fail | warn | ignore );
|
||||
check\-integrity \fIboolean\fR;
|
||||
check\-mx\-cname ( fail | warn | ignore );
|
||||
check\-srv\-cname ( fail | warn | ignore );
|
||||
integrity\-check \fIboolean\fR;
|
||||
dialup \fIdialuptype\fR;
|
||||
ixfr\-from\-differences \fIboolean\fR;
|
||||
journal \fIquoted_string\fR;
|
||||
zero\-no\-soa\-ttl \fIboolean\fR;
|
||||
allow\-query { \fIaddress_match_element\fR; ... };
|
||||
allow\-transfer { \fIaddress_match_element\fR; ... };
|
||||
allow\-update { \fIaddress_match_element\fR; ... };
|
||||
@@ -437,7 +417,6 @@ zone \fIstring\fR \fIoptional_class\fR {
|
||||
( name | subdomain | wildcard | self ) \fIstring\fR
|
||||
\fIrrtypelist\fR; ...
|
||||
};
|
||||
update\-check\-ksk \fIboolean\fR;
|
||||
notify \fInotifytype\fR;
|
||||
notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
- purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -17,7 +17,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: named.conf.docbook,v 1.1.2.21 2006/03/09 23:38:20 marka Exp $ -->
|
||||
<!-- $Id: named.conf.docbook,v 1.1.2.14 2005/08/18 01:02:58 marka Exp $ -->
|
||||
<refentry>
|
||||
<refentryinfo>
|
||||
<date>Aug 13, 2004</date>
|
||||
@@ -38,7 +38,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
</docinfo>
|
||||
@@ -104,7 +103,6 @@ server ( <replaceable>ipv4_address<optional>/prefixlen</optional></replaceable>
|
||||
bogus <replaceable>boolean</replaceable>;
|
||||
edns <replaceable>boolean</replaceable>;
|
||||
edns-udp-size <replaceable>integer</replaceable>;
|
||||
max-udp-size <replaceable>integer</replaceable>;
|
||||
provide-ixfr <replaceable>boolean</replaceable>;
|
||||
request-ixfr <replaceable>boolean</replaceable>;
|
||||
keys <replaceable>server_key</replaceable>;
|
||||
@@ -247,9 +245,7 @@ options {
|
||||
check-names ( master | slave | response )
|
||||
( fail | warn | ignore );
|
||||
check-mx ( fail | warn | ignore );
|
||||
check-integrity <replaceable>boolean</replaceable>;
|
||||
check-mx-cname ( fail | warn | ignore );
|
||||
check-srv-cname ( fail | warn | ignore );
|
||||
integrity-check <replaceable>boolean</replaceable>;
|
||||
cache-file <replaceable>quoted_string</replaceable>;
|
||||
suppress-initial-notify <replaceable>boolean</replaceable>; // not yet implemented
|
||||
preferred-glue <replaceable>string</replaceable>;
|
||||
@@ -257,16 +253,13 @@ options {
|
||||
( <replaceable>quoted_string</replaceable> <optional>port <replaceable>integer</replaceable></optional> |
|
||||
<replaceable>ipv4_address</replaceable> <optional>port <replaceable>integer</replaceable></optional> |
|
||||
<replaceable>ipv6_address</replaceable> <optional>port <replaceable>integer</replaceable></optional> ); ...
|
||||
};
|
||||
}
|
||||
edns-udp-size <replaceable>integer</replaceable>;
|
||||
max-udp-size <replaceable>integer</replaceable>;
|
||||
root-delegation-only <optional> exclude { <replaceable>quoted_string</replaceable>; ... } </optional>;
|
||||
disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
|
||||
dnssec-enable <replaceable>boolean</replaceable>;
|
||||
dnssec-validation <replaceable>boolean</replaceable>;
|
||||
dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
|
||||
dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
|
||||
dnssec-accept-expired <replaceable>boolean</replaceable>;
|
||||
|
||||
empty-server <replaceable>string</replaceable>;
|
||||
empty-contact <replaceable>string</replaceable>;
|
||||
@@ -281,7 +274,6 @@ options {
|
||||
allow-transfer { <replaceable>address_match_element</replaceable>; ... };
|
||||
allow-update { <replaceable>address_match_element</replaceable>; ... };
|
||||
allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
|
||||
update-check-ksk <replaceable>boolean</replaceable>;
|
||||
|
||||
notify <replaceable>notifytype</replaceable>;
|
||||
notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
|
||||
@@ -321,8 +313,6 @@ options {
|
||||
|
||||
zone-statistics <replaceable>boolean</replaceable>;
|
||||
key-directory <replaceable>quoted_string</replaceable>;
|
||||
zero-no-soa-ttl <replaceable>boolean</replaceable>;
|
||||
zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
|
||||
|
||||
allow-v6-synthesis { <replaceable>address_match_element</replaceable>; ... }; // obsolete
|
||||
deallocate-on-exit <replaceable>boolean</replaceable>; // obsolete
|
||||
@@ -395,9 +385,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
check-names ( master | slave | response )
|
||||
( fail | warn | ignore );
|
||||
check-mx ( fail | warn | ignore );
|
||||
check-integrity <replaceable>boolean</replaceable>;
|
||||
check-mx-cname ( fail | warn | ignore );
|
||||
check-srv-cname ( fail | warn | ignore );
|
||||
integrity-check <replaceable>boolean</replaceable>;
|
||||
cache-file <replaceable>quoted_string</replaceable>;
|
||||
suppress-initial-notify <replaceable>boolean</replaceable>; // not yet implemented
|
||||
preferred-glue <replaceable>string</replaceable>;
|
||||
@@ -407,14 +395,12 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
<replaceable>ipv6_address</replaceable> <optional>port <replaceable>integer</replaceable></optional> ); ...
|
||||
};
|
||||
edns-udp-size <replaceable>integer</replaceable>;
|
||||
max-udp-size <replaceable>integer</replaceable>;
|
||||
root-delegation-only <optional> exclude { <replaceable>quoted_string</replaceable>; ... } </optional>;
|
||||
disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
|
||||
dnssec-enable <replaceable>boolean</replaceable>;
|
||||
dnssec-validation <replaceable>boolean</replaceable>;
|
||||
dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
|
||||
|
||||
dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
|
||||
dnssec-accept-expired <replaceable>boolean</replaceable>;
|
||||
|
||||
empty-server <replaceable>string</replaceable>;
|
||||
empty-contact <replaceable>string</replaceable>;
|
||||
@@ -429,7 +415,6 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
allow-transfer { <replaceable>address_match_element</replaceable>; ... };
|
||||
allow-update { <replaceable>address_match_element</replaceable>; ... };
|
||||
allow-update-forwarding { <replaceable>address_match_element</replaceable>; ... };
|
||||
update-check-ksk <replaceable>boolean</replaceable>;
|
||||
|
||||
notify <replaceable>notifytype</replaceable>;
|
||||
notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
|
||||
@@ -469,8 +454,6 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
|
||||
zone-statistics <replaceable>boolean</replaceable>;
|
||||
key-directory <replaceable>quoted_string</replaceable>;
|
||||
zero-no-soa-ttl <replaceable>boolean</replaceable>;
|
||||
zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
|
||||
|
||||
allow-v6-synthesis { <replaceable>address_match_element</replaceable>; ... }; // obsolete
|
||||
fetch-glue <replaceable>boolean</replaceable>; // obsolete
|
||||
@@ -498,13 +481,10 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
delegation-only <replaceable>boolean</replaceable>;
|
||||
check-names ( fail | warn | ignore );
|
||||
check-mx ( fail | warn | ignore );
|
||||
check-integrity <replaceable>boolean</replaceable>;
|
||||
check-mx-cname ( fail | warn | ignore );
|
||||
check-srv-cname ( fail | warn | ignore );
|
||||
integrity-check <replaceable>boolean</replaceable>;
|
||||
dialup <replaceable>dialuptype</replaceable>;
|
||||
ixfr-from-differences <replaceable>boolean</replaceable>;
|
||||
journal <replaceable>quoted_string</replaceable>;
|
||||
zero-no-soa-ttl <replaceable>boolean</replaceable>;
|
||||
|
||||
allow-query { <replaceable>address_match_element</replaceable>; ... };
|
||||
allow-transfer { <replaceable>address_match_element</replaceable>; ... };
|
||||
@@ -515,7 +495,6 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
|
||||
( name | subdomain | wildcard | self ) <replaceable>string</replaceable>
|
||||
<replaceable>rrtypelist</replaceable>; ...
|
||||
};
|
||||
update-check-ksk <replaceable>boolean</replaceable>;
|
||||
|
||||
notify <replaceable>notifytype</replaceable>;
|
||||
notify-source ( <replaceable>ipv4_address</replaceable> | * ) <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
|
||||
|
||||
+21
-41
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
- purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -13,7 +13,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: named.conf.html,v 1.1.2.24 2006/03/10 00:47:37 marka Exp $ -->
|
||||
<!-- $Id: named.conf.html,v 1.1.2.21 2005/10/13 02:53:02 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -31,7 +31,7 @@
|
||||
<div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525900"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525897"></a><h2>DESCRIPTION</h2>
|
||||
<p><code class="filename">named.conf</code> is the configuration file
|
||||
for
|
||||
<span><strong class="command">named</strong></span>. Statements are enclosed
|
||||
@@ -50,14 +50,14 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525928"></a><h2>ACL</h2>
|
||||
<a name="id2525925"></a><h2>ACL</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
<br>
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525944"></a><h2>KEY</h2>
|
||||
<a name="id2525941"></a><h2>KEY</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
key <em class="replaceable"><code>domain_name</code></em> {<br>
|
||||
algorithm <em class="replaceable"><code>string</code></em>;<br>
|
||||
@@ -66,7 +66,7 @@ key
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525963"></a><h2>MASTERS</h2>
|
||||
<a name="id2525960"></a><h2>MASTERS</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
|
||||
( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
|
||||
@@ -75,13 +75,12 @@ masters
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526009"></a><h2>SERVER</h2>
|
||||
<a name="id2526006"></a><h2>SERVER</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
|
||||
bogus <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
edns <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
edns-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
request-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
keys <em class="replaceable"><code>server_key</code></em>;<br>
|
||||
@@ -97,7 +96,7 @@ server
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526077"></a><h2>TRUSTED-KEYS</h2>
|
||||
<a name="id2526071"></a><h2>TRUSTED-KEYS</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
trusted-keys {<br>
|
||||
<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
|
||||
@@ -105,7 +104,7 @@ trusted-keys
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526103"></a><h2>CONTROLS</h2>
|
||||
<a name="id2526097"></a><h2>CONTROLS</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
controls {<br>
|
||||
inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
|
||||
@@ -117,7 +116,7 @@ controls
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526138"></a><h2>LOGGING</h2>
|
||||
<a name="id2526132"></a><h2>LOGGING</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
logging {<br>
|
||||
channel <em class="replaceable"><code>string</code></em> {<br>
|
||||
@@ -135,7 +134,7 @@ logging
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526177"></a><h2>LWRES</h2>
|
||||
<a name="id2526170"></a><h2>LWRES</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
lwres {<br>
|
||||
listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
|
||||
@@ -148,7 +147,7 @@ lwres
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526218"></a><h2>OPTIONS</h2>
|
||||
<a name="id2526212"></a><h2>OPTIONS</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
options {<br>
|
||||
avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
|
||||
@@ -219,9 +218,7 @@ options
|
||||
check-names ( master | slave | response )<br>
|
||||
( fail | warn | ignore );<br>
|
||||
check-mx ( fail | warn | ignore );<br>
|
||||
check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
check-mx-cname ( fail | warn | ignore );<br>
|
||||
check-srv-cname ( fail | warn | ignore );<br>
|
||||
integrity-check <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
suppress-initial-notify <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
|
||||
preferred-glue <em class="replaceable"><code>string</code></em>;<br>
|
||||
@@ -229,16 +226,13 @@ options
|
||||
( <em class="replaceable"><code>quoted_string</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
|
||||
<em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
|
||||
<em class="replaceable"><code>ipv6_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] ); ...<br>
|
||||
};<br>
|
||||
}<br>
|
||||
edns-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } </span>];<br>
|
||||
disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
|
||||
dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
|
||||
dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
empty-server <em class="replaceable"><code>string</code></em>;<br>
|
||||
empty-contact <em class="replaceable"><code>string</code></em>;<br>
|
||||
@@ -253,7 +247,6 @@ options
|
||||
allow-transfer { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
allow-update { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
notify <em class="replaceable"><code>notifytype</code></em>;<br>
|
||||
notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
|
||||
@@ -293,8 +286,6 @@ options
|
||||
<br>
|
||||
zone-statistics <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
allow-v6-synthesis { <em class="replaceable"><code>address_match_element</code></em>; ... }; // obsolete<br>
|
||||
deallocate-on-exit <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
|
||||
@@ -312,7 +303,7 @@ options
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526934"></a><h2>VIEW</h2>
|
||||
<a name="id2526908"></a><h2>VIEW</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
|
||||
match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
@@ -366,9 +357,7 @@ view
|
||||
check-names ( master | slave | response )<br>
|
||||
( fail | warn | ignore );<br>
|
||||
check-mx ( fail | warn | ignore );<br>
|
||||
check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
check-mx-cname ( fail | warn | ignore );<br>
|
||||
check-srv-cname ( fail | warn | ignore );<br>
|
||||
integrity-check <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
cache-file <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
suppress-initial-notify <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
|
||||
preferred-glue <em class="replaceable"><code>string</code></em>;<br>
|
||||
@@ -378,14 +367,12 @@ view
|
||||
<em class="replaceable"><code>ipv6_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] ); ...<br>
|
||||
};<br>
|
||||
edns-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
max-udp-size <em class="replaceable"><code>integer</code></em>;<br>
|
||||
root-delegation-only [<span class="optional"> exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } </span>];<br>
|
||||
disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
|
||||
dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
|
||||
<br>
|
||||
dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
empty-server <em class="replaceable"><code>string</code></em>;<br>
|
||||
empty-contact <em class="replaceable"><code>string</code></em>;<br>
|
||||
@@ -400,7 +387,6 @@ view
|
||||
allow-transfer { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
allow-update { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
allow-update-forwarding { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
notify <em class="replaceable"><code>notifytype</code></em>;<br>
|
||||
notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
|
||||
@@ -440,8 +426,6 @@ view
|
||||
<br>
|
||||
zone-statistics <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
allow-v6-synthesis { <em class="replaceable"><code>address_match_element</code></em>; ... }; // obsolete<br>
|
||||
fetch-glue <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
|
||||
@@ -451,7 +435,7 @@ view
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527403"></a><h2>ZONE</h2>
|
||||
<a name="id2527358"></a><h2>ZONE</h2>
|
||||
<div class="literallayout"><p><br>
|
||||
zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
|
||||
type ( master | slave | stub | hint |<br>
|
||||
@@ -468,13 +452,10 @@ zone
|
||||
delegation-only <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
check-names ( fail | warn | ignore );<br>
|
||||
check-mx ( fail | warn | ignore );<br>
|
||||
check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
check-mx-cname ( fail | warn | ignore );<br>
|
||||
check-srv-cname ( fail | warn | ignore );<br>
|
||||
integrity-check <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
dialup <em class="replaceable"><code>dialuptype</code></em>;<br>
|
||||
ixfr-from-differences <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
journal <em class="replaceable"><code>quoted_string</code></em>;<br>
|
||||
zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
allow-query { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
allow-transfer { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
|
||||
@@ -485,7 +466,6 @@ zone
|
||||
( name | subdomain | wildcard | self ) <em class="replaceable"><code>string</code></em><br>
|
||||
<em class="replaceable"><code>rrtypelist</code></em>; ...<br>
|
||||
};<br>
|
||||
update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
|
||||
<br>
|
||||
notify <em class="replaceable"><code>notifytype</code></em>;<br>
|
||||
notify-source ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
|
||||
@@ -535,12 +515,12 @@ zone
|
||||
</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527824"></a><h2>FILES</h2>
|
||||
<a name="id2527772"></a><h2>FILES</h2>
|
||||
<p><code class="filename">/etc/named.conf</code>
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527835"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2527784"></a><h2>SEE ALSO</h2>
|
||||
<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>.
|
||||
|
||||
+4
-11
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -18,7 +18,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: named.docbook,v 1.7.18.6 2006/01/17 23:49:31 marka Exp $ -->
|
||||
<!-- $Id: named.docbook,v 1.7.18.4 2005/07/19 05:55:43 marka Exp $ -->
|
||||
<refentry id="man.named">
|
||||
<refentryinfo>
|
||||
<date>June 30, 2000</date>
|
||||
@@ -39,7 +39,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
<copyright>
|
||||
@@ -352,16 +351,10 @@
|
||||
<citetitle>RFC 1034</citetitle>,
|
||||
<citetitle>RFC 1035</citetitle>,
|
||||
<citerefentry>
|
||||
<refentrytitle>rndc</refentrytitle>
|
||||
<manvolnum>8</manvolnum>
|
||||
<refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>lwresd</refentrytitle>
|
||||
<manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citerefentry>
|
||||
<refentrytitle>named.conf</refentrytitle>
|
||||
<manvolnum>5</manvolnum>
|
||||
<refentrytitle>lwresd</refentrytitle><manvolnum>8</manvolnum>
|
||||
</citerefentry>,
|
||||
<citetitle>BIND 9 Administrator Reference Manual</citetitle>.
|
||||
</para>
|
||||
|
||||
+9
-10
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -14,7 +14,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: named.html,v 1.6.18.13 2006/01/18 04:59:11 marka Exp $ -->
|
||||
<!-- $Id: named.html,v 1.6.18.11 2005/10/13 02:53:01 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -32,7 +32,7 @@
|
||||
<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525937"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525933"></a><h2>DESCRIPTION</h2>
|
||||
<p><span><strong class="command">named</strong></span>
|
||||
is a Domain Name System (DNS) server,
|
||||
part of the BIND 9 distribution from ISC. For more
|
||||
@@ -47,7 +47,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525961"></a><h2>OPTIONS</h2>
|
||||
<a name="id2525958"></a><h2>OPTIONS</h2>
|
||||
<div class="variablelist"><dl>
|
||||
<dt><span class="term">-4</span></dt>
|
||||
<dd><p>
|
||||
@@ -180,7 +180,7 @@
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526374"></a><h2>SIGNALS</h2>
|
||||
<a name="id2526371"></a><h2>SIGNALS</h2>
|
||||
<p>
|
||||
In routine operation, signals should not be used to control
|
||||
the nameserver; <span><strong class="command">rndc</strong></span> should be used
|
||||
@@ -201,7 +201,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526422"></a><h2>CONFIGURATION</h2>
|
||||
<a name="id2526419"></a><h2>CONFIGURATION</h2>
|
||||
<p>
|
||||
The <span><strong class="command">named</strong></span> configuration file is too complex
|
||||
to describe in detail here. A complete description is provided
|
||||
@@ -210,7 +210,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526439"></a><h2>FILES</h2>
|
||||
<a name="id2526436"></a><h2>FILES</h2>
|
||||
<div class="variablelist"><dl>
|
||||
<dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
|
||||
<dd><p>
|
||||
@@ -223,18 +223,17 @@
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526478"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2526475"></a><h2>SEE ALSO</h2>
|
||||
<p><em class="citetitle">RFC 1033</em>,
|
||||
<em class="citetitle">RFC 1034</em>,
|
||||
<em class="citetitle">RFC 1035</em>,
|
||||
<span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
|
||||
<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526530"></a><h2>AUTHOR</h2>
|
||||
<a name="id2526515"></a><h2>AUTHOR</h2>
|
||||
<p><span class="corpauthor">Internet Systems Consortium</span>
|
||||
</p>
|
||||
</div>
|
||||
|
||||
+13
-35
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: query.c,v 1.257.18.28 2006/03/09 23:46:20 marka Exp $ */
|
||||
/* $Id: query.c,v 1.257.18.20 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -1914,8 +1914,6 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,
|
||||
rdataset->attributes |= dns_order_find(client->view->order,
|
||||
fname, rdataset->type,
|
||||
rdataset->rdclass);
|
||||
rdataset->attributes |= DNS_RDATASETATTR_LOADORDER;
|
||||
|
||||
if (NOADDITIONAL(client))
|
||||
return;
|
||||
|
||||
@@ -2362,21 +2360,13 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
|
||||
|
||||
static isc_boolean_t
|
||||
verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
|
||||
dns_rdata_t *rdata, isc_mem_t *mctx, isc_boolean_t acceptexpired)
|
||||
dns_rdata_t *rdata, isc_mem_t *mctx)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_fixedname_t fixed;
|
||||
isc_boolean_t ignore = ISC_FALSE;
|
||||
|
||||
dns_fixedname_init(&fixed);
|
||||
|
||||
again:
|
||||
result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx,
|
||||
rdata, NULL);
|
||||
if (result == DNS_R_SIGEXPIRED && acceptexpired) {
|
||||
ignore = ISC_TRUE;
|
||||
goto again;
|
||||
}
|
||||
result = dns_dnssec_verify2(name, rdataset, key, ISC_FALSE,
|
||||
mctx, rdata, NULL);
|
||||
if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD)
|
||||
return (ISC_TRUE);
|
||||
return (ISC_FALSE);
|
||||
@@ -2416,8 +2406,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
|
||||
do {
|
||||
if (!get_key(client, db, &rrsig, &keyrdataset, &key))
|
||||
break;
|
||||
if (verify(key, name, rdataset, &rdata, client->mctx,
|
||||
client->view->acceptexpired)) {
|
||||
if (verify(key, name, rdataset, &rdata, client->mctx)) {
|
||||
dst_key_free(&key);
|
||||
dns_rdataset_disassociate(&keyrdataset);
|
||||
mark_secure(client, db, name, rdataset,
|
||||
@@ -3054,7 +3043,7 @@ do { \
|
||||
* ISC_R_NOTIMPLEMENTED The rdata is not a known address type.
|
||||
*/
|
||||
static isc_result_t
|
||||
rdata_tonetaddr(const dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
|
||||
rdata_tonetaddr(dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
|
||||
struct in_addr ina;
|
||||
struct in6_addr in6a;
|
||||
|
||||
@@ -3080,7 +3069,7 @@ rdata_tonetaddr(const dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
|
||||
* sortlist statement.
|
||||
*/
|
||||
static int
|
||||
query_sortlist_order_2element(const dns_rdata_t *rdata, const void *arg) {
|
||||
query_sortlist_order_2element(dns_rdata_t *rdata, void *arg) {
|
||||
isc_netaddr_t netaddr;
|
||||
|
||||
if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
|
||||
@@ -3093,7 +3082,7 @@ query_sortlist_order_2element(const dns_rdata_t *rdata, const void *arg) {
|
||||
* of a 1-element top-level sortlist statement.
|
||||
*/
|
||||
static int
|
||||
query_sortlist_order_1element(const dns_rdata_t *rdata, const void *arg) {
|
||||
query_sortlist_order_1element(dns_rdata_t *rdata, void *arg) {
|
||||
isc_netaddr_t netaddr;
|
||||
|
||||
if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
|
||||
@@ -3109,7 +3098,7 @@ static void
|
||||
setup_query_sortlist(ns_client_t *client) {
|
||||
isc_netaddr_t netaddr;
|
||||
dns_rdatasetorderfunc_t order = NULL;
|
||||
const void *order_arg = NULL;
|
||||
void *order_arg = NULL;
|
||||
|
||||
isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
|
||||
switch (ns_sortlist_setup(client->view->sortlist,
|
||||
@@ -3446,7 +3435,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
/*
|
||||
* First we must find the right database.
|
||||
*/
|
||||
options &= DNS_GETDB_NOLOG; /* Preserve DNS_GETDB_NOLOG. */
|
||||
options = 0;
|
||||
if (dns_rdatatype_atparent(qtype) &&
|
||||
!dns_name_equal(client->query.qname, dns_rootname))
|
||||
options |= DNS_GETDB_NOEXACT;
|
||||
@@ -3876,8 +3865,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
* the containing zone of an arbitrary name with a stub
|
||||
* resolver and not have it cached.
|
||||
*/
|
||||
if (qtype == dns_rdatatype_soa &&
|
||||
dns_zone_getzeronosoattl(zone))
|
||||
if (qtype == dns_rdatatype_soa)
|
||||
result = query_addsoa(client, db, version, ISC_TRUE);
|
||||
else
|
||||
result = query_addsoa(client, db, version, ISC_FALSE);
|
||||
@@ -4001,8 +3989,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
query_maybeputqname(client);
|
||||
client->query.qname = tname;
|
||||
want_restart = ISC_TRUE;
|
||||
if (!WANTRECURSION(client))
|
||||
options |= DNS_GETDB_NOLOG;
|
||||
goto addauth;
|
||||
case DNS_R_DNAME:
|
||||
/*
|
||||
@@ -4120,8 +4106,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
|
||||
client->query.qname = fname;
|
||||
fname = NULL;
|
||||
want_restart = ISC_TRUE;
|
||||
if (!WANTRECURSION(client))
|
||||
options |= DNS_GETDB_NOLOG;
|
||||
goto addauth;
|
||||
default:
|
||||
/*
|
||||
@@ -4424,8 +4408,6 @@ ns_query_start(ns_client_t *client) {
|
||||
if (!client->view->enablednssec) {
|
||||
message->flags &= ~DNS_MESSAGEFLAG_CD;
|
||||
client->extflags &= ~DNS_MESSAGEEXTFLAG_DO;
|
||||
if (client->opt != NULL)
|
||||
client->opt->ttl &= ~DNS_MESSAGEEXTFLAG_DO;
|
||||
}
|
||||
|
||||
if ((message->flags & DNS_MESSAGEFLAG_RD) != 0)
|
||||
@@ -4529,17 +4511,13 @@ ns_query_start(ns_client_t *client) {
|
||||
* If the client has requested that DNSSEC checking be disabled,
|
||||
* allow lookups to return pending data and instruct the resolver
|
||||
* to return data before validation has completed.
|
||||
*
|
||||
* We don't need to set DNS_DBFIND_PENDINGOK when validation is
|
||||
* disabled as there will be no pending data.
|
||||
*/
|
||||
if (message->flags & DNS_MESSAGEFLAG_CD ||
|
||||
qtype == dns_rdatatype_rrsig)
|
||||
{
|
||||
client->query.dboptions |= DNS_DBFIND_PENDINGOK;
|
||||
client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
|
||||
} else if (!client->view->enablevalidation)
|
||||
client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
|
||||
}
|
||||
|
||||
/*
|
||||
* Allow glue NS records to be added to the authority section
|
||||
|
||||
+129
-346
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: server.c,v 1.419.18.44 2006/03/09 23:46:20 marka Exp $ */
|
||||
/* $Id: server.c,v 1.419.18.33 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -215,6 +215,10 @@ static const struct {
|
||||
{ NULL, ISC_FALSE }
|
||||
};
|
||||
|
||||
static const char *empty_dbtype[] = { "_builtin", "empty", NULL, NULL };
|
||||
static unsigned int empty_dbtypec =
|
||||
(sizeof(empty_dbtype) / sizeof(empty_dbtype[0]));
|
||||
|
||||
static void
|
||||
fatal(const char *msg, isc_result_t result);
|
||||
|
||||
@@ -222,25 +226,25 @@ static void
|
||||
ns_server_reload(isc_task_t *task, isc_event_t *event);
|
||||
|
||||
static isc_result_t
|
||||
ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
|
||||
ns_listenelt_fromconfig(cfg_obj_t *listener, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *actx,
|
||||
isc_mem_t *mctx, ns_listenelt_t **target);
|
||||
static isc_result_t
|
||||
ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
|
||||
ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *actx,
|
||||
isc_mem_t *mctx, ns_listenlist_t **target);
|
||||
|
||||
static isc_result_t
|
||||
configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype);
|
||||
configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
cfg_obj_t *forwarders, cfg_obj_t *forwardtype);
|
||||
|
||||
static isc_result_t
|
||||
configure_alternates(const cfg_obj_t *config, dns_view_t *view,
|
||||
const cfg_obj_t *alternates);
|
||||
configure_alternates(cfg_obj_t *config, dns_view_t *view,
|
||||
cfg_obj_t *alternates);
|
||||
|
||||
static isc_result_t
|
||||
configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
|
||||
configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_view_t *view,
|
||||
cfg_aclconfctx_t *aclconf);
|
||||
|
||||
static void
|
||||
@@ -252,13 +256,13 @@ end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);
|
||||
* (for a global default).
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
configure_view_acl(cfg_obj_t *vconfig, cfg_obj_t *config,
|
||||
const char *aclname, cfg_aclconfctx_t *actx,
|
||||
isc_mem_t *mctx, dns_acl_t **aclp)
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *aclobj = NULL;
|
||||
cfg_obj_t *maps[3];
|
||||
cfg_obj_t *aclobj = NULL;
|
||||
int i = 0;
|
||||
|
||||
if (*aclp != NULL)
|
||||
@@ -266,7 +270,7 @@ configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
if (vconfig != NULL)
|
||||
maps[i++] = cfg_tuple_get(vconfig, "options");
|
||||
if (config != NULL) {
|
||||
const cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *options = NULL;
|
||||
(void)cfg_map_get(config, "options", &options);
|
||||
if (options != NULL)
|
||||
maps[i++] = options;
|
||||
@@ -287,7 +291,7 @@ configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
|
||||
configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key,
|
||||
dns_keytable_t *keytable, isc_mem_t *mctx)
|
||||
{
|
||||
dns_rdataclass_t viewclass;
|
||||
@@ -314,7 +318,7 @@ configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
|
||||
if (vconfig == NULL)
|
||||
viewclass = dns_rdataclass_in;
|
||||
else {
|
||||
const cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
|
||||
cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
|
||||
CHECK(ns_config_getclass(classobj, dns_rdataclass_in,
|
||||
&viewclass));
|
||||
}
|
||||
@@ -390,15 +394,15 @@ configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
|
||||
* from 'vconfig' and 'config'. The variable to be configured is '*target'.
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
configure_view_dnsseckeys(cfg_obj_t *vconfig, cfg_obj_t *config,
|
||||
isc_mem_t *mctx, dns_keytable_t **target)
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *keys = NULL;
|
||||
const cfg_obj_t *voptions = NULL;
|
||||
const cfg_listelt_t *element, *element2;
|
||||
const cfg_obj_t *keylist;
|
||||
const cfg_obj_t *key;
|
||||
cfg_obj_t *keys = NULL;
|
||||
cfg_obj_t *voptions = NULL;
|
||||
cfg_listelt_t *element, *element2;
|
||||
cfg_obj_t *keylist;
|
||||
cfg_obj_t *key;
|
||||
dns_keytable_t *keytable = NULL;
|
||||
|
||||
CHECK(dns_keytable_create(mctx, &keytable));
|
||||
@@ -437,10 +441,10 @@ configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
|
||||
mustbesecure(cfg_obj_t *mbs, dns_resolver_t *resolver)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *obj;
|
||||
const char *str;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
@@ -474,14 +478,14 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
|
||||
* Get a dispatch appropriate for the resolver of a given view.
|
||||
*/
|
||||
static isc_result_t
|
||||
get_view_querysource_dispatch(const cfg_obj_t **maps,
|
||||
get_view_querysource_dispatch(cfg_obj_t **maps,
|
||||
int af, dns_dispatch_t **dispatchp)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_dispatch_t *disp;
|
||||
isc_sockaddr_t sa;
|
||||
unsigned int attrs, attrmask;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
cfg_obj_t *obj = NULL;
|
||||
|
||||
/*
|
||||
* Make compiler happy.
|
||||
@@ -572,10 +576,10 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
configure_order(dns_order_t *order, const cfg_obj_t *ent) {
|
||||
configure_order(dns_order_t *order, cfg_obj_t *ent) {
|
||||
dns_rdataclass_t rdclass;
|
||||
dns_rdatatype_t rdtype;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
dns_fixedname_t fixed;
|
||||
unsigned int mode = 0;
|
||||
const char *str;
|
||||
@@ -622,7 +626,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
|
||||
/*
|
||||
* "*" should match everything including the root (BIND 8 compat).
|
||||
* As dns_name_matcheswildcard(".", "*.") returns FALSE add a
|
||||
* explicit entry for "." when the name is "*".
|
||||
* explict entry for "." when the name is "*".
|
||||
*/
|
||||
if (addroot) {
|
||||
result = dns_order_add(order, dns_rootname,
|
||||
@@ -636,10 +640,10 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
|
||||
configure_peer(cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
|
||||
isc_netaddr_t na;
|
||||
dns_peer_t *peer;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
const char *str;
|
||||
isc_result_t result;
|
||||
unsigned int prefixlen;
|
||||
@@ -682,17 +686,6 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
|
||||
CHECK(dns_peer_setudpsize(peer, (isc_uint16_t)udpsize));
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
(void)cfg_map_get(cpeer, "max-udp-size", &obj);
|
||||
if (obj != NULL) {
|
||||
isc_uint32_t udpsize = cfg_obj_asuint32(obj);
|
||||
if (udpsize < 512)
|
||||
udpsize = 512;
|
||||
if (udpsize > 4096)
|
||||
udpsize = 4096;
|
||||
CHECK(dns_peer_setmaxudp(peer, (isc_uint16_t)udpsize));
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
(void)cfg_map_get(cpeer, "transfers", &obj);
|
||||
if (obj != NULL)
|
||||
@@ -730,35 +723,7 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
|
||||
cfg_obj_assockaddr(obj));
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto cleanup;
|
||||
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
if (na.family == AF_INET)
|
||||
(void)cfg_map_get(cpeer, "notify-source", &obj);
|
||||
else
|
||||
(void)cfg_map_get(cpeer, "notify-source-v6", &obj);
|
||||
if (obj != NULL) {
|
||||
result = dns_peer_setnotifysource(peer,
|
||||
cfg_obj_assockaddr(obj));
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto cleanup;
|
||||
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
if (na.family == AF_INET)
|
||||
(void)cfg_map_get(cpeer, "query-source", &obj);
|
||||
else
|
||||
(void)cfg_map_get(cpeer, "query-source-v6", &obj);
|
||||
if (obj != NULL) {
|
||||
result = dns_peer_setquerysource(peer,
|
||||
cfg_obj_assockaddr(obj));
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto cleanup;
|
||||
ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));
|
||||
}
|
||||
|
||||
*peerp = peer;
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
@@ -768,10 +733,10 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
disable_algorithms(cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *algorithms;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *algorithms;
|
||||
cfg_listelt_t *element;
|
||||
const char *str;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
@@ -814,12 +779,12 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
|
||||
}
|
||||
|
||||
static isc_boolean_t
|
||||
on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
|
||||
const cfg_listelt_t *element;
|
||||
on_disable_list(cfg_obj_t *disablelist, dns_name_t *zonename) {
|
||||
cfg_listelt_t *element;
|
||||
dns_fixedname_t fixed;
|
||||
dns_name_t *name;
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *value;
|
||||
cfg_obj_t *value;
|
||||
const char *str;
|
||||
isc_buffer_t b;
|
||||
|
||||
@@ -843,38 +808,6 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
|
||||
return (ISC_FALSE);
|
||||
}
|
||||
|
||||
static void
|
||||
check_dbtype(dns_zone_t **zonep, unsigned int dbtypec, const char **dbargv,
|
||||
isc_mem_t *mctx)
|
||||
{
|
||||
char **argv = NULL;
|
||||
unsigned int i;
|
||||
isc_result_t result;
|
||||
|
||||
result = dns_zone_getdbtype(*zonep, &argv, mctx);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
dns_zone_detach(zonep);
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* Check that all the arguments match.
|
||||
*/
|
||||
for (i = 0; i < dbtypec; i++)
|
||||
if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0) {
|
||||
dns_zone_detach(zonep);
|
||||
break;
|
||||
}
|
||||
|
||||
/*
|
||||
* Check that there are not extra arguments.
|
||||
*/
|
||||
if (i == dbtypec && argv[i] != NULL)
|
||||
dns_zone_detach(zonep);
|
||||
isc_mem_free(mctx, argv);
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
* Configure 'view' according to 'vconfig', taking defaults from 'config'
|
||||
* where values are missing in 'vconfig'.
|
||||
@@ -883,26 +816,26 @@ check_dbtype(dns_zone_t **zonep, unsigned int dbtypec, const char **dbargv,
|
||||
* global defaults in 'config' used exclusively.
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
const cfg_obj_t *vconfig, isc_mem_t *mctx,
|
||||
cfg_aclconfctx_t *actx, isc_boolean_t need_hints)
|
||||
configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, cfg_aclconfctx_t *actx,
|
||||
isc_boolean_t need_hints)
|
||||
{
|
||||
const cfg_obj_t *maps[4];
|
||||
const cfg_obj_t *cfgmaps[3];
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *voptions = NULL;
|
||||
const cfg_obj_t *forwardtype;
|
||||
const cfg_obj_t *forwarders;
|
||||
const cfg_obj_t *alternates;
|
||||
const cfg_obj_t *zonelist;
|
||||
cfg_obj_t *maps[4];
|
||||
cfg_obj_t *cfgmaps[3];
|
||||
cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *voptions = NULL;
|
||||
cfg_obj_t *forwardtype;
|
||||
cfg_obj_t *forwarders;
|
||||
cfg_obj_t *alternates;
|
||||
cfg_obj_t *zonelist;
|
||||
#ifdef DLZ
|
||||
const cfg_obj_t *dlz;
|
||||
cfg_obj_t *dlz;
|
||||
unsigned int dlzargc;
|
||||
char **dlzargv;
|
||||
#endif
|
||||
const cfg_obj_t *disabled;
|
||||
const cfg_obj_t *obj;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *disabled;
|
||||
cfg_obj_t *obj;
|
||||
cfg_listelt_t *element;
|
||||
in_port_t port;
|
||||
dns_cache_t *cache = NULL;
|
||||
isc_result_t result;
|
||||
@@ -928,7 +861,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
const char *forview = " for view ";
|
||||
isc_boolean_t rfc1918;
|
||||
isc_boolean_t empty_zones_enable;
|
||||
const cfg_obj_t *disablelist = NULL;
|
||||
cfg_obj_t *disablelist = NULL;
|
||||
|
||||
REQUIRE(DNS_VIEW_VALID(view));
|
||||
|
||||
@@ -1023,7 +956,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *zconfig = cfg_listelt_value(element);
|
||||
cfg_obj_t *zconfig = cfg_listelt_value(element);
|
||||
CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
|
||||
actx));
|
||||
}
|
||||
@@ -1202,11 +1135,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
if (lame_ttl > 1800)
|
||||
lame_ttl = 1800;
|
||||
dns_resolver_setlamettl(view->resolver, lame_ttl);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
dns_resolver_setzeronosoattl(view->resolver, cfg_obj_asboolean(obj));
|
||||
|
||||
/*
|
||||
* Set the resolver's EDNS UDP size.
|
||||
@@ -1221,19 +1149,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
udpsize = 4096;
|
||||
dns_resolver_setudpsize(view->resolver, (isc_uint16_t)udpsize);
|
||||
|
||||
/*
|
||||
* Set the maximum UDP response size.
|
||||
*/
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "max-udp-size", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
udpsize = cfg_obj_asuint32(obj);
|
||||
if (udpsize < 512)
|
||||
udpsize = 512;
|
||||
if (udpsize > 4096)
|
||||
udpsize = 4096;
|
||||
view->maxudp = udpsize;
|
||||
|
||||
/*
|
||||
* Set supported DNSSEC algorithms.
|
||||
*/
|
||||
@@ -1306,8 +1221,8 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
* Configure the view's peer list.
|
||||
*/
|
||||
{
|
||||
const cfg_obj_t *peers = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *peers = NULL;
|
||||
cfg_listelt_t *element;
|
||||
dns_peerlist_t *newpeers = NULL;
|
||||
|
||||
(void)ns_config_get(cfgmaps, "server", &peers);
|
||||
@@ -1316,7 +1231,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *cpeer = cfg_listelt_value(element);
|
||||
cfg_obj_t *cpeer = cfg_listelt_value(element);
|
||||
dns_peer_t *peer;
|
||||
|
||||
CHECK(configure_peer(cpeer, mctx, &peer));
|
||||
@@ -1331,8 +1246,8 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
* Configure the views rrset-order.
|
||||
*/
|
||||
{
|
||||
const cfg_obj_t *rrsetorder = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *rrsetorder = NULL;
|
||||
cfg_listelt_t *element;
|
||||
|
||||
(void)ns_config_get(maps, "rrset-order", &rrsetorder);
|
||||
CHECK(dns_order_create(mctx, &order));
|
||||
@@ -1340,7 +1255,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *ent = cfg_listelt_value(element);
|
||||
cfg_obj_t *ent = cfg_listelt_value(element);
|
||||
|
||||
CHECK(configure_order(order, ent));
|
||||
}
|
||||
@@ -1430,9 +1345,8 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
CHECK(configure_view_acl(vconfig, config, "allow-query-cache",
|
||||
actx, ns_g_mctx, &view->queryacl));
|
||||
if (view->queryacl == NULL)
|
||||
CHECK(configure_view_acl(NULL, ns_g_defaults,
|
||||
"allow-query-cache", actx,
|
||||
ns_g_mctx, &view->queryacl));
|
||||
CHECK(configure_view_acl(vconfig, config, "allow-query",
|
||||
actx, ns_g_mctx, &view->queryacl));
|
||||
|
||||
if (strcmp(view->name, "_bind") != 0)
|
||||
CHECK(configure_view_acl(vconfig, config, "allow-recursion",
|
||||
@@ -1451,13 +1365,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
"both \"recursion no;\" and \"allow-recursion\" "
|
||||
"active%s%s", forview, viewname);
|
||||
|
||||
/*
|
||||
* Set default "allow-recursion" acl.
|
||||
*/
|
||||
if (view->recursionacl == NULL && view->recursion)
|
||||
CHECK(configure_view_acl(NULL, ns_g_defaults, "allow-recursion",
|
||||
actx, ns_g_mctx, &view->recursionacl));
|
||||
|
||||
CHECK(configure_view_acl(vconfig, config, "sortlist",
|
||||
actx, ns_g_mctx, &view->sortlist));
|
||||
|
||||
@@ -1488,16 +1395,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
view->enablednssec = cfg_obj_asboolean(obj);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "dnssec-accept-expired", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
view->acceptexpired = cfg_obj_asboolean(obj);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "dnssec-validation", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
view->enablevalidation = cfg_obj_asboolean(obj);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "dnssec-lookaside", &obj);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
@@ -1552,10 +1449,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
result = ns_config_get(maps, "dnssec-must-be-secure", &obj);
|
||||
if (result == ISC_R_SUCCESS)
|
||||
CHECK(mustbesecure(obj, view->resolver));
|
||||
} else {
|
||||
if (view->secroots != NULL)
|
||||
dns_keytable_detach(&view->secroots);
|
||||
dns_resolver_resetmustbesecure(view->resolver);
|
||||
}
|
||||
|
||||
obj = NULL;
|
||||
@@ -1592,7 +1485,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
dns_name_t *name;
|
||||
isc_buffer_t b;
|
||||
const char *str;
|
||||
const cfg_obj_t *exclude;
|
||||
cfg_obj_t *exclude;
|
||||
|
||||
dns_fixedname_init(&fixed);
|
||||
name = dns_fixedname_name(&fixed);
|
||||
@@ -1643,9 +1536,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
char server[DNS_NAME_FORMATSIZE + 1];
|
||||
char contact[DNS_NAME_FORMATSIZE + 1];
|
||||
isc_boolean_t logit;
|
||||
const char *empty_dbtype[4] =
|
||||
{ "_builtin", "empty", NULL, NULL };
|
||||
int empty_dbtypec = 4;
|
||||
|
||||
dns_fixedname_init(&fixed);
|
||||
name = dns_fixedname_name(&fixed);
|
||||
@@ -1686,7 +1576,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
empty = empty_zones[++empty_zone].zone)
|
||||
{
|
||||
dns_forwarders_t *forwarders = NULL;
|
||||
dns_view_t *pview = NULL;
|
||||
|
||||
isc_buffer_init(&buffer, empty, strlen(empty));
|
||||
isc_buffer_add(&buffer, strlen(empty));
|
||||
@@ -1735,29 +1624,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
|
||||
continue;
|
||||
}
|
||||
|
||||
/*
|
||||
* See if we can re-use a existing zone.
|
||||
*/
|
||||
result = dns_viewlist_find(&ns_g_server->viewlist,
|
||||
view->name, view->rdclass,
|
||||
&pview);
|
||||
if (result != ISC_R_NOTFOUND &&
|
||||
result != ISC_R_SUCCESS)
|
||||
goto cleanup;
|
||||
|
||||
if (pview != NULL) {
|
||||
(void)dns_view_findzone(pview, name, &zone);
|
||||
dns_view_detach(&pview);
|
||||
if (zone != NULL)
|
||||
check_dbtype(&zone, empty_dbtypec,
|
||||
empty_dbtype, mctx);
|
||||
if (zone != NULL) {
|
||||
dns_zone_setview(zone, view);
|
||||
dns_zone_detach(&zone);
|
||||
continue;
|
||||
}
|
||||
}
|
||||
|
||||
CHECK(dns_zone_create(&zone, mctx));
|
||||
CHECK(dns_zone_setorigin(zone, name));
|
||||
dns_zone_setview(zone, view);
|
||||
@@ -1817,12 +1683,12 @@ configure_hints(dns_view_t *view, const char *filename) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
configure_alternates(const cfg_obj_t *config, dns_view_t *view,
|
||||
const cfg_obj_t *alternates)
|
||||
configure_alternates(cfg_obj_t *config, dns_view_t *view,
|
||||
cfg_obj_t *alternates)
|
||||
{
|
||||
const cfg_obj_t *portobj;
|
||||
const cfg_obj_t *addresses;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *portobj;
|
||||
cfg_obj_t *addresses;
|
||||
cfg_listelt_t *element;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
in_port_t port;
|
||||
|
||||
@@ -1855,7 +1721,7 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *alternate = cfg_listelt_value(element);
|
||||
cfg_obj_t *alternate = cfg_listelt_value(element);
|
||||
isc_sockaddr_t sa;
|
||||
|
||||
if (!cfg_obj_issockaddr(alternate)) {
|
||||
@@ -1902,12 +1768,12 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype)
|
||||
configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
cfg_obj_t *forwarders, cfg_obj_t *forwardtype)
|
||||
{
|
||||
const cfg_obj_t *portobj;
|
||||
const cfg_obj_t *faddresses;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *portobj;
|
||||
cfg_obj_t *faddresses;
|
||||
cfg_listelt_t *element;
|
||||
dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
|
||||
isc_sockaddrlist_t addresses;
|
||||
isc_sockaddr_t *sa;
|
||||
@@ -1945,7 +1811,7 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *forwarder = cfg_listelt_value(element);
|
||||
cfg_obj_t *forwarder = cfg_listelt_value(element);
|
||||
sa = isc_mem_get(view->mctx, sizeof(isc_sockaddr_t));
|
||||
if (sa == NULL) {
|
||||
result = ISC_R_NOMEMORY;
|
||||
@@ -2010,16 +1876,14 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
|
||||
* The view created is attached to '*viewp'.
|
||||
*/
|
||||
static isc_result_t
|
||||
create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
|
||||
dns_view_t **viewp)
|
||||
{
|
||||
create_view(cfg_obj_t *vconfig, dns_viewlist_t *viewlist, dns_view_t **viewp) {
|
||||
isc_result_t result;
|
||||
const char *viewname;
|
||||
dns_rdataclass_t viewclass;
|
||||
dns_view_t *view = NULL;
|
||||
|
||||
if (vconfig != NULL) {
|
||||
const cfg_obj_t *classobj = NULL;
|
||||
cfg_obj_t *classobj = NULL;
|
||||
|
||||
viewname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
|
||||
classobj = cfg_tuple_get(vconfig, "class");
|
||||
@@ -2049,19 +1913,19 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
|
||||
* Configure or reconfigure a zone.
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
|
||||
const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
|
||||
configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_view_t *view,
|
||||
cfg_aclconfctx_t *aclconf)
|
||||
{
|
||||
dns_view_t *pview = NULL; /* Production view */
|
||||
dns_zone_t *zone = NULL; /* New or reused zone */
|
||||
dns_zone_t *dupzone = NULL;
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *typeobj = NULL;
|
||||
const cfg_obj_t *forwarders = NULL;
|
||||
const cfg_obj_t *forwardtype = NULL;
|
||||
const cfg_obj_t *only = NULL;
|
||||
cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *zoptions = NULL;
|
||||
cfg_obj_t *typeobj = NULL;
|
||||
cfg_obj_t *forwarders = NULL;
|
||||
cfg_obj_t *forwardtype = NULL;
|
||||
cfg_obj_t *only = NULL;
|
||||
isc_result_t result;
|
||||
isc_result_t tresult;
|
||||
isc_buffer_t buffer;
|
||||
@@ -2118,7 +1982,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
|
||||
* configure it and return.
|
||||
*/
|
||||
if (strcasecmp(ztypestr, "hint") == 0) {
|
||||
const cfg_obj_t *fileobj = NULL;
|
||||
cfg_obj_t *fileobj = NULL;
|
||||
if (cfg_map_get(zoptions, "file", &fileobj) != ISC_R_SUCCESS) {
|
||||
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
|
||||
NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
|
||||
@@ -2216,8 +2080,10 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
|
||||
result = dns_view_findzone(pview, origin, &zone);
|
||||
if (result != ISC_R_NOTFOUND && result != ISC_R_SUCCESS)
|
||||
goto cleanup;
|
||||
if (zone != NULL && !ns_zone_reusable(zone, zconfig))
|
||||
dns_zone_detach(&zone);
|
||||
if (zone != NULL) {
|
||||
if (! ns_zone_reusable(zone, zconfig))
|
||||
dns_zone_detach(&zone);
|
||||
}
|
||||
|
||||
if (zone != NULL) {
|
||||
/*
|
||||
@@ -2286,10 +2152,9 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
|
||||
* Configure a single server quota.
|
||||
*/
|
||||
static void
|
||||
configure_server_quota(const cfg_obj_t **maps, const char *name,
|
||||
isc_quota_t *quota)
|
||||
configure_server_quota(cfg_obj_t **maps, const char *name, isc_quota_t *quota)
|
||||
{
|
||||
const cfg_obj_t *obj = NULL;
|
||||
cfg_obj_t *obj = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
result = ns_config_get(maps, name, &obj);
|
||||
@@ -2302,7 +2167,7 @@ configure_server_quota(const cfg_obj_t **maps, const char *name,
|
||||
* parsed. This can be extended to support other options if necessary.
|
||||
*/
|
||||
static isc_result_t
|
||||
directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
|
||||
directory_callback(const char *clausename, cfg_obj_t *obj, void *arg) {
|
||||
isc_result_t result;
|
||||
const char *directory;
|
||||
|
||||
@@ -2555,7 +2420,7 @@ setstring(ns_server_t *server, char **field, const char *value) {
|
||||
* or NULL if whether 'obj' is a string or void value, respectively.
|
||||
*/
|
||||
static isc_result_t
|
||||
setoptstring(ns_server_t *server, char **field, const cfg_obj_t *obj) {
|
||||
setoptstring(ns_server_t *server, char **field, cfg_obj_t *obj) {
|
||||
if (cfg_obj_isvoid(obj))
|
||||
return (setstring(server, field, NULL));
|
||||
else
|
||||
@@ -2563,11 +2428,10 @@ setoptstring(ns_server_t *server, char **field, const cfg_obj_t *obj) {
|
||||
}
|
||||
|
||||
static void
|
||||
set_limit(const cfg_obj_t **maps, const char *configname,
|
||||
const char *description, isc_resource_t resourceid,
|
||||
isc_resourcevalue_t defaultvalue)
|
||||
set_limit(cfg_obj_t **maps, const char *configname, const char *description,
|
||||
isc_resource_t resourceid, isc_resourcevalue_t defaultvalue)
|
||||
{
|
||||
const cfg_obj_t *obj = NULL;
|
||||
cfg_obj_t *obj = NULL;
|
||||
const char *resource;
|
||||
isc_resourcevalue_t value;
|
||||
isc_result_t result;
|
||||
@@ -2599,7 +2463,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,
|
||||
ns_g_init ## resource)
|
||||
|
||||
static void
|
||||
set_limits(const cfg_obj_t **maps) {
|
||||
set_limits(cfg_obj_t **maps) {
|
||||
SETLIMIT("stacksize", stacksize, "stack size");
|
||||
SETLIMIT("datasize", datasize, "data size");
|
||||
SETLIMIT("coresize", coresize, "core size");
|
||||
@@ -2608,15 +2472,15 @@ set_limits(const cfg_obj_t **maps) {
|
||||
|
||||
static isc_result_t
|
||||
portlist_fromconf(dns_portlist_t *portlist, unsigned int family,
|
||||
const cfg_obj_t *ports)
|
||||
cfg_obj_t *ports)
|
||||
{
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
isc_result_t result = ISC_R_SUCCESS;
|
||||
|
||||
for (element = cfg_list_first(ports);
|
||||
element != NULL;
|
||||
element = cfg_list_next(element)) {
|
||||
const cfg_obj_t *obj = cfg_listelt_value(element);
|
||||
cfg_obj_t *obj = cfg_listelt_value(element);
|
||||
in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
|
||||
|
||||
result = dns_portlist_add(portlist, family, port);
|
||||
@@ -2626,31 +2490,6 @@ portlist_fromconf(dns_portlist_t *portlist, unsigned int family,
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
removed(dns_zone_t *zone, void *uap) {
|
||||
const char *type;
|
||||
|
||||
if (dns_zone_getview(zone) != uap)
|
||||
return (ISC_R_SUCCESS);
|
||||
|
||||
switch (dns_zone_gettype(zone)) {
|
||||
case dns_zone_master:
|
||||
type = "master";
|
||||
break;
|
||||
case dns_zone_slave:
|
||||
type = "slave";
|
||||
break;
|
||||
case dns_zone_stub:
|
||||
type = "stub";
|
||||
break;
|
||||
default:
|
||||
type = "other";
|
||||
break;
|
||||
}
|
||||
dns_zone_log(zone, ISC_LOG_INFO, "(%s) removed", type);
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
load_configuration(const char *filename, ns_server_t *server,
|
||||
isc_boolean_t first_time)
|
||||
@@ -2659,13 +2498,13 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
isc_interval_t interval;
|
||||
cfg_parser_t *parser = NULL;
|
||||
cfg_obj_t *config;
|
||||
const cfg_obj_t *options;
|
||||
const cfg_obj_t *views;
|
||||
const cfg_obj_t *obj;
|
||||
const cfg_obj_t *v4ports, *v6ports;
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *builtin_views;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_obj_t *options;
|
||||
cfg_obj_t *views;
|
||||
cfg_obj_t *obj;
|
||||
cfg_obj_t *v4ports, *v6ports;
|
||||
cfg_obj_t *maps[3];
|
||||
cfg_obj_t *builtin_views;
|
||||
cfg_listelt_t *element;
|
||||
dns_view_t *view = NULL;
|
||||
dns_view_t *view_next;
|
||||
dns_viewlist_t viewlist;
|
||||
@@ -2852,7 +2691,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
* statement.
|
||||
*/
|
||||
{
|
||||
const cfg_obj_t *clistenon = NULL;
|
||||
cfg_obj_t *clistenon = NULL;
|
||||
ns_listenlist_t *listenon = NULL;
|
||||
|
||||
clistenon = NULL;
|
||||
@@ -2886,7 +2725,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
* Ditto for IPv6.
|
||||
*/
|
||||
{
|
||||
const cfg_obj_t *clistenon = NULL;
|
||||
cfg_obj_t *clistenon = NULL;
|
||||
ns_listenlist_t *listenon = NULL;
|
||||
|
||||
if (options != NULL)
|
||||
@@ -2973,7 +2812,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *vconfig = cfg_listelt_value(element);
|
||||
cfg_obj_t *vconfig = cfg_listelt_value(element);
|
||||
view = NULL;
|
||||
|
||||
CHECK(create_view(vconfig, &viewlist, &view));
|
||||
@@ -3013,7 +2852,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *vconfig = cfg_listelt_value(element);
|
||||
cfg_obj_t *vconfig = cfg_listelt_value(element);
|
||||
CHECK(create_view(vconfig, &viewlist, &view));
|
||||
CHECK(configure_view(view, config, vconfig, ns_g_mctx,
|
||||
&aclconfctx, ISC_FALSE));
|
||||
@@ -3117,7 +2956,7 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
"ignoring config file logging "
|
||||
"statement due to -g option");
|
||||
} else {
|
||||
const cfg_obj_t *logobj = NULL;
|
||||
cfg_obj_t *logobj = NULL;
|
||||
isc_logconfig_t *logc = NULL;
|
||||
|
||||
CHECKM(isc_logconfig_create(ns_g_lctx, &logc),
|
||||
@@ -3156,8 +2995,8 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
* compatibility.
|
||||
*/
|
||||
if (first_time) {
|
||||
const cfg_obj_t *logobj = NULL;
|
||||
const cfg_obj_t *categories = NULL;
|
||||
cfg_obj_t *logobj = NULL;
|
||||
cfg_obj_t *categories = NULL;
|
||||
|
||||
obj = NULL;
|
||||
if (ns_config_get(maps, "querylog", &obj) == ISC_R_SUCCESS) {
|
||||
@@ -3169,12 +3008,12 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
(void)cfg_map_get(logobj, "category",
|
||||
&categories);
|
||||
if (categories != NULL) {
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
for (element = cfg_list_first(categories);
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *catobj;
|
||||
cfg_obj_t *catobj;
|
||||
const char *str;
|
||||
|
||||
obj = cfg_listelt_value(element);
|
||||
@@ -3285,11 +3124,8 @@ load_configuration(const char *filename, ns_server_t *server,
|
||||
view = view_next) {
|
||||
view_next = ISC_LIST_NEXT(view, link);
|
||||
ISC_LIST_UNLINK(viewlist, view, link);
|
||||
if (result == ISC_R_SUCCESS &&
|
||||
strcmp(view->name, "_bind") != 0)
|
||||
(void)dns_zt_apply(view->zonetable, ISC_FALSE,
|
||||
removed, view);
|
||||
dns_view_detach(&view);
|
||||
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -3678,7 +3514,7 @@ end_reserved_dispatches(ns_server_t *server, isc_boolean_t all) {
|
||||
}
|
||||
|
||||
void
|
||||
ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {
|
||||
ns_add_reserved_dispatch(ns_server_t *server, isc_sockaddr_t *addr) {
|
||||
ns_dispatch_t *dispatch;
|
||||
in_port_t port;
|
||||
char addrbuf[ISC_SOCKADDR_FORMATSIZE];
|
||||
@@ -4054,12 +3890,12 @@ ns_server_togglequerylog(ns_server_t *server) {
|
||||
}
|
||||
|
||||
static isc_result_t
|
||||
ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
|
||||
ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *actx,
|
||||
isc_mem_t *mctx, ns_listenlist_t **target)
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
ns_listenlist_t *dlist = NULL;
|
||||
|
||||
REQUIRE(target != NULL && *target == NULL);
|
||||
@@ -4073,7 +3909,7 @@ ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
ns_listenelt_t *delt = NULL;
|
||||
const cfg_obj_t *listener = cfg_listelt_value(element);
|
||||
cfg_obj_t *listener = cfg_listelt_value(element);
|
||||
result = ns_listenelt_fromconfig(listener, config, actx,
|
||||
mctx, &delt);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
@@ -4093,12 +3929,12 @@ ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
|
||||
* data structure.
|
||||
*/
|
||||
static isc_result_t
|
||||
ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
|
||||
ns_listenelt_fromconfig(cfg_obj_t *listener, cfg_obj_t *config,
|
||||
cfg_aclconfctx_t *actx,
|
||||
isc_mem_t *mctx, ns_listenelt_t **target)
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *portobj;
|
||||
cfg_obj_t *portobj;
|
||||
in_port_t port;
|
||||
ns_listenelt_t *delt = NULL;
|
||||
REQUIRE(target != NULL && *target == NULL);
|
||||
@@ -4507,59 +4343,6 @@ ns_server_setdebuglevel(ns_server_t *server, char *args) {
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_server_validation(ns_server_t *server, char *args) {
|
||||
char *ptr, *viewname;
|
||||
dns_view_t *view;
|
||||
isc_boolean_t changed = ISC_FALSE;
|
||||
isc_result_t result;
|
||||
isc_boolean_t enable;
|
||||
|
||||
/* Skip the command name. */
|
||||
ptr = next_token(&args, " \t");
|
||||
if (ptr == NULL)
|
||||
return (ISC_R_UNEXPECTEDEND);
|
||||
|
||||
/* Find out what we are to do. */
|
||||
ptr = next_token(&args, " \t");
|
||||
if (ptr == NULL)
|
||||
return (ISC_R_UNEXPECTEDEND);
|
||||
|
||||
if (!strcasecmp(ptr, "on") || !strcasecmp(ptr, "yes") ||
|
||||
!strcasecmp(ptr, "enable") || !strcasecmp(ptr, "true"))
|
||||
enable = ISC_TRUE;
|
||||
else if (!strcasecmp(ptr, "off") || !strcasecmp(ptr, "no") ||
|
||||
!strcasecmp(ptr, "disable") || !strcasecmp(ptr, "false"))
|
||||
enable = ISC_FALSE;
|
||||
else
|
||||
return (DNS_R_SYNTAX);
|
||||
|
||||
/* Look for the view name. */
|
||||
viewname = next_token(&args, " \t");
|
||||
|
||||
result = isc_task_beginexclusive(server->task);
|
||||
RUNTIME_CHECK(result == ISC_R_SUCCESS);
|
||||
for (view = ISC_LIST_HEAD(server->viewlist);
|
||||
view != NULL;
|
||||
view = ISC_LIST_NEXT(view, link))
|
||||
{
|
||||
if (viewname != NULL && strcasecmp(viewname, view->name) != 0)
|
||||
continue;
|
||||
result = dns_view_flushcache(view);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
goto out;
|
||||
view->enablevalidation = enable;
|
||||
changed = ISC_TRUE;
|
||||
}
|
||||
if (changed)
|
||||
result = ISC_R_SUCCESS;
|
||||
else
|
||||
result = ISC_R_FAILURE;
|
||||
out:
|
||||
isc_task_endexclusive(server->task);
|
||||
return (result);
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_server_flushcache(ns_server_t *server, char *args) {
|
||||
char *ptr, *viewname;
|
||||
|
||||
+9
-11
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: sortlist.c,v 1.9.18.4 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: sortlist.c,v 1.9.18.2 2005/04/29 00:15:26 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -32,9 +32,7 @@
|
||||
#include <named/sortlist.h>
|
||||
|
||||
ns_sortlisttype_t
|
||||
ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
|
||||
const void **argp)
|
||||
{
|
||||
ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp) {
|
||||
unsigned int i;
|
||||
|
||||
if (acl == NULL)
|
||||
@@ -48,7 +46,7 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
|
||||
dns_aclelement_t *e = &acl->elements[i];
|
||||
dns_aclelement_t *try_elt;
|
||||
dns_aclelement_t *order_elt = NULL;
|
||||
const dns_aclelement_t *matched_elt = NULL;
|
||||
dns_aclelement_t *matched_elt = NULL;
|
||||
|
||||
if (e->type == dns_aclelementtype_nestedacl) {
|
||||
dns_acl_t *inner = e->u.nestedacl;
|
||||
@@ -110,8 +108,8 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
|
||||
}
|
||||
|
||||
int
|
||||
ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
|
||||
const dns_acl_t *sortacl = (const dns_acl_t *) arg;
|
||||
ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg) {
|
||||
dns_acl_t *sortacl = (dns_acl_t *) arg;
|
||||
int match;
|
||||
|
||||
(void)dns_acl_match(addr, NULL, sortacl,
|
||||
@@ -126,8 +124,8 @@ ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
|
||||
}
|
||||
|
||||
int
|
||||
ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
|
||||
const dns_aclelement_t *matchelt = (const dns_aclelement_t *) arg;
|
||||
ns_sortlist_addrorder1(isc_netaddr_t *addr, void *arg) {
|
||||
dns_aclelement_t *matchelt = (dns_aclelement_t *) arg;
|
||||
if (dns_aclelement_match(addr, NULL, matchelt,
|
||||
&ns_g_server->aclenv,
|
||||
NULL)) {
|
||||
@@ -140,7 +138,7 @@ ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
|
||||
void
|
||||
ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, isc_netaddr_t *client_addr,
|
||||
dns_addressorderfunc_t *orderp,
|
||||
const void **argp)
|
||||
void **argp)
|
||||
{
|
||||
ns_sortlisttype_t sortlisttype;
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: tkeyconf.c,v 1.20.18.6 2006/03/02 00:37:21 marka Exp $ */
|
||||
/* $Id: tkeyconf.c,v 1.20.18.4 2005/08/23 02:31:34 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -44,8 +44,8 @@
|
||||
|
||||
|
||||
isc_result_t
|
||||
ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
|
||||
isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
|
||||
ns_tkeyctx_fromconfig(cfg_obj_t *options, isc_mem_t *mctx, isc_entropy_t *ectx,
|
||||
dns_tkeyctx_t **tctxp)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_tkeyctx_t *tctx = NULL;
|
||||
@@ -54,7 +54,7 @@ ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
|
||||
dns_fixedname_t fname;
|
||||
dns_name_t *name;
|
||||
isc_buffer_t b;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
int type;
|
||||
|
||||
result = dns_tkeyctx_create(mctx, ectx, &tctx);
|
||||
|
||||
+15
-24
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: tsigconf.c,v 1.22.18.6 2006/02/28 03:10:47 marka Exp $ */
|
||||
/* $Id: tsigconf.c,v 1.22.18.3 2005/08/23 02:31:35 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -37,26 +37,22 @@
|
||||
#include <named/tsigconf.h>
|
||||
|
||||
static isc_result_t
|
||||
add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
isc_mem_t *mctx)
|
||||
{
|
||||
dns_tsigkey_t *tsigkey = NULL;
|
||||
const cfg_listelt_t *element;
|
||||
const cfg_obj_t *key = NULL;
|
||||
add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
|
||||
cfg_listelt_t *element;
|
||||
cfg_obj_t *key = NULL;
|
||||
const char *keyid = NULL;
|
||||
unsigned char *secret = NULL;
|
||||
int secretalloc = 0;
|
||||
int secretlen = 0;
|
||||
isc_result_t ret;
|
||||
isc_stdtime_t now;
|
||||
isc_uint16_t bits;
|
||||
|
||||
for (element = cfg_list_first(list);
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *algobj = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
cfg_obj_t *algobj = NULL;
|
||||
cfg_obj_t *secretobj = NULL;
|
||||
dns_name_t keyname;
|
||||
dns_name_t *alg;
|
||||
const char *algstr;
|
||||
@@ -90,11 +86,10 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
* Create the algorithm.
|
||||
*/
|
||||
algstr = cfg_obj_asstring(algobj);
|
||||
if (ns_config_getkeyalgorithm(algstr, &alg, &bits)
|
||||
!= ISC_R_SUCCESS) {
|
||||
if (ns_config_getkeyalgorithm(algstr, &alg) != ISC_R_SUCCESS) {
|
||||
cfg_obj_log(algobj, ns_g_lctx, ISC_LOG_ERROR,
|
||||
"key '%s': has a unsupported algorithm '%s'",
|
||||
keyid, algstr);
|
||||
"key '%s': the only supported algorithm "
|
||||
"is hmac-md5", keyid);
|
||||
ret = DNS_R_BADALG;
|
||||
goto failure;
|
||||
}
|
||||
@@ -115,16 +110,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
isc_stdtime_get(&now);
|
||||
ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
|
||||
ISC_FALSE, NULL, now, now,
|
||||
mctx, ring, &tsigkey);
|
||||
mctx, ring, NULL);
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
secret = NULL;
|
||||
if (ret != ISC_R_SUCCESS)
|
||||
goto failure;
|
||||
/*
|
||||
* Set digest bits.
|
||||
*/
|
||||
dst_key_setbits(tsigkey->key, bits);
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
}
|
||||
|
||||
return (ISC_R_SUCCESS);
|
||||
@@ -137,14 +127,15 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
|
||||
if (secret != NULL)
|
||||
isc_mem_put(mctx, secret, secretalloc);
|
||||
return (ret);
|
||||
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
|
||||
isc_mem_t *mctx, dns_tsig_keyring_t **ringp)
|
||||
{
|
||||
const cfg_obj_t *maps[3];
|
||||
const cfg_obj_t *keylist;
|
||||
cfg_obj_t *maps[3];
|
||||
cfg_obj_t *keylist;
|
||||
dns_tsig_keyring_t *ring = NULL;
|
||||
isc_result_t result;
|
||||
int i;
|
||||
|
||||
+2
-9
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: os.c,v 1.66.18.11 2006/02/03 23:51:38 marka Exp $ */
|
||||
/* $Id: os.c,v 1.66.18.9 2005/05/20 01:37:26 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -499,13 +499,6 @@ ns_os_changeuser(void) {
|
||||
#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
|
||||
linux_minprivs();
|
||||
#endif
|
||||
#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
|
||||
/*
|
||||
* Restore the ability of named to drop core after the setuid()
|
||||
* call has disabled it.
|
||||
*/
|
||||
prctl(PR_SET_DUMPABLE,1,0,0,0);
|
||||
#endif
|
||||
}
|
||||
|
||||
void
|
||||
|
||||
+12
-88
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: update.c,v 1.109.18.19 2006/03/06 01:38:00 marka Exp $ */
|
||||
/* $Id: update.c,v 1.109.18.15 2005/10/07 04:07:53 marka Exp $ */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
@@ -31,7 +31,6 @@
|
||||
#include <dns/events.h>
|
||||
#include <dns/fixedname.h>
|
||||
#include <dns/journal.h>
|
||||
#include <dns/keyvalues.h>
|
||||
#include <dns/message.h>
|
||||
#include <dns/nsec.h>
|
||||
#include <dns/rdataclass.h>
|
||||
@@ -1312,8 +1311,8 @@ static isc_result_t
|
||||
namelist_append_name(dns_diff_t *list, dns_name_t *name) {
|
||||
isc_result_t result;
|
||||
dns_difftuple_t *tuple = NULL;
|
||||
static dns_rdata_t dummy_rdata = DNS_RDATA_INIT;
|
||||
|
||||
static dns_rdata_t dummy_rdata = { NULL, 0, 0, 0, 0,
|
||||
{ (void*)(-1), (void*)(-1) } };
|
||||
CHECK(dns_difftuple_create(list->mctx, DNS_DIFFOP_EXISTS, name, 0,
|
||||
&dummy_rdata, &tuple));
|
||||
dns_diff_append(list, &tuple);
|
||||
@@ -1520,8 +1519,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
*/
|
||||
static isc_result_t
|
||||
add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
dns_dbversion_t *ver, dns_name_t *name, dns_ttl_t nsecttl,
|
||||
dns_diff_t *diff)
|
||||
dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_dbnode_t *node = NULL;
|
||||
@@ -1556,7 +1554,8 @@ add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
* Add the new NSEC and record the change.
|
||||
*/
|
||||
CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name,
|
||||
nsecttl, &rdata, &tuple));
|
||||
3600, /* XXXRTH */
|
||||
&rdata, &tuple));
|
||||
CHECK(do_one_tuple(&tuple, db, ver, diff));
|
||||
INSIST(tuple == NULL);
|
||||
|
||||
@@ -1605,44 +1604,6 @@ find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
|
||||
return (result);
|
||||
}
|
||||
|
||||
static isc_boolean_t
|
||||
ksk_sanity(dns_db_t *db, dns_dbversion_t *ver) {
|
||||
isc_boolean_t ret = ISC_FALSE;
|
||||
isc_boolean_t have_ksk = ISC_FALSE, have_nonksk = ISC_FALSE;
|
||||
isc_result_t result;
|
||||
dns_dbnode_t *node = NULL;
|
||||
dns_rdataset_t rdataset;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
dns_rdata_dnskey_t dnskey;
|
||||
|
||||
dns_rdataset_init(&rdataset);
|
||||
CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
|
||||
CHECK(dns_db_findrdataset(db, node, ver, dns_rdatatype_dnskey, 0, 0,
|
||||
&rdataset, NULL));
|
||||
CHECK(dns_rdataset_first(&rdataset));
|
||||
while (result == ISC_R_SUCCESS && (!have_ksk || !have_nonksk)) {
|
||||
dns_rdataset_current(&rdataset, &rdata);
|
||||
CHECK(dns_rdata_tostruct(&rdata, &dnskey, NULL));
|
||||
if ((dnskey.flags & (DNS_KEYFLAG_OWNERMASK|DNS_KEYTYPE_NOAUTH))
|
||||
== DNS_KEYOWNER_ZONE) {
|
||||
if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0)
|
||||
have_ksk = ISC_TRUE;
|
||||
else
|
||||
have_nonksk = ISC_TRUE;
|
||||
}
|
||||
dns_rdata_reset(&rdata);
|
||||
result = dns_rdataset_next(&rdataset);
|
||||
}
|
||||
if (have_ksk && have_nonksk)
|
||||
ret = ISC_TRUE;
|
||||
failure:
|
||||
if (dns_rdataset_isassociated(&rdataset))
|
||||
dns_rdataset_disassociate(&rdataset);
|
||||
if (node != NULL)
|
||||
dns_db_detachnode(db, &node);
|
||||
return (ret);
|
||||
}
|
||||
|
||||
/*%
|
||||
* Add RRSIG records for an RRset, recording the change in "diff".
|
||||
*/
|
||||
@@ -1650,7 +1611,7 @@ static isc_result_t
|
||||
add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
|
||||
dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
|
||||
unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
|
||||
isc_stdtime_t expire, isc_boolean_t check_ksk)
|
||||
isc_stdtime_t expire)
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_dbnode_t *node = NULL;
|
||||
@@ -1671,11 +1632,6 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
|
||||
dns_db_detachnode(db, &node);
|
||||
|
||||
for (i = 0; i < nkeys; i++) {
|
||||
|
||||
if (check_ksk && type != dns_rdatatype_dnskey &&
|
||||
(dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)
|
||||
continue;
|
||||
|
||||
/* Calculate the signature, creating a RRSIG RDATA. */
|
||||
CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
|
||||
&inception, &expire,
|
||||
@@ -1724,12 +1680,6 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
unsigned int nkeys = 0;
|
||||
unsigned int i;
|
||||
isc_stdtime_t now, inception, expire;
|
||||
dns_ttl_t nsecttl;
|
||||
dns_rdata_soa_t soa;
|
||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
||||
dns_rdataset_t rdataset;
|
||||
dns_dbnode_t *node = NULL;
|
||||
isc_boolean_t check_ksk;
|
||||
|
||||
dns_diff_init(client->mctx, &diffnames);
|
||||
dns_diff_init(client->mctx, &affected);
|
||||
@@ -1750,31 +1700,6 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
inception = now - 3600; /* Allow for some clock skew. */
|
||||
expire = now + sigvalidityinterval;
|
||||
|
||||
/*
|
||||
* Do we look at the KSK flag on the DNSKEY to determining which
|
||||
* keys sign which RRsets? First check the zone option then
|
||||
* check the keys flags to make sure atleast one has a ksk set
|
||||
* and one doesn't.
|
||||
*/
|
||||
check_ksk = ISC_TF((dns_zone_getoptions(zone) &
|
||||
DNS_ZONEOPT_UPDATECHECKKSK) != 0);
|
||||
if (check_ksk)
|
||||
check_ksk = ksk_sanity(db, newver);
|
||||
|
||||
/*
|
||||
* Get the NSEC's TTL from the SOA MINIMUM field.
|
||||
*/
|
||||
CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
|
||||
dns_rdataset_init(&rdataset);
|
||||
CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0,
|
||||
(isc_stdtime_t) 0, &rdataset, NULL));
|
||||
CHECK(dns_rdataset_first(&rdataset));
|
||||
dns_rdataset_current(&rdataset, &rdata);
|
||||
CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
|
||||
nsecttl = soa.minimum;
|
||||
dns_rdataset_disassociate(&rdataset);
|
||||
dns_db_detachnode(db, &node);
|
||||
|
||||
/*
|
||||
* Find all RRsets directly affected by the update, and
|
||||
* update their RRSIGs. Also build a list of names affected
|
||||
@@ -1820,7 +1745,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
CHECK(add_sigs(db, newver, name, type,
|
||||
&sig_diff, zone_keys, nkeys,
|
||||
client->mctx, inception,
|
||||
expire, check_ksk));
|
||||
expire));
|
||||
}
|
||||
skip:
|
||||
/* Skip any other updates to the same RRset. */
|
||||
@@ -1978,8 +1903,8 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
* there is other data, and if there is other data,
|
||||
* there are other RRSIGs.
|
||||
*/
|
||||
CHECK(add_nsec(client, zone, db, newver, &t->name,
|
||||
nsecttl, &nsec_diff));
|
||||
CHECK(add_nsec(client, zone, db, newver,
|
||||
&t->name, &nsec_diff));
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2005,8 +1930,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
|
||||
} else if (t->op == DNS_DIFFOP_ADD) {
|
||||
CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,
|
||||
&sig_diff, zone_keys, nkeys,
|
||||
client->mctx, inception, expire,
|
||||
check_ksk));
|
||||
client->mctx, inception, expire));
|
||||
} else {
|
||||
INSIST(0);
|
||||
}
|
||||
|
||||
+3
-4
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: xfrout.c,v 1.115.18.8 2006/03/05 23:58:51 marka Exp $ */
|
||||
/* $Id: xfrout.c,v 1.115.18.6 2005/10/14 01:28:21 marka Exp $ */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
@@ -200,7 +200,7 @@ db_rr_iterator_first(db_rr_iterator_t *it) {
|
||||
continue;
|
||||
}
|
||||
dns_rdatasetiter_current(it->rdatasetit, &it->rdataset);
|
||||
it->rdataset.attributes |= DNS_RDATASETATTR_LOADORDER;
|
||||
|
||||
it->result = dns_rdataset_first(&it->rdataset);
|
||||
return (it->result);
|
||||
}
|
||||
@@ -250,7 +250,6 @@ db_rr_iterator_next(db_rr_iterator_t *it) {
|
||||
if (it->result != ISC_R_SUCCESS)
|
||||
return (it->result);
|
||||
dns_rdatasetiter_current(it->rdatasetit, &it->rdataset);
|
||||
it->rdataset.attributes |= DNS_RDATASETATTR_LOADORDER;
|
||||
it->result = dns_rdataset_first(&it->rdataset);
|
||||
if (it->result != ISC_R_SUCCESS)
|
||||
return (it->result);
|
||||
|
||||
+31
-82
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: zoneconf.c,v 1.110.18.22 2006/03/06 01:38:00 marka Exp $ */
|
||||
/* $Id: zoneconf.c,v 1.110.18.15 2005/11/30 03:44:38 marka Exp $ */
|
||||
|
||||
/*% */
|
||||
|
||||
@@ -58,15 +58,15 @@
|
||||
* Convenience function for configuring a single zone ACL.
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *config, const char *aclname,
|
||||
cfg_aclconfctx_t *actx, dns_zone_t *zone,
|
||||
configure_zone_acl(cfg_obj_t *zconfig, cfg_obj_t *vconfig, cfg_obj_t *config,
|
||||
const char *aclname, cfg_aclconfctx_t *actx,
|
||||
dns_zone_t *zone,
|
||||
void (*setzacl)(dns_zone_t *, dns_acl_t *),
|
||||
void (*clearzacl)(dns_zone_t *))
|
||||
{
|
||||
isc_result_t result;
|
||||
const cfg_obj_t *maps[4];
|
||||
const cfg_obj_t *aclobj = NULL;
|
||||
cfg_obj_t *maps[4];
|
||||
cfg_obj_t *aclobj = NULL;
|
||||
int i = 0;
|
||||
dns_acl_t *dacl = NULL;
|
||||
|
||||
@@ -75,7 +75,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
if (vconfig != NULL)
|
||||
maps[i++] = cfg_tuple_get(vconfig, "options");
|
||||
if (config != NULL) {
|
||||
const cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *options = NULL;
|
||||
(void)cfg_map_get(config, "options", &options);
|
||||
if (options != NULL)
|
||||
maps[i++] = options;
|
||||
@@ -101,18 +101,16 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
|
||||
* Parse the zone update-policy statement.
|
||||
*/
|
||||
static isc_result_t
|
||||
configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
const cfg_obj_t *updatepolicy = NULL;
|
||||
const cfg_listelt_t *element, *element2;
|
||||
configure_zone_ssutable(cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
cfg_obj_t *updatepolicy = NULL;
|
||||
cfg_listelt_t *element, *element2;
|
||||
dns_ssutable_t *table = NULL;
|
||||
isc_mem_t *mctx = dns_zone_getmctx(zone);
|
||||
isc_result_t result;
|
||||
|
||||
(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
|
||||
if (updatepolicy == NULL) {
|
||||
dns_zone_setssutable(zone, NULL);
|
||||
if (updatepolicy == NULL)
|
||||
return (ISC_R_SUCCESS);
|
||||
}
|
||||
|
||||
result = dns_ssutable_create(mctx, &table);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
@@ -122,12 +120,12 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
element != NULL;
|
||||
element = cfg_list_next(element))
|
||||
{
|
||||
const cfg_obj_t *stmt = cfg_listelt_value(element);
|
||||
const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
|
||||
const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
|
||||
const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
|
||||
const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
|
||||
const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
|
||||
cfg_obj_t *stmt = cfg_listelt_value(element);
|
||||
cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
|
||||
cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
|
||||
cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
|
||||
cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
|
||||
cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
|
||||
const char *str;
|
||||
isc_boolean_t grant = ISC_FALSE;
|
||||
unsigned int mtype = DNS_SSUMATCHTYPE_NAME;
|
||||
@@ -153,10 +151,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
mtype = DNS_SSUMATCHTYPE_WILDCARD;
|
||||
else if (strcasecmp(str, "self") == 0)
|
||||
mtype = DNS_SSUMATCHTYPE_SELF;
|
||||
else if (strcasecmp(str, "selfsub") == 0)
|
||||
mtype = DNS_SSUMATCHTYPE_SELFSUB;
|
||||
else if (strcasecmp(str, "selfwild") == 0)
|
||||
mtype = DNS_SSUMATCHTYPE_SELFWILD;
|
||||
else
|
||||
INSIST(0);
|
||||
|
||||
@@ -200,7 +194,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
element2 != NULL;
|
||||
element2 = cfg_list_next(element2))
|
||||
{
|
||||
const cfg_obj_t *typeobj;
|
||||
cfg_obj_t *typeobj;
|
||||
isc_textregion_t r;
|
||||
|
||||
INSIST(i < n);
|
||||
@@ -246,8 +240,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
|
||||
* Convert a config file zone type into a server zone type.
|
||||
*/
|
||||
static inline dns_zonetype_t
|
||||
zonetype_fromconfig(const cfg_obj_t *map) {
|
||||
const cfg_obj_t *obj = NULL;
|
||||
zonetype_fromconfig(cfg_obj_t *map) {
|
||||
cfg_obj_t *obj = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
result = cfg_map_get(map, "type", &obj);
|
||||
@@ -302,9 +296,7 @@ strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
|
||||
}
|
||||
|
||||
static void
|
||||
checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
|
||||
const cfg_obj_t **objp)
|
||||
{
|
||||
checknames(dns_zonetype_t ztype, cfg_obj_t **maps, cfg_obj_t **objp) {
|
||||
const char *zone = NULL;
|
||||
isc_result_t result;
|
||||
|
||||
@@ -319,18 +311,17 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
|
||||
}
|
||||
|
||||
isc_result_t
|
||||
ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
|
||||
dns_zone_t *zone)
|
||||
ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
|
||||
cfg_aclconfctx_t *ac, dns_zone_t *zone)
|
||||
{
|
||||
isc_result_t result;
|
||||
const char *zname;
|
||||
dns_rdataclass_t zclass;
|
||||
dns_rdataclass_t vclass;
|
||||
const cfg_obj_t *maps[5];
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *maps[5];
|
||||
cfg_obj_t *zoptions = NULL;
|
||||
cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *obj;
|
||||
const char *filename = NULL;
|
||||
dns_notifytype_t notifytype = dns_notifytype_yes;
|
||||
isc_sockaddr_t *addrs;
|
||||
@@ -349,7 +340,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
isc_boolean_t alt;
|
||||
dns_view_t *view;
|
||||
isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE;
|
||||
isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
|
||||
isc_boolean_t ixfrdiff;
|
||||
dns_masterformat_t masterformat;
|
||||
|
||||
@@ -615,11 +605,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
|
||||
cfg_obj_asboolean(obj));
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -690,42 +675,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
INSIST(obj != NULL);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
|
||||
cfg_obj_asboolean(obj));
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "check-mx-cname", &obj);
|
||||
INSIST(obj != NULL);
|
||||
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
|
||||
warn = ISC_TRUE;
|
||||
ignore = ISC_FALSE;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
|
||||
warn = ignore = ISC_FALSE;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
|
||||
warn = ignore = ISC_TRUE;
|
||||
} else
|
||||
INSIST(0);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_WARNMXCNAME, warn);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "check-srv-cname", &obj);
|
||||
INSIST(obj != NULL);
|
||||
if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
|
||||
warn = ISC_TRUE;
|
||||
ignore = ISC_FALSE;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
|
||||
warn = ignore = ISC_FALSE;
|
||||
} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
|
||||
warn = ignore = ISC_TRUE;
|
||||
} else
|
||||
INSIST(0);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_WARNSRVCNAME, warn);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_IGNORESRVCNAME, ignore);
|
||||
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "update-check-ksk", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
|
||||
cfg_obj_asboolean(obj));
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -885,9 +834,9 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
|
||||
}
|
||||
|
||||
isc_boolean_t
|
||||
ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
|
||||
const cfg_obj_t *zoptions = NULL;
|
||||
const cfg_obj_t *obj = NULL;
|
||||
ns_zone_reusable(dns_zone_t *zone, cfg_obj_t *zconfig) {
|
||||
cfg_obj_t *zoptions = NULL;
|
||||
cfg_obj_t *obj = NULL;
|
||||
const char *cfilename;
|
||||
const char *zfilename;
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
.\" Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
.\"
|
||||
.\" Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -13,7 +13,7 @@
|
||||
.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
.\" PERFORMANCE OF THIS SOFTWARE.
|
||||
.\"
|
||||
.\" $Id: nsupdate.8,v 1.30.18.9 2006/01/28 02:15:41 marka Exp $
|
||||
.\" $Id: nsupdate.8,v 1.30.18.7 2005/10/13 02:53:02 marka Exp $
|
||||
.\"
|
||||
.hy 0
|
||||
.ad l
|
||||
@@ -30,7 +30,7 @@
|
||||
nsupdate \- Dynamic DNS update utility
|
||||
.SH "SYNOPSIS"
|
||||
.HP 9
|
||||
\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
|
||||
\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
|
||||
.SH "DESCRIPTION"
|
||||
.PP
|
||||
\fBnsupdate\fR
|
||||
@@ -68,7 +68,7 @@ uses the
|
||||
\fB\-y\fR
|
||||
or
|
||||
\fB\-k\fR
|
||||
option to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests, default type HMAC\-MD5. These options are mutually exclusive. With the
|
||||
option (with an HMAC\-MD5 key) to provide the shared secret needed to generate a TSIG record for authenticating Dynamic DNS update requests. These options are mutually exclusive. With the
|
||||
\fB\-k\fR
|
||||
option,
|
||||
\fBnsupdate\fR
|
||||
@@ -79,7 +79,7 @@ reads the shared secret from the file
|
||||
must also be present. When the
|
||||
\fB\-y\fR
|
||||
option is used, a signature is generated from
|
||||
[\fIhmac:\fR]\fIkeyname:secret.\fR\fIkeyname\fR
|
||||
\fIkeyname:secret.\fR\fIkeyname\fR
|
||||
is the name of the key, and
|
||||
\fIsecret\fR
|
||||
is the base64 encoded shared secret. Use of the
|
||||
|
||||
+30
-173
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: nsupdate.c,v 1.130.18.13 2006/03/02 23:19:20 marka Exp $ */
|
||||
/* $Id: nsupdate.c,v 1.130.18.9 2005/09/18 07:58:06 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -284,74 +284,6 @@ reset_system(void) {
|
||||
updatemsg->opcode = dns_opcode_update;
|
||||
}
|
||||
|
||||
static isc_uint16_t
|
||||
parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len) {
|
||||
isc_uint16_t digestbits = 0;
|
||||
isc_result_t result;
|
||||
char buf[20];
|
||||
|
||||
REQUIRE(hmac != NULL && *hmac == NULL);
|
||||
REQUIRE(hmacstr != NULL);
|
||||
|
||||
if (len >= sizeof(buf))
|
||||
fatal("unknown key type '%.*s'", (int)(len), hmacstr);
|
||||
|
||||
strncpy(buf, hmacstr, len);
|
||||
buf[len] = 0;
|
||||
|
||||
if (strcasecmp(buf, "hmac-md5") == 0) {
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-md5-", 9) == 0) {
|
||||
*hmac = DNS_TSIG_HMACMD5_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[9], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 128)
|
||||
fatal("digest-bits out of range [0..128]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha1") == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha1-", 10) == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA1_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[10], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 160)
|
||||
fatal("digest-bits out of range [0..160]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha224") == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha224-", 12) == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA224_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 224)
|
||||
fatal("digest-bits out of range [0..224]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha256") == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha256-", 12) == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA256_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 256)
|
||||
fatal("digest-bits out of range [0..256]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha384") == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha384-", 12) == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA384_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 384)
|
||||
fatal("digest-bits out of range [0..384]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else if (strcasecmp(buf, "hmac-sha512") == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
} else if (strncasecmp(buf, "hmac-sha512-", 12) == 0) {
|
||||
*hmac = DNS_TSIG_HMACSHA512_NAME;
|
||||
result = isc_parse_uint16(&digestbits, &buf[12], 10);
|
||||
if (result != ISC_R_SUCCESS || digestbits > 512)
|
||||
fatal("digest-bits out of range [0..512]");
|
||||
digestbits = (digestbits +7) & ~0x7U;
|
||||
} else
|
||||
fatal("unknown key type '%s'", buf);
|
||||
return (digestbits);
|
||||
}
|
||||
|
||||
static void
|
||||
setup_keystr(void) {
|
||||
unsigned char *secret = NULL;
|
||||
@@ -360,12 +292,9 @@ setup_keystr(void) {
|
||||
isc_result_t result;
|
||||
isc_buffer_t keynamesrc;
|
||||
char *secretstr;
|
||||
char *s, *n;
|
||||
char *s;
|
||||
dns_fixedname_t fkeyname;
|
||||
dns_name_t *keyname;
|
||||
char *name;
|
||||
dns_name_t *hmacname = NULL;
|
||||
isc_uint16_t digestbits = 0;
|
||||
|
||||
dns_fixedname_init(&fkeyname);
|
||||
keyname = dns_fixedname_name(&fkeyname);
|
||||
@@ -373,24 +302,12 @@ setup_keystr(void) {
|
||||
debug("Creating key...");
|
||||
|
||||
s = strchr(keystr, ':');
|
||||
if (s == NULL || s == keystr || s[1] == 0)
|
||||
fatal("key option must specify [hmac:]keyname:secret");
|
||||
if (s == NULL || s == keystr || *s == 0)
|
||||
fatal("key option must specify keyname:secret");
|
||||
secretstr = s + 1;
|
||||
n = strchr(secretstr, ':');
|
||||
if (n != NULL) {
|
||||
if (n == secretstr || n[1] == 0)
|
||||
fatal("key option must specify [hmac:]keyname:secret");
|
||||
name = secretstr;
|
||||
secretstr = n + 1;
|
||||
digestbits = parse_hmac(&hmacname, keystr, s - keystr);
|
||||
} else {
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
name = keystr;
|
||||
n = s;
|
||||
}
|
||||
|
||||
isc_buffer_init(&keynamesrc, name, n - name);
|
||||
isc_buffer_add(&keynamesrc, n - name);
|
||||
isc_buffer_init(&keynamesrc, keystr, s - keystr);
|
||||
isc_buffer_add(&keynamesrc, s - keystr);
|
||||
|
||||
debug("namefromtext");
|
||||
result = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
|
||||
@@ -413,13 +330,12 @@ setup_keystr(void) {
|
||||
secretlen = isc_buffer_usedlength(&secretbuf);
|
||||
|
||||
debug("keycreate");
|
||||
result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,
|
||||
ISC_TRUE, NULL, 0, 0, mctx, NULL, &tsigkey);
|
||||
result = dns_tsigkey_create(keyname, dns_tsig_hmacmd5_name,
|
||||
secret, secretlen, ISC_TRUE, NULL,
|
||||
0, 0, mctx, NULL, &tsigkey);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fprintf(stderr, "could not create key from %s: %s\n",
|
||||
keystr, dns_result_totext(result));
|
||||
else
|
||||
dst_key_setbits(tsigkey->key, digestbits);
|
||||
failure:
|
||||
if (secret != NULL)
|
||||
isc_mem_free(mctx, secret);
|
||||
@@ -429,7 +345,6 @@ static void
|
||||
setup_keyfile(void) {
|
||||
dst_key_t *dstkey = NULL;
|
||||
isc_result_t result;
|
||||
dns_name_t *hmacname = NULL;
|
||||
|
||||
debug("Creating key...");
|
||||
|
||||
@@ -441,31 +356,11 @@ setup_keyfile(void) {
|
||||
keyfile, isc_result_totext(result));
|
||||
return;
|
||||
}
|
||||
switch (dst_key_alg(dstkey)) {
|
||||
case DST_ALG_HMACMD5:
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA1:
|
||||
hmacname = DNS_TSIG_HMACSHA1_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA224:
|
||||
hmacname = DNS_TSIG_HMACSHA224_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA256:
|
||||
hmacname = DNS_TSIG_HMACSHA256_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA384:
|
||||
hmacname = DNS_TSIG_HMACSHA384_NAME;
|
||||
break;
|
||||
case DST_ALG_HMACSHA512:
|
||||
hmacname = DNS_TSIG_HMACSHA512_NAME;
|
||||
break;
|
||||
}
|
||||
if (hmacname != NULL) {
|
||||
if (dst_key_alg(dstkey) == DST_ALG_HMACMD5) {
|
||||
result = dns_tsigkey_createfromkey(dst_key_name(dstkey),
|
||||
hmacname, dstkey, ISC_FALSE,
|
||||
NULL, 0, 0, mctx, NULL,
|
||||
&tsigkey);
|
||||
dns_tsig_hmacmd5_name,
|
||||
dstkey, ISC_FALSE, NULL,
|
||||
0, 0, mctx, NULL, &tsigkey);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s: %s\n",
|
||||
keyfile, isc_result_totext(result));
|
||||
@@ -1105,9 +1000,6 @@ evaluate_key(char *cmdline) {
|
||||
int secretlen;
|
||||
unsigned char *secret = NULL;
|
||||
isc_buffer_t secretbuf;
|
||||
dns_name_t *hmacname = NULL;
|
||||
isc_uint16_t digestbits = 0;
|
||||
char *n;
|
||||
|
||||
namestr = nsu_strsep(&cmdline, " \t\r\n");
|
||||
if (*namestr == 0) {
|
||||
@@ -1118,13 +1010,6 @@ evaluate_key(char *cmdline) {
|
||||
dns_fixedname_init(&fkeyname);
|
||||
keyname = dns_fixedname_name(&fkeyname);
|
||||
|
||||
n = strchr(namestr, ':');
|
||||
if (n != NULL) {
|
||||
digestbits = parse_hmac(&hmacname, namestr, n - namestr);
|
||||
namestr = n + 1;
|
||||
} else
|
||||
hmacname = DNS_TSIG_HMACMD5_NAME;
|
||||
|
||||
isc_buffer_init(&b, namestr, strlen(namestr));
|
||||
isc_buffer_add(&b, strlen(namestr));
|
||||
result = dns_name_fromtext(keyname, &b, dns_rootname, ISC_FALSE, NULL);
|
||||
@@ -1155,16 +1040,15 @@ evaluate_key(char *cmdline) {
|
||||
|
||||
if (tsigkey != NULL)
|
||||
dns_tsigkey_detach(&tsigkey);
|
||||
result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,
|
||||
ISC_TRUE, NULL, 0, 0, mctx, NULL,
|
||||
&tsigkey);
|
||||
result = dns_tsigkey_create(keyname, dns_tsig_hmacmd5_name,
|
||||
secret, secretlen, ISC_TRUE, NULL, 0, 0,
|
||||
mctx, NULL, &tsigkey);
|
||||
isc_mem_free(mctx, secret);
|
||||
if (result != ISC_R_SUCCESS) {
|
||||
fprintf(stderr, "could not create key from %s %s: %s\n",
|
||||
namestr, secretstr, dns_result_totext(result));
|
||||
return (STATUS_SYNTAX);
|
||||
}
|
||||
dst_key_setbits(tsigkey->key, digestbits);
|
||||
return (STATUS_MORE);
|
||||
}
|
||||
|
||||
@@ -1421,41 +1305,6 @@ evaluate_update(char *cmdline) {
|
||||
return (update_addordelete(cmdline, isdelete));
|
||||
}
|
||||
|
||||
static void
|
||||
setzone(dns_name_t *zonename) {
|
||||
isc_result_t result;
|
||||
dns_name_t *name = NULL;
|
||||
dns_rdataset_t *rdataset = NULL;
|
||||
|
||||
result = dns_message_firstname(updatemsg, DNS_SECTION_ZONE);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
dns_message_currentname(updatemsg, DNS_SECTION_ZONE, &name);
|
||||
dns_message_removename(updatemsg, name, DNS_SECTION_ZONE);
|
||||
for (rdataset = ISC_LIST_HEAD(name->list);
|
||||
rdataset != NULL;
|
||||
rdataset = ISC_LIST_HEAD(name->list)) {
|
||||
ISC_LIST_UNLINK(name->list, rdataset, link);
|
||||
dns_rdataset_disassociate(rdataset);
|
||||
dns_message_puttemprdataset(updatemsg, &rdataset);
|
||||
}
|
||||
dns_message_puttempname(updatemsg, &name);
|
||||
}
|
||||
|
||||
if (zonename != NULL) {
|
||||
result = dns_message_gettempname(updatemsg, &name);
|
||||
check_result(result, "dns_message_gettempname");
|
||||
dns_name_init(name, NULL);
|
||||
dns_name_clone(zonename, name);
|
||||
result = dns_message_gettemprdataset(updatemsg, &rdataset);
|
||||
check_result(result, "dns_message_gettemprdataset");
|
||||
dns_rdataset_makequestion(rdataset, getzoneclass(),
|
||||
dns_rdatatype_soa);
|
||||
ISC_LIST_INIT(name->list);
|
||||
ISC_LIST_APPEND(name->list, rdataset, link);
|
||||
dns_message_addname(updatemsg, name, DNS_SECTION_ZONE);
|
||||
}
|
||||
}
|
||||
|
||||
static void
|
||||
show_message(dns_message_t *msg) {
|
||||
isc_result_t result;
|
||||
@@ -1463,9 +1312,6 @@ show_message(dns_message_t *msg) {
|
||||
int bufsz;
|
||||
|
||||
ddebug("show_message()");
|
||||
|
||||
setzone(userzone);
|
||||
|
||||
bufsz = INITTEXT;
|
||||
do {
|
||||
if (bufsz > MAXTEXT) {
|
||||
@@ -1691,11 +1537,22 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *master,
|
||||
{
|
||||
isc_result_t result;
|
||||
dns_request_t *request = NULL;
|
||||
dns_name_t *name = NULL;
|
||||
dns_rdataset_t *rdataset = NULL;
|
||||
unsigned int options = 0;
|
||||
|
||||
ddebug("send_update()");
|
||||
|
||||
setzone(zonename);
|
||||
result = dns_message_gettempname(updatemsg, &name);
|
||||
check_result(result, "dns_message_gettempname");
|
||||
dns_name_init(name, NULL);
|
||||
dns_name_clone(zonename, name);
|
||||
result = dns_message_gettemprdataset(updatemsg, &rdataset);
|
||||
check_result(result, "dns_message_gettemprdataset");
|
||||
dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);
|
||||
ISC_LIST_INIT(name->list);
|
||||
ISC_LIST_APPEND(name->list, rdataset, link);
|
||||
dns_message_addname(updatemsg, name, DNS_SECTION_ZONE);
|
||||
|
||||
if (usevc)
|
||||
options |= DNS_REQUESTOPT_TCP;
|
||||
@@ -1810,7 +1667,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
|
||||
result = dns_request_createvia3(requestmgr, soaquery,
|
||||
localaddr, addr, 0, NULL,
|
||||
FIND_TIMEOUT * 20,
|
||||
FIND_TIMEOUT, 3,
|
||||
FIND_TIMEOUT * 20, 3,
|
||||
global_task, recvsoa, reqinfo,
|
||||
&request);
|
||||
check_result(result, "dns_request_createvia");
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
|
||||
[<!ENTITY mdash "—">]>
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -18,7 +18,7 @@
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
|
||||
<!-- $Id: nsupdate.docbook,v 1.18.18.5 2006/01/27 23:57:44 marka Exp $ -->
|
||||
<!-- $Id: nsupdate.docbook,v 1.18.18.3 2005/05/13 01:32:46 marka Exp $ -->
|
||||
<refentry>
|
||||
<refentryinfo>
|
||||
<date>Jun 30, 2000</date>
|
||||
@@ -37,7 +37,6 @@
|
||||
<copyright>
|
||||
<year>2004</year>
|
||||
<year>2005</year>
|
||||
<year>2006</year>
|
||||
<holder>Internet Systems Consortium, Inc. ("ISC")</holder>
|
||||
</copyright>
|
||||
<copyright>
|
||||
@@ -54,7 +53,7 @@
|
||||
<command>nsupdate</command>
|
||||
<arg><option>-d</option></arg>
|
||||
<group>
|
||||
<arg><option>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></option></arg>
|
||||
<arg><option>-y <replaceable class="parameter">keyname:secret</replaceable></option></arg>
|
||||
<arg><option>-k <replaceable class="parameter">keyfile</replaceable></option></arg>
|
||||
</group>
|
||||
<arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg>
|
||||
@@ -127,29 +126,40 @@
|
||||
<filename>/etc/named.conf</filename>.
|
||||
</para>
|
||||
<para><command>nsupdate</command>
|
||||
uses the <option>-y</option> or <option>-k</option> option
|
||||
to provide the shared secret needed to generate a TSIG record
|
||||
for authenticating Dynamic DNS update requests, default type
|
||||
HMAC-MD5. These options are mutually exclusive. With the
|
||||
<option>-k</option> option, <command>nsupdate</command> reads
|
||||
the shared secret from the file <parameter>keyfile</parameter>,
|
||||
uses the <option>-y</option> or <option>-k</option>
|
||||
option (with an HMAC-MD5 key) to provide the shared secret needed to
|
||||
generate
|
||||
a TSIG record for authenticating Dynamic DNS update requests.
|
||||
These options are mutually exclusive.
|
||||
With the
|
||||
<option>-k</option>
|
||||
option,
|
||||
<command>nsupdate</command>
|
||||
reads the shared secret from the file
|
||||
<parameter>keyfile</parameter>,
|
||||
whose name is of the form
|
||||
<filename>K{name}.+157.+{random}.private</filename>. For
|
||||
historical reasons, the file
|
||||
<filename>K{name}.+157.+{random}.key</filename> must also be
|
||||
present. When the <option>-y</option> option is used, a
|
||||
signature is generated from
|
||||
<optional><parameter>hmac:</parameter></optional><parameter>keyname:secret.</parameter>
|
||||
<parameter>keyname</parameter> is the name of the key, and
|
||||
<parameter>secret</parameter> is the base64 encoded shared
|
||||
secret. Use of the <option>-y</option> option is discouraged
|
||||
because the shared secret is supplied as a command line
|
||||
argument in clear text. This may be visible in the output
|
||||
from
|
||||
<filename>K{name}.+157.+{random}.private</filename>.
|
||||
For historical
|
||||
reasons, the file
|
||||
<filename>K{name}.+157.+{random}.key</filename>
|
||||
must also be present. When the
|
||||
<option>-y</option>
|
||||
option is used, a signature is generated from
|
||||
<parameter>keyname:secret.</parameter>
|
||||
<parameter>keyname</parameter>
|
||||
is the name of the key,
|
||||
and
|
||||
<parameter>secret</parameter>
|
||||
is the base64 encoded shared secret.
|
||||
Use of the
|
||||
<option>-y</option>
|
||||
option is discouraged because the shared secret is supplied as a command
|
||||
line argument in clear text.
|
||||
This may be visible in the output from
|
||||
<citerefentry>
|
||||
<refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
|
||||
</citerefentry> or in a history file maintained by the user's
|
||||
shell.
|
||||
<refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
|
||||
</citerefentry>
|
||||
or in a history file maintained by the user's shell.
|
||||
</para>
|
||||
<para>
|
||||
The <option>-k</option> may also be used to specify a SIG(0) key used
|
||||
|
||||
+40
-29
@@ -1,5 +1,5 @@
|
||||
<!--
|
||||
- Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
- Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
-
|
||||
- Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -14,7 +14,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: nsupdate.html,v 1.14.18.15 2006/01/29 22:56:52 marka Exp $ -->
|
||||
<!-- $Id: nsupdate.html,v 1.14.18.12 2005/10/13 02:53:03 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -29,10 +29,10 @@
|
||||
</div>
|
||||
<div class="refsynopsisdiv">
|
||||
<h2>Synopsis</h2>
|
||||
<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
|
||||
<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525910"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525905"></a><h2>DESCRIPTION</h2>
|
||||
<p><span><strong class="command">nsupdate</strong></span>
|
||||
is used to submit Dynamic DNS Update requests as defined in RFC2136
|
||||
to a name server.
|
||||
@@ -93,27 +93,38 @@
|
||||
<code class="filename">/etc/named.conf</code>.
|
||||
</p>
|
||||
<p><span><strong class="command">nsupdate</strong></span>
|
||||
uses the <code class="option">-y</code> or <code class="option">-k</code> option
|
||||
to provide the shared secret needed to generate a TSIG record
|
||||
for authenticating Dynamic DNS update requests, default type
|
||||
HMAC-MD5. These options are mutually exclusive. With the
|
||||
<code class="option">-k</code> option, <span><strong class="command">nsupdate</strong></span> reads
|
||||
the shared secret from the file <em class="parameter"><code>keyfile</code></em>,
|
||||
uses the <code class="option">-y</code> or <code class="option">-k</code>
|
||||
option (with an HMAC-MD5 key) to provide the shared secret needed to
|
||||
generate
|
||||
a TSIG record for authenticating Dynamic DNS update requests.
|
||||
These options are mutually exclusive.
|
||||
With the
|
||||
<code class="option">-k</code>
|
||||
option,
|
||||
<span><strong class="command">nsupdate</strong></span>
|
||||
reads the shared secret from the file
|
||||
<em class="parameter"><code>keyfile</code></em>,
|
||||
whose name is of the form
|
||||
<code class="filename">K{name}.+157.+{random}.private</code>. For
|
||||
historical reasons, the file
|
||||
<code class="filename">K{name}.+157.+{random}.key</code> must also be
|
||||
present. When the <code class="option">-y</code> option is used, a
|
||||
signature is generated from
|
||||
[<span class="optional"><em class="parameter"><code>hmac:</code></em></span>]<em class="parameter"><code>keyname:secret.</code></em>
|
||||
<em class="parameter"><code>keyname</code></em> is the name of the key, and
|
||||
<em class="parameter"><code>secret</code></em> is the base64 encoded shared
|
||||
secret. Use of the <code class="option">-y</code> option is discouraged
|
||||
because the shared secret is supplied as a command line
|
||||
argument in clear text. This may be visible in the output
|
||||
from
|
||||
<span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span> or in a history file maintained by the user's
|
||||
shell.
|
||||
<code class="filename">K{name}.+157.+{random}.private</code>.
|
||||
For historical
|
||||
reasons, the file
|
||||
<code class="filename">K{name}.+157.+{random}.key</code>
|
||||
must also be present. When the
|
||||
<code class="option">-y</code>
|
||||
option is used, a signature is generated from
|
||||
<em class="parameter"><code>keyname:secret.</code></em>
|
||||
<em class="parameter"><code>keyname</code></em>
|
||||
is the name of the key,
|
||||
and
|
||||
<em class="parameter"><code>secret</code></em>
|
||||
is the base64 encoded shared secret.
|
||||
Use of the
|
||||
<code class="option">-y</code>
|
||||
option is discouraged because the shared secret is supplied as a command
|
||||
line argument in clear text.
|
||||
This may be visible in the output from
|
||||
<span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
|
||||
or in a history file maintained by the user's shell.
|
||||
</p>
|
||||
<p>
|
||||
The <code class="option">-k</code> may also be used to specify a SIG(0) key used
|
||||
@@ -153,7 +164,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2526206"></a><h2>INPUT FORMAT</h2>
|
||||
<a name="id2526197"></a><h2>INPUT FORMAT</h2>
|
||||
<p><span><strong class="command">nsupdate</strong></span>
|
||||
reads input from
|
||||
<em class="parameter"><code>filename</code></em>
|
||||
@@ -343,7 +354,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527158"></a><h2>EXAMPLES</h2>
|
||||
<a name="id2527148"></a><h2>EXAMPLES</h2>
|
||||
<p>
|
||||
The examples below show how
|
||||
<span><strong class="command">nsupdate</strong></span>
|
||||
@@ -397,7 +408,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527270"></a><h2>FILES</h2>
|
||||
<a name="id2527260"></a><h2>FILES</h2>
|
||||
<div class="variablelist"><dl>
|
||||
<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
|
||||
<dd><p>
|
||||
@@ -416,7 +427,7 @@
|
||||
</dl></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527408"></a><h2>SEE ALSO</h2>
|
||||
<a name="id2527398"></a><h2>SEE ALSO</h2>
|
||||
<p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,
|
||||
<span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>,
|
||||
@@ -429,7 +440,7 @@
|
||||
</p>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2527478"></a><h2>BUGS</h2>
|
||||
<a name="id2527468"></a><h2>BUGS</h2>
|
||||
<p>
|
||||
The TSIG key is redundantly stored in two separate files.
|
||||
This is a consequence of nsupdate using the DST library
|
||||
|
||||
+17
-19
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: rndc.c,v 1.96.18.15 2006/03/09 23:46:20 marka Exp $ */
|
||||
/* $Id: rndc.c,v 1.96.18.12 2005/09/19 00:15:20 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -132,8 +132,6 @@ command is one of the following:\n\
|
||||
Flush the given name from the server's cache(s)\n\
|
||||
status Display status of the server.\n\
|
||||
recursing Dump the queries that are currently recursing (named.recursing)\n\
|
||||
validation newstate [view]\n\
|
||||
Enable / disable DNSSEC validation.\n\
|
||||
*restart Restart the server.\n\
|
||||
\n\
|
||||
* == not yet implemented\n\
|
||||
@@ -417,25 +415,25 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
|
||||
{
|
||||
isc_result_t result;
|
||||
const char *conffile = admin_conffile;
|
||||
const cfg_obj_t *addresses = NULL;
|
||||
const cfg_obj_t *defkey = NULL;
|
||||
const cfg_obj_t *options = NULL;
|
||||
const cfg_obj_t *servers = NULL;
|
||||
const cfg_obj_t *server = NULL;
|
||||
const cfg_obj_t *keys = NULL;
|
||||
const cfg_obj_t *key = NULL;
|
||||
const cfg_obj_t *defport = NULL;
|
||||
const cfg_obj_t *secretobj = NULL;
|
||||
const cfg_obj_t *algorithmobj = NULL;
|
||||
cfg_obj_t *addresses = NULL;
|
||||
cfg_obj_t *defkey = NULL;
|
||||
cfg_obj_t *options = NULL;
|
||||
cfg_obj_t *servers = NULL;
|
||||
cfg_obj_t *server = NULL;
|
||||
cfg_obj_t *keys = NULL;
|
||||
cfg_obj_t *key = NULL;
|
||||
cfg_obj_t *defport = NULL;
|
||||
cfg_obj_t *secretobj = NULL;
|
||||
cfg_obj_t *algorithmobj = NULL;
|
||||
cfg_obj_t *config = NULL;
|
||||
const cfg_obj_t *address = NULL;
|
||||
const cfg_listelt_t *elt;
|
||||
cfg_obj_t *address = NULL;
|
||||
cfg_listelt_t *elt;
|
||||
const char *secretstr;
|
||||
const char *algorithm;
|
||||
static char secretarray[1024];
|
||||
const cfg_type_t *conftype = &cfg_type_rndcconf;
|
||||
isc_boolean_t key_only = ISC_FALSE;
|
||||
const cfg_listelt_t *element;
|
||||
cfg_listelt_t *element;
|
||||
|
||||
if (! isc_file_exists(conffile)) {
|
||||
conffile = admin_keyfile;
|
||||
@@ -462,7 +460,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
|
||||
if (key_only && servername == NULL)
|
||||
servername = "127.0.0.1";
|
||||
else if (servername == NULL && options != NULL) {
|
||||
const cfg_obj_t *defserverobj = NULL;
|
||||
cfg_obj_t *defserverobj = NULL;
|
||||
(void)cfg_map_get(options, "default-server", &defserverobj);
|
||||
if (defserverobj != NULL)
|
||||
servername = cfg_obj_asstring(defserverobj);
|
||||
@@ -572,7 +570,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
|
||||
if (!cfg_obj_issockaddr(address)) {
|
||||
unsigned int myport;
|
||||
const char *name;
|
||||
const cfg_obj_t *obj;
|
||||
cfg_obj_t *obj;
|
||||
|
||||
obj = cfg_tuple_get(address, "name");
|
||||
name = cfg_obj_asstring(obj);
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
- PERFORMANCE OF THIS SOFTWARE.
|
||||
-->
|
||||
<!-- $Id: rndc.conf.html,v 1.6.18.16 2006/01/29 22:56:52 marka Exp $ -->
|
||||
<!-- $Id: rndc.conf.html,v 1.6.18.15 2005/10/13 02:53:04 marka Exp $ -->
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
|
||||
@@ -32,7 +32,7 @@
|
||||
<div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
|
||||
</div>
|
||||
<div class="refsect1" lang="en">
|
||||
<a name="id2525299"></a><h2>DESCRIPTION</h2>
|
||||
<a name="id2525845"></a><h2>DESCRIPTION</h2>
|
||||
<p><code class="filename">rndc.conf</code> is the configuration file
|
||||
for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
|
||||
utility. This file has a similar structure and syntax to
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1999-2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: compress_test.c,v 1.27.18.4 2006/02/26 23:49:49 marka Exp $ */
|
||||
/* $Id: compress_test.c,v 1.27.18.2 2005/04/29 00:15:43 marka Exp $ */
|
||||
|
||||
/*! \file */
|
||||
|
||||
@@ -133,7 +133,7 @@ test(unsigned int allowed, dns_name_t *name1, dns_name_t *name2,
|
||||
case DNS_COMPRESS_NONE: s = "DNS_COMPRESS_NONE"; break;
|
||||
case DNS_COMPRESS_GLOBAL14: s = "DNS_COMPRESS_GLOBAL14"; break;
|
||||
/* case DNS_COMPRESS_ALL: s = "DNS_COMPRESS_ALL"; break; */
|
||||
default: s = "UNKNOWN"; break;
|
||||
default: s = "UNKOWN"; break;
|
||||
}
|
||||
fprintf(stdout, "Allowed = %s\n", s);
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 1998-2003 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: rdata_test.c,v 1.41.18.5 2006/02/26 23:49:49 marka Exp $ */
|
||||
/* $Id: rdata_test.c,v 1.41.18.3 2005/07/14 06:51:02 marka Exp $ */
|
||||
|
||||
#include <config.h>
|
||||
|
||||
@@ -309,7 +309,7 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
|
||||
break;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fprintf(stdout, "viastruct: tostruct %d %d return %s\n",
|
||||
fprintf(stdout, "viastruct: tostuct %d %d return %s\n",
|
||||
rdata->type, rdata->rdclass,
|
||||
dns_result_totext(result));
|
||||
else
|
||||
@@ -571,7 +571,7 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
|
||||
break;
|
||||
}
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fprintf(stdout, "viastruct: tostruct %d %d return %s\n",
|
||||
fprintf(stdout, "viastruct: tostuct %d %d return %s\n",
|
||||
rdata->type, rdata->rdclass,
|
||||
dns_result_totext(result));
|
||||
else {
|
||||
@@ -582,7 +582,7 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
|
||||
result = dns_rdata_fromstruct(rdata2, rdc, rdt, sp, b);
|
||||
if (result != ISC_R_SUCCESS)
|
||||
fprintf(stdout,
|
||||
"viastruct: fromstruct %d %d return %s\n",
|
||||
"viastruct: fromstuct %d %d return %s\n",
|
||||
rdata->type, rdata->rdclass,
|
||||
dns_result_totext(result));
|
||||
else if (rdata->length != rdata2->length ||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: conf.sh.in,v 1.27.18.8 2006/03/05 23:58:51 marka Exp $
|
||||
# $Id: conf.sh.in,v 1.27.18.6 2005/09/05 00:18:12 marka Exp $
|
||||
|
||||
#
|
||||
# Common configuration data for system tests, to be sourced into
|
||||
@@ -44,8 +44,8 @@ CHECKCONF=$TOP/bin/check/named-checkconf
|
||||
# load on the machine to make it unusable to other users.
|
||||
# v6synth
|
||||
SUBDIRS="cacheclean checkconf checknames dnssec forward glue ixfr limits
|
||||
lwresd masterfile masterformat notify nsupdate resolver rrsetorder
|
||||
sortlist stub tkey unknown upforwd views xfer xferquota zonechecks"
|
||||
lwresd masterfile masterformat notify nsupdate resolver sortlist stub
|
||||
tkey unknown upforwd views xfer xferquota zonechecks"
|
||||
|
||||
# PERL will be an empty string if no perl interpreter was found.
|
||||
PERL=@PERL@
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.2.2.4 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.2.2.2 2004/06/04 02:31:53 marka Exp $ */
|
||||
|
||||
/*
|
||||
* Choose a keyname that is unlikely to clash with any real key names.
|
||||
@@ -58,7 +58,6 @@ options {
|
||||
recursion yes;
|
||||
notify yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-lookaside "." trust-anchor "dlv.utld";
|
||||
};
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.20.18.2 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.20 2004/03/10 02:19:53 marka Exp $ */
|
||||
|
||||
// NS1
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
recursion no;
|
||||
notify yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.19.18.2 2006/01/04 00:37:23 marka Exp $
|
||||
# $Id: sign.sh,v 1.19 2004/03/10 02:19:53 marka Exp $
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
@@ -31,7 +31,7 @@ zonefile=root.db
|
||||
cp ../ns2/keyset-example. .
|
||||
cp ../ns2/keyset-dlv. .
|
||||
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key > $zonefile
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.23.18.3 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.23.18.1 2004/05/05 01:32:35 marka Exp $ */
|
||||
|
||||
// NS2
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
recursion no;
|
||||
notify yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2003 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.24.18.2 2006/01/04 00:37:23 marka Exp $
|
||||
# $Id: sign.sh,v 1.24 2004/03/10 02:19:53 marka Exp $
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
@@ -48,7 +48,7 @@ privzone=private.secure.example.
|
||||
privinfile=private.secure.example.db.in
|
||||
privzonefile=private.secure.example.db
|
||||
|
||||
privkeyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $privzone`
|
||||
privkeyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $privzone`
|
||||
|
||||
cat $privinfile $privkeyname.key >$privzonefile
|
||||
|
||||
@@ -61,7 +61,7 @@ dlvzone=dlv.
|
||||
dlvinfile=dlv.db.in
|
||||
dlvzonefile=dlv.db
|
||||
|
||||
dlvkeyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
|
||||
dlvkeyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $dlvzone`
|
||||
|
||||
cat $dlvinfile $dlvkeyname.key dlvset-$privzone > $dlvzonefile
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.25.18.4 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.25.18.2 2004/05/05 01:32:36 marka Exp $ */
|
||||
|
||||
// NS3
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
recursion no;
|
||||
notify yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.18.18.3 2006/03/06 01:38:00 marka Exp $
|
||||
# $Id: sign.sh,v 1.18 2004/03/05 05:00:21 marka Exp $
|
||||
|
||||
RANDFILE=../random.data
|
||||
|
||||
@@ -33,7 +33,7 @@ zone=bogus.example.
|
||||
infile=bogus.example.db.in
|
||||
zonefile=bogus.example.db
|
||||
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
@@ -43,10 +43,9 @@ zone=dynamic.example.
|
||||
infile=dynamic.example.db.in
|
||||
zonefile=dynamic.example.db
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname2=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -o $zone $zonefile > /dev/null
|
||||
|
||||
@@ -54,7 +53,7 @@ zone=keyless.example.
|
||||
infile=keyless.example.db.in
|
||||
zonefile=keyless.example.db
|
||||
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.22.18.3 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.22.18.1 2004/04/16 00:01:39 marka Exp $ */
|
||||
|
||||
// NS4
|
||||
|
||||
@@ -31,7 +31,6 @@ options {
|
||||
listen-on-v6 { none; };
|
||||
recursion yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-must-be-secure mustbesecure.example yes;
|
||||
};
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.20.18.2 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.20 2004/03/10 02:19:54 marka Exp $ */
|
||||
|
||||
// NS5
|
||||
|
||||
@@ -31,7 +31,6 @@ options {
|
||||
listen-on-v6 { none; };
|
||||
recursion yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
* purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.6.18.3 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.6.18.1 2004/06/04 02:31:53 marka Exp $ */
|
||||
|
||||
// NS6
|
||||
|
||||
@@ -32,7 +32,6 @@ options {
|
||||
notify yes;
|
||||
disable-algorithms . { DSA; };
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-lookaside . trust-anchor dlv;
|
||||
};
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,11 +15,11 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: prereq.sh,v 1.5.18.3 2006/01/04 00:37:23 marka Exp $
|
||||
# $Id: prereq.sh,v 1.5.18.1 2004/12/08 06:14:06 marka Exp $
|
||||
|
||||
../../genrandom 400 random.data
|
||||
|
||||
if $KEYGEN -a RSAMD5 -b 512 -n zone -r random.data foo > /dev/null 2>&1
|
||||
if $KEYGEN -a RSA -b 512 -n zone -r random.data foo > /dev/null 2>&1
|
||||
then
|
||||
rm -f Kfoo*
|
||||
else
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: tests.sh,v 1.44.18.5 2006/02/26 23:49:49 marka Exp $
|
||||
# $Id: tests.sh,v 1.44.18.3 2005/09/06 03:47:15 marka Exp $
|
||||
|
||||
SYSTEMTESTTOP=..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
@@ -428,7 +428,7 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking privately secure wildcard to nxdomain works ($n)"
|
||||
echo "I:checking privately secure wilcard to nxdomain works ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth a.wild.private.secure.example. SOA @10.53.0.2 \
|
||||
> dig.out.ns2.test$n || ret=1
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright (C) 2004, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
|
||||
* Copyright (C) 2000, 2001 Internet Software Consortium.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for any
|
||||
@@ -15,7 +15,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.15.18.2 2006/03/10 00:23:20 marka Exp $ */
|
||||
/* $Id: named.conf,v 1.15 2004/03/10 02:19:54 marka Exp $ */
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
@@ -30,7 +30,6 @@ options {
|
||||
recursion no;
|
||||
notify no;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
};
|
||||
|
||||
zone "." {
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (C) 2005, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -12,6 +12,6 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: compile.sh,v 1.2.2.3 2006/01/07 00:23:34 marka Exp $
|
||||
# $Id: compile.sh,v 1.2 2005/06/20 01:03:50 marka Exp $
|
||||
|
||||
../named-compilezone -D -F raw -o example.db.raw example example.db
|
||||
../named-compilezone -F raw -o example.db.raw example example.db
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# Copyright (C) 2005, 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2005 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -12,9 +12,8 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: setup.sh,v 1.2.2.3 2006/01/07 00:23:34 marka Exp $
|
||||
# $Id: setup.sh,v 1.2 2005/06/20 01:03:50 marka Exp $
|
||||
|
||||
ln -s $CHECKZONE named-compilezone
|
||||
rm -f ns1/example.db.raw
|
||||
cp ns1/example.db ns2/
|
||||
cd ns1 && sh compile.sh
|
||||
|
||||
@@ -1,22 +0,0 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2006 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
# copyright notice and this permission notice appear in all copies.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: clean.sh,v 1.2.2.2 2006/03/05 23:58:51 marka Exp $
|
||||
|
||||
rm -f dig.out.cyclic dig.out.fixed dig.out.random
|
||||
rm -f ns2/root.bk
|
||||
rm -f ns?/named.run ns?/named.core
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.1
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
1.2.3.4
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
1.2.3.3
|
||||
1.2.3.4
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.2
|
||||
1.2.3.3
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.2
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
1.2.3.3
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.2
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
1.2.3.1
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
1.2.3.4
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.1
|
||||
1.2.3.4
|
||||
1.2.3.2
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
1.2.3.4
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.3
|
||||
1.2.3.4
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
1.2.3.3
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.1
|
||||
1.2.3.2
|
||||
1.2.3.4
|
||||
1.2.3.3
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.4
|
||||
1.2.3.1
|
||||
1.2.3.3
|
||||
1.2.3.2
|
||||
@@ -1,4 +0,0 @@
|
||||
1.2.3.4
|
||||
1.2.3.2
|
||||
1.2.3.1
|
||||
1.2.3.3
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user