From 532901856c574b8edc5f1b0479353132060e985b Mon Sep 17 00:00:00 2001 From: "Internet Software Consortium, Inc" <@isc.org> Date: Wed, 17 Feb 2010 14:19:33 -0700 Subject: 9.7.0 --- CHANGES | 18 + HISTORY | 313 +++++++++++++++ README | 453 ++++------------------ README.dnssec | 186 --------- README.libdns | 275 -------------- README.pkcs11 | 309 --------------- README.rfc5011 | 74 ---- bin/dnssec/dnssec-settime.8 | 8 +- bin/dnssec/dnssec-settime.c | 4 +- bin/dnssec/dnssec-settime.docbook | 7 +- bin/dnssec/dnssec-settime.html | 18 +- bin/named/statschannel.c | 354 ++++++++++------- doc/arm/Bv9ARM-book.xml | 19 +- doc/arm/Bv9ARM.ch04.html | 711 ++++++++++++++++++++++++++++++++++- doc/arm/Bv9ARM.ch05.html | 6 +- doc/arm/Bv9ARM.ch06.html | 162 ++++---- doc/arm/Bv9ARM.ch07.html | 14 +- doc/arm/Bv9ARM.ch08.html | 18 +- doc/arm/Bv9ARM.ch09.html | 655 +++++++++++++++++++++++++++----- doc/arm/Bv9ARM.html | 120 ++++-- doc/arm/dnssec.xml | 244 ++++++++++++ doc/arm/libdns.xml | 530 ++++++++++++++++++++++++++ doc/arm/man.arpaname.html | 8 +- doc/arm/man.ddns-confgen.html | 10 +- doc/arm/man.dig.html | 20 +- doc/arm/man.dnssec-dsfromkey.html | 16 +- doc/arm/man.dnssec-keyfromlabel.html | 14 +- doc/arm/man.dnssec-keygen.html | 16 +- doc/arm/man.dnssec-revoke.html | 10 +- doc/arm/man.dnssec-settime.html | 16 +- doc/arm/man.dnssec-signzone.html | 12 +- doc/arm/man.genrandom.html | 10 +- doc/arm/man.host.html | 10 +- doc/arm/man.isc-hmac-fixup.html | 10 +- doc/arm/man.named-checkconf.html | 12 +- doc/arm/man.named-checkzone.html | 12 +- doc/arm/man.named-journalprint.html | 8 +- doc/arm/man.named.html | 16 +- doc/arm/man.nsec3hash.html | 10 +- doc/arm/man.nsupdate.html | 14 +- doc/arm/man.rndc-confgen.html | 12 +- doc/arm/man.rndc.conf.html | 12 +- doc/arm/man.rndc.html | 12 +- doc/arm/managed-keys.xml | 100 +++++ doc/arm/pkcs11.xml | 372 ++++++++++++++++++ lib/dns/api | 2 +- lib/dns/zone.c | 24 +- lib/isc/api | 2 +- lib/isc/httpd.c | 45 ++- lib/isc/unix/socket.c | 24 +- version | 6 +- win32utils/BuildSetup.bat | 1 + 52 files changed, 3556 insertions(+), 1778 deletions(-) create mode 100644 HISTORY delete mode 100644 README.dnssec delete mode 100644 README.libdns delete mode 100644 README.pkcs11 delete mode 100644 README.rfc5011 create mode 100644 doc/arm/dnssec.xml create mode 100644 doc/arm/libdns.xml create mode 100644 doc/arm/managed-keys.xml create mode 100644 doc/arm/pkcs11.xml diff --git a/CHANGES b/CHANGES index aec133c9..09a6f58a 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,21 @@ + --- 9.7.0 released --- + +2849. [bug] Don't treat errors from the xml2 library as fatal. + [RT #20945] + +2848. [doc] Moved README.dnssec, README.libdns, README.pkcs11 and + README.rfc5011 into the ARM. [RT #20899] + +2847. [cleanup] Corrected usage message in dnssec-settime. [RT #20921] + +2846. [bug] EOF on unix domain sockets was not being handled + correctly. [RT #20731] + +2845. [bug] RFC 5011 client could crash on shutdown. [RT #20903] + +2844. [doc] notify-delay default in ARM was wrong. It should have + been five (5) seconds. + --- 9.7.0rc2 released --- 2843. [func] Prevent dnssec-keygen and dnssec-keyfromlabel from diff --git a/HISTORY b/HISTORY new file mode 100644 index 00000000..e98f9b41 --- /dev/null +++ b/HISTORY @@ -0,0 +1,313 @@ +Summary of functional enhancements from prior major releases of BIND 9: + +BIND 9.6.0 + + Full NSEC3 support + + Automatic zone re-signing + + New update-policy methods tcp-self and 6to4-self + + The BIND 8 resolver library, libbind, has been removed from the + BIND 9 distribution and is now available as a separate download. + + Change the default pid file location from /var/run to + /var/run/{named,lwresd} for improved chroot/setuid support. + +BIND 9.5.0 + + GSS-TSIG support (RFC 3645). + + DHCID support. + + Experimental http server and statistics support for named via xml. + + More detailed statistics counters including those supported in BIND 8. + + Faster ACL processing. + + Use Doxygen to generate internal documentation. + + Efficient LRU cache-cleaning mechanism. + + NSID support. + +BIND 9.4.0 + + Implemented "additional section caching (or acache)", an + internal cache framework for additional section content to + improve response performance. Several configuration options + were provided to control the behavior. + + New notify type 'master-only'. Enable notify for master + zones only. + + Accept 'notify-source' style syntax for query-source. + + rndc now allows addresses to be set in the server clauses. + + New option "allow-query-cache". This lets "allow-query" + be used to specify the default zone access level rather + than having to have every zone override the global value. + "allow-query-cache" can be set at both the options and view + levels. If "allow-query-cache" is not set then "allow-recursion" + is used if set, otherwise "allow-query" is used if set + unless "recursion no;" is set in which case "none;" is used, + otherwise the default (localhost; localnets;) is used. + + rndc: the source address can now be specified. + + ixfr-from-differences now takes master and slave in addition + to yes and no at the options and view levels. + + Allow the journal's name to be changed via named.conf. + + 'rndc notify zone [class [view]]' resend the NOTIFY messages + for the specified zone. + + 'dig +trace' now randomly selects the next servers to try. + Report if there is a bad delegation. + + Improve check-names error messages. + + Make public the function to read a key file, dst_key_read_public(). + + dig now returns the byte count for axfr/ixfr. + + allow-update is now settable at the options / view level. + + named-checkconf now checks the logging configuration. + + host now can turn on memory debugging flags with '-m'. + + Don't send notify messages to self. + + Perform sanity checks on NS records which refer to 'in zone' names. + + New zone option "notify-delay". Specify a minimum delay + between sets of NOTIFY messages. + + Extend adjusting TTL warning messages. + + Named and named-checkzone can now both check for non-terminal + wildcard records. + + "rndc freeze/thaw" now freezes/thaws all zones. + + named-checkconf now check acls to verify that they only + refer to existing acls. + + The server syntax has been extended to support a range of + servers. + + Report differences between hints and real NS rrset and + associated address records. + + Preserve the case of domain names in rdata during zone + transfers. + + Restructured the data locking framework using architecture + dependent atomic operations (when available), improving + response performance on multi-processor machines significantly. + x86, x86_64, alpha, powerpc, and mips are currently supported. + + UNIX domain controls are now supported. + + Add support for additional zone file formats for improving + loading performance. The masterfile-format option in + named.conf can be used to specify a non-default format. A + separate command named-compilezone was provided to generate + zone files in the new format. Additionally, the -I and -O + options for dnssec-signzone specify the input and output + formats. + + dnssec-signzone can now randomize signature end times + (dnssec-signzone -j jitter). + + Add support for CH A record. + + Add additional zone data constancy checks. named-checkzone + has extended checking of NS, MX and SRV record and the hosts + they reference. named has extended post zone load checks. + New zone options: check-mx and integrity-check. + + + edns-udp-size can now be overridden on a per server basis. + + dig can now specify the EDNS version when making a query. + + Added framework for handling multiple EDNS versions. + + Additional memory debugging support to track size and mctx + arguments. + + Detect duplicates of UDP queries we are recursing on and + drop them. New stats category "duplicates". + + "USE INTERNAL MALLOC" is now runtime selectable. + + The lame cache is now done on a basis + as some servers only appear to be lame for certain query + types. + + Limit the number of recursive clients that can be waiting + for a single query () to resolve. New + options clients-per-query and max-clients-per-query. + + dig: report the number of extra bytes still left in the + packet after processing all the records. + + Support for IPSECKEY rdata type. + + Raise the UDP recieve buffer size to 32k if it is less than 32k. + + x86 and x86_64 now have seperate atomic locking implementations. + + named-checkconf now validates update-policy entries. + + Attempt to make the amount of work performed in a iteration + self tuning. The covers nodes clean from the cache per + iteration, nodes written to disk when rewriting a master + file and nodes destroyed per iteration when destroying a + zone or a cache. + + ISC string copy API. + + Automatic empty zone creation for D.F.IP6.ARPA and friends. + Note: RFC 1918 zones are not yet covered by this but are + likely to be in a future release. + + New options: empty-server, empty-contact, empty-zones-enable + and disable-empty-zone. + + dig now has a '-q queryname' and '+showsearch' options. + + host/nslookup now continue (default)/fail on SERVFAIL. + + dig now warns if 'RA' is not set in the answer when 'RD' + was set in the query. host/nslookup skip servers that fail + to set 'RA' when 'RD' is set unless a server is explicitly + set. + + Integrate contibuted DLZ code into named. + + Integrate contibuted IDN code from JPNIC. + + libbind: corresponds to that from BIND 8.4.7. + +BIND 9.3.0 + + DNSSEC is now DS based (RFC 3658). + See also RFC 3845, doc/draft/draft-ietf-dnsext-dnssec-*. + + DNSSEC lookaside validation. + + check-names is now implemented. + rrset-order in more complete. + + IPv4/IPv6 transition support, dual-stack-servers. + + IXFR deltas can now be generated when loading master files, + ixfr-from-differences. + + It is now possible to specify the size of a journal, max-journal-size. + + It is now possible to define a named set of master servers to be + used in masters clause, masters. + + The advertised EDNS UDP size can now be set, edns-udp-size. + + allow-v6-synthesis has been obsoleted. + + NOTE: + * Zones containing MD and MF will now be rejected. + * dig, nslookup name. now report "Not Implemented" as + NOTIMP rather than NOTIMPL. This will have impact on scripts + that are looking for NOTIMPL. + + libbind: corresponds to that from BIND 8.4.5. + +BIND 9.2.0 + + The size of the cache can now be limited using the + "max-cache-size" option. + + The server can now automatically convert RFC1886-style recursive + lookup requests into RFC2874-style lookups, when enabled using the + new option "allow-v6-synthesis". This allows stub resolvers that + support AAAA records but not A6 record chains or binary labels to + perform lookups in domains that make use of these IPv6 DNS + features. + + Performance has been improved. + + The man pages now use the more portable "man" macros rather than + the "mandoc" macros, and are installed by "make install". + + The named.conf parser has been completely rewritten. It now + supports "include" directives in more places such as inside "view" + statements, and it no longer has any reserved words. + + The "rndc status" command is now implemented. + + rndc can now be configured automatically. + + A BIND 8 compatible stub resolver library is now included in + lib/bind. + + OpenSSL has been removed from the distribution. This means that to + use DNSSEC, OpenSSL must be installed and the --with-openssl option + must be supplied to configure. This does not apply to the use of + TSIG, which does not require OpenSSL. + + The source distribution now builds on Windows. See + win32utils/readme1.txt and win32utils/win32-build.txt for details. + + This distribution also includes a new lightweight stub + resolver library and associated resolver daemon that fully + support forward and reverse lookups of both IPv4 and IPv6 + addresses. This library is considered experimental and + is not a complete replacement for the BIND 8 resolver library. + Applications that use the BIND 8 res_* functions to perform + DNS lookups or dynamic updates still need to be linked against + the BIND 8 libraries. For DNS lookups, they can also use the + new "getrrsetbyname()" API. + + BIND 9.2 is capable of acting as an authoritative server + for DNSSEC secured zones. This functionality is believed to + be stable and complete except for lacking support for + verifications involving wildcard records in secure zones. + + When acting as a caching server, BIND 9.2 can be configured + to perform DNSSEC secure resolution on behalf of its clients. + This part of the DNSSEC implementation is still considered + experimental. For detailed information about the state of the + DNSSEC implementation, see the file doc/misc/dnssec. + + There are a few known bugs: + + On some systems, IPv6 and IPv4 sockets interact in + unexpected ways. For details, see doc/misc/ipv6. + To reduce the impact of these problems, the server + no longer listens for requests on IPv6 addresses + by default. If you need to accept DNS queries over + IPv6, you must specify "listen-on-v6 { any; };" + in the named.conf options statement. + + FreeBSD prior to 4.2 (and 4.2 if running as non-root) + and OpenBSD prior to 2.8 log messages like + "fcntl(8, F_SETFL, 4): Inappropriate ioctl for device". + This is due to a bug in "/dev/random" and impacts the + server's DNSSEC support. + + OS X 10.1.4 (Darwin 5.4), OS X 10.1.5 (Darwin 5.5) and + OS X 10.2 (Darwin 6.0) reports errors like + "fcntl(3, F_SETFL, 4): Operation not supported by device". + This is due to a bug in "/dev/random" and impacts the + server's DNSSEC support. + + --with-libtool does not work on AIX. + + A bug in some versions of the Microsoft DNS server can cause zone + transfers from a BIND 9 server to a W2K server to fail. For details, + see the "Zone Transfers" section in doc/misc/migration. diff --git a/README b/README index c1def626..f0e1d200 100644 --- a/README +++ b/README @@ -42,6 +42,12 @@ BIND 9 Stichting NLnet - NLnet Foundation Nominum, Inc. + For a summary of functional enhancements in previous + releases, see the HISTORY file. + + For a detailed list of user-visible changes from + previous releases, see the CHANGES file. + BIND 9.7.0 BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier @@ -60,383 +66,64 @@ BIND 9.7.0 - DNS rebinding attack prevention. - New default values for dnssec-keygen parameters. - Support for RFC 5011 automated trust anchor maintenance - (see README.rfc5011 for additional details). - Smart signing: simplified tools for zone signing and key maintenance. - The "statistics-channels" option is now available on Windows. - - A new DNSSEC-aware libdns API for use by non-BIND9 applications - (see README.libdns for details). - - On some platforms, named and other binaries can now print out - a stack backtrace on assertion failure, to aid in debugging. - - A "tools only" installation mode on Windows, which only installs - dig, host, nslookup and nsupdate. - - Improved PKCS#11 support, including Keyper support and explicit - OpenSSL engine selection (see README.pkcs11 for additional details). - - COMPATIBILITY NOTES: - - - If you had built BIND 9.6 with any of ALLOW_NSEC3PARAM_UPDATE, - ALLOW_SECURE_TO_INSECURE or ALLOW_INSECURE_TO_SECURE defined, then - you should ensure that all changes that are in progress have - completed prior to upgrading to BIND 9.7. BIND 9.7 implements - those features in a way which is not backwards compatible. - - - Prior releases had a bug which caused HMAC-SHA* keys with long - secrets to be used incorrectly. Fixing this bug means that older - versions of BIND 9 may fail to interoperate with this version - when using TSIG keys. If this occurs, the new "isc-hmac-fixup" - tool will convert a key with a long secret into a form that works - correctly with all versions of BIND 9. See the "isc-hmac-fixup" - man page for additional details. - - - Revoking a DNSSEC key with "dnssec-revoke" changes its key ID. - It is possible for the new key ID to collide with that of a - different key. Newly generated keys will not have this problem, - as "dnssec-keygen" looks for potential collisions before - generating keys, but exercise caution if using key revokation - with keys that were generated by older versions of BIND 9. - See README.rfc5011 for more details. - - - A bug was fixed in which a key's scheduled inactivity date was - stored incorectly. Users who participated in the 9.7.0 BETA - test and had DNSSEC keys with scheduled inactivity dates will - need to reset those keys' dates using "dnssec-settime -I". - -BIND 9.6.0 - - BIND 9.6.0 includes a number of changes from BIND 9.5 and earlier - releases, including: - - Full NSEC3 support - - Automatic zone re-signing - - New update-policy methods tcp-self and 6to4-self - - The BIND 8 resolver library, libbind, has been removed from the - BIND 9 distribution and is now available as a separate download. - - Change the default pid file location from /var/run to - /var/run/{named,lwresd} for improved chroot/setuid support. - -BIND 9.5.0 - - BIND 9.5.0 has a number of new features over 9.4, - including: - - GSS-TSIG support (RFC 3645). - - DHCID support. - - Experimental http server and statistics support for named via xml. - - More detailed statistics counters including those supported in BIND 8. - - Faster ACL processing. - - Use Doxygen to generate internal documentation. - - Efficient LRU cache-cleaning mechanism. - - NSID support. - -BIND 9.4.0 - - BIND 9.4.0 has a number of new features over 9.3, - including: - - Implemented "additional section caching (or acache)", an - internal cache framework for additional section content to - improve response performance. Several configuration options - were provided to control the behavior. - - New notify type 'master-only'. Enable notify for master - zones only. - - Accept 'notify-source' style syntax for query-source. - - rndc now allows addresses to be set in the server clauses. - - New option "allow-query-cache". This lets "allow-query" - be used to specify the default zone access level rather - than having to have every zone override the global value. - "allow-query-cache" can be set at both the options and view - levels. If "allow-query-cache" is not set then "allow-recursion" - is used if set, otherwise "allow-query" is used if set - unless "recursion no;" is set in which case "none;" is used, - otherwise the default (localhost; localnets;) is used. - - rndc: the source address can now be specified. - - ixfr-from-differences now takes master and slave in addition - to yes and no at the options and view levels. - - Allow the journal's name to be changed via named.conf. - - 'rndc notify zone [class [view]]' resend the NOTIFY messages - for the specified zone. - - 'dig +trace' now randomly selects the next servers to try. - Report if there is a bad delegation. - - Improve check-names error messages. - - Make public the function to read a key file, dst_key_read_public(). - - dig now returns the byte count for axfr/ixfr. - - allow-update is now settable at the options / view level. - - named-checkconf now checks the logging configuration. - - host now can turn on memory debugging flags with '-m'. - - Don't send notify messages to self. - - Perform sanity checks on NS records which refer to 'in zone' names. - - New zone option "notify-delay". Specify a minimum delay - between sets of NOTIFY messages. - - Extend adjusting TTL warning messages. - - Named and named-checkzone can now both check for non-terminal - wildcard records. - - "rndc freeze/thaw" now freezes/thaws all zones. - - named-checkconf now check acls to verify that they only - refer to existing acls. - - The server syntax has been extended to support a range of - servers. - - Report differences between hints and real NS rrset and - associated address records. - - Preserve the case of domain names in rdata during zone - transfers. - - Restructured the data locking framework using architecture - dependent atomic operations (when available), improving - response performance on multi-processor machines significantly. - x86, x86_64, alpha, powerpc, and mips are currently supported. - - UNIX domain controls are now supported. - - Add support for additional zone file formats for improving - loading performance. The masterfile-format option in - named.conf can be used to specify a non-default format. A - separate command named-compilezone was provided to generate - zone files in the new format. Additionally, the -I and -O - options for dnssec-signzone specify the input and output - formats. - - dnssec-signzone can now randomize signature end times - (dnssec-signzone -j jitter). - - Add support for CH A record. - - Add additional zone data constancy checks. named-checkzone - has extended checking of NS, MX and SRV record and the hosts - they reference. named has extended post zone load checks. - New zone options: check-mx and integrity-check. - - - edns-udp-size can now be overridden on a per server basis. - - dig can now specify the EDNS version when making a query. - - Added framework for handling multiple EDNS versions. - - Additional memory debugging support to track size and mctx - arguments. - - Detect duplicates of UDP queries we are recursing on and - drop them. New stats category "duplicates". - - "USE INTERNAL MALLOC" is now runtime selectable. - - The lame cache is now done on a basis - as some servers only appear to be lame for certain query - types. - - Limit the number of recursive clients that can be waiting - for a single query () to resolve. New - options clients-per-query and max-clients-per-query. - - dig: report the number of extra bytes still left in the - packet after processing all the records. - - Support for IPSECKEY rdata type. - - Raise the UDP recieve buffer size to 32k if it is less than 32k. - - x86 and x86_64 now have seperate atomic locking implementations. - - named-checkconf now validates update-policy entries. - - Attempt to make the amount of work performed in a iteration - self tuning. The covers nodes clean from the cache per - iteration, nodes written to disk when rewriting a master - file and nodes destroyed per iteration when destroying a - zone or a cache. - - ISC string copy API. - - Automatic empty zone creation for D.F.IP6.ARPA and friends. - Note: RFC 1918 zones are not yet covered by this but are - likely to be in a future release. - - New options: empty-server, empty-contact, empty-zones-enable - and disable-empty-zone. - - dig now has a '-q queryname' and '+showsearch' options. - - host/nslookup now continue (default)/fail on SERVFAIL. - - dig now warns if 'RA' is not set in the answer when 'RD' - was set in the query. host/nslookup skip servers that fail - to set 'RA' when 'RD' is set unless a server is explicitly - set. - - Integrate contibuted DLZ code into named. - - Integrate contibuted IDN code from JPNIC. - - libbind: corresponds to that from BIND 8.4.7. - -BIND 9.3.0 - - BIND 9.3.0 has a number of new features over 9.2, - including: - - DNSSEC is now DS based (RFC 3658). - See also RFC 3845, doc/draft/draft-ietf-dnsext-dnssec-*. - - DNSSEC lookaside validation. - - check-names is now implemented. - rrset-order in more complete. - - IPv4/IPv6 transition support, dual-stack-servers. - - IXFR deltas can now be generated when loading master files, - ixfr-from-differences. - - It is now possible to specify the size of a journal, max-journal-size. - - It is now possible to define a named set of master servers to be - used in masters clause, masters. - - The advertised EDNS UDP size can now be set, edns-udp-size. - - allow-v6-synthesis has been obsoleted. - - NOTE: - * Zones containing MD and MF will now be rejected. - * dig, nslookup name. now report "Not Implemented" as - NOTIMP rather than NOTIMPL. This will have impact on scripts - that are looking for NOTIMPL. - - libbind: corresponds to that from BIND 8.4.5. - -BIND 9.2.0 - - BIND 9.2.0 has a number of new features over 9.1, - including: - - - The size of the cache can now be limited using the - "max-cache-size" option. - - - The server can now automatically convert RFC1886-style - recursive lookup requests into RFC2874-style lookups, - when enabled using the new option "allow-v6-synthesis". - This allows stub resolvers that support AAAA records - but not A6 record chains or binary labels to perform - lookups in domains that make use of these IPv6 DNS - features. - - - Performance has been improved. - - - The man pages now use the more portable "man" macros - rather than the "mandoc" macros, and are installed - by "make install". - - - The named.conf parser has been completely rewritten. - It now supports "include" directives in more - places such as inside "view" statements, and it no - longer has any reserved words. - - - The "rndc status" command is now implemented. - - - rndc can now be configured automatically. - - - A BIND 8 compatible stub resolver library is now - included in lib/bind. - - - OpenSSL has been removed from the distribution. This - means that to use DNSSEC, OpenSSL must be installed and - the --with-openssl option must be supplied to configure. - This does not apply to the use of TSIG, which does not - require OpenSSL. - - - The source distribution now builds on Windows. - See win32utils/readme1.txt and win32utils/win32-build.txt - for details. - - This distribution also includes a new lightweight stub - resolver library and associated resolver daemon that fully - support forward and reverse lookups of both IPv4 and IPv6 - addresses. This library is considered experimental and - is not a complete replacement for the BIND 8 resolver library. - Applications that use the BIND 8 res_* functions to perform - DNS lookups or dynamic updates still need to be linked against - the BIND 8 libraries. For DNS lookups, they can also use the - new "getrrsetbyname()" API. - - BIND 9.2 is capable of acting as an authoritative server - for DNSSEC secured zones. This functionality is believed to - be stable and complete except for lacking support for - verifications involving wildcard records in secure zones. - - When acting as a caching server, BIND 9.2 can be configured - to perform DNSSEC secure resolution on behalf of its clients. - This part of the DNSSEC implementation is still considered - experimental. For detailed information about the state of the - DNSSEC implementation, see the file doc/misc/dnssec. - - There are a few known bugs: - - On some systems, IPv6 and IPv4 sockets interact in - unexpected ways. For details, see doc/misc/ipv6. - To reduce the impact of these problems, the server - no longer listens for requests on IPv6 addresses - by default. If you need to accept DNS queries over - IPv6, you must specify "listen-on-v6 { any; };" - in the named.conf options statement. - - FreeBSD prior to 4.2 (and 4.2 if running as non-root) - and OpenBSD prior to 2.8 log messages like - "fcntl(8, F_SETFL, 4): Inappropriate ioctl for device". - This is due to a bug in "/dev/random" and impacts the - server's DNSSEC support. - - OS X 10.1.4 (Darwin 5.4), OS X 10.1.5 (Darwin 5.5) and - OS X 10.2 (Darwin 6.0) reports errors like - "fcntl(3, F_SETFL, 4): Operation not supported by device". - This is due to a bug in "/dev/random" and impacts the - server's DNSSEC support. - - --with-libtool does not work on AIX. - - A bug in some versions of the Microsoft DNS server can cause zone - transfers from a BIND 9 server to a W2K server to fail. For details, - see the "Zone Transfers" section in doc/misc/migration. - - For a detailed list of user-visible changes from - previous releases, see the CHANGES file. - + - A new DNSSEC-aware libdns API for use by non-BIND9 applications + - On some platforms, named and other binaries can now print out + a stack backtrace on assertion failure, to aid in debugging. + - A "tools only" installation mode on Windows, which only installs + dig, host, nslookup and nsupdate. + - Improved PKCS#11 support, including Keyper support and explicit + OpenSSL engine selection. + + Known issues in this release: + + - A validating resolver that has been incorrectly configured with + an invalid trust anchor will be unable to resolve names covered + by that trust anchor. In all current versions of BIND 9, such a + resolver will also generate significant unnecessary DNS traffic + while trying to validate. The latter problem will be addressed + in future BIND 9 releases. In the meantime, to avoid these + problems, exercise caution when configuring "trusted-keys": + make sure all keys are correct and current when you add them, + and update your configuration in a timely manner when keys + roll over. + + - In rare cases, DNSSEC validation can leak memory. When this + happens, it will cause an assertion failure when named exits, + but is otherwise harmless. A fix exists, but was too late for + this release; it will be included in BIND 9.7.1. + + Compatibility notes: + + - If you had built BIND 9.6 with any of ALLOW_NSEC3PARAM_UPDATE, + ALLOW_SECURE_TO_INSECURE or ALLOW_INSECURE_TO_SECURE defined, then + you should ensure that all changes that are in progress have + completed prior to upgrading to BIND 9.7. BIND 9.7 implements + those features in a way which is not backwards compatible. + + - Prior releases had a bug which caused HMAC-SHA* keys with long + secrets to be used incorrectly. Fixing this bug means that older + versions of BIND 9 may fail to interoperate with this version + when using TSIG keys. If this occurs, the new "isc-hmac-fixup" + tool will convert a key with a long secret into a form that works + correctly with all versions of BIND 9. See the "isc-hmac-fixup" + man page for additional details. + + - Revoking a DNSSEC key with "dnssec-revoke" changes its key ID. + It is possible for the new key ID to collide with that of a + different key. Newly generated keys will not have this problem, + as "dnssec-keygen" looks for potential collisions before + generating keys, but exercise caution if using key revokation + with keys that were generated by older versions of BIND 9. See + the Administrator's Reference Manual, section 4.10 ("Dynamic + Trust Anchor Management") for more details. + + - A bug was fixed in which a key's scheduled inactivity date was + stored incorectly. Users who participated in the 9.7.0 BETA test + and had DNSSEC keys with scheduled inactivity dates will need to + reset those keys' dates using "dnssec-settime -I". Building @@ -456,9 +143,9 @@ Building Ubuntu 7.04, 7.10 Windows XP/2003/2008 - NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of - Windows, including Windows NT and Windows 2000, are no longer - supported. + NOTE: As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of + Windows, including Windows NT and Windows 2000, are no longer + supported. We have recent reports from the user community that a supported version of BIND will build and run on the following systems: @@ -558,10 +245,10 @@ Building on the configure command line. The default is operating system dependent. - Support for the "fixed" rrset-order option can be enabled - or disabled by specifying "--enable-fixed-rrset" or - "--disable-fixed-rrset" on the configure command line. - The default is "disabled", to reduce memory footprint. + Support for the "fixed" rrset-order option can be enabled + or disabled by specifying "--enable-fixed-rrset" or + "--disable-fixed-rrset" on the configure command line. + The default is "disabled", to reduce memory footprint. If your operating system has integrated support for IPv6, it will be used automatically. If you have installed KAME IPv6 @@ -627,8 +314,8 @@ Documentation Frequently asked questions and their answers can be found in FAQ. - Additional information on various subjects can be found - in the other README files. + Additional information on various subjects can be found + in the other README files. Bug Reports and Mailing Lists diff --git a/README.dnssec b/README.dnssec deleted file mode 100644 index a3eda796..00000000 --- a/README.dnssec +++ /dev/null @@ -1,186 +0,0 @@ - - DNSSEC and Dynamic Zones - -As of BIND 9.7.0 it is possible to change a dynamic zone from -insecure to secure and back again. A secure zone can use either -NSEC or NSEC3 chains. - - Converting from insecure to secure - -Changing a zone from insecure to secure can be done in two ways: -using a dynamic DNS update, or the "auto-dnssec" zone option. - -For either method, you need to configure named so that it can see -the K* files which contain the public and private parts of the keys -that will be used to sign the zone. These files will have been -generated by dnssec-keygen. You can do this by placing them in -the key-directory, as specified in named.conf: - - zone example.net { - type master; - update-policy local; - file "dynamic/example.net/example.net"; - key-directory "dynamic/example.net"; - }; - -If one KSK and one ZSK DNSKEY key have been generated, this configuration -will cause all records in the zone to be signed with the ZSK, and the -DNSKEY RRset to be signed with the KSK as well. An NSEC chain will be -generated as part of the initial signing process. - - Dynamic DNS update method - -To insert the keys via dynamic update: - - % nsupdate - > ttl 3600 - > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8= - > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk= - > send - -While the update request will complete almost immediately, the zone -will not be completely signed until named has had time to walk the -zone and generate the NSEC and RRSIG records. The NSEC record at the -apex will be added last, to signal that there is a complete NSEC chain. - -If you wish to sign using NSEC3 instead of NSEC, you should add an -NSEC3PARAM record to the initial update request. If you wish the -NSEC3 chain to have the OPTOUT bit set, set it in the flags field -of the NSEC3PARAM record. - - % nsupdate - > ttl 3600 - > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8= - > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk= - > update add example.net NSEC3PARAM 1 1 100 1234567890 - > send - -Again, this update request will complete almost immediately; however, -the record won't show up until named has had a chance to build/remove -the relevant chain. A private type record will be created to record -the state of the operation (see below for more details), and will be -removed once the operation completes. - -While the initial signing and NSEC/NSEC3 chain generation is happening, -other updates are possible as well. - - Fully automatic zone signing - -To enable automatic signing, add the "auto-dnssec" option to the zone -statement in named.conf. "auto-dnssec" has two possible arguments: -"allow" or "maintain". - -With "auto-dnssec allow", named can search the key directory for keys -matching the zone, insert them into the zone, and use them to sign the -zone. It will do so only when it receives an "rndc sign " -command. - -"auto-dnssec maintain" includes the above functionality, but will also -automatically adjust the zone's DNSKEY records on schedule according to the -keys' timing metadata (see the man pages for dnssec-keygen and -dnssec-settime for more information). If keys are present in the key -directory the first time the zone is loaded, it will be signed -immediately, without waiting for an "rndc sign" command. (This -command can still be used for unscheduled key changes, however.) - -Using the "auto-dnssec" option requires the zone to be configured to -allow dynamic updates, by adding an "allow-update" or "update-policy" -statement to the zone configuration. If this has not been done, the -configuration will fail. - - Private-type records - -The state of the signing process is signaled by private-type records -(with a default type value of 65534). When signing is complete, these -records will have a nonzero value for the final octet (for those records -which have a nonzero initial octet). - -The private type record format: -If the first octet is non-zero then the record indicates that the zone needs -to be signed with the key matching the record, or that all signatures that -match the record should be removed. - - algorithm (octet 1) - key id in network order (octet 2 and 3) - removal flag (octet 4) - complete flag (octet 5) - -Only records flagged as "complete" can be removed via dynamic update. -Attempts to remove other private type records will be silently ignored. - -If the first octet is zero (this is a reserved algorithm number -that should never appear in a DNSKEY record) then the record indicates -changes to the NSEC3 chains are in progress. The rest of the record -contains an NSEC3PARAM record. The flag field tells what operation -to perform based on the flag bits. - - 0x01 OPTOUT - 0x80 CREATE - 0x40 REMOVE - 0x20 NONSEC - - DNSKEY rollovers via UPDATE - -It is possible to perform key rollovers via dynamic update. You need -to add the K* files for the new keys so that named can find them. You -can then add the new DNSKEY RRs via dynamic update. Named will then cause -the zone to be signed with the new keys. When the signing is -complete the private type records will be updated so that the last -octet is non zero. - -If this is for a KSK you need to inform the parent and any trust -anchor repositories of the new KSK. - -You should then wait for the maximum TTL in the zone before removing the -old DNSKEY. If it is a KSK that is being updated, you also need to wait -for the DS RRset in the parent to be updated and its TTL to expire. -This ensures that all clients will be able to verify at least one -signature when you remove the old DNSKEY. - -The old DNSKEY can be removed via UPDATE. Take care to specify -the correct key. Named will clean out any signatures generated by -the old key after the update completes. - - NSEC3PARAM rollovers via UPDATE - -Add the new NSEC3PARAM record via dynamic update. When the new NSEC3 chain -has been generated, the NSEC3PARAM flag field will be zero. At this -point you can remove the old NSEC3PARAM record. The old chain will -be removed after the update request completes. - - Converting from NSEC to NSEC3 - -To do this, you just need to add an NSEC3PARAM record. When the -conversion is complete, the NSEC chain will have been removed and -the NSEC3PARAM record will have a zero flag field. The NSEC3 chain -will be generated before the NSEC chain is destroyed. - - Converting from NSEC3 to NSEC - -To do this, remove all NSEC3PARAM records with a zero flag field. The -NSEC chain will be generated before the NSEC3 chain is removed. - - Converting from secure to insecure - -To do this, remove all the DNSKEY records. Any NSEC or NSEC3 chains -will be removed as well, along with associated NSEC3PARAM records. -This will take place after the update request completes. This -requires the "dnssec-secure-to-insecure" option to be set to "yes" -in named.conf. - - Periodic re-signing - -In any secure zone which supports dynamic updates, named will -periodically re-sign RRsets which have not been re-signed as -a result of some update action. The signature lifetimes will -be adjusted so as to spread the re-sign load over time rather than -all at once. - - NSEC3 and OPTOUT - -Named only supports creating new NSEC3 chains where all the NSEC3 -records in the zone have the same OPTOUT state. Named supports -UPDATES to zones where the NSEC3 records in the chain have mixed -OPTOUT state. Named does not support changing the OPTOUT state of -an individual NSEC3 record, the entire chain needs to be changed if -the OPTOUT state of an individual NSEC3 needs to be changed. diff --git a/README.libdns b/README.libdns deleted file mode 100644 index e00444f9..00000000 --- a/README.libdns +++ /dev/null @@ -1,275 +0,0 @@ - - BIND-9 DNS Library Support - -This version of BIND9 "exports" its internal libraries so that they -can be used by third-party applications more easily (we call them -"export" libraries in this document). In addition to all major -DNS-related APIs BIND9 is currently using, the export libraries -provide the following features: - -- The newly created "DNS client" module. This is a higher level API - that provides an interface to name resolution, single DNS - transaction with a particular server, and dynamic update. Regarding - name resolution, it supports advanced features such as DNSSEC - validation and caching. This module supports both synchronous and - asynchronous mode. -- The new "IRS" (Information Retrieval System) library. It provides - an interface to parse the traditional resolv.conf file and more - advanced, DNS-specific configuration file for the rest of this - package (see the description for the dns.conf file below). -- As part of the IRS library, newly implemented standard address-name - mapping functions, getaddrinfo() and getnameinfo(), are provided. - They use the DNSSEC-aware validating resolver backend, and could use - other advanced features of the BIND9 libraries such as caching. The - getaddrinfo() function resolves both A and AAAA RRs concurrently - (when the address family is unspecified). -- An experimental framework to support other event libraries than - BIND9's internal event task system. - -* Prerequisite - -GNU make is required to build the export libraries (other part of -BIND9 can still be built with other types of make). In the reminder -of this document, "make" means GNU make. Note that in some platforms -you may need to invoke a different command name than "make" -(e.g. "gmake") to indicate it's GNU make. - -* Compilation - -1. ./configure --enable-exportlib [other flags] -2. make - -This will create (in addition to usual BIND9 programs) and a separate -set of libraries under the lib/export directory. For example, -lib/export/dns/libdns.a is the archive file of the export version of -the BIND9 DNS library. - -Sample application programs using the libraries will also be built -under the lib/export/samples directory (see below). - -* Installation - -1. cd lib/export -2. make install (root privilege is normally required) - (make install at the top directory will do the same) - -This will install library object files under the directory specified -by the --with-export-libdir configure option (default: -EPREFIX/lib/bind9), and header files under the directory specified by -the --with-export-includedir configure option (default: -PREFIX/include/bind9). - -To see how to build your own application after the installation, see -lib/export/samples/Makefile-postinstall.in - -* Known Defects/Restrictions - -- Currently, win32 is not supported for the export library. (Normal - BIND9 application can be built as before). -- The "fixed" RRset order is not (currently) supported in the export - library. If you want to use "fixed" RRset order for, e.g. named - while still building the export library even without the fixed - order support, build them separately: - % ./configure --enable-fixed-rrset [other flags, but not --enable-exportlib] - % make (this doesn't have to be make) - % ./configure --enable-exportlib [other flags, but not --enable-fixed-rrset] - % cd lib/export - % make -- The client module and the IRS library currently do not support - DNSSEC validation using DLV (the underlying modules can handle it, - but there is no tunable interface to enable the feature). -- RFC5011 is not supported in the validating stub resolver of the - export library. In fact, it is not clear whether it should: trust - anchors would be a system-wide configuration which would be managed - by an administrator, while the stub resolver will be used by - ordinary applications run by a normal user. -- Not all common /etc/resolv.conf options are supported in the IRS library. - The only available options in this version are "debug" and "ndots". - -* The dns.conf File - -The IRS library supports an "advanced" configuration file related to -the DNS library for configuration parameters that would be beyond the -capability of the resolv.conf file. Specifically, it is intended to -provide DNSSEC related configuration parameters. - -By default the path to this configuration file is /etc/dns.conf. - -This module is very experimental and the configuration syntax or -library interfaces may change in future versions. Currently, only the -'trusted-keys' statement is supported, whose syntax is the same as the -same name of statement for named.conf. - -* Sample Applications - -Some sample application programs using this API are provided for -reference. The following is a brief description of these -applications. - -- sample: a simple stub resolver utility. - - It sends a query of a given name (of a given optional RR type) - to a specified recursive server, and prints the result as a list of - RRs. It can also act as a validating stub resolver if a trust - anchor is given via a set of command line options. - - Usage: sample [options] server_address hostname - - Options and Arguments: - -t RRtype - specify the RR type of the query. The default is the A RR. - [-a algorithm] [-e] -k keyname -K keystring - specify a command-line DNS key to validate the answer. For - example, to specify the following DNSKEY of example.com: - example.com. 3600 IN DNSKEY 257 3 5 xxx - specify the options as follows: - -e -k example.com -K "xxx" - -e means that this key is a zone's "key signing key" (as known - as "secure Entry point"). - when -a is omitted rsasha1 will be used by default. - -s domain:alt_server_address - specify a separate recursive server address for the specific - "domain". Example: -s example.com:2001:db8::1234 - server_address - an IP(v4/v6) address of the recursive server to which queries - are sent. - hostname - the domain name for the query - -- sample-async: a simple stub resolver, working asynchronously. - - Similar to "sample", but accepts a list of (query) domain names as a - separate file and resolves the names asynchronously. - - Usage: sample-async [-s server_address] [-t RR_type] input_file - Options and Arguments: - -s server_address - an IPv4 address of the recursive server to which queries are - sent. (IPv6 addresses are not supported in this implementation) - -t RR_type - specify the RR type of the queries. The default is the A RR. - input_file - a list of domain names to be resolved. each line consists of a - single domain name. Example: - www.example.com - mx.examle.net - ns.xxx.example - -- sample-request: a simple DNS transaction client. - - It sends a query to a specified server, and prints the response with - minimal processing. It doesn't act as a "stub resolver": it stops - the processing once it gets any response from the server, whether - it's a referral or an alias (CNAME or DNAME) that would require - further queries to get the ultimate answer. In other words, this - utility acts as a very simplified dig. - - Usage: sample-request [-t RRtype] server_address hostname - Options and Arguments: - -t RRtype - specify the RR type of the queries. The default is the A RR. - server_address - an IP(v4/v6) address of the recursive server to which the query is - sent. - hostname - the domain name for the query - -- sample-gai: getaddrinfo() and getnameinfo() test code. - - This is a test program to check getaddrinfo() and getnameinfo() - behavior. It takes a host name as an argument, calls getaddrinfo() - with the given host name, and calls getnameinfo() with the resulting - IP addresses returned by getaddrinfo(). If the dns.conf file exists - and defines a trust anchor, the underlying resolver will act as a - validating resolver, and getaddrinfo()/getnameinfo() will fail with - an EAI_INSECUREDATA error when DNSSEC validation fails. - - Usage: sample-gai hostname - -- sample-update: a simple dynamic update client program - - It accepts a single update command as a command-line argument, sends - an update request message to the authoritative server, and shows the - response from the server. In other words, this is a simplified - nsupdate. - - Usage: sample-update [options] (add|delete) "update data" - Options and Arguments: - -a auth_server - An IP address of the authoritative server that has authority - for the zone containing the update name. This should normally - be the primary authoritative server that accepts dynamic - updates. It can also be a secondary server that is configured - to forward update requests to the primary server. - -k keyfile - A TSIG key file to secure the update transaction. The keyfile - format is the same as that for the nsupdate utility. - -p prerequisite - A prerequisite for the update (only one prerequisite can be - specified). The prerequisite format is the same as that is - accepted by the nsupdate utility. - -r recursive_server - An IP address of a recursive server that this utility will - use. A recursive server may be necessary to identify the - authoritative server address to which the update request is - sent. - -z zonename - The domain name of the zone that contains - (add|delete) - Specify the type of update operation. Either "add" or "delete" - must be specified. - "update data" - Specify the data to be updated. A typical example of the data - would look like "name TTL RRtype RDATA". - - Note: in practice, either -a or -r must be specified. Others can - be optional; the underlying library routine tries to identify the - appropriate server and the zone name for the update. - - Examples: assuming the primary authoritative server of the - dynamic.example.com zone has an IPv6 address 2001:db8::1234, - + sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1" - adds an A RR for foo.dynamic.example.com using the given key. - + sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A" - removes all A RRs for foo.dynamic.example.com using the given key. - + sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com" - removes all RRs for foo.dynamic.example.com using the given key. - -- nsprobe: domain/name server checker in terms of RFC4074. - - It checks a set of domains to see the name servers of the domains - behave correctly in terms of RFC4074. This is included in the set - of sample programs to show how the export library can be used in a - DNS-related application. - - Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file] - Options - -d - run in the "debug" mode. with this option nsprobe will dump - every RRs it receives. - -v - increase verbosity of other normal log messages. This can be - specified multiple times - -c cache_address - specify an IP address of a recursive (caching) name server. - nsprobe uses this server to get the NS RRset of each domain and - the A and/or AAAA RRsets for the name servers. The default - value is 127.0.0.1. - input_file - a file name containing a list of domain (zone) names to be - probed. when omitted the standard input will be used. Each - line of the input file specifies a single domain name such as - "example.com". In general this domain name must be the apex - name of some DNS zone (unlike normal "host names" such as - "www.example.com"). nsprobe first identifies the NS RRsets for - the given domain name, and sends A and AAAA queries to these - servers for some "widely used" names under the zone; - specifically, adding "www" and "ftp" to the zone name. - -* Library References - -As of this writing, there is no formal "manual" of the libraries, -except this document, header files (some of them provide pretty -detailed explanations), and sample application programs. - -; $Id: README.libdns,v 1.3 2009/09/15 19:12:03 jinmei Exp $ diff --git a/README.pkcs11 b/README.pkcs11 deleted file mode 100644 index 72ce281e..00000000 --- a/README.pkcs11 +++ /dev/null @@ -1,309 +0,0 @@ - - BIND 9 PKCS #11 (Cryptoki) support - -INTRODUCTION - -PKCS #11 (Public Key Cryptography Standard #11) defines a platform- -independent API for the control of hardware security modules (HSMs) -and other cryptographic support devices. - -BIND 9 is known to work with two HSMs: The Sun SCA 6000 cryptographic -acceleration board, tested under Solaris x86, and the AEP Keyper -network-attached key storage device, tested with Debian Linux, -Solaris x86 and Windows Server 2003. - -PREREQUISITES - -See the HSM vendor documentation for information about installing, -initializing, testing and troubleshooting the HSM. - -BIND 9 uses OpenSSL for cryptography, but stock OpenSSL does not -yet fully support PKCS #11. However, a PKCS #11 engine for OpenSSL -is available from the OpenSolaris project. It has been modified by -ISC to work with with BIND 9, and to provide new features such as -PIN management and key by reference. - -The patched OpenSSL depends on a "PKCS #11 provider". This is a shared -library object, providing a low-level PKCS #11 interface to the HSM -hardware. It is dynamically loaded by OpenSSL at runtime. The PKCS #11 -provider comes from the HSM vendor, and and is specific to the HSM to be -controlled. - -There are two "flavors" of PKCS #11 support provided by the patched -OpenSSL, one of which must be chosen at configuration time. The correct -choice depends on the HSM hardware: - - - Use 'crypto-accelerator' with HSMs that have hardware cryptographic - acceleration features, such as the SCA 6000 board. This causes OpenSSL - to run all supported cryptographic operations in the HSM. - - - Use 'sign-only' with HSMs that are designed to function primarily as - secure key storage devices, but lack hardware acceleration. These - devices are highly secure, but are not necessarily any faster at - cryptography than the system CPU--often, they are slower. It is - therefore most efficient to use them only for those cryptographic - functions that require access to the secured private key, such as - zone signing, and to use the system CPU for all other computationally- - intensive operations. The AEP Keyper is an example of such a device. - -The modified OpenSSL code is included in the BIND 9.7.0b1 release, in the -form of a context diff against OpenSSL 0.9.8l. Before building BIND 9 -with PKCS #11 support, it will be necessary to build OpenSSL with this -patch in place and inform it of the path to the HSM-specific PKCS #11 -provider library. - -Obtain OpenSSL 0.9.8l: - - wget http://www.openssl.org/source/openssl-0.9.8l.tar.gz - -Extract the tarball: - - tar zxf openssl-0.9.8l.tar.gz - -Apply the patch from the BIND 9 release: - - patch -p1 -d openssl-0.9.8l \ - < bind-9.7.0b1/bin/pkcs11/openssl-0.9.8l-patch - -(Note that the patch file may not be compatible with the "patch" -utility on all operating systems. You may need to install GNU patch.) - -When building OpenSSL, place it in a non-standard location so that it -does not interfere with OpenSSL libraries elsewhere on the system. -In the following examples, we choose to install into "/opt/pkcs11/usr". -We will use this location when we configure BIND 9. - - EXAMPLE 1--BUILDING OPENSSL FOR THE AEP KEYPER ON LINUX: - - The AEP Keyper is a highly secure key storage device, but does - not provide hardware cryptographic acceleration. It can carry out - cryptographic operations, but it is probably slower than your - system's CPU. Therefore, we choose the 'sign-only' flavor when - building OpenSSL. - - The Keyper-specific PKCS #11 provider library is delivered with the - Keyper software. In this example, we place it /opt/pkcs11/usr/lib: - - cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so - - This library is only available for Linux as a 32-bit binary. If we are - compiling on a 64-bit Linux system, it is necessary to force a 32-bit - build, by specifying -m32 in the build options. - - Finally, the Keyper library requires threads, so we must specify -pthread. - - cd openssl-0.9.8l - ./Configure linux-generic32 -m32 -pthread \ - --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \ - --pk11-flavor=sign-only \ - --prefix=/opt/pkcs11/usr - - After configuring, run "make" and "make test". If "make test" fails - with "pthread_atfork() not found", you forgot to add the -pthread - above. - - EXAMPLE 2--BUILDING OPENSSL FOR THE SCA 6000 ON SOLARIS: - - The SCA-6000 PKCS #11 provider is installed as a system library, - libpkcs11. It is a true crypto accelerator, up to 4 times faster - than any CPU, so the flavor shall be 'crypto-accelerator'. - - In this example, we are building on Solaris x86 on an AMD64 system. - - cd openssl-0.9.8l - ./Configure solaris64-x86_64-cc \ - --pk11-libname=/usr/lib/64/libpkcs11.so \ - --pk11-flavor=crypto-accelerator \ - --prefix=/opt/pkcs11/usr - - (For a 32-bit build, use "solaris-x86-cc" and /usr/lib/libpkcs11.so.) - - After configuring, run "make" and "make test". - -Once you have built OpenSSL, run "apps/openssl engine pkcs11" to confirm -that PKCS #11 support was compiled in correctly. The output should be -one of the following lines, depending on the flavor selected: - - (pkcs11) PKCS #11 engine support (sign only) - -Or: - - (pkcs11) PKCS #11 engine support (crypto accelerator) - -Next, run "apps/openssl engine pkcs11 -t". This will attempt to initialize -the PKCS #11 engine. If it is able to do so successfully, it will report -"[ available ]". - -If the output is correct, run "make install". - -BUILDING BIND 9 - -When building BIND 9, the location of the custom-built OpenSSL -library must be specified via configure. - - EXAMPLE 3--CONFIGURING BIND 9 FOR LINUX - - To link with the PKCS #11 provider, threads must be enabled in the - BIND 9 build. - - The PKCS #11 library for the AEP Keyper is currently only available as - a 32-bit binary. If we are building on a 64-bit host, we must force a - 32-bit build by adding "-m32" to the CC options on the "configure" - command line. - - cd ../bind-9.7.0b1 - ./configure CC="gcc -m32" --enable-threads \ - --with-openssl=/opt/pkcs11/usr \ - --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so - - EXAMPLE 4--CONFIGURING BIND 9 FOR SOLARIS - - To link with the PKCS #11 provider, threads must be enabled in the - BIND 9 build. - - cd ../bind-9.7.0b1 - ./configure CC="cc -xarch=amd64" --enable-threads \ - --with-openssl=/opt/pkcs11/usr \ - --with-pkcs11=/usr/lib/64/libpkcs11.so - - (For a 32-bit build, omit CC="cc -xarch=amd64".) - -If configure complains about OpenSSL not working, you may have a 32/64-bit -architecture mismatch. Or, you may have incorrectly specified the path to -OpenSSL (it should be the same as the --prefix argument to the OpenSSL -Configure). - -After configuring, run "make", "make test" and "make install". - -PKCS #11 TOOLS - -BIND 9 includes a minimal set of tools to operate the HSM, including -"pkcs11-keygen" to generate a new key pair within the HSM, "pkcs11-list" -to list objects currently available, and "pkcs11-destroy" to remove -objects. - -In UNIX/Linux builds, these tools are built only if BIND 9 is configured -with the --with-pkcs11 option. (NOTE: If --with-pkcs11 is set to "yes", -rather than to the path of the PKCS #11 provider, then the tools will be -built but the provider will be left undefined. Use the -m option or the -PKCS11_PROVIDER environment variable to specify the path to the provider.) - -USING THE HSM - -First, we must set up the runtime environment so the OpenSSL and PKCS #11 -libraries can be loaded: - - export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH} - -When operating an AEP Keyper, it is also necessary to specify the -location of the "machine" file, which stores information about the Keyper -for use by PKCS #11 provider library. If the machine file is in -/opt/Keyper/PKCS11Provider/machine, use: - - export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider - -These environment variables must be set whenever running any tool -that uses the HSM, including pkcs11-keygen, pkcs11-list, pkcs11-destroy, -dnssec-keyfromlabel, dnssec-signzone, dnssec-keygen (which will use -the HSM for random number generation), and named. - -We can now create and use keys in the HSM. In this case, we will -create a 2048 bit key and give it the label "sample-ksk": - - pkcs11-keygen -b 2048 -l sample-ksk - -To confirm that the key exists: - - pkcs11-list - Enter PIN: - object[0]: handle 2147483658 class 3 label[8] 'sample-ksk' id[0] - object[1]: handle 2147483657 class 2 label[8] 'sample-ksk' id[0] - -Before using this key to sign a zone, we must create a pair of BIND 9 -key files. The "dnssec-keyfromlabel" utility does this. In this case, -we will be using the HSM key "sample-ksk" as the key-signing key for -"example.net": - - dnssec-keyfromlabel -l sample-ksk -f KSK example.net - -The resulting K*.key and K*.private files can now be used to sign the -zone. Unlike normal K* files, which contain both public and private -key data, these files will contain only the public key data, plus an -identifier for the private key which remains stored within the HSM. -The HSM handles signing with the private key. - -If you wish to generate a second key in the HSM for use as a zone-signing -key, follow the same procedure above, using a different keylabel, a -smaller key size, and omitting "-f KSK" from the dnssec-keyfromlabel -arguments: - - pkcs11-keygen -b 1024 -l sample-zsk - dnssec-keyfromlabel -l sample-zsk example.net - -Alternatively, you may prefer to generate a conventional on-disk key, -using dnssec-keygen: - - dnssec-keygen example.net - -This provides less security than an HSM key, but since HSMs can be -slow or cumbersome to use for security reasons, it may be more -efficient to reserve HSM keys for use in the less frequent -key-signing operation. The zone-signing key can be rolled more -frequently, if you wish, to compensate for a reduction in key -security. - -Now you can sign the zone. (Note: If not using the -S option to -dnssec-signzone, it will be necessary to add the contents of both -K*.key files to the zone master file before signing it.) - - dnssec-signzone -S example.net - Enter PIN: - Verifying the zone using the following algorithms: NSEC3RSASHA1. - Zone signing complete: - Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by - example.net.signed - -SPECIFYING THE ENGINE ON THE COMMAND LINE - -The OpenSSL engine can be specified in named and all of the dnssec-* -tools by using the "-E " command line option. If BIND 9 is built -with the --with-pkcs11 option, this option defaults to "pkcs11". -Specifying the engine will generally not be necessary unless for -some reason you wish to use a different OpenSSL engine. - -If you wish to disable use of the "pkcs11" engine--for troubleshooting -purposes, or because the HSM is unavailable--set the engine to the empty -string. For example: - - dnssec-signzone -E '' -S example.net - -This causes dnssec-signzone to run as if it were compiled without the ---with-pkcs11 option. - -RUNNING NAMED WITH AUTOMATIC ZONE RE-SIGNING - -If you want named to dynamically re-sign zones using HSM keys, and/or to -to sign new records inserted via nsupdate, then named must have access -to the HSM PIN. This can be accomplished by placing the PIN into the -openssl.cnf file (in the above examples, /opt/pkcs11/usr/ssl/openssl.cnf). - -The location of the openssl.cnf file can be overridden by setting the -OPENSSL_CONF environment variable before running named. - -Sample openssl.cnf: - - openssl_conf = openssl_def - [ openssl_def ] - engines = engine_section - [ engine_section ] - pkcs11 = pkcs11_section - [ pkcs11_section ] - PIN = - -This will also allow the dnssec-* tools to access the HSM without -PIN entry. (The pkcs11-* tools access the HSM directly, not via -OpenSSL, so a PIN will still be required to use them.) - -PLEASE NOTE: Placing the HSM's PIN in a text file in this manner -may reduce the security advantage of using an HSM. Be sure this -is what you want to do before configuring BIND 9 in this way. diff --git a/README.rfc5011 b/README.rfc5011 deleted file mode 100644 index 7cf34912..00000000 --- a/README.rfc5011 +++ /dev/null @@ -1,74 +0,0 @@ - - BIND 9 RFC 5011 support - -BIND 9.7.0 introduces support for RFC 5011, dynamic trust anchor -management. Using this feature allows named to keep track of changes to -critical DNSSEC keys without any need for the operator to make changes to -configuration files. - -VALIDATING RESOLVER -------------------- - -To configure a validating resolver to use RFC5011 to maintain a trust -anchor, configure the trust anchor using a "managed-keys" statement. -Information about this can be found in the ARM, in the section titled -"managed-keys Statement Definition". - -AUTHORITATIVE SERVER --------------------- - -To set up an authoritative zone for RFC5011 trust anchor maintenance, -generate two (or more) key signing keys (KSKs) for the zone. Sign the zone -with one of them; this is the "active" KSK. All KSK's which do not sign -the zone are "stand-by" keys. - -Any validating resolver which is configured to use the active KSK as an -RFC5011-managed trust anchor will take note of the stand-by KSKs in the -zone's DNSKEY RRset, and store them for future reference. The resolver -will recheck the zone periodically, and after 30 days, if the new key is -still there, then the key will be accepted by the resolver as a valid -trust anchor for the zone. Any time after this 30-day acceptance timer -has completed, the active KSK can be revoked, and the zone can be "rolled -over" to the newly accepted key. - -The easiest way to place a stand-by key in a zone is to use the "smart -signing" features of dnssec-keygen and dnssec-signzone. If a key with a -publication date in the past, but an activation date which is unset or in -the future, "dnssec-signzone -S" will include the DNSKEY record in the -zone, but will not sign with it: - - $ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net - $ dnssec-signzone -S -K keys example.net - -To revoke a key, the new command "dnssec-revoke" has been added. This adds -the REVOKED bit to the key flags and re-generates the K*.key and K*.private -files. - -After revoking the active key, the zone must be signed with both the -revoked KSK and the new active KSK. (Smart signing takes care of this -automatically.) - -Once a key has been revoked and used to sign the DNSKEY RRset in which it -appears, that key will never again be accepted as a valid trust anchor by -the resolver. However, validation can proceed using the new active key -(which had been accepted by the resolver when it was a stand-by key). - -See RFC 5011 for more details on key rollover scenarios. - -When a key has been revoked, its key ID changes, increasing by -128, and wrapping around at 65535. So, for example, the key -"Kexample.com.+005+10000" becomes "Kexample.com.+005+10128". - -If two keys have ID's exactly 128 apart, and one is revoked, then the -two key ID's will collide, causing several problems. To prevent this, -dnssec-keygen will not generate a new key if another key is present which -may collide. This checking will only occur if the new keys are written -to the same directory which holds all other keys in use for that zone. - -Older versions of BIND 9 did not have this precaution. Exercise caution if -using key revocation on keys that were generated by previous releases, or -if using keys stored in multiple directories or on multiple machines. - -It is expected that a future release of BIND 9 will address this problem -in a different way, by storing revoked keys with their original unrevoked -key ID's. diff --git a/bin/dnssec/dnssec-settime.8 b/bin/dnssec/dnssec-settime.8 index b2b33b51..0eaf97cd 100644 --- a/bin/dnssec/dnssec-settime.8 +++ b/bin/dnssec/dnssec-settime.8 @@ -1,4 +1,4 @@ -.\" Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC") +.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC") .\" .\" Permission to use, copy, modify, and/or distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -12,7 +12,7 @@ .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR .\" PERFORMANCE OF THIS SOFTWARE. .\" -.\" $Id: dnssec-settime.8,v 1.9 2009/11/03 21:58:30 tbox Exp $ +.\" $Id: dnssec-settime.8,v 1.9.24.3 2010/02/04 02:08:19 tbox Exp $ .\" .hy 0 .ad l @@ -131,7 +131,7 @@ for the publication date, \fBA\fR for the activation date, \fBR\fR -for the revokation date, +for the revocation date, \fBU\fR for the unpublication date, or \fBD\fR @@ -148,5 +148,5 @@ RFC 5011. .PP Internet Systems Consortium .SH "COPYRIGHT" -Copyright \(co 2009 Internet Systems Consortium, Inc. ("ISC") +Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC") .br diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c index 70ad94ad..1c084bb2 100644 --- a/bin/dnssec/dnssec-settime.c +++ b/bin/dnssec/dnssec-settime.c @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: dnssec-settime.c,v 1.19.34.5 2010/01/07 19:16:30 each Exp $ */ +/* $Id: dnssec-settime.c,v 1.19.34.6 2010/02/03 01:02:17 each Exp $ */ /*! \file */ @@ -80,7 +80,7 @@ usage(void) { fprintf(stderr, " -D date/[+-]offset/none: set/unset key " "deletion date\n"); fprintf(stderr, "Printing options:\n"); - fprintf(stderr, " -p C/P/A/R/U/D/all: print a particular time " + fprintf(stderr, " -p C/P/A/R/I/D/all: print a particular time " "value or values " "[default: all]\n"); fprintf(stderr, " -u: print times in unix epoch " diff --git a/bin/dnssec/dnssec-settime.docbook b/bin/dnssec/dnssec-settime.docbook index 8c081379..b4db0528 100644 --- a/bin/dnssec/dnssec-settime.docbook +++ b/bin/dnssec/dnssec-settime.docbook @@ -2,7 +2,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []> - + July 15, 2009 @@ -37,6 +37,7 @@ 2009 + 2010 Internet Systems Consortium, Inc. ("ISC") @@ -240,7 +241,7 @@ for the creation date, for the publication date, for the activation date, - for the revokation date, + for the revocation date, for the unpublication date, or for the deletion date. To print all of the metadata, use . diff --git a/bin/dnssec/dnssec-settime.html b/bin/dnssec/dnssec-settime.html index 935ec031..e3efc583 100644 --- a/bin/dnssec/dnssec-settime.html +++ b/bin/dnssec/dnssec-settime.html @@ -1,5 +1,5 @@ - + @@ -32,7 +32,7 @@

dnssec-settime [-f] [-K directory] [-P date/offset] [-A date/offset] [-R date/offset] [-I date/offset] [-D date/offset] [-h] [-v level] [-E engine] {keyfile}

-

DESCRIPTION

+

DESCRIPTION

dnssec-settime reads a DNSSEC private key file and sets the key timing metadata as specified by the -P, -A, @@ -57,7 +57,7 @@

-

OPTIONS

+

OPTIONS

-f

@@ -88,7 +88,7 @@

-

TIMING OPTIONS

+

TIMING OPTIONS

Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '-', it is interpreted as @@ -133,7 +133,7 @@

-

PRINTING OPTIONS

+

PRINTING OPTIONS

dnssec-settime can also be used to print the timing metadata associated with a key. @@ -151,7 +151,7 @@ C for the creation date, P for the publication date, A for the activation date, - R for the revokation date, + R for the revocation date, U for the unpublication date, or D for the deletion date. To print all of the metadata, use -p all. @@ -159,7 +159,7 @@

-

SEE ALSO

+

SEE ALSO

dnssec-keygen(8), dnssec-signzone(8), BIND 9 Administrator Reference Manual, @@ -167,7 +167,7 @@

-

AUTHOR

+

AUTHOR

Internet Systems Consortium

diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c index 062fdb5d..c1a287cf 100644 --- a/bin/named/statschannel.c +++ b/bin/named/statschannel.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2008, 2009 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2008-2010 Internet Systems Consortium, Inc. ("ISC") * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: statschannel.c,v 1.24 2009/10/20 03:30:07 marka Exp $ */ +/* $Id: statschannel.c,v 1.24.40.2 2010/02/04 23:48:30 tbox Exp $ */ /*! \file */ @@ -71,6 +71,7 @@ stats_dumparg { int ncounters; /* used for general statistics */ int *counterindices; /* used for general statistics */ isc_uint64_t *countervalues; /* used for general statistics */ + isc_result_t result; } stats_dumparg_t; static isc_once_t once = ISC_ONCE_INIT; @@ -96,6 +97,8 @@ static const char *sockstats_xmldesc[isc_sockstatscounter_max]; #define sockstats_xmldesc NULL #endif /* HAVE_LIBXML2 */ +#define TRY0(a) do { xmlrc = (a); if (xmlrc < 0) goto error; } while(0) + /*% * Mapping arrays to represent statistics counters in the order of our * preference, regardless of the order of counter indices. For example, @@ -438,7 +441,7 @@ generalstat_dump(isc_statscounter_t counter, isc_uint64_t val, void *arg) { dumparg->countervalues[counter] = val; } -static void +static isc_result_t dump_counters(isc_stats_t *stats, statsformat_t type, void *arg, const char *category, const char **desc, int ncounters, int *indices, isc_uint64_t *values, int options) @@ -449,6 +452,7 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg, FILE *fp; #ifdef HAVE_LIBXML2 xmlTextWriterPtr writer; + int xmlrc; #endif #ifndef HAVE_LIBXML2 @@ -481,31 +485,41 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg, writer = arg; if (category != NULL) { - xmlTextWriterStartElement(writer, - ISC_XMLCHAR - category); - xmlTextWriterStartElement(writer, - ISC_XMLCHAR "name"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR - desc[index]); - xmlTextWriterEndElement(writer); /* name */ - - xmlTextWriterStartElement(writer, ISC_XMLCHAR - "counter"); + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + category)); + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + "name")); + TRY0(xmlTextWriterWriteString(writer, + ISC_XMLCHAR + desc[index])); + TRY0(xmlTextWriterEndElement(writer)); /* name */ + + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + "counter")); } else { - xmlTextWriterStartElement(writer, ISC_XMLCHAR - desc[index]); + TRY0(xmlTextWriterStartElement(writer, + ISC_XMLCHAR + desc[index])); } - xmlTextWriterWriteFormatString(writer, - "%" ISC_PRINT_QUADFORMAT - "u", value); - xmlTextWriterEndElement(writer); /* counter */ + TRY0(xmlTextWriterWriteFormatString(writer, + "%" + ISC_PRINT_QUADFORMAT + "u", value)); + TRY0(xmlTextWriterEndElement(writer)); /* counter */ if (category != NULL) - xmlTextWriterEndElement(writer); /* category */ + TRY0(xmlTextWriterEndElement(writer)); /* category */ #endif break; } } + return (ISC_R_SUCCESS); +#ifdef HAVE_LIBXML2 + error: + return (ISC_R_FAILURE); +#endif } static void @@ -516,6 +530,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { FILE *fp; #ifdef HAVE_LIBXML2 xmlTextWriterPtr writer; + int xmlrc; #endif if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_OTHERTYPE) @@ -535,22 +550,28 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { #ifdef HAVE_LIBXML2 writer = dumparg->arg; - xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype"); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype")); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr); - xmlTextWriterEndElement(writer); /* name */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr)); + TRY0(xmlTextWriterEndElement(writer)); /* name */ - xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"); - xmlTextWriterWriteFormatString(writer, + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter")); + TRY0(xmlTextWriterWriteFormatString(writer, "%" ISC_PRINT_QUADFORMAT "u", - val); - xmlTextWriterEndElement(writer); /* counter */ + val)); + TRY0(xmlTextWriterEndElement(writer)); /* counter */ - xmlTextWriterEndElement(writer); /* rdtype */ + TRY0(xmlTextWriterEndElement(writer)); /* rdtype */ #endif break; } + return; +#ifdef HAVE_LIBXML2 + error: + dumparg->result = ISC_R_FAILURE; + return; +#endif } static void @@ -562,6 +583,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { isc_boolean_t nxrrset = ISC_FALSE; #ifdef HAVE_LIBXML2 xmlTextWriterPtr writer; + int xmlrc; #endif if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXDOMAIN) @@ -590,22 +612,28 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) { #ifdef HAVE_LIBXML2 writer = dumparg->arg; - xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset"); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"); - xmlTextWriterWriteFormatString(writer, "%s%s", - nxrrset ? "!" : "", typestr); - xmlTextWriterEndElement(writer); /* name */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset")); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name")); + TRY0(xmlTextWriterWriteFormatString(writer, "%s%s", + nxrrset ? "!" : "", typestr)); + TRY0(xmlTextWriterEndElement(writer)); /* name */ - xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"); - xmlTextWriterWriteFormatString(writer, + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter")); + TRY0(xmlTextWriterWriteFormatString(writer, "%" ISC_PRINT_QUADFORMAT "u", - val); - xmlTextWriterEndElement(writer); /* counter */ + val)); + TRY0(xmlTextWriterEndElement(writer)); /* counter */ - xmlTextWriterEndElement(writer); /* rrset */ + TRY0(xmlTextWriterEndElement(writer)); /* rrset */ #endif break; } + return; +#ifdef HAVE_LIBXML2 + error: + dumparg->result = ISC_R_FAILURE; +#endif + } static void @@ -616,6 +644,7 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) { stats_dumparg_t *dumparg = arg; #ifdef HAVE_LIBXML2 xmlTextWriterPtr writer; + int xmlrc; #endif isc_buffer_init(&b, codebuf, sizeof(codebuf) - 1); @@ -631,30 +660,35 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) { #ifdef HAVE_LIBXML2 writer = dumparg->arg; - xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode"); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode")); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf); - xmlTextWriterEndElement(writer); /* name */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf)); + TRY0(xmlTextWriterEndElement(writer)); /* name */ - xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"); - xmlTextWriterWriteFormatString(writer, + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter")); + TRY0(xmlTextWriterWriteFormatString(writer, "%" ISC_PRINT_QUADFORMAT "u", - val); - xmlTextWriterEndElement(writer); /* counter */ + val)); + TRY0(xmlTextWriterEndElement(writer)); /* counter */ - xmlTextWriterEndElement(writer); /* opcode */ + TRY0(xmlTextWriterEndElement(writer)); /* opcode */ #endif break; } + return; + +#ifdef HAVE_LIBXML2 + error: + dumparg->result = ISC_R_FAILURE; + return; +#endif } #ifdef HAVE_LIBXML2 /* XXXMLG below here sucks. */ -#define TRY(a) do { result = (a); INSIST(result == ISC_R_SUCCESS); } while(0); -#define TRY0(a) do { xmlrc = (a); INSIST(xmlrc >= 0); } while(0); static isc_result_t zone_xmlrender(dns_zone_t *zone, void *arg) { @@ -664,49 +698,55 @@ zone_xmlrender(dns_zone_t *zone, void *arg) { xmlTextWriterPtr writer = arg; isc_stats_t *zonestats; isc_uint64_t nsstat_values[dns_nsstatscounter_max]; + int xmlrc; + isc_result_t result; - xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone"); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone")); dns_zone_name(zone, buf, sizeof(buf)); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR buf); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf)); + TRY0(xmlTextWriterEndElement(writer)); rdclass = dns_zone_getclass(zone); dns_rdataclass_format(rdclass, buf, sizeof(buf)); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR buf); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf)); + TRY0(xmlTextWriterEndElement(writer)); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial")); if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS) - xmlTextWriterWriteFormatString(writer, "%u", serial); + TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial)); else - xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-")); + TRY0(xmlTextWriterEndElement(writer)); zonestats = dns_zone_getrequeststats(zone); if (zonestats != NULL) { - xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"); - dump_counters(zonestats, statsformat_xml, writer, NULL, - nsstats_xmldesc, dns_nsstatscounter_max, - nsstats_index, nsstat_values, - ISC_STATSDUMP_VERBOSE); - xmlTextWriterEndElement(writer); /* counters */ + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters")); + result = dump_counters(zonestats, statsformat_xml, writer, NULL, + nsstats_xmldesc, dns_nsstatscounter_max, + nsstats_index, nsstat_values, + ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* counters */ } - xmlTextWriterEndElement(writer); /* zone */ + TRY0(xmlTextWriterEndElement(writer)); /* zone */ return (ISC_R_SUCCESS); + error: + return (ISC_R_FAILURE); } -static void +static isc_result_t generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { char boottime[sizeof "yyyy-mm-ddThh:mm:ssZ"]; char nowstr[sizeof "yyyy-mm-ddThh:mm:ssZ"]; isc_time_t now; - xmlTextWriterPtr writer; - xmlDocPtr doc; + xmlTextWriterPtr writer = NULL; + xmlDocPtr doc = NULL; int xmlrc; dns_view_t *view; stats_dumparg_t dumparg; @@ -715,12 +755,15 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { isc_uint64_t resstat_values[dns_resstatscounter_max]; isc_uint64_t zonestat_values[dns_zonestatscounter_max]; isc_uint64_t sockstat_values[isc_sockstatscounter_max]; + isc_result_t result; isc_time_now(&now); isc_time_formatISO8601(&ns_g_boottime, boottime, sizeof boottime); isc_time_formatISO8601(&now, nowstr, sizeof nowstr); writer = xmlNewTextWriterDoc(&doc, 0); + if (writer == NULL) + goto error; TRY0(xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL)); TRY0(xmlTextWriterWritePI(writer, ISC_XMLCHAR "xml-stylesheet", ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\"")); @@ -744,27 +787,36 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { view = ISC_LIST_HEAD(server->viewlist); TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views")); while (view != NULL) { - xmlTextWriterStartElement(writer, ISC_XMLCHAR "view"); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view")); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name)); + TRY0(xmlTextWriterEndElement(writer)); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones"); - dns_zt_apply(view->zonetable, ISC_FALSE, zone_xmlrender, - writer); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones")); + result = dns_zt_apply(view->zonetable, ISC_TRUE, zone_xmlrender, + writer); + if (result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); if (view->resquerystats != NULL) { + dumparg.result = ISC_R_SUCCESS; dns_rdatatypestats_dump(view->resquerystats, rdtypestat_dump, &dumparg, 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; } if (view->resstats != NULL) { - dump_counters(view->resstats, statsformat_xml, writer, - "resstat", resstats_xmldesc, - dns_resstatscounter_max, resstats_index, - resstat_values, ISC_STATSDUMP_VERBOSE); + result = dump_counters(view->resstats, statsformat_xml, + writer, "resstat", + resstats_xmldesc, + dns_resstatscounter_max, + resstats_index, resstat_values, + ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; } cachestats = dns_db_getrrsetstats(view->cachedb); @@ -775,12 +827,15 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { ISC_XMLCHAR "name", ISC_XMLCHAR dns_cache_getname(view->cache))); + dumparg.result = ISC_R_SUCCESS; dns_rdatasetstats_dump(cachestats, rdatasetstats_dump, &dumparg, 0); + if (dumparg.result != ISC_R_SUCCESS) + goto error; TRY0(xmlTextWriterEndElement(writer)); /* cache */ } - xmlTextWriterEndElement(writer); /* view */ + TRY0(xmlTextWriterEndElement(writer)); /* view */ view = ISC_LIST_NEXT(view, link); } @@ -795,44 +850,63 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { TRY0(xmlTextWriterEndElement(writer)); /* taskmgr */ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "server")); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime); - xmlTextWriterEndElement(writer); - xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time"); - xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr); - xmlTextWriterEndElement(writer); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime)); + TRY0(xmlTextWriterEndElement(writer)); + TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time")); + TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr)); + TRY0(xmlTextWriterEndElement(writer)); TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "requests")); + dumparg.result = ISC_R_SUCCESS; dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg, 0); - xmlTextWriterEndElement(writer); /* requests */ + if (dumparg.result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* requests */ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "queries-in")); + dumparg.result = ISC_R_SUCCESS; dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump, &dumparg, 0); - xmlTextWriterEndElement(writer); /* queries-in */ - - dump_counters(server->nsstats, statsformat_xml, writer, - "nsstat", nsstats_xmldesc, dns_nsstatscounter_max, - nsstats_index, nsstat_values, ISC_STATSDUMP_VERBOSE); + if (dumparg.result != ISC_R_SUCCESS) + goto error; + TRY0(xmlTextWriterEndElement(writer)); /* queries-in */ + + result = dump_counters(server->nsstats, statsformat_xml, writer, + "nsstat", nsstats_xmldesc, + dns_nsstatscounter_max, + nsstats_index, nsstat_values, + ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; - dump_counters(server->zonestats, statsformat_xml, writer, "zonestat", - zonestats_xmldesc, dns_zonestatscounter_max, - zonestats_index, zonestat_values, ISC_STATSDUMP_VERBOSE); + result = dump_counters(server->zonestats, statsformat_xml, writer, + "zonestat", zonestats_xmldesc, + dns_zonestatscounter_max, zonestats_index, + zonestat_values, ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; /* * Most of the common resolver statistics entries are 0, so we don't * use the verbose dump here. */ - dump_counters(server->resolverstats, statsformat_xml, writer, "resstat", - resstats_xmldesc, dns_resstatscounter_max, resstats_index, - resstat_values, 0); + result = dump_counters(server->resolverstats, statsformat_xml, writer, + "resstat", resstats_xmldesc, + dns_resstatscounter_max, resstats_index, + resstat_values, 0); + if (result != ISC_R_SUCCESS) + goto error; - dump_counters(server->sockstats, statsformat_xml, writer, "sockstat", - sockstats_xmldesc, isc_sockstatscounter_max, - sockstats_index, sockstat_values, ISC_STATSDUMP_VERBOSE); + result = dump_counters(server->sockstats, statsformat_xml, writer, + "sockstat", sockstats_xmldesc, + isc_sockstatscounter_max, sockstats_index, + sockstat_values, ISC_STATSDUMP_VERBOSE); + if (result != ISC_R_SUCCESS) + goto error; - xmlTextWriterEndElement(writer); /* server */ + TRY0(xmlTextWriterEndElement(writer)); /* server */ TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory")); isc_mem_renderxml(writer); @@ -848,6 +922,14 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) { xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 1); xmlFreeDoc(doc); + return (ISC_R_SUCCESS); + + error: + if (writer != NULL) + xmlFreeTextWriter(writer); + if (doc != NULL) + xmlFreeDoc(doc); + return (ISC_R_FAILURE); } static void @@ -866,21 +948,24 @@ render_index(const char *url, const char *querystring, void *arg, unsigned char *msg; int msglen; ns_server_t *server = arg; + isc_result_t result; UNUSED(url); UNUSED(querystring); - generatexml(server, &msglen, &msg); + result = generatexml(server, &msglen, &msg); - *retcode = 200; - *retmsg = "OK"; - *mimetype = "text/xml"; - isc_buffer_reinit(b, msg, msglen); - isc_buffer_add(b, msglen); - *freecb = wrap_xmlfree; - *freecb_args = NULL; + if (result == ISC_R_SUCCESS) { + *retcode = 200; + *retmsg = "OK"; + *mimetype = "text/xml"; + isc_buffer_reinit(b, msg, msglen); + isc_buffer_add(b, msglen); + *freecb = wrap_xmlfree; + *freecb_args = NULL; + } - return (ISC_R_SUCCESS); + return (result); } #endif /* HAVE_LIBXML2 */ @@ -1281,20 +1366,20 @@ ns_stats_dump(ns_server_t *server, FILE *fp) { } fprintf(fp, "++ Name Server Statistics ++\n"); - dump_counters(server->nsstats, statsformat_file, fp, NULL, - nsstats_desc, dns_nsstatscounter_max, nsstats_index, - nsstat_values, 0); + (void) dump_counters(server->nsstats, statsformat_file, fp, NULL, + nsstats_desc, dns_nsstatscounter_max, + nsstats_index, nsstat_values, 0); fprintf(fp, "++ Zone Maintenance Statistics ++\n"); - dump_counters(server->zonestats, statsformat_file, fp, NULL, - zonestats_desc, dns_zonestatscounter_max, - zonestats_index, zonestat_values, 0); + (void) dump_counters(server->zonestats, statsformat_file, fp, NULL, + zonestats_desc, dns_zonestatscounter_max, + zonestats_index, zonestat_values, 0); fprintf(fp, "++ Resolver Statistics ++\n"); fprintf(fp, "[Common]\n"); - dump_counters(server->resolverstats, statsformat_file, fp, NULL, - resstats_desc, dns_resstatscounter_max, resstats_index, - resstat_values, 0); + (void) dump_counters(server->resolverstats, statsformat_file, fp, NULL, + resstats_desc, dns_resstatscounter_max, + resstats_index, resstat_values, 0); for (view = ISC_LIST_HEAD(server->viewlist); view != NULL; view = ISC_LIST_NEXT(view, link)) { @@ -1304,9 +1389,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) { fprintf(fp, "[View: default]\n"); else fprintf(fp, "[View: %s]\n", view->name); - dump_counters(view->resstats, statsformat_file, fp, NULL, - resstats_desc, dns_resstatscounter_max, - resstats_index, resstat_values, 0); + (void) dump_counters(view->resstats, statsformat_file, fp, NULL, + resstats_desc, dns_resstatscounter_max, + resstats_index, resstat_values, 0); } fprintf(fp, "++ Cache DB RRsets ++\n"); @@ -1335,9 +1420,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) { } fprintf(fp, "++ Socket I/O Statistics ++\n"); - dump_counters(server->sockstats, statsformat_file, fp, NULL, - sockstats_desc, isc_sockstatscounter_max, sockstats_index, - sockstat_values, 0); + (void) dump_counters(server->sockstats, statsformat_file, fp, NULL, + sockstats_desc, isc_sockstatscounter_max, + sockstats_index, sockstat_values, 0); fprintf(fp, "++ Per Zone Query Statistics ++\n"); zone = NULL; @@ -1358,9 +1443,10 @@ ns_stats_dump(ns_server_t *server, FILE *fp) { fprintf(fp, " (view: %s)", view->name); fprintf(fp, "]\n"); - dump_counters(zonestats, statsformat_file, fp, NULL, - nsstats_desc, dns_nsstatscounter_max, - nsstats_index, nsstat_values, 0); + (void) dump_counters(zonestats, statsformat_file, fp, + NULL, nsstats_desc, + dns_nsstatscounter_max, + nsstats_index, nsstat_values, 0); } } diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 5661a036..9700f12a 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -2655,6 +2655,13 @@ options { + + + + + + + IPv6 Support in <acronym>BIND</acronym> 9 @@ -8437,7 +8444,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; The delay, in seconds, between sending sets of notify - messages for a zone. The default is zero. + messages for a zone. The default is five (5) seconds. @@ -9187,7 +9194,7 @@ deny-answer-aliases { "example.net"; }; - + <command>trusted-keys</command> Statement Grammar trusted-keys { @@ -9248,7 +9255,7 @@ deny-answer-aliases { "example.net"; }; - + <command>managed-keys</command> Statement Definition and Usage @@ -15650,8 +15657,12 @@ zone "example.com" { + + + + Manual pages diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 259fbe00..306cb6ac 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -68,10 +68,38 @@
Signing the Zone
Configuring Servers
-
IPv6 Support in BIND 9
+
DNSSEC, Dynamic Zones, and Automatic Signing
-
Address Lookups Using AAAA Records
-
Address to Name Lookups Using Nibble Format
+
Converting from insecure to secure
+
Dynamic DNS update method
+
Fully automatic zone signing
+
Private-type records
+
DNSKEY rollovers via UPDATE
+
NSEC3PARAM rollovers via UPDATE
+
Converting from NSEC to NSEC3
+
Converting from NSEC3 to NSEC
+
Converting from secure to insecure
+
Periodic re-signing
+
NSEC3 and OPTOUT
+
+
Dynamic Trust Anchor Management
+
+
Validating Resolver
+
Authoritative Server
+
+
PKCS #11 (Cryptoki) support
+
+
Prerequisites
+
Building BIND 9 with PKCS#11
+
PKCS #11 Tools
+
Using the HSM
+
Specifying the engine on the command line
+
Running named with automatic zone re-signing
+
+
IPv6 Support in BIND 9
+
+
Address Lookups Using AAAA Records
+
Address to Name Lookups Using Nibble Format
@@ -1019,7 +1047,676 @@ options {

-IPv6 Support in BIND 9

+DNSSEC, Dynamic Zones, and Automatic Signing
+

As of BIND 9.7.0 it is possible to change a dynamic zone + from insecure to signed and back again. A secure zone can use + either NSEC or NSEC3 chains.

+

+Converting from insecure to secure

+

Changing a zone from insecure to secure can be done in two + ways: using a dynamic DNS update, or the + auto-dnssec zone option.

+

For either method, you need to configure + named so that it can see the + K* files which contain the public and private + parts of the keys that will be used to sign the zone. These files + will have been generated by + dnssec-keygen. You can do this by placing them + in the key-directory, as specified in + named.conf:

+
+        zone example.net {
+                type master;
+                update-policy local;
+                file "dynamic/example.net/example.net";
+                key-directory "dynamic/example.net";
+        };
+
+

If one KSK and one ZSK DNSKEY key have been generated, this + configuration will cause all records in the zone to be signed + with the ZSK, and the DNSKEY RRset to be signed with the KSK as + well. An NSEC chain will be generated as part of the initial + signing process.

+

+Dynamic DNS update method

+

To insert the keys via dynamic update:

+
+        % nsupdate
+        > ttl 3600
+        > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
+        > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
+        > send
+
+

While the update request will complete almost immediately, + the zone will not be completely signed until + named has had time to walk the zone and + generate the NSEC and RRSIG records. The NSEC record at the apex + will be added last, to signal that there is a complete NSEC + chain.

+

If you wish to sign using NSEC3 instead of NSEC, you should + add an NSEC3PARAM record to the initial update request. If you + wish the NSEC3 chain to have the OPTOUT bit set, set it in the + flags field of the NSEC3PARAM record.

+
+        % nsupdate
+        > ttl 3600
+        > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
+        > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
+        > update add example.net NSEC3PARAM 1 1 100 1234567890
+        > send
+
+

Again, this update request will complete almost + immediately; however, the record won't show up until + named has had a chance to build/remove the + relevant chain. A private type record will be created to record + the state of the operation (see below for more details), and will + be removed once the operation completes.

+

While the initial signing and NSEC/NSEC3 chain generation + is happening, other updates are possible as well.

+

+Fully automatic zone signing

+

To enable automatic signing, add the + auto-dnssec option to the zone statement in + named.conf. + auto-dnssec has two possible arguments: + allow or + maintain.

+

With + auto-dnssec allow, + named can search the key directory for keys + matching the zone, insert them into the zone, and use them to + sign the zone. It will do so only when it receives an + rndc sign <zonename> command.

+

+ + auto-dnssec maintain includes the above + functionality, but will also automatically adjust the zone's + DNSKEY records on schedule according to the keys' timing metadata. + (See dnssec-keygen(8) and + dnssec-settime(8) for more information.) + If keys are present in the key directory the first time the zone + is loaded, it will be signed immediately, without waiting for an + rndc sign command. (This command can still be + used for unscheduled key changes, however.)

+

Using the + auto-dnssec option requires the zone to be + configured to allow dynamic updates, by adding an + allow-update or + update-policy statement to the zone + configuration. If this has not been done, the configuration will + fail.

+

+Private-type records

+

The state of the signing process is signaled by + private-type records (with a default type value of 65534). When + signing is complete, these records will have a nonzero value for + the final octet (for those records which have a nonzero initial + octet).

+

The private type record format: If the first octet is + non-zero then the record indicates that the zone needs to be + signed with the key matching the record, or that all signatures + that match the record should be removed.

+

+

+


+
+  algorithm (octet 1)
+  key id in network order (octet 2 and 3)
+  removal flag (octet 4)
+  complete flag (octet 5)
+

+

+

+

Only records flagged as "complete" can be removed via + dynamic update. Attempts to remove other private type records + will be silently ignored.

+

If the first octet is zero (this is a reserved algorithm + number that should never appear in a DNSKEY record) then the + record indicates changes to the NSEC3 chains are in progress. The + rest of the record contains an NSEC3PARAM record. The flag field + tells what operation to perform based on the flag bits.

+

+

+


+
+  0x01 OPTOUT
+  0x80 CREATE
+  0x40 REMOVE
+  0x20 NONSEC
+

+

+

+

+DNSKEY rollovers via UPDATE

+

It is possible to perform key rollovers via dynamic update. + You need to add the + K* files for the new keys so that + named can find them. You can then add the new + DNSKEY RRs via dynamic update. + named will then cause the zone to be signed + with the new keys. When the signing is complete the private type + records will be updated so that the last octet is non + zero.

+

If this is for a KSK you need to inform the parent and any + trust anchor repositories of the new KSK.

+

You should then wait for the maximum TTL in the zone before + removing the old DNSKEY. If it is a KSK that is being updated, + you also need to wait for the DS RRset in the parent to be + updated and its TTL to expire. This ensures that all clients will + be able to verify at least one signature when you remove the old + DNSKEY.

+

The old DNSKEY can be removed via UPDATE. Take care to + specify the correct key. + named will clean out any signatures generated + by the old key after the update completes.

+

+NSEC3PARAM rollovers via UPDATE

+

Add the new NSEC3PARAM record via dynamic update. When the + new NSEC3 chain has been generated, the NSEC3PARAM flag field + will be zero. At this point you can remove the old NSEC3PARAM + record. The old chain will be removed after the update request + completes.

+

+Converting from NSEC to NSEC3

+

To do this, you just need to add an NSEC3PARAM record. When + the conversion is complete, the NSEC chain will have been removed + and the NSEC3PARAM record will have a zero flag field. The NSEC3 + chain will be generated before the NSEC chain is + destroyed.

+

+Converting from NSEC3 to NSEC

+

To do this, use nsupdate to + remove all NSEC3PARAM records with a zero flag + field. The NSEC chain will be generated before the NSEC3 chain is + removed.

+

+Converting from secure to insecure

+

To convert a signed zone to unsigned using dynamic DNS, + delete all the DNSKEY records from the zone apex using + nsupdate. All signatures, NSEC or NSEC3 chains, + and associated NSEC3PARAM records will be removed automatically. + This will take place after the update request completes.

+

This requires the + dnssec-secure-to-insecure option to be set to + yes in + named.conf.

+

In addition, if the auto-dnssec maintain + zone statement is used, it should be removed or changed to + allow instead (or it will re-sign). +

+

+Periodic re-signing

+

In any secure zone which supports dynamic updates, named + will periodically re-sign RRsets which have not been re-signed as + a result of some update action. The signature lifetimes will be + adjusted so as to spread the re-sign load over time rather than + all at once.

+

+NSEC3 and OPTOUT

+

+ named only supports creating new NSEC3 chains + where all the NSEC3 records in the zone have the same OPTOUT + state. + named supports UPDATES to zones where the NSEC3 + records in the chain have mixed OPTOUT state. + named does not support changing the OPTOUT + state of an individual NSEC3 record, the entire chain needs to be + changed if the OPTOUT state of an individual NSEC3 needs to be + changed.

+ +
+

+Dynamic Trust Anchor Management

+

BIND 9.7.0 introduces support for RFC 5011, dynamic trust + anchor management. Using this feature allows + named to keep track of changes to critical + DNSSEC keys without any need for the operator to make changes to + configuration files.

+
+

+Validating Resolver

+

To configure a validating resolver to use RFC 5011 to + maintain a trust anchor, configure the trust anchor using a + managed-keys statement. Information about + this can be found in + the section called “managed-keys Statement Definition + and Usage”.

+
+
+

+Authoritative Server

+

To set up an authoritative zone for RFC 5011 trust anchor + maintenance, generate two (or more) key signing keys (KSKs) for + the zone. Sign the zone with one of them; this is the "active" + KSK. All KSK's which do not sign the zone are "stand-by" + keys.

+

Any validating resolver which is configured to use the + active KSK as an RFC 5011-managed trust anchor will take note + of the stand-by KSKs in the zone's DNSKEY RRset, and store them + for future reference. The resolver will recheck the zone + periodically, and after 30 days, if the new key is still there, + then the key will be accepted by the resolver as a valid trust + anchor for the zone. Any time after this 30-day acceptance + timer has completed, the active KSK can be revoked, and the + zone can be "rolled over" to the newly accepted key.

+

The easiest way to place a stand-by key in a zone is to + use the "smart signing" features of + dnssec-keygen and + dnssec-signzone. If a key with a publication + date in the past, but an activation date which is unset or in + the future, " + dnssec-signzone -S" will include the DNSKEY + record in the zone, but will not sign with it:

+
+$ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net
+$ dnssec-signzone -S -K keys example.net
+
+

To revoke a key, the new command + dnssec-revoke has been added. This adds the + REVOKED bit to the key flags and re-generates the + K*.key and + K*.private files.

+

After revoking the active key, the zone must be signed + with both the revoked KSK and the new active KSK. (Smart + signing takes care of this automatically.)

+

Once a key has been revoked and used to sign the DNSKEY + RRset in which it appears, that key will never again be + accepted as a valid trust anchor by the resolver. However, + validation can proceed using the new active key (which had been + accepted by the resolver when it was a stand-by key).

+

See RFC 5011 for more details on key rollover + scenarios.

+

When a key has been revoked, its key ID changes, + increasing by 128, and wrapping around at 65535. So, for + example, the key "Kexample.com.+005+10000" becomes + "Kexample.com.+005+10128".

+

If two keys have ID's exactly 128 apart, and one is + revoked, then the two key ID's will collide, causing several + problems. To prevent this, + dnssec-keygen will not generate a new key if + another key is present which may collide. This checking will + only occur if the new keys are written to the same directory + which holds all other keys in use for that zone.

+

Older versions of BIND 9 did not have this precaution. + Exercise caution if using key revocation on keys that were + generated by previous releases, or if using keys stored in + multiple directories or on multiple machines.

+

It is expected that a future release of BIND 9 will + address this problem in a different way, by storing revoked + keys with their original unrevoked key ID's.

+
+
+
+

+PKCS #11 (Cryptoki) support

+

PKCS #11 (Public Key Cryptography Standard #11) defines a + platform- independent API for the control of hardware security + modules (HSMs) and other cryptographic support devices.

+

BIND 9 is known to work with two HSMs: The Sun SCA 6000 + cryptographic acceleration board, tested under Solaris x86, and + the AEP Keyper network-attached key storage device, tested with + Debian Linux, Solaris x86 and Windows Server 2003.

+
+

+Prerequisites

+

See the HSM vendor documentation for information about + installing, initializing, testing and troubleshooting the + HSM.

+

BIND 9 uses OpenSSL for cryptography, but stock OpenSSL + does not yet fully support PKCS #11. However, a PKCS #11 engine + for OpenSSL is available from the OpenSolaris project. It has + been modified by ISC to work with with BIND 9, and to provide + new features such as PIN management and key by + reference.

+

The patched OpenSSL depends on a "PKCS #11 provider". + This is a shared library object, providing a low-level PKCS #11 + interface to the HSM hardware. It is dynamically loaded by + OpenSSL at runtime. The PKCS #11 provider comes from the HSM + vendor, and and is specific to the HSM to be controlled.

+

There are two "flavors" of PKCS #11 support provided by + the patched OpenSSL, one of which must be chosen at + configuration time. The correct choice depends on the HSM + hardware:

+
    +

  • Use 'crypto-accelerator' with HSMs that have hardware + cryptographic acceleration features, such as the SCA 6000 + board. This causes OpenSSL to run all supported + cryptographic operations in the HSM.

    • +

  • Use 'sign-only' with HSMs that are designed to + function primarily as secure key storage devices, but lack + hardware acceleration. These devices are highly secure, but + are not necessarily any faster at cryptography than the + system CPU — often, they are slower. It is therefore + most efficient to use them only for those cryptographic + functions that require access to the secured private key, + such as zone signing, and to use the system CPU for all + other computationally-intensive operations. The AEP Keyper + is an example of such a device.

    • +
+

The modified OpenSSL code is included in the BIND 9.7.0 + release, in the form of a context diff against the latest OpenSSL. +

+
+

Note

+ The latest OpenSSL version at the time of the BIND release + is 0.9.8l. + ISC will provide an updated patch as new versions of OpenSSL + are released. The version number in the following examples + is expected to change.
+

+ Before building BIND 9 with PKCS #11 support, it will be + necessary to build OpenSSL with this patch in place and inform + it of the path to the HSM-specific PKCS #11 provider + library.

+

Obtain OpenSSL 0.9.8l:

+
+$ wget http://www.openssl.org/source/openssl-0.9.8l.tar.gz
+
+

Extract the tarball:

+
+$ tar zxf openssl-0.9.8l.tar.gz
+
+

Apply the patch from the BIND 9 release:

+
+$ patch -p1 -d openssl-0.9.8l \
+            < bind-9.7.0/bin/pkcs11/openssl-0.9.8l-patch
+
+
+

Note

(Note that the patch file may not be compatible with the + "patch" utility on all operating systems. You may need to + install GNU patch.)
+

When building OpenSSL, place it in a non-standard + location so that it does not interfere with OpenSSL libraries + elsewhere on the system. In the following examples, we choose + to install into "/opt/pkcs11/usr". We will use this location + when we configure BIND 9.

+
+

+Building OpenSSL for the AEP Keyper on Linux

+

The AEP Keyper is a highly secure key storage device, + but does not provide hardware cryptographic acceleration. It + can carry out cryptographic operations, but it is probably + slower than your system's CPU. Therefore, we choose the + 'sign-only' flavor when building OpenSSL.

+

The Keyper-specific PKCS #11 provider library is + delivered with the Keyper software. In this example, we place + it /opt/pkcs11/usr/lib:

+
+$ cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so
+
+

This library is only available for Linux as a 32-bit + binary. If we are compiling on a 64-bit Linux system, it is + necessary to force a 32-bit build, by specifying -m32 in the + build options.

+

Finally, the Keyper library requires threads, so we + must specify -pthread.

+
+$ cd openssl-0.9.8l
+$ ./Configure linux-generic32 -m32 -pthread \
+            --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
+            --pk11-flavor=sign-only \
+            --prefix=/opt/pkcs11/usr
+
+

After configuring, run "make" + and "make test". If "make + test" fails with "pthread_atfork() not found", you forgot to + add the -pthread above.

+
+
+

+Building OpenSSL for the SCA 6000 on Solaris

+

The SCA-6000 PKCS #11 provider is installed as a system + library, libpkcs11. It is a true crypto accelerator, up to 4 + times faster than any CPU, so the flavor shall be + 'crypto-accelerator'.

+

In this example, we are building on Solaris x86 on an + AMD64 system.

+
+$ cd openssl-0.9.8l
+$ ./Configure solaris64-x86_64-cc \
+            --pk11-libname=/usr/lib/64/libpkcs11.so \
+            --pk11-flavor=crypto-accelerator \
+            --prefix=/opt/pkcs11/usr
+
+

(For a 32-bit build, use "solaris-x86-cc" and + /usr/lib/libpkcs11.so.)

+

After configuring, run + make and + make test.

+

Once you have built OpenSSL, run + "apps/openssl engine pkcs11" to confirm + that PKCS #11 support was compiled in correctly. The output + should be one of the following lines, depending on the flavor + selected:

+
+        (pkcs11) PKCS #11 engine support (sign only)
+
+

Or:

+
+        (pkcs11) PKCS #11 engine support (crypto accelerator)
+
+

Next, run + "apps/openssl engine pkcs11 -t". This will + attempt to initialize the PKCS #11 engine. If it is able to + do so successfully, it will report + “[ available ]”.

+

If the output is correct, run + "make install" which will install the + modified OpenSSL suite to + /opt/pkcs11/usr.

+
+
+
+

+Building BIND 9 with PKCS#11

+

When building BIND 9, the location of the custom-built + OpenSSL library must be specified via configure.

+
+

+Configuring BIND 9 for Linux

+

To link with the PKCS #11 provider, threads must be + enabled in the BIND 9 build.

+

The PKCS #11 library for the AEP Keyper is currently + only available as a 32-bit binary. If we are building on a + 64-bit host, we must force a 32-bit build by adding "-m32" to + the CC options on the "configure" command line.

+
+$ cd ../bind-9.7.0
+$ ./configure CC="gcc -m32" --enable-threads \
+           --with-openssl=/opt/pkcs11/usr \
+           --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so
+
+
+
+

+Configuring BIND 9 for Solaris

+

To link with the PKCS #11 provider, threads must be + enabled in the BIND 9 build.

+
+$ cd ../bind-9.7.0
+$ ./configure CC="cc -xarch=amd64" --enable-threads \
+            --with-openssl=/opt/pkcs11/usr \
+            --with-pkcs11=/usr/lib/64/libpkcs11.so
+
+

(For a 32-bit build, omit CC="cc -xarch=amd64".)

+

If configure complains about OpenSSL not working, you + may have a 32/64-bit architecture mismatch. Or, you may have + incorrectly specified the path to OpenSSL (it should be the + same as the --prefix argument to the OpenSSL + Configure).

+
+

After configuring, run + "make", + "make test" and + "make install".

+
+
+

+PKCS #11 Tools

+

BIND 9 includes a minimal set of tools to operate the + HSM, including + pkcs11-keygen to generate a new key pair + within the HSM, + pkcs11-list to list objects currently + available, and + pkcs11-destroy to remove objects.

+

In UNIX/Linux builds, these tools are built only if BIND + 9 is configured with the --with-pkcs11 option. (NOTE: If + --with-pkcs11 is set to "yes", rather than to the path of the + PKCS #11 provider, then the tools will be built but the + provider will be left undefined. Use the -m option or the + PKCS11_PROVIDER environment variable to specify the path to the + provider.)

+
+
+

+Using the HSM

+

First, we must set up the runtime environment so the + OpenSSL and PKCS #11 libraries can be loaded:

+
+$ export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}
+
+

When operating an AEP Keyper, it is also necessary to + specify the location of the "machine" file, which stores + information about the Keyper for use by PKCS #11 provider + library. If the machine file is in + /opt/Keyper/PKCS11Provider/machine, + use:

+
+$ export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider
+
+

These environment variables must be set whenever running + any tool that uses the HSM, including + pkcs11-keygen, + pkcs11-list, + pkcs11-destroy, + dnssec-keyfromlabel, + dnssec-signzone, + dnssec-keygen(which will use the HSM for + random number generation), and + named.

+

We can now create and use keys in the HSM. In this case, + we will create a 2048 bit key and give it the label + "sample-ksk":

+
+$ pkcs11-keygen -b 2048 -l sample-ksk
+
+

To confirm that the key exists:

+
+$ pkcs11-list
+Enter PIN:
+object[0]: handle 2147483658 class 3 label[8] 'sample-ksk' id[0]
+object[1]: handle 2147483657 class 2 label[8] 'sample-ksk' id[0]
+
+

Before using this key to sign a zone, we must create a + pair of BIND 9 key files. The "dnssec-keyfromlabel" utility + does this. In this case, we will be using the HSM key + "sample-ksk" as the key-signing key for "example.net":

+
+$ dnssec-keyfromlabel -l sample-ksk -f KSK example.net
+
+

The resulting K*.key and K*.private files can now be used + to sign the zone. Unlike normal K* files, which contain both + public and private key data, these files will contain only the + public key data, plus an identifier for the private key which + remains stored within the HSM. The HSM handles signing with the + private key.

+

If you wish to generate a second key in the HSM for use + as a zone-signing key, follow the same procedure above, using a + different keylabel, a smaller key size, and omitting "-f KSK" + from the dnssec-keyfromlabel arguments:

+
+$ pkcs11-keygen -b 1024 -l sample-zsk
+$ dnssec-keyfromlabel -l sample-zsk example.net
+
+

Alternatively, you may prefer to generate a conventional + on-disk key, using dnssec-keygen:

+
+$ dnssec-keygen example.net
+
+

This provides less security than an HSM key, but since + HSMs can be slow or cumbersome to use for security reasons, it + may be more efficient to reserve HSM keys for use in the less + frequent key-signing operation. The zone-signing key can be + rolled more frequently, if you wish, to compensate for a + reduction in key security.

+

Now you can sign the zone. (Note: If not using the -S + option to + dnssec-signzone, it will be necessary to add + the contents of both + K*.key files to the zone master file before + signing it.)

+
+$ dnssec-signzone -S example.net
+Enter PIN:
+Verifying the zone using the following algorithms:
+NSEC3RSASHA1.
+Zone signing complete:
+Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
+example.net.signed
+
+
+
+

+Specifying the engine on the command line

+

The OpenSSL engine can be specified in + named and all of the BIND + dnssec-* tools by using the "-E + <engine>" command line option. If BIND 9 is built with + the --with-pkcs11 option, this option defaults to "pkcs11". + Specifying the engine will generally not be necessary unless + for some reason you wish to use a different OpenSSL + engine.

+

If you wish to disable use of the "pkcs11" engine — + for troubleshooting purposes, or because the HSM is unavailable + — set the engine to the empty string. For example:

+
+$ dnssec-signzone -E '' -S example.net
+
+

This causes + dnssec-signzone to run as if it were compiled + without the --with-pkcs11 option.

+
+
+

+Running named with automatic zone re-signing

+

If you want + named to dynamically re-sign zones using HSM + keys, and/or to to sign new records inserted via nsupdate, then + named must have access to the HSM PIN. This can be accomplished + by placing the PIN into the openssl.cnf file (in the above + examples, + /opt/pkcs11/usr/ssl/openssl.cnf).

+

The location of the openssl.cnf file can be overridden by + setting the OPENSSL_CONF environment variable before running + named.

+

Sample openssl.cnf:

+
+        openssl_conf = openssl_def
+        [ openssl_def ]
+        engines = engine_section
+        [ engine_section ]
+        pkcs11 = pkcs11_section
+        [ pkcs11_section ]
+        PIN = <PLACE PIN HERE>
+
+

This will also allow the dnssec-* tools to access the HSM + without PIN entry. (The pkcs11-* tools access the HSM directly, + not via OpenSSL, so a PIN will still be required to use + them.)

+
+

Warning

+

Placing the HSM's PIN in a text file in + this manner may reduce the security advantage of using an + HSM. Be sure this is what you want to do before configuring + OpenSSL in this way.

+
+
+
+
+

+IPv6 Support in BIND 9

BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name @@ -1057,7 +1754,7 @@ options {

-Address Lookups Using AAAA Records

+Address Lookups Using AAAA Records

The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -1076,7 +1773,7 @@ host 3600 IN AAAA 2001:db8::1

-Address to Name Lookups Using Nibble Format

+Address to Name Lookups Using Nibble Format

When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index bc5d02a1..a1690f75 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -45,13 +45,13 @@

Table of Contents

-
The Lightweight Resolver Library
+
The Lightweight Resolver Library
Running a Resolver Daemon

-The Lightweight Resolver Library

+The Lightweight Resolver Library

Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index a76ee137..7173ab89 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -48,58 +48,58 @@

Configuration File Elements
Address Match Lists
-
Comment Syntax
+
Comment Syntax
Configuration File Grammar
-
acl Statement Grammar
+
acl Statement Grammar
acl Statement Definition and Usage
-
controls Statement Grammar
+
controls Statement Grammar
controls Statement Definition and Usage
-
include Statement Grammar
-
include Statement Definition and +
include Statement Grammar
+
include Statement Definition and Usage
-
key Statement Grammar
-
key Statement Definition and Usage
-
logging Statement Grammar
-
logging Statement Definition and +
key Statement Grammar
+
key Statement Definition and Usage
+
logging Statement Grammar
+
logging Statement Definition and Usage
-
lwres Statement Grammar
-
lwres Statement Definition and Usage
-
masters Statement Grammar
-
masters Statement Definition and +
lwres Statement Grammar
+
lwres Statement Definition and Usage
+
masters Statement Grammar
+
masters Statement Definition and Usage
-
options Statement Grammar
+
options Statement Grammar
options Statement Definition and Usage
server Statement Grammar
server Statement Definition and Usage
statistics-channels Statement Grammar
-
statistics-channels Statement Definition and +
statistics-channels Statement Definition and Usage
-
trusted-keys Statement Grammar
-
trusted-keys Statement Definition +
trusted-keys Statement Grammar
+
trusted-keys Statement Definition and Usage
-
managed-keys Statement Grammar
-
managed-keys Statement Definition +
managed-keys Statement Grammar
+
managed-keys Statement Definition and Usage
view Statement Grammar
-
view Statement Definition and Usage
+
view Statement Definition and Usage
zone Statement Grammar
-
zone Statement Definition and Usage
+
zone Statement Definition and Usage
-
Zone File
+
Zone File
Types of Resource Records and When to Use Them
-
Discussion of MX Records
+
Discussion of MX Records
Setting TTLs
-
Inverse Mapping in IPv4
-
Other Zone File Directives
-
BIND Master File Extension: the $GENERATE Directive
+
Inverse Mapping in IPv4
+
Other Zone File Directives
+
BIND Master File Extension: the $GENERATE Directive
Additional File Formats
BIND9 Statistics
@@ -477,7 +477,7 @@ Address Match Lists

-Syntax

+Syntax
address_match_list = address_match_list_element ;
   [ address_match_list_element; ... ]
 address_match_list_element = [ ! ] (ip_address [/length] |
@@ -486,7 +486,7 @@
 
 

 

-Definition and Usage

+Definition and Usage

 

             Address match lists are primarily used to determine access
             control for various server operations. They are also used in
@@ -570,7 +570,7 @@
 
 

 

-Comment Syntax

+Comment Syntax

 

           The BIND 9 comment syntax allows for
           comments to appear
@@ -580,7 +580,7 @@
         

 

 

-Syntax

+Syntax

 

             

 
/* This is a BIND comment as in C */

@@ -596,7 +596,7 @@
 
 

 

-Definition and Usage

+Definition and Usage

 

             Comments may appear anywhere that whitespace may appear in
             a BIND configuration file.
@@ -848,7 +848,7 @@
       

 

 

-acl Statement Grammar

+acl Statement Grammar

 
acl acl-name {
     address_match_list
 };
@@ -930,7 +930,7 @@
 
 

 

-controls Statement Grammar

+controls Statement Grammar

 
controls {
    [ inet ( ip_addr | * ) [ port ip_port ]
                 allow {  address_match_list  }
@@ -1054,12 +1054,12 @@
 
 

 

-include Statement Grammar

+include Statement Grammar

 
include filename;

 
 

 

-include Statement Definition and
+include Statement Definition and
           Usage

 

           The include statement inserts the
@@ -1074,7 +1074,7 @@
 

 

 

-key Statement Grammar

+key Statement Grammar

 
key key_id {
     algorithm string;
     secret string;
@@ -1083,7 +1083,7 @@
 
 

 

-key Statement Definition and Usage

+key Statement Definition and Usage

 

           The key statement defines a shared
           secret key for use with TSIG (see the section called “TSIG”)
@@ -1130,7 +1130,7 @@
 
 

 

-logging Statement Grammar

+logging Statement Grammar

 
logging {
    [ channel channel_name {
      ( file path_name
@@ -1154,7 +1154,7 @@
 
 

 

-logging Statement Definition and
+logging Statement Definition and
           Usage

 

           The logging statement configures a
@@ -1188,7 +1188,7 @@
         

 

 

-The channel Phrase

+The channel Phrase

 

             All log output goes to one or more channels;
             you can make as many of them as you want.
@@ -1753,7 +1753,7 @@ category notify { null; };
 
 

 

-The query-errors Category

+The query-errors Category

 

             The query-errors category is
             specifically intended for debugging purposes: To identify
@@ -1981,7 +1981,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 
 

 

-lwres Statement Grammar

+lwres Statement Grammar

 

            This is the grammar of the lwres
           statement in the named.conf file:
@@ -1997,7 +1997,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 
 

 

-lwres Statement Definition and Usage

+lwres Statement Definition and Usage

 

           The lwres statement configures the
           name
@@ -2048,7 +2048,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 
 

 

-masters Statement Grammar

+masters Statement Grammar

 
 masters name [port ip_port] { ( masters_list | 
       ip_addr [port ip_port] [key key] ) ; [...] };
@@ -2056,7 +2056,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 
 

 

-masters Statement Definition and
+masters Statement Definition and
           Usage

 
masters
           lists allow for a common set of masters to be easily used by
@@ -2065,7 +2065,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 

 

 

-options Statement Grammar

+options Statement Grammar

 

           This is the grammar of the options
           statement in the named.conf file:
@@ -3517,7 +3517,7 @@ options {
 
 

 

-Forwarding

+Forwarding

 

             The forwarding facility can be used to create a large site-wide
             cache on a few servers, reducing traffic over links to external
@@ -3561,7 +3561,7 @@ options {
 
 

 

-Dual-stack Servers

+Dual-stack Servers

 

             Dual-stack servers are used as servers of last resort to work
             around
@@ -3758,7 +3758,7 @@ options {
 
 

 

-Interfaces

+Interfaces

 

             The interfaces and ports that the server will answer queries
             from may be specified using the listen-on option. listen-on takes
@@ -4210,7 +4210,7 @@ avoid-v6-udp-ports {};
 
 

 

-UDP Port Lists

+UDP Port Lists

 

             use-v4-udp-ports,
             avoid-v4-udp-ports,
@@ -4252,7 +4252,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 
 

 

-Operating System Resource Limits

+Operating System Resource Limits

 

             The server's usage of many system resources can be limited.
             Scaled values are allowed when specifying resource limits.  For
@@ -4414,7 +4414,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 
 

 

-Periodic Task Intervals

+Periodic Task Intervals

 

 
cleaning-interval

 

@@ -4960,7 +4960,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 
notify-delay

 

                   The delay, in seconds, between sending sets of notify
-                  messages for a zone.  The default is zero.
+                  messages for a zone.  The default is five (5) seconds.
                 

 

 
@@ -5210,7 +5210,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 
 

 

-Content Filtering

+Content Filtering

 

             BIND 9 provides the ability to filter
             out DNS responses from external DNS servers containing
@@ -5540,7 +5540,7 @@ deny-answer-aliases { "example.net"; };
 
 

 

-statistics-channels Statement Definition and
+statistics-channels Statement Definition and
             Usage

 

           The statistics-channels statement
@@ -5591,7 +5591,7 @@ deny-answer-aliases { "example.net"; };
 

 

 

-trusted-keys Statement Grammar

+trusted-keys Statement Grammar

 
trusted-keys {
     string number number number string ;
     [ string number number number string ; [...]]
@@ -5600,7 +5600,7 @@ deny-answer-aliases { "example.net"; };
 
 

 

-trusted-keys Statement Definition
+trusted-keys Statement Definition
             and Usage

 

             The trusted-keys statement defines
@@ -5640,7 +5640,7 @@ deny-answer-aliases { "example.net"; };
 

 

 

-managed-keys Statement Grammar

+managed-keys Statement Grammar

 
managed-keys {
     string initial-key number number number string ;
     [ string initial-key number number number string ; [...]]
@@ -5649,7 +5649,7 @@ deny-answer-aliases { "example.net"; };
 
 

 

-managed-keys Statement Definition
+managed-keys Statement Definition
             and Usage

 

             The managed-keys statement, like 
@@ -5775,7 +5775,7 @@ deny-answer-aliases { "example.net"; };
 

 

 

-view Statement Definition and Usage

+view Statement Definition and Usage

 

             The view statement is a powerful
             feature
@@ -6055,10 +6055,10 @@ zone zone_name [
 

 

-zone Statement Definition and Usage

+zone Statement Definition and Usage

 

 

-Zone Types

+Zone Types

 
@@ -6269,7 +6269,7 @@ zone zone_name [
 

 

-Class

+Class

 

               The zone's name may optionally be followed by a class. If
               a class is not specified, class IN (for Internet),
@@ -6291,7 +6291,7 @@ zone zone_name [
 

 

-Zone Options

+Zone Options

 

 
allow-notify

 

@@ -6962,7 +6962,7 @@ zone zone_name [
 

 

-Zone File

+Zone File

 

 

 Types of Resource Records and When to Use Them

@@ -6975,7 +6975,7 @@ zone zone_name [
 

 

-Resource Records

+Resource Records

 

               A domain name identifies a node.  Each node has a set of
               resource information, which may be empty.  The set of resource
@@ -7712,7 +7712,7 @@ zone zone_name [
 

 

-Textual expression of RRs

+Textual expression of RRs

 

               RRs are represented in binary form in the packets of the DNS
               protocol, and are usually represented in highly encoded form
@@ -7915,7 +7915,7 @@ zone zone_name [
 

 

-Discussion of MX Records

+Discussion of MX Records

 

             As described above, domain servers store information as a
             series of resource records, each of which contains a particular
@@ -8171,7 +8171,7 @@ zone zone_name [
 

 

-Inverse Mapping in IPv4

+Inverse Mapping in IPv4

 

             Reverse name resolution (that is, translation from IP address
             to name) is achieved by means of the in-addr.arpa domain
@@ -8232,7 +8232,7 @@ zone zone_name [
 

 

-Other Zone File Directives

+Other Zone File Directives

 

             The Master File Format was initially defined in RFC 1035 and
             has subsequently been extended. While the Master File Format
@@ -8247,7 +8247,7 @@ zone zone_name [
 

 

-The @ (at-sign)

+The @ (at-sign)

 

               When used in the label (or name) field, the asperand or
               at-sign (@) symbol represents the current origin.
@@ -8258,7 +8258,7 @@ zone zone_name [
 

 

-The $ORIGIN Directive

+The $ORIGIN Directive

 

               Syntax: $ORIGIN
               domain-name
@@ -8287,7 +8287,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 
 

 

-The $INCLUDE Directive

+The $INCLUDE Directive

 

               Syntax: $INCLUDE
               filename
@@ -8323,7 +8323,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 
 

 

-The $TTL Directive

+The $TTL Directive

 

               Syntax: $TTL
               default-ttl
@@ -8342,7 +8342,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
 
 

 

-BIND Master File Extension: the  $GENERATE Directive

+BIND Master File Extension: the  $GENERATE Directive

 

             Syntax: $GENERATE
             range
@@ -8766,7 +8766,7 @@ HOST-127.EXAMPLE. MX 0 .
           

 

 

-Name Server Statistics Counters

+Name Server Statistics Counters

 

 
 

@@ -9323,7 +9323,7 @@ HOST-127.EXAMPLE. MX 0 .
 

 

-Zone Maintenance Statistics Counters

+Zone Maintenance Statistics Counters

 
 

 
 
@@ -9477,7 +9477,7 @@ HOST-127.EXAMPLE. MX 0 .
 

 

-Resolver Statistics Counters

+Resolver Statistics Counters

 
 

 
 
@@ -9860,7 +9860,7 @@ HOST-127.EXAMPLE. MX 0 .
 

 

-Socket I/O Statistics Counters

+Socket I/O Statistics Counters

               Socket I/O statistics counters are defined per socket
               types, which are
@@ -10015,7 +10015,7 @@ HOST-127.EXAMPLE. MX 0 .
 
 

 

-Compatibility with BIND 8 Counters

+Compatibility with BIND 8 Counters

               Most statistics counters that were available
               in BIND 8 are also supported in
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 02d84d46..2742c2fb 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -46,10 +46,10 @@
 
Table of Contents

 
Access Control Lists

-
Chroot and Setuid

+
Chroot and Setuid

 

-
The chroot Environment

-
Using the setuid Function

+
The chroot Environment

+
Using the setuid Function

 

 
Dynamic Update Security

 

@@ -122,7 +122,7 @@ zone "example.com" {
 

 

-Chroot and Setuid
+Chroot and Setuid
 

 

           On UNIX servers, it is possible to run BIND
@@ -148,7 +148,7 @@ zone "example.com" {
         

 

 

-The chroot Environment

+The chroot Environment

             In order for a chroot environment
             to
@@ -176,7 +176,7 @@ zone "example.com" {
 
 

 

-Using the setuid Function

+Using the setuid Function

             Prior to running the named daemon,
             use
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index 578609e7..1aae0d76 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -45,18 +45,18 @@
 

 
Table of Contents

 

-
Common Problems

-
It's not working; how can I figure out what's wrong?

-
Incrementing and Changing the Serial Number

-
Where Can I Get Help?

+
Common Problems

+
It's not working; how can I figure out what's wrong?

+
Incrementing and Changing the Serial Number

+
Where Can I Get Help?

 

 

 

-Common Problems

+Common Problems

 

-It's not working; how can I figure out what's wrong?

+It's not working; how can I figure out what's wrong?

             The best solution to solving installation and
             configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
 
 

 

-Incrementing and Changing the Serial Number

+Incrementing and Changing the Serial Number

           Zone serial numbers are just numbers — they aren't
           date related.  A lot of people set them to a number that
@@ -95,7 +95,7 @@
 
 

 

-Where Can I Get Help?

+Where Can I Get Help?

           The Internet Systems Consortium
           (ISC) offers a wide range
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index a8e96f8a..50726b4e 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -45,21 +45,31 @@
 

 
Table of Contents

 

-
Acknowledgments

+
Acknowledgments

 
A Brief History of the DNS and BIND

-
General DNS Reference Information

+
General DNS Reference Information

 
IPv6 addresses (AAAA)

 
Bibliography (and Suggested Reading)

 

 
Request for Comments (RFCs)

 
Internet Drafts

-
Other Documents About BIND

+
Other Documents About BIND

+

+
BIND 9 DNS Library Support

+

+
Prerequisite

+
Compilation

+
Installation

+
Known Defects/Restrictions

+
The dns.conf File

+
Sample Applications

+
Library References

 

 

 

 

-Acknowledgments

+Acknowledgments

 

 A Brief History of the DNS and BIND
@@ -162,7 +172,7 @@
 

 

 

-General DNS Reference Information

+General DNS Reference Information

 

 

 IPv6 addresses (AAAA)

@@ -250,17 +260,17 @@
           

 

 

-Bibliography

+Bibliography

 
Standards

 

-
[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986. 

+
[RFC974] C. Partridge. Mail Routing and the Domain System. January 1986. 

 

 

-
[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987. 

+
[RFC1034] P.V. Mockapetris. Domain Names — Concepts and Facilities. November 1987. 

 

 

-
[RFC1035] P. V. Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V. Mockapetris. Domain Names — Implementation and
                   Specification. November 1987. 

 

 

@@ -268,42 +278,42 @@
 

 Proposed Standards

 

-
[RFC2181] R., R. Bush Elz. Clarifications to the DNS
+
[RFC2181] R., R. Bush Elz. Clarifications to the DNS
                   Specification. July 1997. 

 

 

-
[RFC2308] M. Andrews. Negative Caching of DNS
+
[RFC2308] M. Andrews. Negative Caching of DNS
                   Queries. March 1998. 

 

 

-
[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996. 

+
[RFC1995] M. Ohta. Incremental Zone Transfer in DNS. August 1996. 

 

 

-
[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996. 

+
[RFC1996] P. Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996. 

 

 

-
[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997. 

+
[RFC2136] P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. Dynamic Updates in the Domain Name System. April 1997. 

 

 

-
[RFC2671] P. Vixie. Extension Mechanisms for DNS (EDNS0). August 1997. 

+
[RFC2671] P. Vixie. Extension Mechanisms for DNS (EDNS0). August 1997. 

 

 

-
[RFC2672] M. Crawford. Non-Terminal DNS Name Redirection. August 1999. 

+
[RFC2672] M. Crawford. Non-Terminal DNS Name Redirection. August 1999. 

 

 

-
[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000. 

+
[RFC2845] P. Vixie, O. Gudmundsson, D. Eastlake, 3rd, and B. Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000. 

 

 

-
[RFC2930] D. Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000. 

+
[RFC2930] D. Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000. 

 

 

-
[RFC2931] D. Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000. 

+
[RFC2931] D. Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000. 

 

 

-
[RFC3007] B. Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000. 

+
[RFC3007] B. Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000. 

 

 

-
[RFC3645] S. Kwan, P. Garg, J. Gilroy, L. Esibov, J. Westhead, and R. Hall. Generic Security Service Algorithm for Secret
+
[RFC3645] S. Kwan, P. Garg, J. Gilroy, L. Esibov, J. Westhead, and R. Hall. Generic Security Service Algorithm for Secret
                        Key Transaction Authentication for DNS
                        (GSS-TSIG). October 2003. 

 

@@ -312,19 +322,19 @@
 

 DNS Security Proposed Standards

 

-
[RFC3225] D. Conrad. Indicating Resolver Support of DNSSEC. December 2001. 

+
[RFC3225] D. Conrad. Indicating Resolver Support of DNSSEC. December 2001. 

 

 

-
[RFC3833] D. Atkins and R. Austein. Threat Analysis of the Domain Name System (DNS). August 2004. 

+
[RFC3833] D. Atkins and R. Austein. Threat Analysis of the Domain Name System (DNS). August 2004. 

 

 

-
[RFC4033] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. DNS Security Introduction and Requirements. March 2005. 

+
[RFC4033] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. DNS Security Introduction and Requirements. March 2005. 

 

 

-
[RFC4034] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Resource Records for the DNS Security Extensions. March 2005. 

+
[RFC4034] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Resource Records for the DNS Security Extensions. March 2005. 

 

 

-
[RFC4035] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Protocol Modifications for the DNS
+
[RFC4035] R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. Protocol Modifications for the DNS
                        Security Extensions. March 2005. 

 

 
@@ -332,146 +342,146 @@
 
Other Important RFCs About DNS
                 Implementation

 

-
[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely
+
[RFC1535] E. Gavron. A Security Problem and Proposed Correction With Widely
                   Deployed DNS Software.. October 1993. 

 

 

-
[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation
+
[RFC1536] A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. Common DNS Implementation
                   Errors and Suggested Fixes. October 1993. 

 

 

-
[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996. 

+
[RFC1982] R. Elz and R. Bush. Serial Number Arithmetic. August 1996. 

 

 

-
[RFC4074] Y. Morishita and T. Jinmei. Common Misbehaviour Against DNS
+
[RFC4074] Y. Morishita and T. Jinmei. Common Misbehaviour Against DNS
                 Queries for IPv6 Addresses. May 2005. 

 

 
 

 
Resource Record Types

 

-
[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990. 

+
[RFC1183] C.F. Everhart, L. A. Mamakos, R. Ullmann, and P. Mockapetris. New DNS RR Definitions. October 1990. 

 

 

-
[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994. 

+
[RFC1706] B. Manning and R. Colella. DNS NSAP Resource Records. October 1994. 

 

 

-
[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R. Daniel and M. Mealling. Resolution of Uniform Resource Identifiers using
                   the Domain Name System. June 1997. 

 

 

-
[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the
+
[RFC1876] C. Davis, P. Vixie, T., and I. Dickinson. A Means for Expressing Location Information in the
                   Domain
                   Name System. January 1996. 

 

 

-
[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the
+
[RFC2052] A. Gulbrandsen and P. Vixie. A DNS RR for Specifying the
                   Location of
                   Services.. October 1996. 

 

 

-
[RFC2163] A. Allocchio. Using the Internet DNS to
+
[RFC2163] A. Allocchio. Using the Internet DNS to
                   Distribute MIXER
                   Conformant Global Address Mapping. January 1998. 

 

 

-
[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997. 

+
[RFC2230] R. Atkinson. Key Exchange Delegation Record for the DNS. October 1997. 

 

 

-
[RFC2536] D. Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. 

+
[RFC2536] D. Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. 

 

 

-
[RFC2537] D. Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. 

+
[RFC2537] D. Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. 

 

 

-
[RFC2538] D. Eastlake, 3rd and O. Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999. 

+
[RFC2538] D. Eastlake, 3rd and O. Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999. 

 

 

-
[RFC2539] D. Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. 

+
[RFC2539] D. Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. 

 

 

-
[RFC2540] D. Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999. 

+
[RFC2540] D. Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999. 

 

 

-
[RFC2782] A. Gulbrandsen. P. Vixie. L. Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000. 

+
[RFC2782] A. Gulbrandsen. P. Vixie. L. Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000. 

 

 

-
[RFC2915] M. Mealling. R. Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. 

+
[RFC2915] M. Mealling. R. Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. 

 

 

-
[RFC3110] D. Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. 

+
[RFC3110] D. Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. 

 

 

-
[RFC3123] P. Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. 

+
[RFC3123] P. Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. 

 

 

-
[RFC3596] S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. DNS Extensions to support IP
+
[RFC3596] S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. DNS Extensions to support IP
                   version 6. October 2003. 

 

 

-
[RFC3597] A. Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003. 

+
[RFC3597] A. Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003. 

 

 

 

 

 DNS and the Internet

 

-
[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names
+
[RFC1101] P. V. Mockapetris. DNS Encoding of Network Names
                   and Other Types. April 1989. 

 

 

-
[RFC1123] Braden. Requirements for Internet Hosts - Application and
+
[RFC1123] Braden. Requirements for Internet Hosts - Application and
                   Support. October 1989. 

 

 

-
[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994. 

+
[RFC1591] J. Postel. Domain Name System Structure and Delegation. March 1994. 

 

 

-
[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998. 

+
[RFC2317] H. Eidnes, G. de Groot, and P. Vixie. Classless IN-ADDR.ARPA Delegation. March 1998. 

 

 

-
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000. 

+
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000. 

 

 

-
[RFC2929] D. Eastlake, 3rd, E. Brunner-Williams, and B. Manning. Domain Name System (DNS) IANA Considerations. September 2000. 

+
[RFC2929] D. Eastlake, 3rd, E. Brunner-Williams, and B. Manning. Domain Name System (DNS) IANA Considerations. September 2000. 

 

 

 

 

 DNS Operations

 

-
[RFC1033] M. Lottor. Domain administrators operations guide.. November 1987. 

+
[RFC1033] M. Lottor. Domain administrators operations guide.. November 1987. 

 

 

-
[RFC1537] P. Beertema. Common DNS Data File
+
[RFC1537] P. Beertema. Common DNS Data File
                   Configuration Errors. October 1993. 

 

 

-
[RFC1912] D. Barr. Common DNS Operational and
+
[RFC1912] D. Barr. Common DNS Operational and
                   Configuration Errors. February 1996. 

 

 

-
[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996. 

+
[RFC2010] B. Manning and P. Vixie. Operational Criteria for Root Name Servers.. October 1996. 

 

 

-
[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for
+
[RFC2219] M. Hamilton and R. Wright. Use of DNS Aliases for
                   Network Services.. October 1997. 

 

 

 

 
Internationalized Domain Names

 

-
[RFC2825] IAB and R. Daigle. A Tangled Web: Issues of I18N, Domain Names,
+
[RFC2825] IAB and R. Daigle. A Tangled Web: Issues of I18N, Domain Names,
                        and the Other Internet protocols. May 2000. 

 

 

-
[RFC3490] P. Faltstrom, P. Hoffman, and A. Costello. Internationalizing Domain Names in Applications (IDNA). March 2003. 

+
[RFC3490] P. Faltstrom, P. Hoffman, and A. Costello. Internationalizing Domain Names in Applications (IDNA). March 2003. 

 

 

-
[RFC3491] P. Hoffman and M. Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. 

+
[RFC3491] P. Hoffman and M. Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. 

 

 

-
[RFC3492] A. Costello. Punycode: A Bootstring encoding of Unicode
+
[RFC3492] A. Costello. Punycode: A Bootstring encoding of Unicode
                        for Internationalized Domain Names in
                        Applications (IDNA). March 2003. 

 

@@ -487,47 +497,47 @@
                 

 

 

-
[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String
+
[RFC1464] R. Rosenbaum. Using the Domain Name System To Store Arbitrary String
                   Attributes. May 1993. 

 

 

-
[RFC1713] A. Romao. Tools for DNS Debugging. November 1994. 

+
[RFC1713] A. Romao. Tools for DNS Debugging. November 1994. 

 

 

-
[RFC1794] T. Brisco. DNS Support for Load
+
[RFC1794] T. Brisco. DNS Support for Load
                   Balancing. April 1995. 

 

 

-
[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997. 

+
[RFC2240] O. Vaughan. A Legal Basis for Domain Name Allocation. November 1997. 

 

 

-
[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998. 

+
[RFC2345] J. Klensin, T. Wolf, and G. Oglesby. Domain Names and Company Name Retrieval. May 1998. 

 

 

-
[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998. 

+
[RFC2352] O. Vaughan. A Convention For Using Legal Names as Domain Names. May 1998. 

 

 

-
[RFC3071] J. Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. 

+
[RFC3071] J. Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. 

 

 

-
[RFC3258] T. Hardie. Distributing Authoritative Name Servers via
+
[RFC3258] T. Hardie. Distributing Authoritative Name Servers via
                        Shared Unicast Addresses. April 2002. 

 

 

-
[RFC3901] A. Durand and J. Ihren. DNS IPv6 Transport Operational Guidelines. September 2004. 

+
[RFC3901] A. Durand and J. Ihren. DNS IPv6 Transport Operational Guidelines. September 2004. 

 

 
 

 
Obsolete and Unimplemented Experimental RFC

 

-
[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical
+
[RFC1712] C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. DNS Encoding of Geographical
                   Location. November 1994. 

 

 

-
[RFC2673] M. Crawford. Binary Labels in the Domain Name System. August 1999. 

+
[RFC2673] M. Crawford. Binary Labels in the Domain Name System. August 1999. 

 

 

-
[RFC2874] M. Crawford and C. Huitema. DNS Extensions to Support IPv6 Address Aggregation
+
[RFC2874] M. Crawford and C. Huitema. DNS Extensions to Support IPv6 Address Aggregation
                        and Renumbering. July 2000. 

 

 

@@ -541,39 +551,39 @@
                 

 
 

-
[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997. 

+
[RFC2065] D. Eastlake, 3rd and C. Kaufman. Domain Name System Security Extensions. January 1997. 

 

 

-
[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997. 

+
[RFC2137] D. Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997. 

 

 

-
[RFC2535] D. Eastlake, 3rd. Domain Name System Security Extensions. March 1999. 

+
[RFC2535] D. Eastlake, 3rd. Domain Name System Security Extensions. March 1999. 

 

 

-
[RFC3008] B. Wellington. Domain Name System Security (DNSSEC)
+
[RFC3008] B. Wellington. Domain Name System Security (DNSSEC)
                        Signing Authority. November 2000. 

 

 

-
[RFC3090] E. Lewis. DNS Security Extension Clarification on Zone Status. March 2001. 

+
[RFC3090] E. Lewis. DNS Security Extension Clarification on Zone Status. March 2001. 

 

 

-
[RFC3445] D. Massey and S. Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002. 

+
[RFC3445] D. Massey and S. Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002. 

 

 

-
[RFC3655] B. Wellington and O. Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003. 

+
[RFC3655] B. Wellington and O. Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003. 

 

 

-
[RFC3658] O. Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003. 

+
[RFC3658] O. Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003. 

 

 

-
[RFC3755] S. Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. 

+
[RFC3755] S. Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. 

 

 

-
[RFC3757] O. Kolkman, J. Schlyter, and E. Lewis. Domain Name System KEY (DNSKEY) Resource Record
+
[RFC3757] O. Kolkman, J. Schlyter, and E. Lewis. Domain Name System KEY (DNSKEY) Resource Record
                       (RR) Secure Entry Point (SEP) Flag. April 2004. 

 

 

-
[RFC3845] J. Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. 

+
[RFC3845] J. Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. 

 

 
 
@@ -594,16 +604,481 @@
 
 

 

-Other Documents About BIND
+Other Documents About BIND
 

 

 

 

-Bibliography

+Bibliography

 

-
Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. 

+
Paul Albitz and Cricket Liu. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. 

+

+
+
+
+

+

+BIND 9 DNS Library Support

+
This version of BIND 9 "exports" its internal libraries so
+  that they can be used by third-party applications more easily (we
+  call them "export" libraries in this document). In addition to
+  all major DNS-related APIs BIND 9 is currently using, the export
+  libraries provide the following features:

+
    
+
  • The newly created "DNS client" module. This is a higher
+      level API that provides an interface to name resolution,
+      single DNS transaction with a particular server, and dynamic
+      update. Regarding name resolution, it supports advanced
+      features such as DNSSEC validation and caching. This module
+      supports both synchronous and asynchronous mode.
    • 
+
  • The new "IRS" (Information Retrieval System) library.
+      It provides an interface to parse the traditional resolv.conf
+      file and more advanced, DNS-specific configuration file for
+      the rest of this package (see the description for the
+      dns.conf file below).
    • 
+
  • As part of the IRS library, newly implemented standard
+      address-name mapping functions, getaddrinfo() and
+      getnameinfo(), are provided. They use the DNSSEC-aware
+      validating resolver backend, and could use other advanced
+      features of the BIND 9 libraries such as caching. The
+      getaddrinfo() function resolves both A and AAAA RRs
+      concurrently (when the address family is unspecified).
    • 
+
  • An experimental framework to support other event
+      libraries than BIND 9's internal event task system.
    • 
+

+

+

+Prerequisite

+
GNU make is required to build the export libraries (other
+  part of BIND 9 can still be built with other types of make). In
+  the reminder of this document, "make" means GNU make. Note that
+  in some platforms you may need to invoke a different command name
+  than "make" (e.g. "gmake") to indicate it's GNU make.

+

+

+

+Compilation

+
+$ ./configure --enable-exportlib [other flags]
+$ make
+

+

+  This will create (in addition to usual BIND 9 programs) and a
+  separate set of libraries under the lib/export directory. For
+  example, lib/export/dns/libdns.a is the archive file of the
+  export version of the BIND 9 DNS library. Sample application
+  programs using the libraries will also be built under the
+  lib/export/samples directory (see below).

+

+

+

+Installation

+
+$ cd lib/export
+$ make install
+

+

+  This will install library object files under the directory
+  specified by the --with-export-libdir configure option (default:
+  EPREFIX/lib/bind9), and header files under the directory
+  specified by the --with-export-includedir configure option
+  (default: PREFIX/include/bind9).
+  Root privilege is normally required.
+  "make install" at the top directory will do the
+  same.
+  

+

+  To see how to build your own
+  application after the installation, see
+  lib/export/samples/Makefile-postinstall.in.

+

+

+

+Known Defects/Restrictions

+
    
+
  • Currently, win32 is not supported for the export
+      library. (Normal BIND 9 application can be built as
+      before).
    • 
+
  • 
+
    The "fixed" RRset order is not (currently) supported in
+      the export library. If you want to use "fixed" RRset order
+      for, e.g. named while still building the
+      export library even without the fixed order support, build
+      them separately:
+      
    
+
    +$ ./configure --enable-fixed-rrset [other flags, but not --enable-exportlib]
+$ make
+$ ./configure --enable-exportlib [other flags, but not --enable-fixed-rrset]
+$ cd lib/export
+$ make
+
    
+
    
+    
    
+
    • 
+
  • The client module and the IRS library currently do not
+      support DNSSEC validation using DLV (the underlying modules
+      can handle it, but there is no tunable interface to enable
+      the feature).
    • 
+
  • RFC 5011 is not supported in the validating stub
+      resolver of the export library. In fact, it is not clear
+      whether it should: trust anchors would be a system-wide
+      configuration which would be managed by an administrator,
+      while the stub resolver will be used by ordinary applications
+      run by a normal user.
    • 
+
  • Not all common /etc/resolv.conf
+      options are supported
+      in the IRS library. The only available options in this
+      version are "debug" and "ndots".
    • 
+

+

+

+

+The dns.conf File

+
The IRS library supports an "advanced" configuration file
+  related to the DNS library for configuration parameters that
+  would be beyond the capability of the
+  resolv.conf file.
+  Specifically, it is intended to provide DNSSEC related
+  configuration parameters. By default the path to this
+  configuration file is /etc/dns.conf.
+  This module is very
+  experimental and the configuration syntax or library interfaces
+  may change in future versions. Currently, only the
+  trusted-keys
+  statement is supported, whose syntax is the same as the same name
+  of statement for named.conf. (See
+  the section called “trusted-keys Statement Grammar” for details.)

+

+

+

+Sample Applications

+
Some sample application programs using this API are
+  provided for reference. The following is a brief description of
+  these applications.
+  

+

+

+sample: a simple stub resolver utility

+

+  It sends a query of a given name (of a given optional RR type) to a
+  specified recursive server, and prints the result as a list of
+  RRs. It can also act as a validating stub resolver if a trust
+  anchor is given via a set of command line options.

+

+  Usage: sample [options] server_address hostname
+  

+

+  Options and Arguments:
+  

+

+

+  -t RRtype
+  

+

+        specify the RR type of the query.  The default is the A RR.
+  

+

+  [-a algorithm] [-e] -k keyname -K keystring
+  

+

+

+        specify a command-line DNS key to validate the answer.  For
+        example, to specify the following DNSKEY of example.com:
+

+


+                example.com. 3600 IN DNSKEY 257 3 5 xxx

+

+

+        specify the options as follows:
+

+
+
+          -e -k example.com -K "xxx"
+
+

+

+        -e means that this key is a zone's "key signing key" (as known
+        as "secure Entry point").
+        When -a is omitted rsasha1 will be used by default.
+  

+

+

+  -s domain:alt_server_address
+  

+

+         specify a separate recursive server address for the specific
+        "domain".  Example: -s example.com:2001:db8::1234
+  

+
server_address

+

+        an IP(v4/v6) address of the recursive server to which queries
+        are sent.
+  

+
hostname

+

+        the domain name for the query
+  

+

+

+

+

+sample-async: a simple stub resolver, working asynchronously

+

+  Similar to "sample", but accepts a list
+  of (query) domain names as a separate file and resolves the names
+  asynchronously.

+

+    Usage: sample-async [-s server_address] [-t RR_type] input_file

+

+ Options and Arguments:
+  

+

+

+   -s server_address
+   

+

+   an IPv4 address of the recursive server to which queries are sent.
+  (IPv6 addresses are not supported in this implementation)
+  

+

+   -t RR_type
+  

+

+  specify the RR type of the queries. The default is the A
+  RR.
+  

+

+   input_file
+  

+

+   a list of domain names to be resolved. each line
+  consists of a single domain name. Example:
+  


+  www.example.com

+  mx.examle.net

+  ns.xxx.example

+

+

+

+

+

+

+sample-request: a simple DNS transaction client

+

+  It sends a query to a specified server, and
+  prints the response with minimal processing. It doesn't act as a
+  "stub resolver": it stops the processing once it gets any
+  response from the server, whether it's a referral or an alias
+  (CNAME or DNAME) that would require further queries to get the
+  ultimate answer. In other words, this utility acts as a very
+  simplified dig.
+  

+

+  Usage: sample-request [-t RRtype] server_address hostname
+  

+

+    Options and Arguments:
+  

+

+

+   -t RRtype
+  

+

+  specify the RR type of
+  the queries. The default is the A RR.
+  

+

+  server_address
+  

+

+   an IP(v4/v6)
+  address of the recursive server to which the query is sent.
+  

+

+  hostname
+  

+

+  the domain name for the query
+  

+

+

+

+

+sample-gai: getaddrinfo() and getnameinfo() test code

+

+  This is a test program
+  to check getaddrinfo() and getnameinfo() behavior. It takes a
+  host name as an argument, calls getaddrinfo() with the given host
+  name, and calls getnameinfo() with the resulting IP addresses
+  returned by getaddrinfo(). If the dns.conf file exists and
+  defines a trust anchor, the underlying resolver will act as a
+  validating resolver, and getaddrinfo()/getnameinfo() will fail
+  with an EAI_INSECUREDATA error when DNSSEC validation fails.
+  

+

+  Usage: sample-gai hostname
+  

+

+

+

+sample-update: a simple dynamic update client program

+

+  It accepts a single update command as a
+  command-line argument, sends an update request message to the
+  authoritative server, and shows the response from the server. In
+  other words, this is a simplified nsupdate.
+  

+

+   Usage: sample-update [options] (add|delete) "update data"
+  

+

+  Options and Arguments:
+  

+

+

+  -a auth_server
+   

+

+        An IP address of the authoritative server that has authority
+        for the zone containing the update name.  This should normally
+        be the primary authoritative server that accepts dynamic
+        updates.  It can also be a secondary server that is configured
+        to forward update requests to the primary server.
+   

+

+  -k keyfile
+   

+

+        A TSIG key file to secure the update transaction.  The keyfile
+        format is the same as that for the nsupdate utility.
+   

+

+  -p prerequisite
+   

+

+        A prerequisite for the update (only one prerequisite can be
+        specified).  The prerequisite format is the same as that is
+        accepted by the nsupdate utility.
+   

+

+  -r recursive_server
+   

+

+        An IP address of a recursive server that this utility will
+        use.  A recursive server may be necessary to identify the
+        authoritative server address to which the update request is
+        sent.
+   

+

+  -z zonename
+   

+

+        The domain name of the zone that contains
+   

+

+  (add|delete)
+   

+

+        Specify the type of update operation.  Either "add" or "delete"
+        must be specified.
+   

+

+  "update data"
+   

+

+        Specify the data to be updated.  A typical example of the data
+        would look like "name TTL RRtype RDATA".
+  

+

+

+
Note
In practice, either -a or -r must be specified.  Others can
+   be optional; the underlying library routine tries to identify the
+   appropriate server and the zone name for the update.

+

+   Examples: assuming the primary authoritative server of the
+   dynamic.example.com zone has an IPv6 address 2001:db8::1234,
+   

+
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"

+

+     adds an A RR for foo.dynamic.example.com using the given key.
+   

+
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"

+

+     removes all A RRs for foo.dynamic.example.com using the given key.
+   

+
   
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"

+

+     removes all RRs for foo.dynamic.example.com using the given key.
+   

+

+

+

+nsprobe: domain/name server checker in terms of RFC 4074

+

+  It checks a set
+  of domains to see the name servers of the domains behave
+  correctly in terms of RFC 4074. This is included in the set of
+  sample programs to show how the export library can be used in a
+  DNS-related application.
+  

+

+ Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
+  

+

+   Options
+  

+

+

+  -d
+  

+

+        run in the "debug" mode.  with this option nsprobe will dump
+        every RRs it receives.
+  

+

+  -v
+  

+

+        increase verbosity of other normal log messages.  This can be
+        specified multiple times
+  

+

+  -c cache_address
+  

+

+        specify an IP address of a recursive (caching) name server.
+        nsprobe uses this server to get the NS RRset of each domain and
+        the A and/or AAAA RRsets for the name servers.  The default
+        value is 127.0.0.1.
+  

+

+  input_file
+  

+

+        a file name containing a list of domain (zone) names to be
+        probed.  when omitted the standard input will be used.  Each
+        line of the input file specifies a single domain name such as
+        "example.com".  In general this domain name must be the apex
+        name of some DNS zone (unlike normal "host names" such as
+        "www.example.com").  nsprobe first identifies the NS RRsets for
+        the given domain name, and sends A and AAAA queries to these
+        servers for some "widely used" names under the zone;
+        specifically, adding "www" and "ftp" to the zone name.
+  

+

 

 

+

+

+Library References

+
As of this writing, there is no formal "manual" of the
+  libraries, except this document, header files (some of them
+  provide pretty detailed explanations), and sample application
+  programs.

 

 

 
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index c66282bc..533f113c 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -111,15 +111,43 @@
 
Signing the Zone

 
Configuring Servers

 
-
IPv6 Support in BIND 9

+
DNSSEC, Dynamic Zones, and Automatic Signing

 

-
Address Lookups Using AAAA Records

-
Address to Name Lookups Using Nibble Format

+
Converting from insecure to secure

+
Dynamic DNS update method

+
Fully automatic zone signing

+
Private-type records

+
DNSKEY rollovers via UPDATE

+
NSEC3PARAM rollovers via UPDATE

+
Converting from NSEC to NSEC3

+
Converting from NSEC3 to NSEC

+
Converting from secure to insecure

+
Periodic re-signing

+
NSEC3 and OPTOUT

+

+
Dynamic Trust Anchor Management

+

+
Validating Resolver

+
Authoritative Server

+

+
PKCS #11 (Cryptoki) support

+

+
Prerequisites

+
Building BIND 9 with PKCS#11

+
PKCS #11 Tools

+
Using the HSM

+
Specifying the engine on the command line

+
Running named with automatic zone re-signing

+

+
IPv6 Support in BIND 9

+

+
Address Lookups Using AAAA Records

+
Address to Name Lookups Using Nibble Format

 

 
 
5. The BIND 9 Lightweight Resolver

 

-
The Lightweight Resolver Library

+
The Lightweight Resolver Library

 
Running a Resolver Daemon

 

 
6. BIND 9 Configuration Reference

@@ -127,58 +155,58 @@
 
Configuration File Elements

 

 
Address Match Lists

-
Comment Syntax

+
Comment Syntax

 

 
Configuration File Grammar

 

-
acl Statement Grammar

+
acl Statement Grammar

 
acl Statement Definition and
           Usage

-
controls Statement Grammar

+
controls Statement Grammar

 
controls Statement Definition and
           Usage

-
include Statement Grammar

-
include Statement Definition and
+
include Statement Grammar

+
include Statement Definition and
           Usage

-
key Statement Grammar

-
key Statement Definition and Usage

-
logging Statement Grammar

-
logging Statement Definition and
+
key Statement Grammar

+
key Statement Definition and Usage

+
logging Statement Grammar

+
logging Statement Definition and
           Usage

-
lwres Statement Grammar

-
lwres Statement Definition and Usage

-
masters Statement Grammar

-
masters Statement Definition and
+
lwres Statement Grammar

+
lwres Statement Definition and Usage

+
masters Statement Grammar

+
masters Statement Definition and
           Usage

-
options Statement Grammar

+
options Statement Grammar

 
options Statement Definition and
           Usage

 
server Statement Grammar

 
server Statement Definition and
             Usage

 
statistics-channels Statement Grammar

-
statistics-channels Statement Definition and
+
statistics-channels Statement Definition and
             Usage

-
trusted-keys Statement Grammar

-
trusted-keys Statement Definition
+
trusted-keys Statement Grammar

+
trusted-keys Statement Definition
             and Usage

-
managed-keys Statement Grammar

-
managed-keys Statement Definition
+
managed-keys Statement Grammar

+
managed-keys Statement Definition
             and Usage

 
view Statement Grammar

-
view Statement Definition and Usage

+
view Statement Definition and Usage

 
zone
             Statement Grammar

-
zone Statement Definition and Usage

+
zone Statement Definition and Usage

 

-
Zone File

+
Zone File

 

 
Types of Resource Records and When to Use Them

-
Discussion of MX Records

+
Discussion of MX Records

 
Setting TTLs

-
Inverse Mapping in IPv4

-
Other Zone File Directives

-
BIND Master File Extension: the  $GENERATE Directive

+
Inverse Mapping in IPv4

+
Other Zone File Directives

+
BIND Master File Extension: the  $GENERATE Directive

 
Additional File Formats

 

 
BIND9 Statistics

@@ -187,31 +215,41 @@
 
7. BIND 9 Security Considerations

 

 
Access Control Lists

-
Chroot and Setuid

+
Chroot and Setuid

 

-
The chroot Environment

-
Using the setuid Function

+
The chroot Environment

+
Using the setuid Function

 

 
Dynamic Update Security

 

 
8. Troubleshooting

 

-
Common Problems

-
It's not working; how can I figure out what's wrong?

-
Incrementing and Changing the Serial Number

-
Where Can I Get Help?

+
Common Problems

+
It's not working; how can I figure out what's wrong?

+
Incrementing and Changing the Serial Number

+
Where Can I Get Help?

 

 
A. Appendices

 

-
Acknowledgments

+
Acknowledgments

 
A Brief History of the DNS and BIND

-
General DNS Reference Information

+
General DNS Reference Information

 
IPv6 addresses (AAAA)

 
Bibliography (and Suggested Reading)

 

 
Request for Comments (RFCs)

 
Internet Drafts

-
Other Documents About BIND

+
Other Documents About BIND

+

+
BIND 9 DNS Library Support

+

+
Prerequisite

+
Compilation

+
Installation

+
Known Defects/Restrictions

+
The dns.conf File

+
Sample Applications

+
Library References

 

 

 
I. Manual pages

diff --git a/doc/arm/dnssec.xml b/doc/arm/dnssec.xml
new file mode 100644
index 00000000..8dca8be7
--- /dev/null
+++ b/doc/arm/dnssec.xml
@@ -0,0 +1,244 @@
+
+
+
+
+
+
+  DNSSEC, Dynamic Zones, and Automatic Signing
+  As of BIND 9.7.0 it is possible to change a dynamic zone
+  from insecure to signed and back again. A secure zone can use
+  either NSEC or NSEC3 chains.
+  
+    Converting from insecure to secure
+  
+  Changing a zone from insecure to secure can be done in two
+  ways: using a dynamic DNS update, or the 
+  auto-dnssec zone option.
+  For either method, you need to configure 
+  named so that it can see the 
+  K* files which contain the public and private
+  parts of the keys that will be used to sign the zone. These files
+  will have been generated by 
+  dnssec-keygen. You can do this by placing them
+  in the key-directory, as specified in 
+  named.conf:
+  
+        zone example.net {
+                type master;
+                update-policy local;
+                file "dynamic/example.net/example.net";
+                key-directory "dynamic/example.net";
+        };
+
+  If one KSK and one ZSK DNSKEY key have been generated, this
+  configuration will cause all records in the zone to be signed
+  with the ZSK, and the DNSKEY RRset to be signed with the KSK as
+  well. An NSEC chain will be generated as part of the initial
+  signing process.
+  
+    Dynamic DNS update method
+  
+  To insert the keys via dynamic update:
+  
+        % nsupdate
+        > ttl 3600
+        > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
+        > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
+        > send
+
+  While the update request will complete almost immediately,
+  the zone will not be completely signed until 
+  named has had time to walk the zone and
+  generate the NSEC and RRSIG records. The NSEC record at the apex
+  will be added last, to signal that there is a complete NSEC
+  chain.
+  If you wish to sign using NSEC3 instead of NSEC, you should
+  add an NSEC3PARAM record to the initial update request. If you
+  wish the NSEC3 chain to have the OPTOUT bit set, set it in the
+  flags field of the NSEC3PARAM record.
+  
+        % nsupdate
+        > ttl 3600
+        > update add example.net DNSKEY 256 3 7 AwEAAZn17pUF0KpbPA2c7Gz76Vb18v0teKT3EyAGfBfL8eQ8al35zz3Y I1m/SAQBxIqMfLtIwqWPdgthsu36azGQAX8=
+        > update add example.net DNSKEY 257 3 7 AwEAAd/7odU/64o2LGsifbLtQmtO8dFDtTAZXSX2+X3e/UNlq9IHq3Y0 XtC0Iuawl/qkaKVxXe2lo8Ct+dM6UehyCqk=
+        > update add example.net NSEC3PARAM 1 1 100 1234567890
+        > send
+
+  Again, this update request will complete almost
+  immediately; however, the record won't show up until 
+  named has had a chance to build/remove the
+  relevant chain. A private type record will be created to record
+  the state of the operation (see below for more details), and will
+  be removed once the operation completes.
+  While the initial signing and NSEC/NSEC3 chain generation
+  is happening, other updates are possible as well.
+  
+    Fully automatic zone signing
+  
+  To enable automatic signing, add the 
+  auto-dnssec option to the zone statement in 
+  named.conf. 
+  auto-dnssec has two possible arguments: 
+  allow or 
+  maintain.
+  With 
+  auto-dnssec allow, 
+  named can search the key directory for keys
+  matching the zone, insert them into the zone, and use them to
+  sign the zone. It will do so only when it receives an 
+  rndc sign <zonename> command.
+  
+  
+  auto-dnssec maintain includes the above
+  functionality, but will also automatically adjust the zone's
+  DNSKEY records on schedule according to the keys' timing metadata.
+  (See  and
+   for more information.) 
+  If keys are present in the key directory the first time the zone
+  is loaded, it will be signed immediately, without waiting for an 
+  rndc sign command. (This command can still be
+  used for unscheduled key changes, however.)
+  Using the 
+  auto-dnssec option requires the zone to be
+  configured to allow dynamic updates, by adding an 
+  allow-update or 
+  update-policy statement to the zone
+  configuration. If this has not been done, the configuration will
+  fail.
+  
+    Private-type records
+  
+  The state of the signing process is signaled by
+  private-type records (with a default type value of 65534). When
+  signing is complete, these records will have a nonzero value for
+  the final octet (for those records which have a nonzero initial
+  octet).
+  The private type record format: If the first octet is
+  non-zero then the record indicates that the zone needs to be
+  signed with the key matching the record, or that all signatures
+  that match the record should be removed.
+  
+    
+
+  algorithm (octet 1)
+  key id in network order (octet 2 and 3)
+  removal flag (octet 4)
+  complete flag (octet 5)
+
+  
+  Only records flagged as "complete" can be removed via
+  dynamic update. Attempts to remove other private type records
+  will be silently ignored.
+  If the first octet is zero (this is a reserved algorithm
+  number that should never appear in a DNSKEY record) then the
+  record indicates changes to the NSEC3 chains are in progress. The
+  rest of the record contains an NSEC3PARAM record. The flag field
+  tells what operation to perform based on the flag bits.
+  
+    
+
+  0x01 OPTOUT
+  0x80 CREATE
+  0x40 REMOVE
+  0x20 NONSEC
+
+  
+  
+    DNSKEY rollovers via UPDATE
+  
+  It is possible to perform key rollovers via dynamic update.
+  You need to add the 
+  K* files for the new keys so that 
+  named can find them. You can then add the new
+  DNSKEY RRs via dynamic update. 
+  named will then cause the zone to be signed
+  with the new keys. When the signing is complete the private type
+  records will be updated so that the last octet is non
+  zero.
+  If this is for a KSK you need to inform the parent and any
+  trust anchor repositories of the new KSK.
+  You should then wait for the maximum TTL in the zone before
+  removing the old DNSKEY. If it is a KSK that is being updated,
+  you also need to wait for the DS RRset in the parent to be
+  updated and its TTL to expire. This ensures that all clients will
+  be able to verify at least one signature when you remove the old
+  DNSKEY.
+  The old DNSKEY can be removed via UPDATE. Take care to
+  specify the correct key. 
+  named will clean out any signatures generated
+  by the old key after the update completes.
+  
+    NSEC3PARAM rollovers via UPDATE
+  
+  Add the new NSEC3PARAM record via dynamic update. When the
+  new NSEC3 chain has been generated, the NSEC3PARAM flag field
+  will be zero. At this point you can remove the old NSEC3PARAM
+  record. The old chain will be removed after the update request
+  completes.
+  
+    Converting from NSEC to NSEC3
+  
+  To do this, you just need to add an NSEC3PARAM record. When
+  the conversion is complete, the NSEC chain will have been removed
+  and the NSEC3PARAM record will have a zero flag field. The NSEC3
+  chain will be generated before the NSEC chain is
+  destroyed.
+  
+    Converting from NSEC3 to NSEC
+  
+  To do this, use nsupdate to
+  remove all NSEC3PARAM records with a zero flag
+  field. The NSEC chain will be generated before the NSEC3 chain is
+  removed.
+  
+    Converting from secure to insecure
+  
+  To convert a signed zone to unsigned using dynamic DNS,
+  delete all the DNSKEY records from the zone apex using
+  nsupdate. All signatures, NSEC or NSEC3 chains,
+  and associated NSEC3PARAM records will be removed automatically.
+  This will take place after the update request completes.
+   This requires the 
+  dnssec-secure-to-insecure option to be set to 
+  yes in 
+  named.conf.
+  In addition, if the auto-dnssec maintain
+  zone statement is used, it should be removed or changed to
+  allow instead (or it will re-sign).
+  
+  
+    Periodic re-signing
+  
+  In any secure zone which supports dynamic updates, named
+  will periodically re-sign RRsets which have not been re-signed as
+  a result of some update action. The signature lifetimes will be
+  adjusted so as to spread the re-sign load over time rather than
+  all at once.
+  
+    NSEC3 and OPTOUT
+  
+  
+  named only supports creating new NSEC3 chains
+  where all the NSEC3 records in the zone have the same OPTOUT
+  state. 
+  named supports UPDATES to zones where the NSEC3
+  records in the chain have mixed OPTOUT state. 
+  named does not support changing the OPTOUT
+  state of an individual NSEC3 record, the entire chain needs to be
+  changed if the OPTOUT state of an individual NSEC3 needs to be
+  changed.
+
diff --git a/doc/arm/libdns.xml b/doc/arm/libdns.xml
new file mode 100644
index 00000000..5c2022f1
--- /dev/null
+++ b/doc/arm/libdns.xml
@@ -0,0 +1,530 @@
+
+
+
+
+  BIND 9 DNS Library Support
+  This version of BIND 9 "exports" its internal libraries so
+  that they can be used by third-party applications more easily (we
+  call them "export" libraries in this document). In addition to
+  all major DNS-related APIs BIND 9 is currently using, the export
+  libraries provide the following features:
+  
+    
+      The newly created "DNS client" module. This is a higher
+      level API that provides an interface to name resolution,
+      single DNS transaction with a particular server, and dynamic
+      update. Regarding name resolution, it supports advanced
+      features such as DNSSEC validation and caching. This module
+      supports both synchronous and asynchronous mode.
+    
+    
+      The new "IRS" (Information Retrieval System) library.
+      It provides an interface to parse the traditional resolv.conf
+      file and more advanced, DNS-specific configuration file for
+      the rest of this package (see the description for the
+      dns.conf file below).
+    
+    
+      As part of the IRS library, newly implemented standard
+      address-name mapping functions, getaddrinfo() and
+      getnameinfo(), are provided. They use the DNSSEC-aware
+      validating resolver backend, and could use other advanced
+      features of the BIND 9 libraries such as caching. The
+      getaddrinfo() function resolves both A and AAAA RRs
+      concurrently (when the address family is unspecified).
+    
+    
+      An experimental framework to support other event
+      libraries than BIND 9's internal event task system.
+    
+  
+  
+    Prerequisite
+  GNU make is required to build the export libraries (other
+  part of BIND 9 can still be built with other types of make). In
+  the reminder of this document, "make" means GNU make. Note that
+  in some platforms you may need to invoke a different command name
+  than "make" (e.g. "gmake") to indicate it's GNU make.
+  
+  
+    Compilation
+  
+$ ./configure --enable-exportlib [other flags]
+$ make
+
+  
+  This will create (in addition to usual BIND 9 programs) and a
+  separate set of libraries under the lib/export directory. For
+  example, lib/export/dns/libdns.a is the archive file of the
+  export version of the BIND 9 DNS library. Sample application
+  programs using the libraries will also be built under the
+  lib/export/samples directory (see below).
+  
+  
+    Installation
+  
+$ cd lib/export
+$ make install
+
+  
+  This will install library object files under the directory
+  specified by the --with-export-libdir configure option (default:
+  EPREFIX/lib/bind9), and header files under the directory
+  specified by the --with-export-includedir configure option
+  (default: PREFIX/include/bind9).
+  Root privilege is normally required.
+  "make install" at the top directory will do the
+  same.
+  
+  
+  To see how to build your own
+  application after the installation, see
+  lib/export/samples/Makefile-postinstall.in.
+  
+  
+    Known Defects/Restrictions
+  
+    
+
+      Currently, win32 is not supported for the export
+      library. (Normal BIND 9 application can be built as
+      before).
+    
+    
+      The "fixed" RRset order is not (currently) supported in
+      the export library. If you want to use "fixed" RRset order
+      for, e.g. named while still building the
+      export library even without the fixed order support, build
+      them separately:
+      
+$ ./configure --enable-fixed-rrset [other flags, but not --enable-exportlib]
+$ make
+$ ./configure --enable-exportlib [other flags, but not --enable-fixed-rrset]
+$ cd lib/export
+$ make
+
+    
+    
+    
+      The client module and the IRS library currently do not
+      support DNSSEC validation using DLV (the underlying modules
+      can handle it, but there is no tunable interface to enable
+      the feature).
+    
+    
+      RFC 5011 is not supported in the validating stub
+      resolver of the export library. In fact, it is not clear
+      whether it should: trust anchors would be a system-wide
+      configuration which would be managed by an administrator,
+      while the stub resolver will be used by ordinary applications
+      run by a normal user.
+    
+    
+      Not all common /etc/resolv.conf
+      options are supported
+      in the IRS library. The only available options in this
+      version are "debug" and "ndots".
+    
+  
+  
+  
+    The dns.conf File
+  The IRS library supports an "advanced" configuration file
+  related to the DNS library for configuration parameters that
+  would be beyond the capability of the
+  resolv.conf file.
+  Specifically, it is intended to provide DNSSEC related
+  configuration parameters. By default the path to this
+  configuration file is /etc/dns.conf.
+  This module is very
+  experimental and the configuration syntax or library interfaces
+  may change in future versions. Currently, only the
+  trusted-keys
+  statement is supported, whose syntax is the same as the same name
+  of statement for named.conf. (See
+   for details.)
+  
+  
+    Sample Applications
+  Some sample application programs using this API are
+  provided for reference. The following is a brief description of
+  these applications.
+  
+  
+    sample: a simple stub resolver utility
+  
+  It sends a query of a given name (of a given optional RR type) to a
+  specified recursive server, and prints the result as a list of
+  RRs. It can also act as a validating stub resolver if a trust
+  anchor is given via a set of command line options.
+  
+  Usage: sample [options] server_address hostname
+  
+  
+  Options and Arguments:
+  
+  
+  
+  
+  -t RRtype
+  
+  
+        specify the RR type of the query.  The default is the A RR.
+  
+  
+  
+  
+  [-a algorithm] [-e] -k keyname -K keystring
+  
+  
+        specify a command-line DNS key to validate the answer.  For
+        example, to specify the following DNSKEY of example.com:
+
+                example.com. 3600 IN DNSKEY 257 3 5 xxx
+
+        specify the options as follows:
+
+
+          -e -k example.com -K "xxx"
+
+
+        -e means that this key is a zone's "key signing key" (as known
+        as "secure Entry point").
+        When -a is omitted rsasha1 will be used by default.
+  
+  
+  
+  
+  -s domain:alt_server_address
+  
+  
+         specify a separate recursive server address for the specific
+        "domain".  Example: -s example.com:2001:db8::1234
+  
+  
+  
+  server_address
+  
+        an IP(v4/v6) address of the recursive server to which queries
+        are sent.
+  
+  
+  
+  hostname
+  
+        the domain name for the query
+  
+  
+  
+  
+  
+    sample-async: a simple stub resolver, working asynchronously
+  
+  Similar to "sample", but accepts a list
+  of (query) domain names as a separate file and resolves the names
+  asynchronously.
+  
+    Usage: sample-async [-s server_address] [-t RR_type] input_file
+  
+ Options and Arguments:
+  
+  
+  
+   
+   -s server_address
+   
+  
+   an IPv4 address of the recursive server to which queries are sent.
+  (IPv6 addresses are not supported in this implementation)
+  
+  
+  
+  
+   -t RR_type
+  
+  
+  specify the RR type of the queries. The default is the A
+  RR.
+  
+  
+  
+  
+   input_file
+  
+  
+   a list of domain names to be resolved. each line
+  consists of a single domain name. Example:
+  
+  www.example.com
+  mx.examle.net
+  ns.xxx.example
+
+  
+    
+    
+  
+  
+    sample-request: a simple DNS transaction client
+  
+  It sends a query to a specified server, and
+  prints the response with minimal processing. It doesn't act as a
+  "stub resolver": it stops the processing once it gets any
+  response from the server, whether it's a referral or an alias
+  (CNAME or DNAME) that would require further queries to get the
+  ultimate answer. In other words, this utility acts as a very
+  simplified dig.
+  
+  
+  Usage: sample-request [-t RRtype] server_address hostname
+  
+  
+    Options and Arguments:
+  
+  
+  
+   
+   -t RRtype
+  
+  
+  
+  specify the RR type of
+  the queries. The default is the A RR.
+  
+  
+  
+  
+  
+  server_address
+  
+  
+  
+   an IP(v4/v6)
+  address of the recursive server to which the query is sent.
+  
+  
+  
+  
+  
+  hostname
+  
+  
+  
+  the domain name for the query
+  
+  
+  
+  
+  
+  
+    sample-gai: getaddrinfo() and getnameinfo() test code
+  
+  This is a test program
+  to check getaddrinfo() and getnameinfo() behavior. It takes a
+  host name as an argument, calls getaddrinfo() with the given host
+  name, and calls getnameinfo() with the resulting IP addresses
+  returned by getaddrinfo(). If the dns.conf file exists and
+  defines a trust anchor, the underlying resolver will act as a
+  validating resolver, and getaddrinfo()/getnameinfo() will fail
+  with an EAI_INSECUREDATA error when DNSSEC validation fails.
+  
+  
+  Usage: sample-gai hostname
+  
+  
+  
+    sample-update: a simple dynamic update client program
+  
+  It accepts a single update command as a
+  command-line argument, sends an update request message to the
+  authoritative server, and shows the response from the server. In
+  other words, this is a simplified nsupdate.
+  
+  
+   Usage: sample-update [options] (add|delete) "update data"
+  
+  
+  Options and Arguments:
+  
+  
+  
+   
+  -a auth_server
+   
+   
+        An IP address of the authoritative server that has authority
+        for the zone containing the update name.  This should normally
+        be the primary authoritative server that accepts dynamic
+        updates.  It can also be a secondary server that is configured
+        to forward update requests to the primary server.
+   
+   
+   
+   
+  -k keyfile
+   
+   
+        A TSIG key file to secure the update transaction.  The keyfile
+        format is the same as that for the nsupdate utility.
+   
+   
+   
+   
+  -p prerequisite
+   
+   
+        A prerequisite for the update (only one prerequisite can be
+        specified).  The prerequisite format is the same as that is
+        accepted by the nsupdate utility.
+   
+   
+   
+   
+  -r recursive_server
+   
+   
+        An IP address of a recursive server that this utility will
+        use.  A recursive server may be necessary to identify the
+        authoritative server address to which the update request is
+        sent.
+   
+   
+   
+   
+  -z zonename
+   
+   
+        The domain name of the zone that contains
+   
+   
+   
+   
+  (add|delete)
+   
+   
+        Specify the type of update operation.  Either "add" or "delete"
+        must be specified.
+   
+   
+   
+   
+  "update data"
+   
+   
+        Specify the data to be updated.  A typical example of the data
+        would look like "name TTL RRtype RDATA".
+  
+  
+  
+
+   In practice, either -a or -r must be specified.  Others can
+   be optional; the underlying library routine tries to identify the
+   appropriate server and the zone name for the update.
+
+   
+   Examples: assuming the primary authoritative server of the
+   dynamic.example.com zone has an IPv6 address 2001:db8::1234,
+   
+   
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"
+   
+     adds an A RR for foo.dynamic.example.com using the given key.
+   
+   
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"
+   
+     removes all A RRs for foo.dynamic.example.com using the given key.
+   
+      
+$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"
+   
+     removes all RRs for foo.dynamic.example.com using the given key.
+   
+  
+  
+    nsprobe: domain/name server checker in terms of RFC 4074
+  
+  It checks a set
+  of domains to see the name servers of the domains behave
+  correctly in terms of RFC 4074. This is included in the set of
+  sample programs to show how the export library can be used in a
+  DNS-related application.
+  
+  
+ Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
+  
+  
+   Options
+  
+
+  
+  
+  
+  -d
+  
+  
+        run in the "debug" mode.  with this option nsprobe will dump
+        every RRs it receives.
+  
+  
+  
+  
+  -v
+  
+  
+        increase verbosity of other normal log messages.  This can be
+        specified multiple times
+  
+  
+  
+  
+  -c cache_address
+  
+  
+        specify an IP address of a recursive (caching) name server.
+        nsprobe uses this server to get the NS RRset of each domain and
+        the A and/or AAAA RRsets for the name servers.  The default
+        value is 127.0.0.1.
+  
+  
+  
+  
+  input_file
+  
+  
+        a file name containing a list of domain (zone) names to be
+        probed.  when omitted the standard input will be used.  Each
+        line of the input file specifies a single domain name such as
+        "example.com".  In general this domain name must be the apex
+        name of some DNS zone (unlike normal "host names" such as
+        "www.example.com").  nsprobe first identifies the NS RRsets for
+        the given domain name, and sends A and AAAA queries to these
+        servers for some "widely used" names under the zone;
+        specifically, adding "www" and "ftp" to the zone name.
+  
+  
+  
+  
+  
+  
+    Library References
+  As of this writing, there is no formal "manual" of the
+  libraries, except this document, header files (some of them
+  provide pretty detailed explanations), and sample application
+  programs.
+  
+
+
diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html
index 0bf82d4a..efe0b199 100644
--- a/doc/arm/man.arpaname.html
+++ b/doc/arm/man.arpaname.html
@@ -14,7 +14,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-
+
 
 
 
@@ -50,20 +50,20 @@
 
arpaname  {ipaddress ...}

 
 

-
DESCRIPTION

+
DESCRIPTION

 

       arpaname translates IP addresses (IPv4 and
       IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
     

 

 

-
SEE ALSO

+
SEE ALSO

 

       BIND 9 Administrator Reference Manual.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html
index aeed4b8e..df75b751 100644
--- a/doc/arm/man.ddns-confgen.html
+++ b/doc/arm/man.ddns-confgen.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
ddns-confgen  [-a algorithm] [-h] [-k keyname] [-r randomfile] [ -s name  |   -z zone ] [-q] [name]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
ddns-confgen
       generates a key for use by nsupdate
       and named.  It simplifies configuration
@@ -77,7 +77,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a algorithm

 

@@ -144,7 +144,7 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 
nsupdate(1),
       named.conf(5),
       named(8),
@@ -152,7 +152,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index fafebe92..8d4b4a4d 100644
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -52,7 +52,7 @@
 
dig  [global-queryopt...] [query...]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dig
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -98,7 +98,7 @@
     

 

 

-
SIMPLE USAGE

+
SIMPLE USAGE

 

       A typical invocation of dig looks like:
       

@@ -144,7 +144,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

       The -b option sets the source IP address of the query
       to address.  This must be a valid
@@ -248,7 +248,7 @@
     

 

 

-
QUERY OPTIONS

+
QUERY OPTIONS

 
dig
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -573,7 +573,7 @@
     

 

 

-
MULTIPLE QUERIES

+
MULTIPLE QUERIES

 

       The BIND 9 implementation of dig 
       supports
@@ -619,7 +619,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     

 

 

-
IDN SUPPORT

+
IDN SUPPORT

 

       If dig has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -633,14 +633,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     

 

 

-
FILES

+
FILES

 
/etc/resolv.conf
     

 
${HOME}/.digrc
     

 

 

-
SEE ALSO

+
SEE ALSO

 
host(1),
       named(8),
       dnssec-keygen(8),
@@ -648,7 +648,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
     

 

 

-
BUGS

+
BUGS

 

       There are probably too many query options.
     

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html
index bbde3499..a995f392 100644
--- a/doc/arm/man.dnssec-dsfromkey.html
+++ b/doc/arm/man.dnssec-dsfromkey.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -51,14 +51,14 @@
 
dnssec-dsfromkey  {-s} [-1] [-2] [-a alg] [-K directory] [-l domain] [-s] [-c class] [-f file] [-A] [-v level] {dnsname}

 

 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-dsfromkey
       outputs the Delegation Signer (DS) resource record (RR), as defined in
       RFC 3658 and RFC 4509, for the given key(s).
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-1

 

@@ -119,7 +119,7 @@
 

 

 

-
EXAMPLE

+
EXAMPLE

 

       To build the SHA-256 DS RR from the
       Kexample.com.+003+26160
@@ -134,7 +134,7 @@
     

 

 

-
FILES

+
FILES

 

       The keyfile can be designed by the key identification
       Knnnn.+aaa+iiiii or the full file name
@@ -148,13 +148,13 @@
     

 

 

-
CAVEAT

+
CAVEAT

 

       A keyfile error can give a "file not found" even if the file exists.
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
@@ -164,7 +164,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html
index 3c9177cd..cb3316cb 100644
--- a/doc/arm/man.dnssec-keyfromlabel.html
+++ b/doc/arm/man.dnssec-keyfromlabel.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
dnssec-keyfromlabel  {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-k] [-K directory] [-n nametype] [-P date/offset] [-p protocol] [-R date/offset] [-t type] [-v level] [-y] {name}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-keyfromlabel
       gets keys with the given label from a crypto hardware and builds
       key files for DNSSEC (Secure DNS), as defined in RFC 2535
@@ -63,7 +63,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a algorithm

 

@@ -182,7 +182,7 @@
 

 

 

-
TIMING OPTIONS

+
TIMING OPTIONS

 

       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -229,7 +229,7 @@
 

 
 

-
GENERATED KEY FILES

+
GENERATED KEY FILES

 

       When dnssec-keyfromlabel completes
       successfully,
@@ -268,7 +268,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
@@ -276,7 +276,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index c83bff82..e90125c1 100644
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
dnssec-keygen  [-a algorithm] [-b keysize] [-n nametype] [-3] [-A date/offset] [-C] [-c class] [-D date/offset] [-E engine] [-e] [-f flag] [-G] [-g generator] [-h] [-I date/offset] [-K directory] [-k] [-P date/offset] [-p protocol] [-q] [-R date/offset] [-r randomdev] [-s strength] [-t type] [-v level] [-z] {name}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-keygen
       generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
       and RFC 4034.  It can also generate keys for use with
@@ -64,7 +64,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a algorithm

 

@@ -256,7 +256,7 @@
 

 

 

-
TIMING OPTIONS

+
TIMING OPTIONS

 

       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -303,7 +303,7 @@
 

 
 

-
GENERATED KEYS

+
GENERATED KEYS

 

       When dnssec-keygen completes
       successfully,
@@ -349,7 +349,7 @@
     

 

 

-
EXAMPLE

+
EXAMPLE

 

       To generate a 768-bit DSA key for the domain
       example.com, the following command would be
@@ -370,7 +370,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
       RFC 2539,
@@ -379,7 +379,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html
index 217d2efd..6ba61479 100644
--- a/doc/arm/man.dnssec-revoke.html
+++ b/doc/arm/man.dnssec-revoke.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
dnssec-revoke  [-hr] [-v level] [-K directory] [-E engine] [-f] {keyfile}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-revoke
       reads a DNSSEC key file, sets the REVOKED bit on the key as defined
       in RFC 5011, and creates a new pair of key files containing the
@@ -58,7 +58,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-h

 

@@ -91,14 +91,14 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       BIND 9 Administrator Reference Manual,
       RFC 5011.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html
index b778af86..20dd97be 100644
--- a/doc/arm/man.dnssec-settime.html
+++ b/doc/arm/man.dnssec-settime.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
dnssec-settime  [-f] [-K directory] [-P date/offset] [-A date/offset] [-R date/offset] [-I date/offset] [-D date/offset] [-h] [-v level] [-E engine] {keyfile}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-settime
       reads a DNSSEC private key file and sets the key timing metadata
       as specified by the -P, -A,
@@ -75,7 +75,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-f

 

@@ -106,7 +106,7 @@
 

 

 

-
TIMING OPTIONS

+
TIMING OPTIONS

 

       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -151,7 +151,7 @@
 

 
 

-
PRINTING OPTIONS

+
PRINTING OPTIONS

 

       dnssec-settime can also be used to print the
       timing metadata associated with a key.
@@ -169,7 +169,7 @@
             C for the creation date,
             P for the publication date,
             A for the activation date,
-            R for the revokation date,
+            R for the revocation date,
             U for the unpublication date, or
             D for the deletion date.
             To print all of the metadata, use -p all.
@@ -177,7 +177,7 @@
 

 
 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
@@ -185,7 +185,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index e5fda458..4c93e082 100644
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
dnssec-signzone  [-a] [-c class] [-d directory] [-E engine] [-e end-time] [-f output-file] [-g] [-h] [-K directory] [-k key] [-l domain] [-i interval] [-I input-format] [-j jitter] [-N soa-serial-format] [-o origin] [-O output-format] [-p] [-P] [-r randomdev] [-S] [-s start-time] [-T ttl] [-t] [-u] [-v level] [-x] [-z] [-3 salt] [-H iterations] [-A] {zonefile} [key...]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-signzone
       signs a zone.  It generates
       NSEC and RRSIG records and produces a signed version of the
@@ -61,7 +61,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a

 

@@ -397,7 +397,7 @@
 

 

 

-
EXAMPLE

+
EXAMPLE

 

       The following command signs the example.com
       zone with the DSA key generated by dnssec-keygen
@@ -427,14 +427,14 @@ db.example.com.signed
 %
 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       BIND 9 Administrator Reference Manual,
       RFC 4033.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html
index 21885b8b..a0608f71 100644
--- a/doc/arm/man.genrandom.html
+++ b/doc/arm/man.genrandom.html
@@ -14,7 +14,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-
+
 
 
 
@@ -50,7 +50,7 @@
 
genrandom  {size} {filename}

 
 

-
DESCRIPTION

+
DESCRIPTION

 

       genrandom
       generates a file containing a specified quantity of pseudo-random
@@ -59,7 +59,7 @@
     

 

 

-
ARGUMENTS

+
ARGUMENTS

 

 
size

 

@@ -72,14 +72,14 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 

       rand(3),
       arc4random(3)
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index dc783775..9bce126e 100644
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
host  [-aCdlnrsTwv] [-c class] [-N ndots] [-R number] [-t type] [-W wait] [-m flag] [-4] [-6] {name} [server]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
host
       is a simple utility for performing DNS lookups.
       It is normally used to convert names to IP addresses and vice versa.
@@ -202,7 +202,7 @@
     

 

 

-
IDN SUPPORT

+
IDN SUPPORT

 

       If host has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names. 
@@ -216,12 +216,12 @@
     

 

 

-
FILES

+
FILES

 
/etc/resolv.conf
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dig(1),
       named(8).
     

diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html
index fbcefeb9..23a9c998 100644
--- a/doc/arm/man.isc-hmac-fixup.html
+++ b/doc/arm/man.isc-hmac-fixup.html
@@ -14,7 +14,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-
+
 
 
 
@@ -50,7 +50,7 @@
 
isc-hmac-fixup  {algorithm} {secret}

 

 

-
DESCRIPTION

+
DESCRIPTION

 

       Versions of BIND 9 up to and including BIND 9.6 had a bug causing
       HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -76,7 +76,7 @@
     

 

 

-
SECURITY CONSIDERATIONS

+
SECURITY CONSIDERATIONS

 

       Secrets that have been converted by isc-hmac-fixup
       are shortened, but as this is how the HMAC protocol works in
@@ -87,14 +87,14 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 

       BIND 9 Administrator Reference Manual,
       RFC 2104.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index bae1246f..747380c4 100644
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
named-checkconf  [-h] [-v] [-j] [-t directory] {filename} [-p] [-z]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
named-checkconf
       checks the syntax, but not the semantics, of a
       named configuration file.  The file is parsed
@@ -70,7 +70,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-h

 

@@ -109,21 +109,21 @@
 

 

 

-
RETURN VALUES

+
RETURN VALUES

 
named-checkconf
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     

 

 

-
SEE ALSO

+
SEE ALSO

 
named(8),
       named-checkzone(8),
       BIND 9 Administrator Reference Manual.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index 2965763d..14183283 100644
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -51,7 +51,7 @@
 
named-compilezone  [-d] [-j] [-q] [-v] [-c class] [-C mode] [-f format] [-F format] [-i mode] [-k mode] [-m mode] [-n mode] [-o filename] [-r mode] [-s style] [-t directory] [-w directory] [-D] [-W mode] {-o filename} {zonename} {filename}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
named-checkzone
       checks the syntax and integrity of a zone file.  It performs the
       same checks as named does when loading a
@@ -71,7 +71,7 @@
      

 

 

-
OPTIONS

+
OPTIONS

 

 
-d

 

@@ -265,14 +265,14 @@
 

 

 

-
RETURN VALUES

+
RETURN VALUES

 
named-checkzone
       returns an exit status of 1 if
       errors were detected and 0 otherwise.
     

 

 

-
SEE ALSO

+
SEE ALSO

 
named(8),
       named-checkconf(8),
       RFC 1035,
@@ -280,7 +280,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html
index 691616d0..6724ad5c 100644
--- a/doc/arm/man.named-journalprint.html
+++ b/doc/arm/man.named-journalprint.html
@@ -14,7 +14,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-
+
 
 
 
@@ -50,7 +50,7 @@
 
named-journalprint  {journal}

 
 

-
DESCRIPTION

+
DESCRIPTION

 

       named-journalprint
       prints the contents of a zone journal file in a human-readable
@@ -76,7 +76,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 

       named(8),
       nsupdate(8),
@@ -84,7 +84,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index c18bad7b..da7865f3 100644
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
named  [-4] [-6] [-c config-file] [-d debug-level] [-E engine-name] [-f] [-g] [-m flag] [-n #cpus] [-p port] [-s] [-S #max-socks] [-t directory] [-u user] [-v] [-V] [-x cache-file]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
named
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -65,7 +65,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-4

 

@@ -246,7 +246,7 @@
 

 

 

-
SIGNALS

+
SIGNALS

 

       In routine operation, signals should not be used to control
       the nameserver; rndc should be used
@@ -267,7 +267,7 @@
     

 

 

-
CONFIGURATION

+
CONFIGURATION

 

       The named configuration file is too complex
       to describe in detail here.  A complete description is provided
@@ -284,7 +284,7 @@
     

 

 

-
FILES

+
FILES

 

 
/etc/named.conf

 

@@ -297,7 +297,7 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 
RFC 1033,
       RFC 1034,
       RFC 1035,
@@ -310,7 +310,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index 90294a57..684b6feb 100644
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -14,7 +14,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-
+
 
 
 
@@ -48,7 +48,7 @@
 
nsec3hash  {salt} {algorithm} {iterations} {domain}

 
 

-
DESCRIPTION

+
DESCRIPTION

 

       nsec3hash generates an NSEC3 hash based on
       a set of NSEC3 parameters.  This can be used to check the validity
@@ -56,7 +56,7 @@
     

 

 

-
ARGUMENTS

+
ARGUMENTS

 

 
salt

 

@@ -80,14 +80,14 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 

       BIND 9 Administrator Reference Manual,
       RFC 5155.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html
index 219a41b0..8cb502f9 100644
--- a/doc/arm/man.nsupdate.html
+++ b/doc/arm/man.nsupdate.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
nsupdate  [-d] [-D] [[-g] |  [-o] |  [-l] |  [-y [hmac:]keyname:secret] |  [-k keyfile]] [-t timeout] [-u udptimeout] [-r udpretries] [-R randomdev] [-v] [filename]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
nsupdate
       is used to submit Dynamic DNS Update requests as defined in RFC 2136
       to a name server.
@@ -210,7 +210,7 @@
     

 

 

-
INPUT FORMAT

+
INPUT FORMAT

 
nsupdate
       reads input from
       filename
@@ -474,7 +474,7 @@
     

 

 

-
EXAMPLES

+
EXAMPLES

 

       The examples below show how
       nsupdate
@@ -528,7 +528,7 @@
     

 

 

-
FILES

+
FILES

 

 
/etc/resolv.conf

 

@@ -551,7 +551,7 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 

       RFC 2136,
       RFC 3007,
@@ -566,7 +566,7 @@
     

 

 

-
BUGS

+
BUGS

 

       The TSIG key is redundantly stored in two separate files.
       This is a consequence of nsupdate using the DST library
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index fdaf9480..3085907b 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
rndc-confgen  [-a] [-b keysize] [-c keyfile] [-h] [-k keyname] [-p port] [-r randomfile] [-s address] [-t chrootdir] [-u user]

 

 

-
DESCRIPTION

+
DESCRIPTION

 
rndc-confgen
       generates configuration files
       for rndc.  It can be used as a
@@ -66,7 +66,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a

 

@@ -173,7 +173,7 @@
 

 

 

-
EXAMPLES

+
EXAMPLES

 

       To allow rndc to be used with
       no manual configuration, run
@@ -190,7 +190,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
rndc(8),
       rndc.conf(5),
       named(8),
@@ -198,7 +198,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index 41ca9787..43c3131f 100644
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
rndc.conf 

 
 

-
DESCRIPTION

+
DESCRIPTION

 
rndc.conf is the configuration file
       for rndc, the BIND 9 name server control
       utility.  This file has a similar structure and syntax to
@@ -135,7 +135,7 @@
     

 

 

-
EXAMPLE

+
EXAMPLE

 
       options {
         default-server  localhost;
@@ -209,7 +209,7 @@
     

 

 

-
NAME SERVER CONFIGURATION

+
NAME SERVER CONFIGURATION

 

       The name server must be configured to accept rndc connections and
       to recognize the key specified in the rndc.conf
@@ -219,7 +219,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
rndc(8),
       rndc-confgen(8),
       mmencode(1),
@@ -227,7 +227,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index cd59e490..aa88635d 100644
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-
+
 
 
 
@@ -50,7 +50,7 @@
 
rndc  [-b source-address] [-c config-file] [-k key-file] [-s server] [-p port] [-V] [-y key_id] {command}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
rndc
       controls the operation of a name
       server.  It supersedes the ndc utility
@@ -79,7 +79,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-b source-address

 

@@ -151,7 +151,7 @@
     

 

 

-
LIMITATIONS

+
LIMITATIONS

 
rndc
       does not yet support all the commands of
       the BIND 8 ndc utility.
@@ -165,7 +165,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
rndc.conf(5),
       rndc-confgen(8),
       named(8),
@@ -175,7 +175,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

diff --git a/doc/arm/managed-keys.xml b/doc/arm/managed-keys.xml
new file mode 100644
index 00000000..2279d883
--- /dev/null
+++ b/doc/arm/managed-keys.xml
@@ -0,0 +1,100 @@
+
+
+
+
+
+
+  Dynamic Trust Anchor Management
+  BIND 9.7.0 introduces support for RFC 5011, dynamic trust
+  anchor management. Using this feature allows 
+  named to keep track of changes to critical
+  DNSSEC keys without any need for the operator to make changes to
+  configuration files.
+  
+    Validating Resolver
+    
+    To configure a validating resolver to use RFC 5011 to
+    maintain a trust anchor, configure the trust anchor using a 
+    managed-keys statement. Information about
+    this can be found in 
+    .
+    
+  
+  
+    Authoritative Server
+    To set up an authoritative zone for RFC 5011 trust anchor
+    maintenance, generate two (or more) key signing keys (KSKs) for
+    the zone. Sign the zone with one of them; this is the "active"
+    KSK. All KSK's which do not sign the zone are "stand-by"
+    keys.
+    Any validating resolver which is configured to use the
+    active KSK as an RFC 5011-managed trust anchor will take note
+    of the stand-by KSKs in the zone's DNSKEY RRset, and store them
+    for future reference. The resolver will recheck the zone
+    periodically, and after 30 days, if the new key is still there,
+    then the key will be accepted by the resolver as a valid trust
+    anchor for the zone. Any time after this 30-day acceptance
+    timer has completed, the active KSK can be revoked, and the
+    zone can be "rolled over" to the newly accepted key.
+    The easiest way to place a stand-by key in a zone is to
+    use the "smart signing" features of 
+    dnssec-keygen and 
+    dnssec-signzone. If a key with a publication
+    date in the past, but an activation date which is unset or in
+    the future, " 
+    dnssec-signzone -S" will include the DNSKEY
+    record in the zone, but will not sign with it:
+    
+$ dnssec-keygen -K keys -f KSK -P now -A now+2y example.net
+$ dnssec-signzone -S -K keys example.net
+
+    To revoke a key, the new command 
+    dnssec-revoke has been added. This adds the
+    REVOKED bit to the key flags and re-generates the 
+    K*.key and 
+    K*.private files.
+    After revoking the active key, the zone must be signed
+    with both the revoked KSK and the new active KSK. (Smart
+    signing takes care of this automatically.)
+    Once a key has been revoked and used to sign the DNSKEY
+    RRset in which it appears, that key will never again be
+    accepted as a valid trust anchor by the resolver. However,
+    validation can proceed using the new active key (which had been
+    accepted by the resolver when it was a stand-by key).
+    See RFC 5011 for more details on key rollover
+    scenarios.
+    When a key has been revoked, its key ID changes,
+    increasing by 128, and wrapping around at 65535. So, for
+    example, the key "Kexample.com.+005+10000" becomes
+    "Kexample.com.+005+10128".
+    If two keys have ID's exactly 128 apart, and one is
+    revoked, then the two key ID's will collide, causing several
+    problems. To prevent this, 
+    dnssec-keygen will not generate a new key if
+    another key is present which may collide. This checking will
+    only occur if the new keys are written to the same directory
+    which holds all other keys in use for that zone.
+    Older versions of BIND 9 did not have this precaution.
+    Exercise caution if using key revocation on keys that were
+    generated by previous releases, or if using keys stored in
+    multiple directories or on multiple machines.
+    It is expected that a future release of BIND 9 will
+    address this problem in a different way, by storing revoked
+    keys with their original unrevoked key ID's.
+  
+
diff --git a/doc/arm/pkcs11.xml b/doc/arm/pkcs11.xml
new file mode 100644
index 00000000..f416d176
--- /dev/null
+++ b/doc/arm/pkcs11.xml
@@ -0,0 +1,372 @@
+]>
+
+  PKCS #11 (Cryptoki) support
+  PKCS #11 (Public Key Cryptography Standard #11) defines a
+  platform- independent API for the control of hardware security
+  modules (HSMs) and other cryptographic support devices.
+  BIND 9 is known to work with two HSMs: The Sun SCA 6000
+  cryptographic acceleration board, tested under Solaris x86, and
+  the AEP Keyper network-attached key storage device, tested with
+  Debian Linux, Solaris x86 and Windows Server 2003.
+  
+    Prerequisites
+    See the HSM vendor documentation for information about
+    installing, initializing, testing and troubleshooting the
+    HSM.
+    BIND 9 uses OpenSSL for cryptography, but stock OpenSSL
+    does not yet fully support PKCS #11. However, a PKCS #11 engine
+    for OpenSSL is available from the OpenSolaris project. It has
+    been modified by ISC to work with with BIND 9, and to provide
+    new features such as PIN management and key by
+    reference.
+    The patched OpenSSL depends on a "PKCS #11 provider".
+    This is a shared library object, providing a low-level PKCS #11
+    interface to the HSM hardware. It is dynamically loaded by
+    OpenSSL at runtime. The PKCS #11 provider comes from the HSM
+    vendor, and and is specific to the HSM to be controlled.
+    There are two "flavors" of PKCS #11 support provided by
+    the patched OpenSSL, one of which must be chosen at
+    configuration time. The correct choice depends on the HSM
+    hardware:
+    
+      
+        Use 'crypto-accelerator' with HSMs that have hardware
+        cryptographic acceleration features, such as the SCA 6000
+        board. This causes OpenSSL to run all supported
+        cryptographic operations in the HSM.
+      
+      
+        Use 'sign-only' with HSMs that are designed to
+        function primarily as secure key storage devices, but lack
+        hardware acceleration. These devices are highly secure, but
+        are not necessarily any faster at cryptography than the
+        system CPU — often, they are slower. It is therefore
+        most efficient to use them only for those cryptographic
+        functions that require access to the secured private key,
+        such as zone signing, and to use the system CPU for all
+        other computationally-intensive operations. The AEP Keyper
+        is an example of such a device.
+      
+    
+    The modified OpenSSL code is included in the BIND 9.7.0
+    release, in the form of a context diff against the latest OpenSSL.
+    
+    
+      The latest OpenSSL version at the time of the BIND release
+      is 0.9.8l.
+      ISC will provide an updated patch as new versions of OpenSSL
+      are released. The version number in the following examples
+      is expected to change.
+    
+    Before building BIND 9 with PKCS #11 support, it will be
+    necessary to build OpenSSL with this patch in place and inform
+    it of the path to the HSM-specific PKCS #11 provider
+    library.
+    Obtain OpenSSL 0.9.8l:
+    
+$ wget http://www.openssl.org/source/openssl-0.9.8l.tar.gz
+
+    Extract the tarball:
+    
+$ tar zxf openssl-0.9.8l.tar.gz
+
+    Apply the patch from the BIND 9 release:
+    
+$ patch -p1 -d openssl-0.9.8l \
+            < bind-9.7.0/bin/pkcs11/openssl-0.9.8l-patch
+
+    (Note that the patch file may not be compatible with the
+    "patch" utility on all operating systems. You may need to
+    install GNU patch.)
+    When building OpenSSL, place it in a non-standard
+    location so that it does not interfere with OpenSSL libraries
+    elsewhere on the system. In the following examples, we choose
+    to install into "/opt/pkcs11/usr". We will use this location
+    when we configure BIND 9.
+    
+      
+      Building OpenSSL for the AEP Keyper on Linux
+      The AEP Keyper is a highly secure key storage device,
+      but does not provide hardware cryptographic acceleration. It
+      can carry out cryptographic operations, but it is probably
+      slower than your system's CPU. Therefore, we choose the
+      'sign-only' flavor when building OpenSSL.
+      The Keyper-specific PKCS #11 provider library is
+      delivered with the Keyper software. In this example, we place
+      it /opt/pkcs11/usr/lib:
+      
+$ cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib/libpkcs11.so
+
+      This library is only available for Linux as a 32-bit
+      binary. If we are compiling on a 64-bit Linux system, it is
+      necessary to force a 32-bit build, by specifying -m32 in the
+      build options.
+      Finally, the Keyper library requires threads, so we
+      must specify -pthread.
+      
+$ cd openssl-0.9.8l
+$ ./Configure linux-generic32 -m32 -pthread \
+            --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
+            --pk11-flavor=sign-only \
+            --prefix=/opt/pkcs11/usr
+
+      After configuring, run "make"
+      and "make test". If "make
+      test" fails with "pthread_atfork() not found", you forgot to
+      add the -pthread above.
+    
+    
+      
+      Building OpenSSL for the SCA 6000 on Solaris
+      The SCA-6000 PKCS #11 provider is installed as a system
+      library, libpkcs11. It is a true crypto accelerator, up to 4
+      times faster than any CPU, so the flavor shall be
+      'crypto-accelerator'.
+      In this example, we are building on Solaris x86 on an
+      AMD64 system.
+      
+$ cd openssl-0.9.8l
+$ ./Configure solaris64-x86_64-cc \
+            --pk11-libname=/usr/lib/64/libpkcs11.so \
+            --pk11-flavor=crypto-accelerator \
+            --prefix=/opt/pkcs11/usr
+
+      (For a 32-bit build, use "solaris-x86-cc" and
+      /usr/lib/libpkcs11.so.)
+      After configuring, run 
+      make and 
+      make test.
+      Once you have built OpenSSL, run
+      "apps/openssl engine pkcs11" to confirm
+      that PKCS #11 support was compiled in correctly. The output
+      should be one of the following lines, depending on the flavor
+      selected:
+      
+        (pkcs11) PKCS #11 engine support (sign only)
+
+      Or:
+      
+        (pkcs11) PKCS #11 engine support (crypto accelerator)
+
+      Next, run
+      "apps/openssl engine pkcs11 -t". This will
+      attempt to initialize the PKCS #11 engine. If it is able to
+      do so successfully, it will report
+      [ available ].
+      If the output is correct, run
+      "make install" which will install the
+      modified OpenSSL suite to 
+      /opt/pkcs11/usr.
+    
+  
+  
+    Building BIND 9 with PKCS#11
+    When building BIND 9, the location of the custom-built
+    OpenSSL library must be specified via configure.
+    
+      
+      Configuring BIND 9 for Linux
+      To link with the PKCS #11 provider, threads must be
+      enabled in the BIND 9 build.
+      The PKCS #11 library for the AEP Keyper is currently
+      only available as a 32-bit binary. If we are building on a
+      64-bit host, we must force a 32-bit build by adding "-m32" to
+      the CC options on the "configure" command line.
+      
+$ cd ../bind-9.7.0
+$ ./configure CC="gcc -m32" --enable-threads \
+           --with-openssl=/opt/pkcs11/usr \
+           --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so
+
+    
+    
+      
+      Configuring BIND 9 for Solaris
+      To link with the PKCS #11 provider, threads must be
+      enabled in the BIND 9 build.
+      
+$ cd ../bind-9.7.0
+$ ./configure CC="cc -xarch=amd64" --enable-threads \
+            --with-openssl=/opt/pkcs11/usr \
+            --with-pkcs11=/usr/lib/64/libpkcs11.so
+
+      (For a 32-bit build, omit CC="cc -xarch=amd64".)
+      If configure complains about OpenSSL not working, you
+      may have a 32/64-bit architecture mismatch. Or, you may have
+      incorrectly specified the path to OpenSSL (it should be the
+      same as the --prefix argument to the OpenSSL
+      Configure).
+    
+    After configuring, run
+    "make",
+    "make test" and
+    "make install".
+  
+  
+    PKCS #11 Tools
+    BIND 9 includes a minimal set of tools to operate the
+    HSM, including 
+    pkcs11-keygen to generate a new key pair
+    within the HSM, 
+    pkcs11-list to list objects currently
+    available, and 
+    pkcs11-destroy to remove objects.
+    In UNIX/Linux builds, these tools are built only if BIND
+    9 is configured with the --with-pkcs11 option. (NOTE: If
+    --with-pkcs11 is set to "yes", rather than to the path of the
+    PKCS #11 provider, then the tools will be built but the
+    provider will be left undefined. Use the -m option or the
+    PKCS11_PROVIDER environment variable to specify the path to the
+    provider.)
+  
+  
+    Using the HSM
+    First, we must set up the runtime environment so the
+    OpenSSL and PKCS #11 libraries can be loaded:
+    
+$ export LD_LIBRARY_PATH=/opt/pkcs11/usr/lib:${LD_LIBRARY_PATH}
+
+    When operating an AEP Keyper, it is also necessary to
+    specify the location of the "machine" file, which stores
+    information about the Keyper for use by PKCS #11 provider
+    library. If the machine file is in 
+    /opt/Keyper/PKCS11Provider/machine,
+    use:
+    
+$ export KEYPER_LIBRARY_PATH=/opt/Keyper/PKCS11Provider
+
+    
+    These environment variables must be set whenever running
+    any tool that uses the HSM, including 
+    pkcs11-keygen, 
+    pkcs11-list, 
+    pkcs11-destroy, 
+    dnssec-keyfromlabel, 
+    dnssec-signzone, 
+    dnssec-keygen(which will use the HSM for
+    random number generation), and 
+    named.
+    We can now create and use keys in the HSM. In this case,
+    we will create a 2048 bit key and give it the label
+    "sample-ksk":
+    
+$ pkcs11-keygen -b 2048 -l sample-ksk
+
+    To confirm that the key exists:
+    
+$ pkcs11-list
+Enter PIN:
+object[0]: handle 2147483658 class 3 label[8] 'sample-ksk' id[0]
+object[1]: handle 2147483657 class 2 label[8] 'sample-ksk' id[0]
+
+    Before using this key to sign a zone, we must create a
+    pair of BIND 9 key files. The "dnssec-keyfromlabel" utility
+    does this. In this case, we will be using the HSM key
+    "sample-ksk" as the key-signing key for "example.net":
+    
+$ dnssec-keyfromlabel -l sample-ksk -f KSK example.net
+
+    The resulting K*.key and K*.private files can now be used
+    to sign the zone. Unlike normal K* files, which contain both
+    public and private key data, these files will contain only the
+    public key data, plus an identifier for the private key which
+    remains stored within the HSM. The HSM handles signing with the
+    private key.
+    If you wish to generate a second key in the HSM for use
+    as a zone-signing key, follow the same procedure above, using a
+    different keylabel, a smaller key size, and omitting "-f KSK"
+    from the dnssec-keyfromlabel arguments:
+    
+$ pkcs11-keygen -b 1024 -l sample-zsk
+$ dnssec-keyfromlabel -l sample-zsk example.net
+
+    Alternatively, you may prefer to generate a conventional
+    on-disk key, using dnssec-keygen:
+    
+$ dnssec-keygen example.net
+
+    This provides less security than an HSM key, but since
+    HSMs can be slow or cumbersome to use for security reasons, it
+    may be more efficient to reserve HSM keys for use in the less
+    frequent key-signing operation. The zone-signing key can be
+    rolled more frequently, if you wish, to compensate for a
+    reduction in key security.
+    Now you can sign the zone. (Note: If not using the -S
+    option to 
+    dnssec-signzone, it will be necessary to add
+    the contents of both 
+    K*.key files to the zone master file before
+    signing it.)
+    
+$ dnssec-signzone -S example.net
+Enter PIN:
+Verifying the zone using the following algorithms:
+NSEC3RSASHA1.
+Zone signing complete:
+Algorithm: NSEC3RSASHA1: ZSKs: 1, KSKs: 1 active, 0 revoked, 0 stand-by
+example.net.signed
+
+  
+  
+    Specifying the engine on the command line
+    The OpenSSL engine can be specified in 
+    named and all of the BIND 
+    dnssec-* tools by using the "-E
+    <engine>" command line option. If BIND 9 is built with
+    the --with-pkcs11 option, this option defaults to "pkcs11".
+    Specifying the engine will generally not be necessary unless
+    for some reason you wish to use a different OpenSSL
+    engine.
+    If you wish to disable use of the "pkcs11" engine —
+    for troubleshooting purposes, or because the HSM is unavailable
+    — set the engine to the empty string. For example:
+    
+$ dnssec-signzone -E '' -S example.net
+
+    This causes 
+    dnssec-signzone to run as if it were compiled
+    without the --with-pkcs11 option.
+  
+  
+    Running named with automatic zone re-signing
+    If you want 
+    named to dynamically re-sign zones using HSM
+    keys, and/or to to sign new records inserted via nsupdate, then
+    named must have access to the HSM PIN. This can be accomplished
+    by placing the PIN into the openssl.cnf file (in the above
+    examples, 
+    /opt/pkcs11/usr/ssl/openssl.cnf).
+    The location of the openssl.cnf file can be overridden by
+    setting the OPENSSL_CONF environment variable before running
+    named.
+    Sample openssl.cnf:
+    
+        openssl_conf = openssl_def
+        [ openssl_def ]
+        engines = engine_section
+        [ engine_section ]
+        pkcs11 = pkcs11_section
+        [ pkcs11_section ]
+        PIN = <PLACE PIN HERE>
+
+    This will also allow the dnssec-* tools to access the HSM
+    without PIN entry. (The pkcs11-* tools access the HSM directly,
+    not via OpenSSL, so a PIN will still be required to use
+    them.)
+
+    
+      Placing the HSM's PIN in a text file in
+      this manner may reduce the security advantage of using an
+      HSM. Be sure this is what you want to do before configuring
+      OpenSSL in this way.
+    
+  
+  
+  
+
diff --git a/lib/dns/api b/lib/dns/api
index c4e83f4e..6a453afb 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 64
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index f4f6a85e..319fe2ff 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.540.2.13 2010/01/22 01:46:43 each Exp $ */
+/* $Id: zone.c,v 1.540.2.14 2010/01/26 23:35:22 fdupont Exp $ */
 
 /*! \file */
 
@@ -7179,6 +7179,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	dns_fetchevent_t *devent;
 	dns_keyfetch_t *kfetch;
 	dns_zone_t *zone;
+	isc_mem_t *mctx;
 	dns_keytable_t *secroots = NULL;
 	dns_dbversion_t *ver = NULL;
 	dns_diff_t diff;
@@ -7205,6 +7206,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	kfetch = event->ev_arg;
 	zone = kfetch->zone;
+	mctx = zone->mctx;
 	keyname = dns_fixedname_name(&kfetch->name);
 
 	devent = (dns_fetchevent_t *) event;
@@ -7226,7 +7228,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	LOCK_ZONE(zone);
 	dns_db_newversion(kfetch->db, &ver);
-	dns_diff_init(zone->mctx, &diff);
+	dns_diff_init(mctx, &diff);
 
 	/* Fetch failed */
 	if (eresult != ISC_R_SUCCESS ||
@@ -7459,8 +7461,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 					/* Remove from secroots */
 					untrust_key(zone->view->viewlist,
-						    keyname, zone->mctx,
-						    &dnskey);
+						    keyname, mctx, &dnskey);
 
 					/* If initializing, delete now */
 					if (keydata.addhd == 0)
@@ -7506,7 +7507,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 			if (initializing) {
 				dns_keytag_t tag = 0;
 				CHECK(compute_tag(keyname, &dnskey,
-						  zone->mctx, &tag));
+						  mctx, &tag));
 				dns_zone_log(zone, ISC_LOG_WARNING,
 					     "Initializing automatic trust "
 					     "anchor management for zone '%s'; "
@@ -7564,7 +7565,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 			/* Trust this key in all views */
 			dns_rdata_tostruct(&dnskeyrr, &dnskey, NULL);
 			trust_key(zone->view->viewlist, keyname, &dnskey,
-				  zone->mctx);
+				  mctx);
 		}
 
 		if (!deletekey)
@@ -7599,8 +7600,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	/* Write changes to journal file. */
 	if (alldone) {
-		result = increment_soa_serial(kfetch->db, ver, &diff,
-					      zone->mctx);
+		result = increment_soa_serial(kfetch->db, ver, &diff, mctx);
 		if (result == ISC_R_SUCCESS)
 			zone_journal(zone, &diff, "keyfetch_done");
 	}
@@ -7608,6 +7608,7 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	dns_diff_clear(&diff);
 	dns_db_closeversion(kfetch->db, &ver, changed);
 	dns_db_detach(&kfetch->db);
+	dns_zone_detach(&kfetch->zone);
 
 	if (dns_rdataset_isassociated(&kfetch->keydataset))
 		dns_rdataset_disassociate(&kfetch->keydataset);
@@ -7616,8 +7617,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 	if (dns_rdataset_isassociated(&kfetch->dnskeysigset))
 		dns_rdataset_disassociate(&kfetch->dnskeysigset);
 
-	dns_name_free(keyname, zone->mctx);
-	isc_mem_put(zone->mctx, kfetch, sizeof(dns_keyfetch_t));
+	dns_name_free(keyname, mctx);
+	isc_mem_put(mctx, kfetch, sizeof(dns_keyfetch_t));
 
 	if (secroots != NULL)
 		dns_keytable_detach(&secroots);
@@ -7706,7 +7707,8 @@ zone_refreshkeys(dns_zone_t *zone) {
 		zone->refreshkeycount++;
 
 		kfetch = isc_mem_get(zone->mctx, sizeof(dns_keyfetch_t));
-		kfetch->zone = zone;
+		kfetch->zone = NULL;
+		dns_zone_attach(zone, &kfetch->zone);
 		dns_fixedname_init(&kfetch->name);
 		dns_name_dup(name, zone->mctx,
 			     dns_fixedname_name(&kfetch->name));
diff --git a/lib/isc/api b/lib/isc/api
index ea516a14..f7fd6642 100644
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 61
-LIBREVISION = 3
+LIBREVISION = 4
 LIBAGE = 1
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index fa313253..9690b084 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006-2008, 2010  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: httpd.c,v 1.16 2008/08/08 05:06:49 marka Exp $ */
+/* $Id: httpd.c,v 1.16.284.2 2010/02/04 23:48:30 tbox Exp $ */
 
 /*! \file */
 
@@ -151,6 +151,7 @@ struct isc_httpdmgr {
 
 	ISC_LIST(isc_httpdurl_t) urls;		/*%< urls we manage */
 	isc_httpdaction_t      *render_404;
+	isc_httpdaction_t      *render_500;
 };
 
 /*%
@@ -221,6 +222,11 @@ static isc_result_t render_404(const char *, const char *,
 			       unsigned int *, const char **,
 			       const char **, isc_buffer_t *,
 			       isc_httpdfree_t **, void **);
+static isc_result_t render_500(const char *, const char *,
+			       void *,
+			       unsigned int *, const char **,
+			       const char **, isc_buffer_t *,
+			       isc_httpdfree_t **, void **);
 
 static void
 destroy_client(isc_httpd_t **httpdp)
@@ -300,6 +306,7 @@ isc_httpdmgr_create(isc_mem_t *mctx, isc_socket_t *sock, isc_task_t *task,
 		goto cleanup;
 
 	httpd->render_404 = render_404;
+	httpd->render_500 = render_500;
 
 	*httpdp = httpd;
 	return (ISC_R_SUCCESS);
@@ -623,6 +630,30 @@ render_404(const char *url, const char *querystring,
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+render_500(const char *url, const char *querystring,
+	   void *arg,
+	   unsigned int *retcode, const char **retmsg,
+	   const char **mimetype, isc_buffer_t *b,
+	   isc_httpdfree_t **freecb, void **freecb_args)
+{
+	static char msg[] = "Internal server failure.";
+
+	UNUSED(url);
+	UNUSED(querystring);
+	UNUSED(arg);
+
+	*retcode = 500;
+	*retmsg = "Internal server failure";
+	*mimetype = "text/plain";
+	isc_buffer_reinit(b, msg, strlen(msg));
+	isc_buffer_add(b, strlen(msg));
+	*freecb = NULL;
+	*freecb_args = NULL;
+
+	return (ISC_R_SUCCESS);
+}
+
 static void
 isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 {
@@ -691,8 +722,14 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev)
 				     &httpd->mimetype, &httpd->bodybuffer,
 				     &httpd->freecb, &httpd->freecb_arg);
 	if (result != ISC_R_SUCCESS) {
-		destroy_client(&httpd);
-		goto out;
+	    result = httpd->mgr->render_500(httpd->url, httpd->querystring,
+					    NULL,
+					    &httpd->retcode,
+					    &httpd->retmsg,
+					    &httpd->mimetype,
+					    &httpd->bodybuffer,
+					    &httpd->freecb,
+					    &httpd->freecb_arg);
 	}
 
 	isc_httpd_response(httpd);
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index c3e5430f..9add24fa 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.326 2009/11/13 00:41:58 each Exp $ */
+/* $Id: socket.c,v 1.326.20.2 2010/01/31 23:48:29 tbox Exp $ */
 
 /*! \file */
 
@@ -1674,12 +1674,22 @@ doio_recv(isc__socket_t *sock, isc_socketevent_t *dev) {
 	}
 
 	/*
-	 * On TCP, zero length reads indicate EOF, while on
-	 * UDP, zero length reads are perfectly valid, although
-	 * strange.
+	 * On TCP and UNIX sockets, zero length reads indicate EOF,
+	 * while on UDP sockets, zero length reads are perfectly valid,
+	 * although strange.
 	 */
-	if ((sock->type == isc_sockettype_tcp) && (cc == 0))
-		return (DOIO_EOF);
+	switch (sock->type) {
+	case isc_sockettype_tcp:
+	case isc_sockettype_unix:
+		if (cc == 0)
+			return (DOIO_EOF);
+		break;
+	case isc_sockettype_udp:
+		break;
+	case isc_sockettype_fdwatch:
+	default:
+		INSIST(0);
+	}
 
 	if (sock->type == isc_sockettype_udp) {
 		dev->address.length = msghdr.msg_namelen;
diff --git a/version b/version
index c23b0bea..97cf3817 100644
--- a/version
+++ b/version
@@ -1,4 +1,4 @@
-# $Id: version,v 1.51.2.1 2010/01/21 21:26:06 each Exp $
+# $Id: version,v 1.51.2.2 2010/02/04 05:19:29 each Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
@@ -6,5 +6,5 @@
 MAJORVER=9
 MINORVER=7
 PATCHVER=0
-RELEASETYPE=rc
-RELEASEVER=2
+RELEASETYPE=
+RELEASEVER=
diff --git a/win32utils/BuildSetup.bat b/win32utils/BuildSetup.bat
index 5942e267..5e371453 100644
--- a/win32utils/BuildSetup.bat
+++ b/win32utils/BuildSetup.bat
@@ -45,6 +45,7 @@ echo Copying the ARM and the Installation Notes.
 
 copy ..\COPYRIGHT ..\Build\Release
 copy ..\README ..\Build\Release
+copy ..\HISTORY ..\Build\Release
 copy readme1st.txt ..\Build\Release
 copy index.html ..\Build\Release
 copy ..\doc\arm\*.html ..\Build\Release
-- 
cgit v1.2.3