From 52a7f63e4e1a5cc6705c88c2090499b2caaa0805 Mon Sep 17 00:00:00 2001
From: "Internet Software Consortium, Inc" <@isc.org>
Date: Wed, 18 Jan 2012 10:10:04 -0700
Subject: 9.9.0b1
---
doc/arm/Bv9ARM-book.xml | 71 +-
doc/arm/Bv9ARM.ch03.html | 52 +-
doc/arm/Bv9ARM.ch04.html | 162 +-
doc/arm/Bv9ARM.ch05.html | 6 +-
doc/arm/Bv9ARM.ch06.html | 180 +-
doc/arm/Bv9ARM.ch07.html | 14 +-
doc/arm/Bv9ARM.ch08.html | 18 +-
doc/arm/Bv9ARM.ch09.html | 220 +-
doc/arm/Bv9ARM.html | 162 +-
doc/arm/Bv9ARM.pdf | 7423 +++++++++++++++++-----------------
doc/arm/man.arpaname.html | 8 +-
doc/arm/man.ddns-confgen.html | 10 +-
doc/arm/man.dig.html | 20 +-
doc/arm/man.dnssec-dsfromkey.html | 24 +-
doc/arm/man.dnssec-keyfromlabel.html | 14 +-
doc/arm/man.dnssec-keygen.html | 16 +-
doc/arm/man.dnssec-revoke.html | 17 +-
doc/arm/man.dnssec-settime.html | 14 +-
doc/arm/man.dnssec-signzone.html | 12 +-
doc/arm/man.genrandom.html | 10 +-
doc/arm/man.host.html | 10 +-
doc/arm/man.isc-hmac-fixup.html | 10 +-
doc/arm/man.named-checkconf.html | 12 +-
doc/arm/man.named-checkzone.html | 12 +-
doc/arm/man.named-journalprint.html | 8 +-
doc/arm/man.named.html | 16 +-
doc/arm/man.nsec3hash.html | 10 +-
doc/arm/man.nsupdate.html | 14 +-
doc/arm/man.rndc-confgen.html | 12 +-
doc/arm/man.rndc.conf.html | 12 +-
doc/arm/man.rndc.html | 12 +-
31 files changed, 4392 insertions(+), 4189 deletions(-)
(limited to 'doc')
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 6a3c5154..77f39693 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
- PERFORMANCE OF THIS SOFTWARE.
-->
-
+
signing
+ [( -list | -clear keyid/algorithm
| -clear all
| -nsec3param ( parameters
| none
) ) ]
+ zone
+ [class
+ [view
]]
+
+ List, edit, or remove the DNSSEC signing state for + the specified zone. The status of ongoing DNSSEC + operations (such as signing or generating + NSEC3 chains) is stored in the zone in the form + of DNS resource records of type + sig-signing-type. + rndc signing -list converts + these records into a human-readable form, + indicating which keys are currently signing + or have finished signing the zone, and which NSEC3 + NSEC3 chains are being created or removed. +
++ rndc signing -clear can remove + a single key (specified in the same format that + rndc signing -list uses to + display it), or all keys. In either case, only + completed keys are removed; any record indicating + that a key has not yet finished signing the zone + will be retained. +
++ rndc signing -nsec3param sets + the NSEC3 parameters for a zone. This is the + only supported mechanism for using NSEC3 with + inline-signing zones. + Parameters are specified in the same format as + an NSEC3PARAM resource record: hash algorithm, + flags, iterations, salt. For example, to set an + NSEC3 chain using the SHA-1 hash algorithm, + no opt-out flag, 10 iterations, and a salt value + of "FFFF", use: + rndc signing -nsec3param 1 0 10 FFFF. + rndc signing -nsec3param none + removes an existing NSEC3 chain and replaces it + with NSEC. +
+A configuration file is required, since all @@ -898,7 +944,7 @@ controls {
Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 5ddb4cef..5d7874d0 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -49,59 +49,59 @@Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -286,7 +286,7 @@
Let's say a company named Example, Inc.
(example.com
)
@@ -543,7 +543,7 @@ nameserver 172.16.72.4
A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -551,7 +551,7 @@ nameserver 172.16.72.4
The following command will generate a 128-bit (16 byte) HMAC-SHA256 key as described above. Longer keys are better, but shorter keys @@ -575,7 +575,7 @@ nameserver 172.16.72.4
The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -590,7 +590,7 @@ nameserver 172.16.72.4
This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -598,7 +598,7 @@ nameserver 172.16.72.4
Imagine host1 and host 2 are @@ -625,7 +625,7 @@ key host1-host2. {
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf
file
@@ -657,7 +657,7 @@ server 10.1.2.3 {
BIND allows IP addresses and ranges to be specified in ACL @@ -684,7 +684,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -710,7 +710,7 @@ allow-update { key host1-host2. ;};
TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -746,7 +746,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC 2931. @@ -807,7 +807,7 @@ allow-update { key host1-host2. ;};
The dnssec-keygen program is used to generate keys. @@ -863,7 +863,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used to sign a zone. @@ -905,7 +905,7 @@ allow-update { key host1-host2. ;};
To enable named to respond appropriately to DNS requests from DNSSEC aware clients, @@ -1065,7 +1065,7 @@ options { from insecure to signed and back again. A secure zone can use either NSEC or NSEC3 chains.
+Converting from insecure to secureChanging a zone from insecure to secure can be done in two ways: using a dynamic DNS update, or the auto-dnssec zone option.
@@ -1091,7 +1091,7 @@ options { well. An NSEC chain will be generated as part of the initial signing process. +Dynamic DNS update methodTo insert the keys via dynamic update:
% nsupdate @@ -1127,7 +1127,7 @@ options {While the initial signing and NSEC/NSEC3 chain generation is happening, other updates are possible as well.
+Fully automatic zone signingTo enable automatic signing, add the auto-dnssec option to the zone statement in
+Private-type recordsnamed.conf
. @@ -1183,7 +1183,7 @@ options { configuration. If this has not been done, the configuration will fail.The state of the signing process is signaled by private-type records (with a default type value of 65534). When signing is complete, these records will have a nonzero value for @@ -1224,12 +1224,12 @@ options {
+DNSKEY rollovers
As with insecure-to-secure conversions, rolling DNSSEC keys can be done in two ways: using a dynamic DNS update, or the auto-dnssec zone option.
+Dynamic DNS update methodTo perform key rollovers via dynamic update, you need to add the
+Automatic key rolloversK*
files for the new keys so that named can find them. You can then add the new @@ -1251,7 +1251,7 @@ options { named will clean out any signatures generated by the old key after the update completes.When a new key reaches its activation date (as set by dnssec-keygen or dnssec-settime), if the auto-dnssec zone option is set to @@ -1266,27 +1266,27 @@ options { completes in 30 days, after which it will be safe to remove the old key from the DNSKEY RRset.
+NSEC3PARAM rollovers via UPDATEAdd the new NSEC3PARAM record via dynamic update. When the new NSEC3 chain has been generated, the NSEC3PARAM flag field will be zero. At this point you can remove the old NSEC3PARAM record. The old chain will be removed after the update request completes.
+Converting from NSEC to NSEC3To do this, you just need to add an NSEC3PARAM record. When the conversion is complete, the NSEC chain will have been removed and the NSEC3PARAM record will have a zero flag field. The NSEC3 chain will be generated before the NSEC chain is destroyed.
+Converting from NSEC3 to NSECTo do this, use nsupdate to remove all NSEC3PARAM records with a zero flag field. The NSEC chain will be generated before the NSEC3 chain is removed.
+Converting from secure to insecureTo convert a signed zone to unsigned using dynamic DNS, delete all the DNSKEY records from the zone apex using nsupdate. All signatures, NSEC or NSEC3 chains, @@ -1301,14 +1301,14 @@ options { allow instead (or it will re-sign).
+Periodic re-signingIn any secure zone which supports dynamic updates, named will periodically re-sign RRsets which have not been re-signed as a result of some update action. The signature lifetimes will be adjusted so as to spread the re-sign load over time rather than all at once.
+NSEC3 and OPTOUTnamed only supports creating new NSEC3 chains where all the NSEC3 records in the zone have the same OPTOUT @@ -1330,7 +1330,7 @@ options { configuration files.
To configure a validating resolver to use RFC 5011 to maintain a trust anchor, configure the trust anchor using a managed-keys statement. Information about @@ -1341,7 +1341,7 @@ options {
To set up an authoritative zone for RFC 5011 trust anchor maintenance, generate two (or more) key signing keys (KSKs) for the zone. Sign the zone with one of them; this is the "active" @@ -1415,7 +1415,7 @@ $
dnssec-signzone -S -K keys example.net
< Debian Linux, Solaris x86 and Windows Server 2003.See the HSM vendor documentation for information about installing, initializing, testing and troubleshooting the HSM.
@@ -1489,7 +1489,7 @@ $patch -p1 -d openssl-0.9.8l \ when we configure BIND 9.
The AEP Keyper is a highly secure key storage device, but does not provide hardware cryptographic acceleration. It can carry out cryptographic operations, but it is probably @@ -1521,7 +1521,7 @@ $
./Configure linux-generic32 -m32 -pthread \
The SCA-6000 PKCS #11 provider is installed as a system library, libpkcs11. It is a true crypto accelerator, up to 4 times faster than any CPU, so the flavor shall be @@ -1565,12 +1565,12 @@ $
./Configure solaris64-x86_64-cc \
When building BIND 9, the location of the custom-built OpenSSL library must be specified via configure.
To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.
The PKCS #11 library for the AEP Keyper is currently @@ -1586,7 +1586,7 @@ $
./configure CC="gcc -m32" --enable-threads \
To link with the PKCS #11 provider, threads must be enabled in the BIND 9 build.
@@ -1609,7 +1609,7 @@ $./configure CC="cc -xarch=amd64" --enable-thre
BIND 9 includes a minimal set of tools to operate the HSM, including pkcs11-keygen to generate a new key pair @@ -1627,7 +1627,7 @@ $
./configure CC="cc -xarch=amd64" --enable-thre
First, we must set up the runtime environment so the OpenSSL and PKCS #11 libraries can be loaded:
@@ -1715,7 +1715,7 @@ example.net.signedThe OpenSSL engine can be specified in named and all of the BIND dnssec-* tools by using the "-E @@ -1736,7 +1736,7 @@ $
dnssec-signzone -E '' -S example.net
If you want named to dynamically re-sign zones using HSM keys, and/or to to sign new records inserted via nsupdate, then @@ -1772,7 +1772,7 @@ $
dnssec-signzone -E '' -S example.net
BIND 9 fully supports all currently defined forms of IPv6 name to address and address to name @@ -1810,7 +1810,7 @@ $
dnssec-signzone -E '' -S example.net
The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -1829,7 +1829,7 @@ host 3600 IN AAAA 2001:db8::1
When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index 2f75849e..8e9dde0b 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -45,13 +45,13 @@Table of Contents
Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 0782f8d8..68f88db0 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -48,58 +48,58 @@Configuration File Elements Configuration File Grammar - -
- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and Usage
-- include Statement Grammar
-- include Statement Definition and +
- include Statement Grammar
+- include Statement Definition and Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and +
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and +
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and Usage
- server Statement Grammar
- server Statement Definition and Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and +
- statistics-channels Statement Definition and Usage
- trusted-keys Statement Grammar
-- trusted-keys Statement Definition +
- trusted-keys Statement Definition and Usage
-- managed-keys Statement Grammar
+- managed-keys Statement Grammar
- managed-keys Statement Definition and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
Zone File +Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics @@ -477,7 +477,7 @@ Address Match Listsaddress_match_list
= address_match_list_element ; [ address_match_list_element; ... ]address_match_list_element
= [ ! ] (ip_address [/length] | @@ -486,7 +486,7 @@Address match lists are primarily used to determine access control for various server operations. They are also used in @@ -570,7 +570,7 @@
The BIND 9 comment syntax allows for comments to appear @@ -580,7 +580,7 @@
/* This is a BIND comment as in C */@@ -596,7 +596,7 @@Comments may appear anywhere that whitespace may appear in a BIND configuration file. @@ -850,7 +850,7 @@
acl acl-name { address_match_list }; @@ -932,7 +932,7 @@controls { [ inet ( ip_addr | * ) [ port ip_port ] allow {address_match_list
} @@ -1056,12 +1056,12 @@includefilename
;The include statement inserts the @@ -1076,7 +1076,7 @@
keykey_id
{ algorithmstring
; secretstring
; @@ -1085,7 +1085,7 @@The key statement defines a shared secret key for use with TSIG (see the section called “TSIG”) @@ -1132,7 +1132,7 @@
logging { [ channelchannel_name
{ ( filepath_name
@@ -1156,7 +1156,7 @@The logging statement configures a @@ -1190,7 +1190,7 @@
All log output goes to one or more channels; you can make as many of them as you want. @@ -1768,7 +1768,7 @@ category notify { null; };
The query-errors category is specifically intended for debugging purposes: To identify @@ -1996,7 +1996,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the lwres statement in the
named.conf
file: @@ -2012,7 +2012,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]The lwres statement configures the name @@ -2063,7 +2063,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
mastersname
[portip_port
] { (masters_list
|ip_addr
[portip_port
] [keykey
] ) ; [...] }; @@ -2071,7 +2071,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]masters lists allow for a common set of masters to be easily used by @@ -2081,7 +2081,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the options statement in the
named.conf
file: @@ -3711,7 +3711,7 @@ options {The forwarding facility can be used to create a large site-wide cache on a few servers, reducing traffic over links to external @@ -3755,7 +3755,7 @@ options {
Dual-stack servers are used as servers of last resort to work around @@ -3966,7 +3966,7 @@ options {
The interfaces and ports that the server will answer queries from may be specified using the listen-on option. listen-on takes @@ -4434,7 +4434,7 @@ avoid-v6-udp-ports {};
use-v4-udp-ports, avoid-v4-udp-ports, @@ -4476,7 +4476,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The server's usage of many system resources can be limited. Scaled values are allowed when specifying resource limits. For @@ -4638,7 +4638,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- cleaning-interval
@@ -5065,6 +5065,15 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; It is expected that this parameter may be removed in a future version once there is a standard type.
++ These records can be removed from the zone once named + has completed signing the zone with the matching key + using nsupdate or + rndc signing -clear. + rndc signing -clear is the only supported + way to remove these records from + inline-signing zones. +
- min-refresh-time, max-refresh-time, min-retry-time, max-retry-time @@ -5140,13 +5149,19 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- masterfile-format
-Specifies +
- +
+ +Specifies the file format of zone files (see the section called “Additional File Formats”). The default value is
+text
, which is the - standard textual representation. Files in other formats - thantext
are typically expected - to be generated by the named-compilezone tool. + standard textual representation, except for slave zones, + in which the default value israw
. + Files in other formats thantext
are + typically expected to be generated by the + named-compilezone tool, or dumped by + named. +Note that when a zone file in a different format than
text
is loaded, named may omit some of the checks which would be performed for a @@ -5163,7 +5178,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; statement within the zone or view block in the configuration file. -- clients-per-query, max-clients-per-query
@@ -5477,7 +5493,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };BIND 9 provides the ability to filter out DNS responses from external DNS servers containing @@ -5600,7 +5616,7 @@ deny-answer-aliases { "example.net"; };
BIND 9 includes an intentionally limited mechanism to modify DNS responses for recursive requests @@ -6036,7 +6052,7 @@ ns.domain.com.rpz-nsdname CNAME .
The statistics-channels statement @@ -6096,7 +6112,7 @@ ns.domain.com.rpz-nsdname CNAME .
The trusted-keys statement defines @@ -6136,7 +6152,7 @@ ns.domain.com.rpz-nsdname CNAME .
managed-keys {string
initial-keynumber
number
number
string
; [string
initial-keynumber
number
number
string
; [...]] @@ -6271,7 +6287,7 @@ ns.domain.com.rpz-nsdname CNAME .The view statement is a powerful feature @@ -6572,10 +6588,10 @@ zone
zone_name
[
@@ -6855,7 +6871,7 @@ zone zone_name
[The zone's name may optionally be followed by a class. If a class is not specified, class
IN
(forInternet
), @@ -6877,7 +6893,7 @@ zonezone_name
[
- allow-notify
@@ -7788,7 +7804,7 @@ example.com. NS ns2.example.net.
@@ -7801,7 +7817,7 @@ example.com. NS ns2.example.net.A domain name identifies a node. Each node has a set of resource information, which may be empty. The set of resource @@ -8538,7 +8554,7 @@ example.com. NS ns2.example.net.
RRs are represented in binary form in the packets of the DNS protocol, and are usually represented in highly encoded form @@ -8741,7 +8757,7 @@ example.com. NS ns2.example.net.
As described above, domain servers store information as a series of resource records, each of which contains a particular @@ -8997,7 +9013,7 @@ example.com. NS ns2.example.net.
Reverse name resolution (that is, translation from IP address to name) is achieved by means of the in-addr.arpa domain @@ -9058,7 +9074,7 @@ example.com. NS ns2.example.net.
The Master File Format was initially defined in RFC 1035 and has subsequently been extended. While the Master File Format @@ -9073,7 +9089,7 @@ example.com. NS ns2.example.net.
When used in the label (or name) field, the asperand or at-sign (@) symbol represents the current origin. @@ -9084,7 +9100,7 @@ example.com. NS ns2.example.net.
Syntax: $ORIGIN
domain-name
@@ -9113,7 +9129,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.Syntax: $INCLUDE
filename
@@ -9149,7 +9165,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.Syntax: $TTL
default-ttl
@@ -9168,7 +9184,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.Syntax: $GENERATE
range
@@ -9592,7 +9608,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -10149,7 +10165,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -10303,7 +10319,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -10686,7 +10702,7 @@ HOST-127.EXAMPLE. MX 0 . Socket I/O statistics counters are defined per socket types, which are @@ -10841,7 +10857,7 @@ HOST-127.EXAMPLE. MX 0 .
Most statistics counters that were available in BIND 8 are also supported in diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index 77237361..fd896f03 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -46,10 +46,10 @@Table of Contents
@@ -122,7 +122,7 @@ zone "example.com" {On UNIX servers, it is possible to run BIND @@ -148,7 +148,7 @@ zone "example.com" {
In order for a chroot environment to @@ -176,7 +176,7 @@ zone "example.com" {
Prior to running the named daemon, use diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index db15aad8..ef4a9c48 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -45,18 +45,18 @@Table of Contents
The best solution to solving installation and configuration issues is to take preventative measures by setting @@ -68,7 +68,7 @@
Zone serial numbers are just numbers — they aren't date related. A lot of people set them to a number that @@ -95,7 +95,7 @@
The Internet Systems Consortium (ISC) offers a wide range diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index fbfe9341..5914644e 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -45,31 +45,31 @@Table of Contents
@@ -278,42 +278,42 @@Standards
-[RFC974] Mail Routing and the Domain System. January 1986.
+[RFC974] Mail Routing and the Domain System. January 1986.
Proposed Standards
-[RFC1995] Incremental Zone Transfer in DNS. August 1996.
+[RFC1995] Incremental Zone Transfer in DNS. August 1996.
-[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
+[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
-[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
+[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
-[RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997.
+[RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997.
-[RFC2672] Non-Terminal DNS Name Redirection. August 1999.
+[RFC2672] Non-Terminal DNS Name Redirection. August 1999.
-[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-[RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000.
+[RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000.
-[RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+[RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-[RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000.
+[RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000.
-@@ -322,19 +322,19 @@[RFC3645] Generic Security Service Algorithm for Secret +
[RFC3645] Generic Security Service Algorithm for Secret Key Transaction Authentication for DNS (GSS-TSIG). October 2003.
DNS Security Proposed Standards
-[RFC3225] Indicating Resolver Support of DNSSEC. December 2001.
+[RFC3225] Indicating Resolver Support of DNSSEC. December 2001.
-[RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004.
+[RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004.
-[RFC4033] DNS Security Introduction and Requirements. March 2005.
+[RFC4033] DNS Security Introduction and Requirements. March 2005.
-[RFC4034] Resource Records for the DNS Security Extensions. March 2005.
+[RFC4034] Resource Records for the DNS Security Extensions. March 2005.
-@@ -342,146 +342,146 @@[RFC4035] Protocol Modifications for the DNS +
[RFC4035] Protocol Modifications for the DNS Security Extensions. March 2005.
Other Important RFCs About DNS Implementation
-[RFC1535] A Security Problem and Proposed Correction With Widely +
[RFC1535] A Security Problem and Proposed Correction With Widely Deployed DNS Software.. October 1993.
-[RFC1536] Common DNS Implementation +
[RFC1536] Common DNS Implementation Errors and Suggested Fixes. October 1993.
-[RFC4074] Common Misbehaviour Against DNS +
[RFC4074] Common Misbehaviour Against DNS Queries for IPv6 Addresses. May 2005.
Resource Record Types
-[RFC1706] DNS NSAP Resource Records. October 1994.
+[RFC1706] DNS NSAP Resource Records. October 1994.
-[RFC2168] Resolution of Uniform Resource Identifiers using +
[RFC2168] Resolution of Uniform Resource Identifiers using the Domain Name System. June 1997.
-[RFC1876] A Means for Expressing Location Information in the +
[RFC1876] A Means for Expressing Location Information in the Domain Name System. January 1996.
-[RFC2052] A DNS RR for Specifying the +
[RFC2052] A DNS RR for Specifying the Location of Services.. October 1996.
-[RFC2163] Using the Internet DNS to +
[RFC2163] Using the Internet DNS to Distribute MIXER Conformant Global Address Mapping. January 1998.
-[RFC2230] Key Exchange Delegation Record for the DNS. October 1997.
+[RFC2230] Key Exchange Delegation Record for the DNS. October 1997.
-[RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+[RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-[RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+[RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-[RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999.
+[RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999.
-[RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+[RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-[RFC2540] Detached Domain Name System (DNS) Information. March 1999.
+[RFC2540] Detached Domain Name System (DNS) Information. March 1999.
-[RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000.
+[RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000.
-[RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+[RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-[RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+[RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-[RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+[RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
DNS and the Internet
-[RFC1101] DNS Encoding of Network Names +
[RFC1101] DNS Encoding of Network Names and Other Types. April 1989.
-[RFC1123] Requirements for Internet Hosts - Application and +
[RFC1123] Requirements for Internet Hosts - Application and Support. October 1989.
-[RFC1591] Domain Name System Structure and Delegation. March 1994.
+[RFC1591] Domain Name System Structure and Delegation. March 1994.
-[RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998.
+[RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998.
DNS Operations
-[RFC1033] Domain administrators operations guide.. November 1987.
+[RFC1033] Domain administrators operations guide.. November 1987.
-[RFC1912] Common DNS Operational and +
[RFC1912] Common DNS Operational and Configuration Errors. February 1996.
Internationalized Domain Names
-[RFC2825] A Tangled Web: Issues of I18N, Domain Names, +
[RFC2825] A Tangled Web: Issues of I18N, Domain Names, and the Other Internet protocols. May 2000.
-@@ -497,47 +497,47 @@[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003.
+[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003.
-[RFC1464] Using the Domain Name System To Store Arbitrary String +
[RFC1464] Using the Domain Name System To Store Arbitrary String Attributes. May 1993.
-[RFC1713] Tools for DNS Debugging. November 1994.
+[RFC1713] Tools for DNS Debugging. November 1994.
-[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
+[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
-[RFC2345] Domain Names and Company Name Retrieval. May 1998.
+[RFC2345] Domain Names and Company Name Retrieval. May 1998.
-[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
+[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
-[RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+[RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-[RFC3258] Distributing Authoritative Name Servers via +
[RFC3258] Distributing Authoritative Name Servers via Shared Unicast Addresses. April 2002.
-[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004.
+[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004.
@@ -551,39 +551,39 @@Obsolete and Unimplemented Experimental RFC
-[RFC1712] DNS Encoding of Geographical +
[RFC1712] DNS Encoding of Geographical Location. November 1994.
-[RFC2065] Domain Name System Security Extensions. January 1997.
+[RFC2065] Domain Name System Security Extensions. January 1997.
-[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
+[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
-[RFC2535] Domain Name System Security Extensions. March 1999.
+[RFC2535] Domain Name System Security Extensions. March 1999.
-[RFC3008] Domain Name System Security (DNSSEC) +
[RFC3008] Domain Name System Security (DNSSEC) Signing Authority. November 2000.
-[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001.
+[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001.
-[RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002.
+[RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002.
-[RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+[RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-[RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003.
+[RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003.
-[RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+[RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-[RFC3757] Domain Name System KEY (DNSKEY) Resource Record +
[RFC3757] Domain Name System KEY (DNSKEY) Resource Record (RR) Secure Entry Point (SEP) Flag. April 2004.
-@@ -604,14 +604,14 @@[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
-@@ -648,7 +648,7 @@DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
+DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
GNU make is required to build the export libraries (other part of BIND 9 can still be built with other types of make). In the reminder of this document, "make" means GNU make. Note that @@ -657,7 +657,7 @@
$./configure --enable-exportlib
$[other flags]
make
@@ -672,7 +672,7 @@ $make
$cd lib/export
$make install
@@ -694,7 +694,7 @@ $make install
Currently, win32 is not supported for the export library. (Normal BIND 9 application can be built as @@ -734,7 +734,7 @@ $
make
The IRS library supports an "advanced" configuration file related to the DNS library for configuration parameters that would be beyond the capability of the @@ -752,14 +752,14 @@ $
make
Some sample application programs using this API are provided for reference. The following is a brief description of these applications.
It sends a query of a given name (of a given optional RR type) to a specified recursive server, and prints the result as a list of @@ -823,7 +823,7 @@ $
make
Similar to "sample", but accepts a list of (query) domain names as a separate file and resolves the names @@ -864,7 +864,7 @@ $
make
It sends a query to a specified server, and prints the response with minimal processing. It doesn't act as a @@ -905,7 +905,7 @@ $
make
This is a test program to check getaddrinfo() and getnameinfo() behavior. It takes a @@ -922,7 +922,7 @@ $
make
It accepts a single update command as a command-line argument, sends an update request message to the @@ -1017,7 +1017,7 @@ $
sample-update -a sample-update -k Kxxx.+nnn+mm
It checks a set of domains to see the name servers of the domains behave @@ -1074,7 +1074,7 @@ $
sample-update -a sample-update -k Kxxx.+nnn+mm
As of this writing, there is no formal "manual" of the libraries, except this document, header files (some of them provide pretty detailed explanations), and sample application diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index 1daa002e..0ea9dc93 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - +
@@ -83,7 +83,7 @@Name Server Operations 4. Advanced DNS Features @@ -92,64 +92,64 @@Dynamic Update Incremental Zone Transfers (IXFR) -Split DNS -+ Split DNS +TSIG - -
- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
TKEY -SIG(0) +TKEY +SIG(0) DNSSEC DNSSEC, Dynamic Zones, and Automatic Signing -
- Converting from insecure to secure
-- Dynamic DNS update method
-- Fully automatic zone signing
-- Private-type records
-- DNSKEY rollovers
-- Dynamic DNS update method
-- Automatic key rollovers
-- NSEC3PARAM rollovers via UPDATE
-- Converting from NSEC to NSEC3
-- Converting from NSEC3 to NSEC
-- Converting from secure to insecure
-- Periodic re-signing
-- NSEC3 and OPTOUT
+- Converting from insecure to secure
+- Dynamic DNS update method
+- Fully automatic zone signing
+- Private-type records
+- DNSKEY rollovers
+- Dynamic DNS update method
+- Automatic key rollovers
+- NSEC3PARAM rollovers via UPDATE
+- Converting from NSEC to NSEC3
+- Converting from NSEC3 to NSEC
+- Converting from secure to insecure
+- Periodic re-signing
+- NSEC3 and OPTOUT
Dynamic Trust Anchor Management PKCS #11 (Cryptoki) support - -
- Prerequisites
-- Building BIND 9 with PKCS#11
-- PKCS #11 Tools
-- Using the HSM
-- Specifying the engine on the command line
-- Running named with automatic zone re-signing
+- Prerequisites
+- Building BIND 9 with PKCS#11
+- PKCS #11 Tools
+- Using the HSM
+- Specifying the engine on the command line
+- Running named with automatic zone re-signing
IPv6 Support in BIND 9 +IPv6 Support in BIND 9 5. The BIND 9 Lightweight Resolver 6. BIND 9 Configuration Reference @@ -157,58 +157,58 @@Configuration File Elements Configuration File Grammar - -
- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and Usage
-- include Statement Grammar
-- include Statement Definition and +
- include Statement Grammar
+- include Statement Definition and Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and +
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and +
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and Usage
- server Statement Grammar
- server Statement Definition and Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and +
- statistics-channels Statement Definition and Usage
- trusted-keys Statement Grammar
-- trusted-keys Statement Definition +
- trusted-keys Statement Definition and Usage
-- managed-keys Statement Grammar
+- managed-keys Statement Grammar
- managed-keys Statement Definition and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
Zone File +Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics @@ -217,41 +217,41 @@7. BIND 9 Security Considerations 8. Troubleshooting A. Appendices I. Manual pages diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index bdded874..69ee47ee 100755 --- a/doc/arm/Bv9ARM.pdf +++ b/doc/arm/Bv9ARM.pdf @@ -3309,7 +3309,7 @@ endobj /ProcSet [ /PDF /Text ] >> endobj 1078 0 obj << -/Length 3423 +/Length 3426 /Filter /FlateDecode >> stream @@ -3318,16 +3318,12 @@ x ž[´2F>èV&䲘`ˆaµRªŸ“L(¨÷8ûÖZ«¤Ö̾ŸÏçÓjÔŠú¦¥Ã{p[9 º%!]Å0 C†ŽýSì\¨÷ƒò-‚“ÂÐÖñ^Ο}ÁìîédvV×àø#˜—±²WÌ0ÄØ訣ûÙÈızOlÿC.$d£-Óí_¦Ãåj4þ³i+ÞU‹OõxuègŲ‘©*b t¤@@ÈÄ€zO pCœâ‚ žÇÕrÙ@ðb>[Û‹ù´î4Q3Ñ‹EH\1Àâ#‚E&Ô{‚)â,3Õ`q8óÓ×#ÏÆÞPSö úÐ}„ã1<:õ¯òäâÀð@½'<¨$”QñÐ ¿Ö+8M£ñìôtÝf¬[aÌS£óVL0Ĩèèâú©ÈÄQzT(Çëõm©0 泪âdÏÑÝÅh¶ü¸T(Þ°ˆ‰+Å"Xt„1ýó\¸÷„…¥„궡âýþÛŠ·óE[€x=Y®j,äSkWLE²Ã ²˜þ‚V& Ìu"B[B…-â$Þ\V‹Ñj=)]O>¾.WÕEóú¸ZίÖʸ °\LjZ¬Tk56& XZ`ˆilD¿¸™80uQïI^¥ ã¦[…¢~g“›5Loɯx/!GÅ CŒ ¨F@&Œ Ô{"@J”kx[-&óÓÉ8øîhÙÖÖs‹O£iý;-ܶ7ï!IÅ C(‚‘ýdâÀ@½'„WÝ*ÕA€7¬EŸ_Χó3?U0«KáþäÆà˜…b!¦1̲é/IæâÀ4F½' 'Bt Ìä$>¸¸\µeë ú>” ¾GŸrT@²Ãô -`òßSsÄ÷ãE¡i·aõŸž®79¦a•{œ~¥_ŒÆçëŽÂi½=%‡˜Žb¡!¦4L·íßÌ‹ÓõžÄ––ëº%׈]¯^Ç-n/ý¯};$B<â±`ÌX1Àã*bû+̹80P‰d¶³Ã…·EÈãjy9Ÿ-«°ø0ŒAÛß¼ú*züöƒÿƒ…jå獩LK&ï}·¾~±¸À¦×ö×sq`â¢ÞãŽXÉ%‘Ò€â’Ù¸#¶ÄeŠÔ³¡7Üàf›§½…Ls1Ž ’¶¿‹ãõž8bœH£A ÊÞG›7V[· …§˜Ñb^€!ÆTã%Æê=ñB)QT“ÛÌ‹a²\MÆËáø|4›UÓÜ®|«ˆTÖmh„$7[p²9f±˜`ˆ1U²HY!Æê=2"¬72¡8ýŒln`”ûHô±³UÊ4DX訰‹a÷žX0š(Æ |ó!÷Õâj¹ªN‡V_ûn@àvÓ`ÅÊ„”ó’ì0\€`-7ƒÀ`Á\'V´$ÊZçw -Ëæƒ+ñ°1…Åp CŒ(†G&ŒÔ{DqOå,~›ãê3/e/ ÚO¥•Z-åö5#!™Å¨ C(–íߟ‹CõžP©oZR,ø¼STn1»¡æÞ·!iÅH C ( -†D& Ô{B¢£V;"±ùú§Iõ9wCŠô_ÈÏñVC ñR{a -é.† b0A9mÿºJ.&Ô{‚©ÞÙO]ª¿q}'0mnW´ÓÛsISLk14ÀƒÊ†A“‰ƒõž ¡’®Ûᛋ¶õâzjܦ0”µxy'¦»&`ˆÁåtý‡Jrq`0¡Þ#LÜqb´U{'0mnŒbÛÓmÅ´–B h:²¹þe£\4¸÷¸&È-%Æ£H>,–= öõ²ZŸBugX/ !…Å€ C(H&Ô{ÄÏr,8ï£joÌx1O±>‹2îÉÂÏbX’Æ -PËõ/e‚ÀHÁ\'P”&V)I×[’xËŽàO H-d®˜ `ˆA•Á¨ÈÄazO\HéG’C.Úë4ö¿ÎFáØÓûËS?Ì ûO&u#•ÚZÙCbŠe†˜ì0ñ®j“‹“õîüK+Ä€N¡ÜæF;-ÁËÉ´^€SîÁw÷rð*ˆ®gQ†Û2ÖÚ ¡aŽ±ëŸ_ËÌhÿŽ¶\ d¨û4åá”8ÉCÑEÔCWÆigÄZÃ6ÿØw¼ö¸Ï›31Ëks™ŸWíôf5³›0>¯`#îQÅ62R,80ćGÏ‚ ŽºO µÄ¦“àkÉÅfm`jlô - +æb<@AP2`< î#ÌBi¼D¶æ·<¬OÔV_VWa?{õå2ܽ+±a8^Ïdô¶ö1O¥@CƒŽ¾§ïÅ ‚î>ö¬~Œw6bÀÛ~`²_eôþå?™&BÒGù8„ aÈa1"ÀCj„"’ CuŸ1‚Ðz«X@D´ˆ¼«Vér•““×käÓ ³ áb€€!TÑþ“´¹@0€P÷ ÍêÇYE~dËÏᬾ´rü2º¼Œ0…ƒt‡o?ù7s+žæ#!‰Åˆ$;Œ -ÈÍ(0>0ß écñ†Qß ¹æãÍê<”½>û]¯¦LšAÉx5ùTOW„d¹ -Y,b„@•í߯–cuŸ†«Â&ã%@’8}¹ÍõÿÊ,ÕùW‚‡7Ô'´F«árr6kNi)Åž:¦˜õb¨€!T…*ê>AÅ=EFI /€ê§7LJ¯rÏ&4D°xgL§¡Úº{DÖßµ2èZÌ0Äx‚¡¼dÁxAÝ'^˜ŸQ© /¢„—ã¯ßïä6Wû‘¸}Àp±}ÝUHe1)À#J…’’ #uŸH¡Œp!4 E–âgS¹Í%šXéz(1J=®qHq1AÀ#JÈhÿÛ\ A¨û8*¶ŽpÍSyN·ƒâç‡GûaÆT?ûëú¨øà˪šÕe›ú1£»«,nÌhª -;%zuptpü¬®ûäš'íçyTÈ