Keys that do not match the root zone name are ignored.
An alternate key name can be specified using the
- +root=NAME options. DNSSEC Lookaside
- Validation can also be turned on by using the
- +dlv=NAME to specify the name of a
- zone containing DLV records.
+ +root=NAME options.
Note: When reading the trust anchor file,
@@ -520,14 +517,13 @@
request DNSSEC records or whether to validate them.
DNSSEC records are always requested, and validation
will always occur unless suppressed by the use of
- -i or +noroot and
- +nodlv.
+ -i or +noroot.
+[no]root[=ROOT]- Indicates whether to perform conventional (non-lookaside) + Indicates whether to perform conventional DNSSEC validation, and if so, specifies the name of a trust anchor. The default is to validate using a trust anchor of "." (the root zone), for which there is @@ -536,15 +532,6 @@ containing the key.
+[no]dlv[=DLV]
- Indicates whether to perform DNSSEC lookaside validation,
- and if so, specifies the name of the DLV trust anchor.
- The -a option must also be used to specify
- a file containing the DLV key.
-
+[no]tcpdiff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index 7da5c5693a..c17d9a6559 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -361,14 +361,20 @@ Display [do not display] the CLASS when printing the record\&. .PP \fB+[no]cmd\fR .RS 4 -Toggles the printing of the initial comment in the output identifying the version of +Toggles the printing of the initial comment in the output, identifying the version of \fBdig\fR -and the query options that have been applied\&. This comment is printed by default\&. +and the query options that have been applied\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. The default is to print this comment\&. .RE .PP \fB+[no]comments\fR .RS 4 -Toggle the display of comment lines in the output\&. The default is to print comments\&. +Toggles the display of some comment lines in the output, containing information about the packet header and OPT pseudosection, and the names of the response section\&. The default is to print these comments\&. +.sp +Other types of comments in the output are not affected by this option, but can be controlled using other command line switches\&. These include +\fB+[no]cmd\fR, +\fB+[no]question\fR, +\fB+[no]stats\fR, and +\fB+[no]rrcomments\fR\&. .RE .PP \fB+[no]cookie\fR\fB[=####]\fR @@ -566,12 +572,12 @@ would cause a 48\-byte query to be padded to 64 bytes\&. The default block size .PP \fB+[no]qr\fR .RS 4 -Print [do not print] the query as it is sent\&. By default, the query is not printed\&. +Toggles the display of the query message as it is sent\&. By default, the query is not printed\&. .RE .PP \fB+[no]question\fR .RS 4 -Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&. +Toggles the display of the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&. .RE .PP \fB+[no]raflag\fR @@ -624,7 +630,7 @@ determines if the name will be treated as relative or not and hence whether a se .PP \fB+[no]short\fR .RS 4 -Provide a terse answer\&. The default is to print the answer in a verbose form\&. +Provide a terse answer\&. The default is to print the answer in a verbose form\&. This option always has global effect; it cannot be set globally and then overridden on a per\-lookup basis\&. .RE .PP \fB+[no]showsearch\fR @@ -654,7 +660,7 @@ causes fields not to be split at all\&. The default is 56 characters, or 44 char .PP \fB+[no]stats\fR .RS 4 -This query option toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics\&. +Toggles the printing of statistics: when the query was made, the size of the reply and so on\&. The default behavior is to print the query statistics as a comment after each lookup\&. .RE .PP \fB+[no]subnet=addr[/prefix\-length]\fR diff --git a/bin/dig/dig.html b/bin/dig/dig.html index d191d7a6b5..a078616f01 100644 --- a/bin/dig/dig.html +++ b/bin/dig/dig.html @@ -481,16 +481,28 @@
Toggles the printing of the initial comment in the - output identifying the version of dig - and the query options that have been applied. This - comment is printed by default. + output, identifying the version of dig + and the query options that have been applied. This option + always has global effect; it cannot be set globally + and then overridden on a per-lookup basis. The default + is to print this comment.
+[no]comments- Toggle the display of comment lines in the output. - The default is to print comments. + Toggles the display of some comment lines in the output, + containing information about the packet header and + OPT pseudosection, and the names of the response + section. The default is to print these comments. +
++ Other types of comments in the output are not affected by + this option, but can be controlled using other command + line switches. These include +[no]cmd, + +[no]question, + +[no]stats, and + +[no]rrcomments.
+[no]cookie[=####]+[no]qr- Print [do not print] the query as it is sent. By - default, the query is not printed. + Toggles the display of the query message as it is sent. + By default, the query is not printed.
+[no]question- Print [do not print] the question section of a query + Toggles the display of the question section of a query when an answer is returned. The default is to print the question section as a comment.
@@ -841,7 +853,9 @@Provide a terse answer. The default is to print the - answer in a verbose form. + answer in a verbose form. This option always has global + effect; it cannot be set globally and then overridden on + a per-lookup basis.
+[no]showsearch+[no]stats- This query option toggles the printing of statistics: - when the query was made, the size of the reply and - so on. The default behavior is to print the query - statistics. + Toggles the printing of statistics: when the query was made, + the size of the reply and so on. The default behavior is to + print the query statistics as a comment after each lookup.
+[no]subnet=addr[/prefix-length]
The dnssec-dsfromkey command outputs DS (Delegation
- Signer) resource records (RRs) and other similarly-constructed RRs:
- with the -l option it outputs DLV (DNSSEC Lookaside
- Validation) RRs; or with the -C it outputs CDS (Child
- DS) RRs.
+ Signer) resource records (RRs), or CDS (Child DS) RRs with the
+ -C option.
@@ -182,9 +180,7 @@
- Generate CDS records rather than DS records. This is mutually
- exclusive with the -l option for generating DLV
- records.
+ Generate CDS records rather than DS records.
filedirectory.
-domain
- Generate a DLV set instead of a DS set. The specified
- domain is appended to the name for each
- record in the set.
- This is mutually exclusive with the -C option
- for generating CDS records.
-
@@ -311,7 +297,6 @@
,
BIND 9 Administrator Reference Manual,
RFC 3658 (DS RRs),
- RFC 4431 (DLV RRs),
RFC 4509 (SHA-256 for DS RRs),
RFC 6605 (SHA-384 for DS RRs),
RFC 7344 (CDS and CDNSKEY RRs).
diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8
index 7a099ecf13..3a0db6862c 100644
--- a/bin/dnssec/dnssec-signzone.8
+++ b/bin/dnssec/dnssec-signzone.8
@@ -39,7 +39,7 @@
dnssec-signzone \- DNSSEC zone signing tool
.SH "SYNOPSIS"
.HP \w'\fBdnssec\-signzone\fR\ 'u
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
.SH "DESCRIPTION"
.PP
\fBdnssec\-signzone\fR
@@ -113,11 +113,6 @@ Key repository: Specify a directory to search for DNSSEC keys\&. If not specifie
Treat specified key as a key signing key ignoring any key flags\&. This option may be specified multiple times\&.
.RE
.PP
-\-l \fIdomain\fR
-.RS 4
-Generate a DLV set in addition to the key (DNSKEY) and DS sets\&. The domain is appended to the name of the records\&.
-.RE
-.PP
\-M \fImaxttl\fR
.RS 4
Sets the maximum TTL for the signed zone\&. Any TTL higher than
@@ -296,6 +291,13 @@ forces
to remove signatures from keys that are no longer active\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.1 ("Pre\-Publish Key Rollover")\&.
.RE
.PP
+\-q
+.RS 4
+Quiet mode: Suppresses unnecessary output\&. Without this option, when
+\fBdnssec\-signzone\fR
+is run it will print to standard output the number of keys in use, the algorithms used to verify the zone was signed correctly and other status information, and finally the filename containing the signed zone\&. With it, that output is suppressed, leaving only the filename\&.
+.RE
+.PP
\-R
.RS 4
Remove signatures from keys that are no longer published\&.
diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html
index ffd4c77e2f..fe7cb3c028 100644
--- a/bin/dnssec/dnssec-signzone.html
+++ b/bin/dnssec/dnssec-signzone.html
@@ -55,6 +55,7 @@
[-O ]
[output-format-P]
[-Q]
+ [-q]
[-R]
[-S]
[-s ]
@@ -173,13 +174,6 @@
key flags. This option may be specified multiple times.
start-time
domain- Generate a DLV set in addition to the key (DNSKEY) and DS sets. - The domain is appended to the name of the records. -
-maxttl@@ -429,6 +423,18 @@ RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover").
+ Quiet mode: Suppresses unnecessary output. Without this + option, when dnssec-signzone is run it + will print to standard output the number of keys in use, + the algorithms used to verify the zone was signed correctly + and other status information, and finally the filename + containing the signed zone. With it, that output is + suppressed, leaving only the filename. +
+
diff --git a/bin/dnssec/dnssec-verify.8 b/bin/dnssec/dnssec-verify.8
index 592dd0890f..bedf131cdf 100644
--- a/bin/dnssec/dnssec-verify.8
+++ b/bin/dnssec/dnssec-verify.8
@@ -39,7 +39,7 @@
dnssec-verify \- DNSSEC zone verification tool
.SH "SYNOPSIS"
.HP \w'\fBdnssec\-verify\fR\ 'u
-\fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile}
+\fBdnssec\-verify\fR [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-q\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-x\fR] [\fB\-z\fR] {zonefile}
.SH "DESCRIPTION"
.PP
\fBdnssec\-verify\fR
@@ -81,6 +81,13 @@ Sets the debugging level\&.
Prints version information\&.
.RE
.PP
+\-q
+.RS 4
+Quiet mode: Suppresses output\&. Without this option, when
+\fBdnssec\-verify\fR
+is run it will print to standard output the number of keys in use, the algorithms used to verify the zone was signed correctly and other status information\&. With it, all non\-error output is suppressed, and only the exit code will indicate success\&.
+.RE
+.PP
\-x
.RS 4
Only verify that the DNSKEY RRset is signed with key\-signing keys\&. Without this flag, it is assumed that the DNSKEY RRset will be signed by all active keys\&. When this flag is set, it will not be an error if the DNSKEY RRset is not signed by zone\-signing keys\&. This corresponds to the
diff --git a/bin/dnssec/dnssec-verify.html b/bin/dnssec/dnssec-verify.html
index aff7f8483e..b62ca61825 100644
--- a/bin/dnssec/dnssec-verify.html
+++ b/bin/dnssec/dnssec-verify.html
@@ -37,6 +37,7 @@
[-E ]
[engine-I ]
[input-format-o ]
+ [origin-q]
[-v ]
[level-V]
[-x]
@@ -112,6 +113,17 @@
Prints version information.
+ Quiet mode: Suppresses output. Without this option, when + dnssec-verify is run it will print to + standard output the number of keys in use, the algorithms + used to verify the zone was signed correctly and other + status information. With it, all non-error output is + suppressed, and only the exit code will indicate success. +
+
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 3d8965df1c..510e2b5c0a 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -10,12 +10,12 @@
.\" Title: named.conf
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.78.1
Deprecated - see DNSSEC-KEYS.
@@ -210,7 +209,7 @@ options check-srv-cname ( fail | warn | ignore );boolean;integer;string;sizeval );sizeval );boolean;boolean;integer;stringstring |string boolean;boolean;integer integerinteger quoted_string; ... };integer;stringstring |string boolean;boolean;integer ] [ dscp integer ] { ( mastersipv4_address [ port integer ] | ipv6_address [integer ] ) [ key string ]; ... };sizeval );integer;integer;ipv6_address | * ) [ port ( integerinteger ];boolean;integer integer integerboolean;boolean;dnssec-checkds - verifies the correctness of Delegation Signer (DS) or DNSSEC - Lookaside Validation (DLV) resource records for keys in a specified - zone. + verifies the correctness of Delegation Signer (DS) + resource records for keys in a specified zone.
Specify a digest algorithm to use when converting the - zone's DNSKEY records to expected DS or DLV records. This + zone's DNSKEY records to expected DS records. This option can be repeated, so that multiple records are checked for each DNSKEY record.
@@ -79,13 +78,6 @@ then the DNSKEY records for the zone are looked up in the DNS.domain- Check for a DLV record in the specified lookaside domain, - instead of checking for a DS record in the zone's parent. -
-filediff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index f27750b36b..388ae8dd6b 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -614,6 +614,6 @@ -
BIND 9.15.2 (Development Release)
+BIND 9.15.3 (Development Release)