From 9bb0b30bc25f8982b624e00a9c1b98a644435b1e Mon Sep 17 00:00:00 2001
From: Tinderbox User
Date: Mon, 3 Jun 2019 19:29:39 +0000
Subject: [PATCH] prep 9.15.1
---
CHANGES | 2 +
CONTRIBUTING | 2 +
HISTORY | 10 +-
OPTIONS | 4 +-
PLATFORMS | 27 +-
README | 40 +-
README.md | 2 +-
bin/delv/delv.1 | 16 +-
bin/delv/delv.html | 19 +-
bin/dig/dig.1 | 6 +-
bin/dig/dig.html | 6 +-
bin/named/named.conf.5 | 71 ++--
bin/named/named.conf.html | 102 ++---
bin/rndc/rndc.8 | 20 +-
bin/rndc/rndc.html | 19 +-
doc/arm/Bv9ARM.ch01.html | 2 +-
doc/arm/Bv9ARM.ch02.html | 2 +-
doc/arm/Bv9ARM.ch03.html | 2 +-
doc/arm/Bv9ARM.ch04.html | 51 ++-
doc/arm/Bv9ARM.ch05.html | 536 +++++++++++++++------------
doc/arm/Bv9ARM.ch06.html | 2 +-
doc/arm/Bv9ARM.ch07.html | 2 +-
doc/arm/Bv9ARM.ch08.html | 100 ++++-
doc/arm/Bv9ARM.ch09.html | 2 +-
doc/arm/Bv9ARM.ch10.html | 2 +-
doc/arm/Bv9ARM.ch11.html | 14 +-
doc/arm/Bv9ARM.ch12.html | 2 +-
doc/arm/Bv9ARM.html | 19 +-
doc/arm/Bv9ARM.pdf | Bin 1077833 -> 1083159 bytes
doc/arm/man.arpaname.html | 2 +-
doc/arm/man.ddns-confgen.html | 2 +-
doc/arm/man.delv.html | 21 +-
doc/arm/man.dig.html | 8 +-
doc/arm/man.dnssec-cds.html | 2 +-
doc/arm/man.dnssec-checkds.html | 2 +-
doc/arm/man.dnssec-coverage.html | 2 +-
doc/arm/man.dnssec-dsfromkey.html | 2 +-
doc/arm/man.dnssec-importkey.html | 2 +-
doc/arm/man.dnssec-keyfromlabel.html | 2 +-
doc/arm/man.dnssec-keygen.html | 2 +-
doc/arm/man.dnssec-keymgr.html | 2 +-
doc/arm/man.dnssec-revoke.html | 2 +-
doc/arm/man.dnssec-settime.html | 2 +-
doc/arm/man.dnssec-signzone.html | 2 +-
doc/arm/man.dnssec-verify.html | 2 +-
doc/arm/man.dnstap-read.html | 2 +-
doc/arm/man.filter-aaaa.html | 2 +-
doc/arm/man.host.html | 2 +-
doc/arm/man.mdig.html | 2 +-
doc/arm/man.named-checkconf.html | 2 +-
doc/arm/man.named-checkzone.html | 2 +-
doc/arm/man.named-journalprint.html | 2 +-
doc/arm/man.named-nzd2nzf.html | 2 +-
doc/arm/man.named-rrchecker.html | 2 +-
doc/arm/man.named.conf.html | 104 +++---
doc/arm/man.named.html | 2 +-
doc/arm/man.nsec3hash.html | 2 +-
doc/arm/man.nslookup.html | 2 +-
doc/arm/man.nsupdate.html | 2 +-
doc/arm/man.pkcs11-destroy.html | 2 +-
doc/arm/man.pkcs11-keygen.html | 2 +-
doc/arm/man.pkcs11-list.html | 2 +-
doc/arm/man.pkcs11-tokens.html | 2 +-
doc/arm/man.rndc-confgen.html | 2 +-
doc/arm/man.rndc.conf.html | 2 +-
doc/arm/man.rndc.html | 21 +-
doc/arm/notes.html | 96 ++++-
doc/arm/notes.pdf | Bin 60620 -> 64710 bytes
doc/arm/notes.txt | 46 ++-
doc/arm/notes.xml | 73 ++--
doc/misc/options | 23 +-
lib/dns/api | 2 +-
lib/irs/api | 2 +-
lib/isc/api | 2 +-
lib/ns/api | 2 +-
version | 2 +-
76 files changed, 904 insertions(+), 646 deletions(-)
diff --git a/CHANGES b/CHANGES
index d09f3a9478..76e7106d04 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,8 @@
statistics when hitting recursive clients
soft quota. [GL #1067]
+ --- 9.15.1 released ---
+
5248. [func] To clarify the configuration of DNSSEC keys,
the "managed-keys" and "trusted-keys" options
have both been deprecated. The new "dnssec-keys"
diff --git a/CONTRIBUTING b/CONTRIBUTING
index 003a7c8593..288bcab915 100644
--- a/CONTRIBUTING
+++ b/CONTRIBUTING
@@ -1,3 +1,5 @@
+CONTRIBUTING
+
BIND Source Access and Contributor Guidelines
Feb 22, 2018
diff --git a/HISTORY b/HISTORY
index c8b5cb9d15..1e3dc72233 100644
--- a/HISTORY
+++ b/HISTORY
@@ -1,3 +1,5 @@
+HISTORY
+
Functional enhancements from prior major releases of BIND 9
BIND 9.14
@@ -505,11 +507,11 @@ BIND 9.4.0
* Detect duplicates of UDP queries we are recursing on and drop them.
New stats category "duplicates".
* "USE INTERNAL MALLOC" is now runtime selectable.
- * The lame cache is now done on a basis as some servers only appear to
- be lame for certain query types.
+ * The lame cache is now done on a basis as some
+ servers only appear to be lame for certain query types.
* Limit the number of recursive clients that can be waiting for a single
- query () to resolve. New options clients-per-query and
- max-clients-per-query.
+ query () to resolve. New options clients-per-query
+ and max-clients-per-query.
* dig: report the number of extra bytes still left in the packet after
processing all the records.
* Support for IPSECKEY rdata type.
diff --git a/OPTIONS b/OPTIONS
index 340b53db67..811cf7c867 100644
--- a/OPTIONS
+++ b/OPTIONS
@@ -1,10 +1,12 @@
+OPTIONS
+
Setting the STD_CDEFINES environment variable before running configure can
be used to enable certain compile-time options that are not explicitly
defined in configure.
Some of these settings are:
-Setting Description
+ Setting Description
Overwrite memory with tag values when allocating
-DISC_MEM_DEFAULTFILL=1 or freeing it; this impairs performance but
makes debugging of memory problems easier.
diff --git a/PLATFORMS b/PLATFORMS
index e0a0aa6aab..6e123440e0 100644
--- a/PLATFORMS
+++ b/PLATFORMS
@@ -1,3 +1,5 @@
+PLATFORMS
+
Supported platforms
In general, this version of BIND will build and run on any POSIX-compliant
@@ -64,31 +66,6 @@ These are platforms on which BIND 9.15 is known not to build or run:
Platform quirks
-ARM
-
-If the compilation ends with following error:
-
-Error: selected processor does not support `yield' in ARM mode
-
-You will need to set -march compiler option to native, so the compiler
-recognizes yield assembler instruction. The proper way to set -march=
-native would be to put it into CFLAGS, e.g. run ./configure like this:
-CFLAGS="-march=native -Os -g" ./configure plus your usual options.
-
-If that doesn't work, you can enforce the minimum CPU and FPU (taken from
-Debian armhf documentation):
-
- * The lowest worthwhile CPU implementation is Armv7-A, therefore the
- recommended build option is -march=armv7-a.
-
- * FPU should be set at VFPv3-D16 as they represent the minimum
- specification of the processors to support here, therefore the
- recommended build option is -mfpu=vfpv3-d16.
-
-The configure command should look like this:
-
-CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
-
NetBSD 6 i386
The i386 build of NetBSD requires the libatomic library, available from
diff --git a/README b/README
index 8beb62dc1b..a964b5afb8 100644
--- a/README
+++ b/README
@@ -1,3 +1,5 @@
+README
+
BIND 9
Contents
@@ -134,7 +136,7 @@ make depend. If you're using Emacs, you might find make tags helpful.
Several environment variables that can be set before running configure
will affect compilation:
-Variable Description
+ Variable Description
CC The C compiler to use. configure tries to figure out the
right one for supported systems.
C compiler flags. Defaults to include -g and/or -O2 as
@@ -187,8 +189,10 @@ operations, specify the path to the PKCS#11 provider library using
To support the HTTP statistics channel, the server must be linked with at
least one of the following: libxml2 http://xmlsoft.org or json-c https://
-github.com/json-c. If these are installed at a nonstandard location,
-specify the prefix using --with-libxml2=/prefix or --with-libjson=/prefix.
+github.com/json-c. If these are installed at a nonstandard location, then:
+
+ * for libxml2, specify the prefix using --with-libxml2=/prefix,
+ * for json-c, adjust PKG_CONFIG_PATH.
To support compression on the HTTP statistics channel, the server must be
linked against libzlib. If this is installed in a nonstandard location,
@@ -286,7 +290,7 @@ development BIND 9 is included in the file CHANGES, with the most recent
changes listed first. Change notes include tags indicating the category of
the change that was made; these categories are:
-Category Description
+ Category Description
[func] New feature
[bug] General bug fix
[security] Fix for a significant security flaw
@@ -321,8 +325,8 @@ issue number. Prior to 2018, these were usually of the form [RT #NNN] and
referred to entries in the "bind9-bugs" RT database, which was not open to
the public. More recent entries use the form [GL #NNN] or, less often, [GL
!NNN], which, respectively, refer to issues or merge requests in the
-Gitlab database. Most of these are publically readable, unless they
-include information which is confidential or security senstive.
+Gitlab database. Most of these are publicly readable, unless they include
+information which is confidential or security senstive.
To look up a Gitlab issue by its number, use the URL https://
gitlab.isc.org/isc-projects/bind9/issues/NNN. To look up a merge request,
@@ -337,21 +341,23 @@ Acknowledgments
* The original development of BIND 9 was underwritten by the following
organizations:
- Sun Microsystems, Inc.
- Hewlett Packard
- Compaq Computer Corporation
- IBM
- Process Software Corporation
- Silicon Graphics, Inc.
- Network Associates, Inc.
- U.S. Defense Information Systems Agency
- USENIX Association
- Stichting NLnet - NLnet Foundation
- Nominum, Inc.
+ Sun Microsystems, Inc.
+ Hewlett Packard
+ Compaq Computer Corporation
+ IBM
+ Process Software Corporation
+ Silicon Graphics, Inc.
+ Network Associates, Inc.
+ U.S. Defense Information Systems Agency
+ USENIX Association
+ Stichting NLnet - NLnet Foundation
+ Nominum, Inc.
* This product includes software developed by the OpenSSL Project for
use in the OpenSSL Toolkit. http://www.OpenSSL.org/
+
* This product includes cryptographic software written by Eric Young
(eay@cryptsoft.com)
+
* This product includes software written by Tim Hudson
(tjh@cryptsoft.com)
diff --git a/README.md b/README.md
index 6958ba110f..153b141233 100644
--- a/README.md
+++ b/README.md
@@ -332,7 +332,7 @@ issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
and referred to entries in the "bind9-bugs" RT database, which was not open
to the public. More recent entries use the form `[GL #NNN]` or, less often,
`[GL !NNN]`, which, respectively, refer to issues or merge requests in the
-Gitlab database. Most of these are publically readable, unless they include
+Gitlab database. Most of these are publicly readable, unless they include
information which is confidential or security senstive.
To look up a Gitlab issue by its number, use the URL
diff --git a/bin/delv/delv.1 b/bin/delv/delv.1
index f8e0da555b..7155b70c1d 100644
--- a/bin/delv/delv.1
+++ b/bin/delv/delv.1
@@ -146,14 +146,16 @@ to specify the name of a zone containing DLV records\&.
Note: When reading the trust anchor file,
\fBdelv\fR
treats
-\fBmanaged\-keys\fR
-statements and
-\fBtrusted\-keys\fR
-statements identically\&. That is, for a managed key, it is the
-\fIinitial\fR
-key that is trusted; RFC 5011 key management is not supported\&.
+\fBdnssec\-keys\fR\fBinitial\-key\fR
+and
+\fBstatic\-key\fR
+entries identically\&. That is, even if a key is configured with
+\fBinitial\-key\fR, indicating that it is meant to be used only as an initializing key for RFC 5011 key maintenance, it is still treated by
\fBdelv\fR
-will not consult the managed\-keys database maintained by
+as if it had been configured as a
+\fBstatic\-key\fR\&.
+\fBdelv\fR
+does not consult the managed keys database maintained by
\fBnamed\fR\&. This means that if either of the keys in
/etc/bind\&.keys
is revoked and rolled over, it will be necessary to update
diff --git a/bin/delv/delv.html b/bin/delv/delv.html
index 22c70cd576..6fe8840329 100644
--- a/bin/delv/delv.html
+++ b/bin/delv/delv.html
@@ -200,14 +200,17 @@
Note: When reading the trust anchor file,
- delv treats managed-keys
- statements and trusted-keys
statements
- identically. That is, for a managed key, it is the
- initial key that is trusted; RFC 5011
- key management is not supported. delv
- will not consult the managed-keys database maintained by
- named. This means that if either of the
- keys in /etc/bind.keys
is revoked
+ delv treats dnssec-keys
+ initial-key
and static-key
+ entries identically. That is, even if a key is configured
+ with initial-key, indicating that it is
+ meant to be used only as an initializing key for RFC 5011
+ key maintenance, it is still treated by delv
+ as if it had been configured as a static-key.
+ delv does not consult the managed keys
+ database maintained by named. This means
+ that if either of the keys in
+ /etc/bind.keys
is revoked
and rolled over, it will be necessary to update
/etc/bind.keys
to use DNSSEC
validation in delv.
diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index 555c5dcb70..7da5c5693a 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -589,11 +589,11 @@ A synonym for
.RS 4
Toggle the setting of the RD (recursion desired) bit in the query\&. This bit is set by default, which means
\fBdig\fR
-normally sends recursive queries\&. Recursion is automatically disabled when the
+normally sends recursive queries\&. Recursion is automatically disabled when using the
\fI+nssearch\fR
-or
+option, and when using
\fI+trace\fR
-query options are used\&.
+except for an initial recursive query to get the list of root servers\&.
.RE
.PP
\fB+retry=T\fR
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index e4f85c60f8..d191d7a6b5 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -797,8 +797,10 @@
in the query. This bit is set by default, which means
dig normally sends recursive
queries. Recursion is automatically disabled when
- the +nssearch
or
- +trace
query options are used.
+ using the +nssearch
option, and
+ when using +trace
except for
+ an initial recursive query to get the list of root
+ servers.
+retry=T
diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 081b7b8c95..7b93ad4771 100644
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -10,12 +10,12 @@
.\" Title: named.conf
.\" Author:
.\" Generator: DocBook XSL Stylesheets v1.78.1
-.\" Date: 2018-12-07
+.\" Date: 2019-05-10
.\" Manual: BIND9
.\" Source: ISC
.\" Language: English
.\"
-.TH "NAMED\&.CONF" "5" "2018\-12\-07" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2019\-05\-10" "ISC" "BIND9"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -97,6 +97,19 @@ dlz \fIstring\fR {
.if n \{\
.RE
.\}
+.SH "DNSSEC-KEYS"
+.sp
+.if n \{\
+.RS 4
+.\}
+.nf
+dnssec\-keys { \fIstring\fR ( static\-key |
+ initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. };
+.fi
+.if n \{\
+.RE
+.\}
.SH "DYNDB"
.sp
.if n \{\
@@ -149,13 +162,16 @@ logging {
.RE
.\}
.SH "MANAGED-KEYS"
+.PP
+See DNSSEC\-KEYS\&.
.sp
.if n \{\
.RS 4
.\}
.nf
-managed\-keys { \fIstring\fR \fIstring\fR \fIinteger\fR
- \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
+managed\-keys { \fIstring\fR ( static\-key |
+ initial\-key ) \fIinteger\fR \fIinteger\fR \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. };
.fi
.if n \{\
.RE
@@ -257,7 +273,6 @@ options {
dnsrps\-options { \fIunspecified\-text\fR };
dnssec\-accept\-expired \fIboolean\fR;
dnssec\-dnskey\-kskonly \fIboolean\fR;
- dnssec\-enable \fIboolean\fR;
dnssec\-loadkeys\-interval \fIinteger\fR;
dnssec\-lookaside ( \fIstring\fR trust\-anchor
\fIstring\fR | auto | no );
@@ -409,11 +424,12 @@ options {
resolver\-retry\-interval \fIinteger\fR;
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
\fIinteger\fR;
- response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
- \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
- disabled | drop | given | no\-op | nodata | nxdomain | passthru
- | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
- nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
+ response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
+ \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
+ \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+ nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
+ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
@@ -551,13 +567,16 @@ statistics\-channels {
.RE
.\}
.SH "TRUSTED-KEYS"
+.PP
+Deprecated \- see DNSSEC\-KEYS\&.
.sp
.if n \{\
.RS 4
.\}
.nf
-trusted\-keys { \fIstring\fR \fIinteger\fR \fIinteger\fR
- \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
+trusted\-keys { \fIstring\fR \fIinteger\fR
+ \fIinteger\fR \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. };, deprecated
.fi
.if n \{\
.RE
@@ -638,7 +657,9 @@ view \fIstring\fR [ \fIclass\fR ] {
dnsrps\-options { \fIunspecified\-text\fR };
dnssec\-accept\-expired \fIboolean\fR;
dnssec\-dnskey\-kskonly \fIboolean\fR;
- dnssec\-enable \fIboolean\fR;
+ dnssec\-keys { \fIstring\fR ( static\-key |
+ initial\-key ) \fIinteger\fR \fIinteger\fR
+ \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
dnssec\-loadkeys\-interval \fIinteger\fR;
dnssec\-lookaside ( \fIstring\fR trust\-anchor
\fIstring\fR | auto | no );
@@ -676,9 +697,9 @@ view \fIstring\fR [ \fIclass\fR ] {
key\-directory \fIquoted_string\fR;
lame\-ttl \fIttlval\fR;
lmdb\-mapsize \fIsizeval\fR;
- managed\-keys { \fIstring\fR \fIstring\fR
- \fIinteger\fR \fIinteger\fR \fIinteger\fR
- \fIquoted_string\fR; \&.\&.\&. };
+ managed\-keys { \fIstring\fR ( static\-key |
+ initial\-key ) \fIinteger\fR \fIinteger\fR
+ \fIinteger\fR \fIquoted_string\fR; \&.\&.\&. };
masterfile\-format ( map | raw | text );
masterfile\-style ( full | relative );
match\-clients { \fIaddress_match_element\fR; \&.\&.\&. };
@@ -761,11 +782,12 @@ view \fIstring\fR [ \fIclass\fR ] {
resolver\-retry\-interval \fIinteger\fR;
response\-padding { \fIaddress_match_element\fR; \&.\&.\&. } block\-size
\fIinteger\fR;
- response\-policy { zone \fIstring\fR [ log \fIboolean\fR ] [ max\-policy\-ttl
- \fIttlval\fR ] [ min\-update\-interval \fIttlval\fR ] [ policy ( cname |
- disabled | drop | given | no\-op | nodata | nxdomain | passthru
- | tcp\-only \fIquoted_string\fR ) ] [ recursive\-only \fIboolean\fR ] [
- nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [
+ response\-policy { zone \fIstring\fR [ add\-soa \fIboolean\fR ] [ log
+ \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [ min\-update\-interval
+ \fIttlval\fR ] [ policy ( cname | disabled | drop | given | no\-op |
+ nodata | nxdomain | passthru | tcp\-only \fIquoted_string\fR ) ] [
+ recursive\-only \fIboolean\fR ] [ nsip\-enable \fIboolean\fR ] [
+ nsdname\-enable \fIboolean\fR ]; \&.\&.\&. } [ add\-soa \fIboolean\fR ] [
break\-dnssec \fIboolean\fR ] [ max\-policy\-ttl \fIttlval\fR ] [
min\-update\-interval \fIttlval\fR ] [ min\-ns\-dots \fIinteger\fR ] [
nsip\-wait\-recurse \fIboolean\fR ] [ qname\-wait\-recurse \fIboolean\fR ]
@@ -827,9 +849,10 @@ view \fIstring\fR [ \fIclass\fR ] {
transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
] [ dscp \fIinteger\fR ];
trust\-anchor\-telemetry \fIboolean\fR; // experimental
- trusted\-keys { \fIstring\fR \fIinteger\fR
- \fIinteger\fR \fIinteger\fR \fIquoted_string\fR;
- \&.\&.\&. };
+ trusted\-keys { \fIstring\fR
+ \fIinteger\fR \fIinteger\fR
+ \fIinteger\fR
+ \fIquoted_string\fR; \&.\&.\&. };, deprecated
try\-tcp\-refresh \fIboolean\fR;
update\-check\-ksk \fIboolean\fR;
use\-alt\-transfer\-source \fIboolean\fR;
diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index a77e646f06..bca8de5a24 100644
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -59,7 +59,6 @@
ACL
-
acl string
{ address_match_element
; ... };
@@ -67,7 +66,6 @@ acl
CONTROLS
-
controls {
inet ( ipv4_address
| ipv6_address
|
@@ -85,7 +83,6 @@ controls
DLZ
-
dlz string
{
database string
;
@@ -95,8 +92,16 @@ dlz
-
DYNDB
+
DNSSEC-KEYS
+
+dnssec-keys { string
( static-key |
+ initial-key ) integer
integer
integer
+ quoted_string
; ... };
+
+
+
+
DYNDB
dyndb string
quoted_string
{
unspecified-text
};
@@ -104,8 +109,7 @@ dyndb
-
KEY
-
+
KEY
key string
{
algorithm string
;
@@ -115,8 +119,7 @@ key
-
LOGGING
-
+
LOGGING
logging {
category string
{ string
; ... };
@@ -138,17 +141,17 @@ logging
-
MANAGED-KEYS
-
+
MANAGED-KEYS
+
See DNSSEC-KEYS.
-managed-keys { string
string
integer
- integer
integer
quoted_string
; ... };
+managed-keys { string
( static-key |
+ initial-key ) integer
integer
integer
+ quoted_string
; ... };
-
MASTERS
-
+
MASTERS
masters string
[ port integer
] [ dscp
integer
] { ( masters
| ipv4_address
[
@@ -158,8 +161,7 @@ masters
-
OPTIONS
-
+
OPTIONS
options {
allow-new-zones boolean
;
@@ -238,7 +240,6 @@ options
dnsrps-options { unspecified-text
};
dnssec-accept-expired boolean
;
dnssec-dnskey-kskonly boolean
;
- dnssec-enable boolean
;
dnssec-loadkeys-interval integer
;
dnssec-lookaside ( string
trust-anchor
string
| auto | no );
@@ -390,11 +391,12 @@ options
resolver-retry-interval integer
;
response-padding { address_match_element
; ... } block-size
integer
;
- response-policy { zone string
[ log boolean
] [ max-policy-ttl
- ttlval
] [ min-update-interval ttlval
] [ policy ( cname |
- disabled | drop | given | no-op | nodata | nxdomain | passthru
- | tcp-only quoted_string
) ] [ recursive-only boolean
] [
- nsip-enable boolean
] [ nsdname-enable boolean
]; ... } [
+ response-policy { zone string
[ add-soa boolean
] [ log
+ boolean
] [ max-policy-ttl ttlval
] [ min-update-interval
+ ttlval
] [ policy ( cname | disabled | drop | given | no-op |
+ nodata | nxdomain | passthru | tcp-only quoted_string
) ] [
+ recursive-only boolean
] [ nsip-enable boolean
] [
+ nsdname-enable boolean
]; ... } [ add-soa boolean
] [
break-dnssec boolean
] [ max-policy-ttl ttlval
] [
min-update-interval ttlval
] [ min-ns-dots integer
] [
nsip-wait-recurse boolean
] [ qname-wait-recurse boolean
]
@@ -461,8 +463,7 @@ options
-
PLUGIN
-
+
PLUGIN
plugin ( query ) string
[ { unspecified-text
} ];
@@ -470,8 +471,7 @@ plugin
-
SERVER
-
+
SERVER
server netprefix
{
bogus boolean
;
@@ -509,8 +509,7 @@ server
-
STATISTICS-CHANNELS
-
+
STATISTICS-CHANNELS
statistics-channels {
inet ( ipv4_address
| ipv6_address
|
@@ -522,17 +521,17 @@ statistics-channels
-
TRUSTED-KEYS
-
+
TRUSTED-KEYS
+
Deprecated - see DNSSEC-KEYS.
-trusted-keys { string
integer
integer
- integer
quoted_string
; ... };
+trusted-keys { string
integer
+ integer
integer
+ quoted_string
; ... };, deprecated
-
VIEW
-
+
VIEW
view string
[ class
] {
allow-new-zones boolean
;
@@ -604,7 +603,9 @@ view
dnsrps-options { unspecified-text
};
dnssec-accept-expired boolean
;
dnssec-dnskey-kskonly boolean
;
- dnssec-enable boolean
;
+ dnssec-keys { string
( static-key |
+ initial-key ) integer
integer
+ integer
quoted_string
; ... };
dnssec-loadkeys-interval integer
;
dnssec-lookaside ( string
trust-anchor
string
| auto | no );
@@ -642,9 +643,9 @@ view
key-directory quoted_string
;
lame-ttl ttlval
;
lmdb-mapsize sizeval
;
- managed-keys { string
string
- integer
integer
integer
- quoted_string
; ... };
+ managed-keys { string
( static-key |
+ initial-key ) integer
integer
+ integer
quoted_string
; ... };
masterfile-format ( map | raw | text );
masterfile-style ( full | relative );
match-clients { address_match_element
; ... };
@@ -727,11 +728,12 @@ view
resolver-retry-interval integer
;
response-padding { address_match_element
; ... } block-size
integer
;
- response-policy { zone string
[ log boolean
] [ max-policy-ttl
- ttlval
] [ min-update-interval ttlval
] [ policy ( cname |
- disabled | drop | given | no-op | nodata | nxdomain | passthru
- | tcp-only quoted_string
) ] [ recursive-only boolean
] [
- nsip-enable boolean
] [ nsdname-enable boolean
]; ... } [
+ response-policy { zone string
[ add-soa boolean
] [ log
+ boolean
] [ max-policy-ttl ttlval
] [ min-update-interval
+ ttlval
] [ policy ( cname | disabled | drop | given | no-op |
+ nodata | nxdomain | passthru | tcp-only quoted_string
) ] [
+ recursive-only boolean
] [ nsip-enable boolean
] [
+ nsdname-enable boolean
]; ... } [ add-soa boolean
] [
break-dnssec boolean
] [ max-policy-ttl ttlval
] [
min-update-interval ttlval
] [ min-ns-dots integer
] [
nsip-wait-recurse boolean
] [ qname-wait-recurse boolean
]
@@ -793,9 +795,10 @@ view
transfer-source-v6 ( ipv6_address
| * ) [ port ( integer
| * )
] [ dscp integer
];
trust-anchor-telemetry boolean
; // experimental
- trusted-keys { string
integer
- integer
integer
quoted_string
;
- ... };
+ trusted-keys { string
+ integer
integer
+ integer
+ quoted_string
; ... };, deprecated
try-tcp-refresh boolean
;
update-check-ksk boolean
;
use-alt-transfer-source boolean
;
@@ -907,8 +910,7 @@ view
-
ZONE
-
+
ZONE
zone string
[ class
] {
allow-notify { address_match_element
; ... };
@@ -1007,14 +1009,14 @@ zone
-
FILES
+
FILES
/etc/named.conf
-
SEE ALSO
+
SEE ALSO
ddns-confgen(8)
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index 0ce4c203a0..b859194604 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -284,7 +284,7 @@ maintain, and also requires the zone to be configured to allow dynamic DNS\&. (S
.PP
\fBmanaged\-keys \fR\fB\fI(status | refresh | sync | destroy)\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR
.RS 4
-Inspect and control the "managed\-keys" database which handles RFC 5011 DNSSEC trust anchor maintenance\&. If a view is specified, these commands are applied to that view; otherwise they are applied to all views\&.
+Inspect and control the "managed keys" database which handles RFC 5011 DNSSEC trust anchor maintenance\&. If a view is specified, these commands are applied to that view; otherwise they are applied to all views\&.
.sp
.RS 4
.ie n \{\
@@ -296,7 +296,7 @@ Inspect and control the "managed\-keys" database which handles RFC 5011 DNSSEC t
.\}
When run with the
status
-keyword, prints the current status of the managed\-keys database\&.
+keyword, prints the current status of the managed keys database\&.
.RE
.sp
.RS 4
@@ -309,7 +309,7 @@ keyword, prints the current status of the managed\-keys database\&.
.\}
When run with the
refresh
-keyword, forces an immediate refresh query to be sent for all the managed keys, updating the managed\-keys database if any new keys are found, without waiting the normal refresh interval\&.
+keyword, forces an immediate refresh query to be sent for all the managed keys, updating the managed keys database if any new keys are found, without waiting the normal refresh interval\&.
.RE
.sp
.RS 4
@@ -322,7 +322,7 @@ keyword, forces an immediate refresh query to be sent for all the managed keys,
.\}
When run with the
sync
-keyword, forces an immediate dump of the managed\-keys database to disk (in the file
+keyword, forces an immediate dump of the managed keys database to disk (in the file
managed\-keys\&.bind
or (\fIviewname\fR\&.mkeys)\&. This synchronizes the database with its journal file, so that the database\*(Aqs current contents can be inspected visually\&.
.RE
@@ -337,7 +337,7 @@ or (\fIviewname\fR\&.mkeys)\&. This synchronizes the database with its journal f
.\}
When run with the
destroy
-keyword, the managed\-keys database is shut down and deleted, and all key maintenance is terminated\&. This command should be used only with extreme caution\&.
+keyword, the managed keys database is shut down and deleted, and all key maintenance is terminated\&. This command should be used only with extreme caution\&.
.sp
Existing keys that are already trusted are not deleted from memory; DNSSEC validation can continue after this command is used\&. However, key maintenance operations will cease until
\fBnamed\fR
@@ -515,8 +515,12 @@ timer\&.
\fBsecroots \fR\fB[\-]\fR\fB \fR\fB[\fIview \&.\&.\&.\fR]\fR
.RS 4
Dump the security roots (i\&.e\&., trust anchors configured via
-\fBtrusted\-keys\fR,
-\fBmanaged\-keys\fR, or
+\fBdnssec\-keys\fR
+statements, or the synonymous
+\fBmanaged\-keys\fR
+or the deprecated
+\fBtrusted\-keys\fR
+statements, or via
\fBdnssec\-validation auto\fR) and negative trust anchors for the specified views\&. If no view is specified, all views are dumped\&. Security roots will indicate whether they are configured as trusted keys, managed keys, or initializing managed keys (managed keys that have not yet been updated by a successful key refresh query)\&.
.sp
If the first argument is "\-", then the output is returned via the
@@ -697,7 +701,7 @@ Delete a given TKEY\-negotiated key from the server\&. (This does not apply to s
.RS 4
List the names of all TSIG keys currently configured for use by
\fBnamed\fR
-in each view\&. The list both statically configured keys and dynamic TKEY\-negotiated keys\&.
+in each view\&. The list includes both statically configured keys and dynamic TKEY\-negotiated keys\&.
.RE
.PP
\fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index 8b9df50b16..d03708cb0f 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -378,7 +378,7 @@
managed-keys (status | refresh | sync | destroy)
[class
[view
]]
- Inspect and control the "managed-keys" database which
+ Inspect and control the "managed keys" database which
handles RFC 5011 DNSSEC trust anchor maintenance. If a view
is specified, these commands are applied to that view;
otherwise they are applied to all views.
@@ -387,14 +387,14 @@
When run with the status
keyword, prints
- the current status of the managed-keys database.
+ the current status of the managed keys database.
When run with the refresh
keyword,
forces an immediate refresh query to be sent for all
- the managed keys, updating the managed-keys database
+ the managed keys, updating the managed keys database
if any new keys are found, without waiting the normal
refresh interval.
@@ -402,7 +402,7 @@
When run with the sync
keyword, forces an
- immediate dump of the managed-keys database to disk
+ immediate dump of the managed keys database to disk
(in the file managed-keys.bind
or
(viewname
.mkeys
).
This synchronizes the database with its journal file, so
@@ -413,7 +413,7 @@
When run with the destroy
keyword, the
- managed-keys database is shut down and deleted, and all key
+ managed keys database is shut down and deleted, and all key
maintenance is terminated. This command should be used only
with extreme caution.
@@ -653,9 +653,10 @@
Dump the security roots (i.e., trust anchors
- configured via trusted-keys,
- managed-keys, or
- dnssec-validation auto) and negative trust
+ configured via dnssec-keys statements,
+ or the synonymous managed-keys or
+ the deprecated trusted-keys statements, or
+ via dnssec-validation auto) and negative trust
anchors for the specified views. If no view is specified, all
views are dumped. Security roots will indicate whether
they are configured as trusted keys, managed keys, or
@@ -905,7 +906,7 @@
List the names of all TSIG keys currently configured
for use by named in each view. The
- list both statically configured keys and dynamic
+ list includes both statically configured keys and dynamic
TKEY-negotiated keys.
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 73fb6a4017..f469fc7511 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
-
BIND 9.15.0 (Development Release)
+
BIND 9.15.1 (Development Release)