From 92ca6d96a96522bb1e8e222f02352a8b98d9203b Mon Sep 17 00:00:00 2001
From: Doug Barton
Date: Tue, 2 Aug 2011 07:40:29 +0000
Subject: Vendor import of BIND 9.4-ESV-R5
---
CHANGES | 73 +-
COPYRIGHT | 494 +-
README | 10 +-
RELEASE-NOTES-BIND-9.4-ESV.html | 203 +
RELEASE-NOTES-BIND-9.4-ESV.pdf | Bin 0 -> 51983 bytes
RELEASE-NOTES-BIND-9.4-ESV.txt | 129 +
bin/dnssec/dnssec-signzone.c | 24 +-
bin/named/client.c | 6 +-
bin/named/logconf.c | 59 +-
bin/named/update.c | 6 +-
bin/named/zoneconf.c | 30 +-
doc/arm/Bv9ARM-book.xml | 46 +-
doc/arm/Bv9ARM.ch01.html | 52 +-
doc/arm/Bv9ARM.ch02.html | 24 +-
doc/arm/Bv9ARM.ch03.html | 28 +-
doc/arm/Bv9ARM.ch04.html | 72 +-
doc/arm/Bv9ARM.ch05.html | 8 +-
doc/arm/Bv9ARM.ch06.html | 179 +-
doc/arm/Bv9ARM.ch07.html | 16 +-
doc/arm/Bv9ARM.ch08.html | 20 +-
doc/arm/Bv9ARM.ch09.html | 182 +-
doc/arm/Bv9ARM.ch10.html | 4 +-
doc/arm/Bv9ARM.html | 148 +-
doc/arm/Bv9ARM.pdf | 12143 ++++++++++---------
doc/arm/man.dig.html | 22 +-
doc/arm/man.dnssec-keygen.html | 16 +-
doc/arm/man.dnssec-signzone.html | 14 +-
doc/arm/man.host.html | 12 +-
doc/arm/man.named-checkconf.html | 14 +-
doc/arm/man.named-checkzone.html | 14 +-
doc/arm/man.named.html | 18 +-
doc/arm/man.rndc-confgen.html | 14 +-
doc/arm/man.rndc.conf.html | 14 +-
doc/arm/man.rndc.html | 14 +-
doc/draft/draft-faltstrom-uri-06.txt | 729 ++
.../draft-ietf-dnsext-rfc2671bis-edns0-02.txt | 616 -
.../draft-ietf-dnsext-rfc2671bis-edns0-05.txt | 728 ++
.../draft-ietf-dnsop-dnssec-key-timing-00.txt | 1960 ---
.../draft-ietf-dnsop-dnssec-key-timing-02.txt | 1848 +++
lib/dns/api | 2 +-
lib/dns/dispatch.c | 7 +-
lib/dns/include/dns/masterdump.h | 22 +-
lib/dns/include/dns/rdataset.h | 9 +-
lib/dns/masterdump.c | 53 +-
lib/dns/message.c | 12 +-
lib/dns/ncache.c | 15 +-
lib/dns/rbtdb.c | 28 +-
lib/dns/rdata.c | 9 +-
lib/dns/rdata/generic/ipseckey_45.c | 10 +-
lib/dns/rdata/generic/nsec_47.c | 12 +-
lib/dns/rdata/generic/rrsig_46.c | 12 +-
lib/dns/rdataset.c | 6 +-
lib/dns/resolver.c | 36 +-
lib/dns/time.c | 46 +-
lib/dns/validator.c | 94 +-
lib/dns/xfrin.c | 54 +-
lib/dns/zone.c | 6 +-
lib/isc/api | 4 +-
lib/isc/include/isc/file.h | 25 +-
lib/isc/powerpc/include/isc/atomic.h | 36 +-
lib/isc/unix/file.c | 21 +-
lib/isc/unix/socket.c | 59 +-
lib/isc/unix/stdio.c | 7 +-
lib/lwres/api | 2 +-
lib/lwres/print_p.h | 11 +-
release-notes.css | 4 +-
version | 4 +-
67 files changed, 11736 insertions(+), 8859 deletions(-)
create mode 100644 RELEASE-NOTES-BIND-9.4-ESV.html
create mode 100644 RELEASE-NOTES-BIND-9.4-ESV.pdf
create mode 100644 RELEASE-NOTES-BIND-9.4-ESV.txt
create mode 100644 doc/draft/draft-faltstrom-uri-06.txt
delete mode 100644 doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-02.txt
create mode 100644 doc/draft/draft-ietf-dnsext-rfc2671bis-edns0-05.txt
delete mode 100644 doc/draft/draft-ietf-dnsop-dnssec-key-timing-00.txt
create mode 100644 doc/draft/draft-ietf-dnsop-dnssec-key-timing-02.txt
diff --git a/CHANGES b/CHANGES
index bde05d1b30014..86d88abf874ea 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,14 +1,83 @@
- --- 9.4-ESV-R4-P1 released ---
+ --- 9.4-ESV-R5 released ---
+
+3135. [port] FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
+ See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
+ [RT #24950]
+
+3023. [bug] Named could be left in an inconsistent state when
+ receiving multiple AXFR response messages that were
+ not all TSIG-signed. [RT #23254]
+
+ --- 9.4-ESV-R5rc1 released ---
+
+3124. [bug] Use an rdataset attribute flag to indicate
+ negative-cache records rather than using rrtype 0;
+ this will prevent problems when that rrtype is
+ used in actual DNS packets. [RT #24777]
3121. [security] An authoritative name server sending a negative
response containing a very large RRset could
trigger an off-by-one error in the ncache code
and crash named. [RT #24650]
-3120. [bug] Named could fail to validate zones listed in a DLV
+3120. [bug] Named could fail to validate zones list in a DLV
that validated insecure without using DLV and had
DS records in the parent zone. [RT #24631]
+3113. [doc] Document the relationship between serial-query-rate
+ and NOTIFY messages.
+
+ --- 9.4-ESV-R5b1 released ---
+
+3095. [bug] Handle isolated reserved ports in the port range.
+ [RT #23957]
+
+3088. [bug] Remove bin/tests/system/logfileconfig/ns1/named.conf
+ and add setup.sh in order to resolve changing
+ named.conf issue. [RT #23687]
+
+3071. [bug] has_nsec could be used unintialised in
+ update.c:next_active. [RT #20256]
+
+3067. [bug] ixfr-from-differences {master|slave}; failed to
+ select the master/slave zones. [RT #23580]
+
+3065. [bug] RRSIG could have time stamps too far in the future.
+ [RT #23356]
+
+3064. [bug] powerpc: add sync instructions to the end of atomic
+ operations. [RT #23469]
+
+3058. [bug] Cause named to terminate at startup or rndc reconfig/
+ reload to fail, if a log file specified in the conf
+ file isn't a plain file. [RT #22771]
+
+3051. [bug] NS records obsure DNAME records at the bottom of the
+ zone if both are present. [RT #23035]
+
+3041. [bug] dnssec-signzone failed to generate new signatures on
+ ttl changes. [RT #23330]
+
+3040. [bug] Named failed to validate insecure zones where a node
+ with a CNAME existed between the trust anchor and the
+ top of the zone. [RT #23338]
+
+3037. [doc] Update COPYRIGHT to contain all the individual
+ copyright notices that cover various parts.
+
+3014. [bug] Fix the zonechecks system test to match expected
+ behaviour for 9.4 and to fail on error. [RT #22905]
+
+3009. [bug] clients-per-query code didn't work as expected with
+ particular query patterns. [RT #22972]
+
+3007. [bug] Named failed to preserve the case of domain names in
+ rdata which is not compressible when writing master
+ files. [RT #22863]
+
+2996. [security] Temporarily disable SO_ACCEPTFILTER support.
+ [RT #22589]
+
--- 9.4-ESV-R4 released ---
2970. [security] Adding a NO DATA negative cache entry failed to clear
diff --git a/COPYRIGHT b/COPYRIGHT
index 8434bb629da64..2301d04a570e0 100644
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
Copyright (C) 1996-2003 Internet Software Consortium.
Permission to use, copy, modify, and/or distribute this software for any
@@ -13,9 +13,15 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
PERFORMANCE OF THIS SOFTWARE.
-$Id: COPYRIGHT,v 1.9.18.7 2010-01-07 23:46:07 tbox Exp $
+$Id: COPYRIGHT,v 1.9.18.9 2011-02-22 06:45:07 marka Exp $
-Portions Copyright (C) 1996-2001 Nominum, Inc.
+ Portions of this code release fall under one or more of the
+ following Copyright notices. Please see individual source
+ files for details.
+
+ For binary releases also see: OpenSSL-LICENSE.
+
+Copyright (C) 1996-2001 Nominum, Inc.
Permission to use, copy, modify, and distribute this software for any
purpose with or without fee is hereby granted, provided that the above
@@ -28,3 +34,485 @@ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995-2000 by Network Associates, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE
+FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1987, 1990, 1993, 1994
+ The Regents of the University of California. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+ must display the following acknowledgement:
+ This product includes software developed by the University of
+ California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) The Internet Society 2005. This version of
+this module is part of RFC 4178; see the RFC itself for
+full legal notices.
+
+(The above copyright notice is per RFC 3978 5.6 (a), q.v.)
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2004 Masarykova universita
+(Masaryk University, Brno, Czech Republic)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+ this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the University nor the names of its contributors may
+ be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
+(Royal Institute of Technology, Stockholm, Sweden).
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the Institute nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright ((c)) 2002, Rice University
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+ * Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above
+ copyright notice, this list of conditions and the following
+ disclaimer in the documentation and/or other materials provided
+ with the distribution.
+
+ * Neither the name of Rice University (RICE) nor the names of its
+ contributors may be used to endorse or promote products derived
+ from this software without specific prior written permission.
+
+
+This software is provided by RICE and the contributors on an "as is"
+basis, without any representations or warranties of any kind, express
+or implied including, but not limited to, representations or
+warranties of non-infringement, merchantability or fitness for a
+particular purpose. In no event shall RICE or contributors be liable
+for any direct, indirect, incidental, special, exemplary, or
+consequential damages (including, but not limited to, procurement of
+substitute goods or services; loss of use, data, or profits; or
+business interruption) however caused and on any theory of liability,
+whether in contract, strict liability, or tort (including negligence
+or otherwise) arising in any way out of the use of this software, even
+if advised of the possibility of such damage.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1993 by Digital Equipment Corporation.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies, and that
+the name of Digital Equipment Corporation not be used in advertising or
+publicity pertaining to distribution of the document or software without
+specific, written prior permission.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT
+CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright 2000 Aaron D. Gifford. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson.
+Copyright (c) 2001 Jake Burkholder.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in the
+ documentation and/or other materials provided with the distribution.
+3. Neither the name of the project nor the names of its contributors
+ may be used to endorse or promote products derived from this software
+ without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1999-2000 by Nortel Networks Corporation
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NORTEL NETWORKS DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NORTEL NETWORKS
+BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2000-2002 Japan Network Information Center. All rights reserved.
+
+By using this file, you agree to the terms and conditions set forth bellow.
+
+ LICENSE TERMS AND CONDITIONS
+
+The following License Terms and Conditions apply, unless a different
+license is obtained from Japan Network Information Center ("JPNIC"),
+a Japanese association, Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda,
+Chiyoda-ku, Tokyo 101-0047, Japan.
+
+1. Use, Modification and Redistribution (including distribution of any
+ modified or derived work) in source and/or binary forms is permitted
+ under this License Terms and Conditions.
+
+2. Redistribution of source code must retain the copyright notices as they
+ appear in each source code file, this License Terms and Conditions.
+
+3. Redistribution in binary form must reproduce the Copyright Notice,
+ this License Terms and Conditions, in the documentation and/or other
+ materials provided with the distribution. For the purposes of binary
+ distribution the "Copyright Notice" refers to the following language:
+ "Copyright (c) 2000-2002 Japan Network Information Center. All rights
+ reserved."
+
+4. The name of JPNIC may not be used to endorse or promote products
+ derived from this Software without specific prior written approval of
+ JPNIC.
+
+5. Disclaimer/Limitation of Liability: THIS SOFTWARE IS PROVIDED BY JPNIC
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL JPNIC BE LIABLE
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2004 Nominet, Ltd.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Portions Copyright RSA Security Inc.
+
+License to copy and use this software is granted provided that it is
+identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
+(Cryptoki)" in all material mentioning or referencing this software.
+
+License is also granted to make and use derivative works provided that
+such works are identified as "derived from the RSA Security Inc. PKCS #11
+Cryptographic Token Interface (Cryptoki)" in all material mentioning or
+referencing the derived work.
+
+RSA Security Inc. makes no representations concerning either the
+merchantability of this software or the suitability of this software for
+any particular purpose. It is provided "as is" without express or implied
+warranty of any kind.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1996, David Mazieres
+Copyright (c) 2008, Damien Miller
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-----------------------------------------------------------------------------
+
+Copyright (c) 2000-2001 The OpenSSL Project. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the
+ distribution.
+
+3. All advertising materials mentioning features or use of this
+ software must display the following acknowledgment:
+ "This product includes software developed by the OpenSSL Project
+ for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+
+4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ endorse or promote products derived from this software without
+ prior written permission. For written permission, please contact
+ licensing@OpenSSL.org.
+
+5. Products derived from this software may not be called "OpenSSL"
+ nor may "OpenSSL" appear in their names without prior written
+ permission of the OpenSSL Project.
+
+6. Redistributions of any form whatsoever must retain the following
+ acknowledgment:
+ "This product includes software developed by the OpenSSL Project
+ for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+
+THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+
diff --git a/README b/README
index 1b584fd6e9130..c9f45006dece6 100644
--- a/README
+++ b/README
@@ -42,15 +42,19 @@ BIND 9
Stichting NLnet - NLnet Foundation
Nominum, Inc.
+BIND 9.4-ESV-R5 (Extended Support Version)
+
+ BIND 9.4-ESV-R5 is expected to be the last release in the 9.4
+ series.
+
BIND 9.4-ESV (Extended Support Version)
BIND 9.4-ESV is the Extended Support Version of BIND 9.4
and incorporates the final maintenance release fixing bugs
in BIND 9.4.3.
- BIND 9.4-ESV will be supported until December 31, 2010, at
- which time you will need to upgrade to the current release
- of BIND.
+ BIND 9.4-ESV will be supported until May 31, 2011, at which
+ time you will need to upgrade to the current release of BIND.
BIND 9.4.3
diff --git a/RELEASE-NOTES-BIND-9.4-ESV.html b/RELEASE-NOTES-BIND-9.4-ESV.html
new file mode 100644
index 0000000000000..4aceea87be758
--- /dev/null
+++ b/RELEASE-NOTES-BIND-9.4-ESV.html
@@ -0,0 +1,203 @@
+
+
+
+
+
+
+
+
+
Introduction
+
+
+ BIND 9.4-ESV-R5 is the current production release
+ of BIND 9.4.
+
+
+ This document summarizes changes from BIND 9.4-ESV-R4 to BIND 9.4-ESV-R5.
+ Please see the CHANGES file in the source code release for a
+ complete list of all changes.
+
+
+
+
Download
+
+
+ The latest release of BIND 9 software can always be found
+ on our web site at
+ http://www.isc.org/downloads/all.
+ There you will find additional information about each release,
+ source code, and some pre-compiled versions for certain operating
+ systems.
+
+A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled allows
+for a TCP DoS attack. Until there is a kernel fix, ISC is disabling
+SO_ACCEPTFILTER support in BIND. [RT #22589]
+
+named, set up to be a caching resolver, is vulnerable to a
+user querying a domain with very large resource record sets (RRSets)
+when trying to negatively cache the response. Due to an off-by-one
+error, caching the response could cause named to crash. [RT #24650]
+[CVE-2011-1910]
+
+Change #2912 (see CHANGES) exposed a latent bug in the DNS message
+processing code that could allow certain UPDATE requests to crash
+named. This was fixed by disambiguating internal database representation
+vs DNS wire format data. [RT #24777] [CVE-2011-2464]
+
+
+
+
+
Bug Fixes
+
+
9.4-ESV-R5
+
+
+During RFC5011 processing some journal write errors were not detected.
+This could lead to managed-keys changes being committed but not
+recorded in the journal files, causing potential inconsistencies
+during later processing. [RT #20256]
+
+A potential NULL pointer deference in the DNS64 code could cause
+named to terminate unexpectedly. [RT #20256]
+
+
+A state variable relating to DNSSEC could fail to be set during
+some infrequently-executed code paths, allowing it to be used whilst
+in an unitialized state during cache updates, with unpredictable results.
+[RT #20256]
+
+
+A potential NULL pointer deference in DNSSEC signing code could
+cause named to terminate unexpectedly [RT #20256]
+
+
+Several cosmetic code changes were made to silence warnings
+generated by a static code analysis tool. [RT #20256]
+
+
+Cause named to terminate at startup or rndc reconfig
+reload to fail, if a log file specified in the
+conf file isn't a plain file. (RT #22771]
+
+Prior to this fix, when named was was writing a zone to disk (as slave,
+when resigning, etc.), it might not correctly preserve the case of domain
+name labels within RDATA, if the RDATA was not compressible. The result
+is that when reloading the zone from disk would, named could serve data
+that did not match the RRSIG for that data, due to case mismatch. named
+now correctly preserves case. After upgrading to fixed code, the operator
+should either resign the data (on the master) or delete the disk file
+on the slave and reload the zone. [RT #22863]
+
+Fix the zonechecks system test to fail on error (warning in 9.6,
+fatal in 9.7) to match behaviour for 9.4. [RT #22905]
+
+There was a bug in how the clients-per-query code worked with some
+query patterns. This could result, in rare circumstances, in having all
+the client query slots filled with queries for the same DNS label,
+essentially ignoring the max-clients-per-query setting.
+[RT #22972]
+
+If a slave initiates a TSIG signed AXFR from the master and the master
+fails to correctly TSIG sign the final message, the slave would be left
+with the zone in an unclean state. named detected this error too late
+and named would crash with an INSIST. The order dependancy has been
+fixed. [RT #23254]
+
+Fixed precedence order bug with NS and DNAME records if both are present.
+(Also fixed timing of autosign test in 9.7+) [RT #23035]
+
+Changing TTL did not cause dnssec-signzone to generate new signatures.
+[RT #23330]
+
+If named encountered a CNAME instead of a DS record when walking
+the chain of trust down from the trust anchor, it incorrectly stopped
+validating. [RT #23338]
+
+RRSIG records could have time stamps too far in the future.
+[RT #23356]
+
+If running on a powerpc CPU and with atomic operations enabled,
+named could lock up. Added sync instructions to the end of atomic
+operations. [RT #23469]
+
+ixfr-from-differences {master|slave};
+failed to select the master/slave zones, resulting in on diff/journal
+file being created.
+[RT #23580]
+
+Remove bin/tests/system/logfileconfig/ns1/named.conf and
+add setup.sh in order to resolve changing named.conf issue. [RT #23687]
+
+The autosign tests attempted to open ports within reserved ranges. Test
+now avoids those ports.
+[RT #23957]
+
+Named could fail to validate zones list in a DLV that validated insecure
+without using DLV and had DS records in the parent zone. [RT #24631]
+
+A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+1280 bytes to not fragment as they should. Until there is a kernel
+fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+per packet basis. [RT #24950]
+
+
+
+
+
Thank You
+
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to make
+ quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
+
+
+
diff --git a/RELEASE-NOTES-BIND-9.4-ESV.pdf b/RELEASE-NOTES-BIND-9.4-ESV.pdf
new file mode 100644
index 0000000000000..96f6a13b9699d
Binary files /dev/null and b/RELEASE-NOTES-BIND-9.4-ESV.pdf differ
diff --git a/RELEASE-NOTES-BIND-9.4-ESV.txt b/RELEASE-NOTES-BIND-9.4-ESV.txt
new file mode 100644
index 0000000000000..33f2557ed1840
--- /dev/null
+++ b/RELEASE-NOTES-BIND-9.4-ESV.txt
@@ -0,0 +1,129 @@
+ __________________________________________________________________
+
+Introduction
+
+ BIND 9.4-ESV-R5 is the current production release of BIND 9.4.
+
+ This document summarizes changes from BIND 9.4-ESV-R4 to BIND
+ 9.4-ESV-R5. Please see the CHANGES file in the source code release for
+ a complete list of all changes.
+
+Download
+
+ The latest release of BIND 9 software can always be found on our web
+ site at http://www.isc.org/downloads/all. There you will find
+ additional information about each release, source code, and some
+ pre-compiled versions for certain operating systems.
+
+Support
+
+ Product support information is available on
+ http://www.isc.org/services/support for paid support options. Free
+ support is provided by our user community via a mailing list.
+ Information on all public email lists is available at
+ https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.4-ESV-R5
+
+ None.
+
+Feature Changes
+
+9.4-ESV-R5
+
+ None.
+
+Security Fixes
+
+9.4-ESV-R5
+
+ * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled
+ allows for a TCP DoS attack. Until there is a kernel fix, ISC is
+ disabling SO_ACCEPTFILTER support in BIND. [RT #22589]
+ * named, set up to be a caching resolver, is vulnerable to a user
+ querying a domain with very large resource record sets (RRSets)
+ when trying to negatively cache the response. Due to an off-by-one
+ error, caching the response could cause named to crash. [RT #24650]
+ [CVE-2011-1910]
+ * Change #2912 (see CHANGES) exposed a latent bug in the DNS message
+ processing code that could allow certain UPDATE requests to crash
+ named. This was fixed by disambiguating internal database
+ representation vs DNS wire format data. [RT #24777] [CVE-2011-2464]
+
+Bug Fixes
+
+9.4-ESV-R5
+
+ * During RFC5011 processing some journal write errors were not
+ detected. This could lead to managed-keys changes being committed
+ but not recorded in the journal files, causing potential
+ inconsistencies during later processing. [RT #20256]
+ A potential NULL pointer deference in the DNS64 code could cause
+ named to terminate unexpectedly. [RT #20256]
+ A state variable relating to DNSSEC could fail to be set during
+ some infrequently-executed code paths, allowing it to be used
+ whilst in an unitialized state during cache updates, with
+ unpredictable results. [RT #20256]
+ A potential NULL pointer deference in DNSSEC signing code could
+ cause named to terminate unexpectedly [RT #20256]
+ Several cosmetic code changes were made to silence warnings
+ generated by a static code analysis tool. [RT #20256]
+ * Cause named to terminate at startup or rndc reconfig reload to
+ fail, if a log file specified in the conf file isn't a plain file.
+ (RT #22771]
+ * Prior to this fix, when named was was writing a zone to disk (as
+ slave, when resigning, etc.), it might not correctly preserve the
+ case of domain name labels within RDATA, if the RDATA was not
+ compressible. The result is that when reloading the zone from disk
+ would, named could serve data that did not match the RRSIG for that
+ data, due to case mismatch. named now correctly preserves case.
+ After upgrading to fixed code, the operator should either resign
+ the data (on the master) or delete the disk file on the slave and
+ reload the zone. [RT #22863]
+ * Fix the zonechecks system test to fail on error (warning in 9.6,
+ fatal in 9.7) to match behaviour for 9.4. [RT #22905]
+ * There was a bug in how the clients-per-query code worked with some
+ query patterns. This could result, in rare circumstances, in having
+ all the client query slots filled with queries for the same DNS
+ label, essentially ignoring the max-clients-per-query setting. [RT
+ #22972]
+ * If a slave initiates a TSIG signed AXFR from the master and the
+ master fails to correctly TSIG sign the final message, the slave
+ would be left with the zone in an unclean state. named detected
+ this error too late and named would crash with an INSIST. The order
+ dependancy has been fixed. [RT #23254]
+ * Fixed precedence order bug with NS and DNAME records if both are
+ present. (Also fixed timing of autosign test in 9.7+) [RT #23035]
+ * Changing TTL did not cause dnssec-signzone to generate new
+ signatures. [RT #23330]
+ * If named encountered a CNAME instead of a DS record when walking
+ the chain of trust down from the trust anchor, it incorrectly
+ stopped validating. [RT #23338]
+ * RRSIG records could have time stamps too far in the future. [RT
+ #23356]
+ * If running on a powerpc CPU and with atomic operations enabled,
+ named could lock up. Added sync instructions to the end of atomic
+ operations. [RT #23469]
+ * ixfr-from-differences {master|slave}; failed to select the
+ master/slave zones, resulting in on diff/journal file being
+ created. [RT #23580]
+ * Remove bin/tests/system/logfileconfig/ns1/named.conf and add
+ setup.sh in order to resolve changing named.conf issue. [RT #23687]
+ * The autosign tests attempted to open ports within reserved ranges.
+ Test now avoids those ports. [RT #23957]
+ * Named could fail to validate zones list in a DLV that validated
+ insecure without using DLV and had DS records in the parent zone.
+ [RT #24631]
+ * A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+ 1280 bytes to not fragment as they should. Until there is a kernel
+ fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+ per packet basis. [RT #24950]
+
+Thank You
+
+ Thank you to everyone who assisted us in making this release possible.
+ If you would like to contribute to ISC to assist us in continuing to
+ make quality open source software, please visit our donations page at
+ http://www.isc.org/supportisc.
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 3ce7a4fbebc43..f2473ae443f28 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -1,5 +1,5 @@
/*
- * Portions Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Portions Copyright (C) 1999-2003 Internet Software Consortium.
* Portions Copyright (C) 1995-2000 by Network Associates, Inc.
*
@@ -16,7 +16,7 @@
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: dnssec-signzone.c,v 1.177.18.29 2009-07-21 06:44:32 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.177.18.31 2011-02-27 23:45:14 tbox Exp $ */
/*! \file */
@@ -435,32 +435,32 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
if (!expired)
keep = ISC_TRUE;
} else if (issigningkey(key)) {
- if (!expired && setverifies(name, set, key, &sigrdata))
- {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->position] = ISC_TRUE;
nowsignedby[key->position] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->position] = ISC_TRUE;
resign = ISC_TRUE;
}
} else if (iszonekey(key)) {
- if (!expired && setverifies(name, set, key, &sigrdata))
- {
+ if (!expired && rrsig.originalttl == set->ttl &&
+ setverifies(name, set, key, &sigrdata)) {
vbprintf(2, "\trrsig by %s retained\n", sigstr);
keep = ISC_TRUE;
wassignedby[key->position] = ISC_TRUE;
nowsignedby[key->position] = ISC_TRUE;
} else {
vbprintf(2, "\trrsig by %s dropped - %s\n",
- sigstr,
- expired ? "expired" :
- "failed to verify");
+ sigstr, expired ? "expired" :
+ rrsig.originalttl != set->ttl ?
+ "ttl change" : "failed to verify");
wassignedby[key->position] = ISC_TRUE;
}
} else if (!expired) {
diff --git a/bin/named/client.c b/bin/named/client.c
index 1f163fb50a0dd..b58a660933e79 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: client.c,v 1.219.18.33 2009-01-19 23:46:14 tbox Exp $ */
+/* $Id: client.c,v 1.219.18.35 2011-05-06 23:45:18 tbox Exp $ */
#include
@@ -619,6 +619,7 @@ ns_client_endrequest(ns_client_t *client) {
dns_message_puttemprdataset(client->message, &client->opt);
}
+ client->signer = NULL;
client->udpsize = 512;
client->extflags = 0;
client->ednsversion = -1;
@@ -1934,6 +1935,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
client->next = NULL;
client->shutdown = NULL;
client->shutdown_arg = NULL;
+ client->signer = NULL;
dns_name_init(&client->signername, NULL);
client->mortal = ISC_FALSE;
client->tcpquota = NULL;
diff --git a/bin/named/logconf.c b/bin/named/logconf.c
index 453a98b4456c8..a554eab57e64f 100644
--- a/bin/named/logconf.c
+++ b/bin/named/logconf.c
@@ -1,8 +1,8 @@
/*
- * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2001 Internet Software Consortium.
*
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
@@ -15,12 +15,13 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: logconf.c,v 1.35.18.5 2006-03-02 00:37:21 marka Exp $ */
+/* $Id: logconf.c,v 1.35.18.8 2011-03-06 01:46:22 marka Exp $ */
/*! \file */
#include
+#include
#include
#include
#include
@@ -130,7 +131,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
}
type = ISC_LOG_TONULL;
-
+
if (fileobj != NULL) {
const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
@@ -140,7 +141,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
isc_offset_t size = 0;
type = ISC_LOG_TOFILE;
-
+
if (versionsobj != NULL && cfg_obj_isuint32(versionsobj))
versions = cfg_obj_asuint32(versionsobj);
if (versionsobj != NULL && cfg_obj_isstring(versionsobj) &&
@@ -219,26 +220,38 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
FILE *fp;
-
- /*
- * Test that the file can be opened, since isc_log_open()
- * can't effectively report failures when called in
- * isc_log_doit().
- */
- result = isc_stdio_open(dest.file.name, "a", &fp);
- if (result != ISC_R_SUCCESS)
- isc_log_write(ns_g_lctx, CFG_LOGCATEGORY_CONFIG,
- NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
- "logging channel '%s' file '%s': %s",
- channelname, dest.file.name,
- isc_result_totext(result));
- else
- (void)isc_stdio_close(fp);
/*
- * Allow named to continue by returning success.
- */
- result = ISC_R_SUCCESS;
+ * Test to make sure that file is a plain file.
+ * Fix defect #22771
+ */
+ result = isc_file_isplainfile(dest.file.name);
+ if (result == ISC_R_SUCCESS ||
+ result == ISC_R_FILENOTFOUND) {
+ /*
+ * Test that the file can be opened, since
+ * isc_log_open() can't effectively report
+ * failures when called in
+ * isc_log_doit().
+ */
+ result = isc_stdio_open(dest.file.name, "a", &fp);
+ if (result != ISC_R_SUCCESS) {
+ syslog(LOG_ERR,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ fprintf(stderr,
+ "isc_stdio_open '%s' failed: %s",
+ dest.file.name,
+ isc_result_totext(result));
+ } else
+ (void)isc_stdio_close(fp);
+ } else {
+ syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+ dest.file.name, isc_result_totext(result));
+ }
}
return (result);
diff --git a/bin/named/update.c b/bin/named/update.c
index da735dd70a2ba..e2c78da2c94b5 100644
--- a/bin/named/update.c
+++ b/bin/named/update.c
@@ -1,5 +1,5 @@
/*
- * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
* Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: update.c,v 1.109.18.33 2009-07-28 15:57:26 marka Exp $ */
+/* $Id: update.c,v 1.109.18.35 2011-03-12 04:56:41 tbox Exp $ */
#include
@@ -1549,7 +1549,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
{
isc_result_t result;
dns_dbiterator_t *dbit = NULL;
- isc_boolean_t has_nsec;
+ isc_boolean_t has_nsec = ISC_FALSE;
unsigned int wraps = 0;
CHECK(dns_db_createiterator(db, ISC_FALSE, &dbit));
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index be872bed7de0a..7ed556fbe2927 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1,8 +1,8 @@
/*
- * Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006, 2011 Internet Systems Consortium, Inc. ("ISC")
* Copyright (C) 1999-2003 Internet Software Consortium.
*
- * Permission to use, copy, modify, and distribute this software for any
+ * Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
-/* $Id: zoneconf.c,v 1.110.18.23 2006-05-16 03:39:57 marka Exp $ */
+/* $Id: zoneconf.c,v 1.110.18.25 2011-03-12 04:56:41 tbox Exp $ */
/*% */
@@ -60,7 +60,7 @@
static isc_result_t
configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
const cfg_obj_t *config, const char *aclname,
- cfg_aclconfctx_t *actx, dns_zone_t *zone,
+ cfg_aclconfctx_t *actx, dns_zone_t *zone,
void (*setzacl)(dns_zone_t *, dns_acl_t *),
void (*clearzacl)(dns_zone_t *))
{
@@ -264,11 +264,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
char ***argvp, unsigned int n)
{
isc_result_t result;
-
+
/* Discard leading whitespace. */
while (*s == ' ' || *s == '\t')
s++;
-
+
if (*s == '\0') {
/* We have reached the end of the string. */
*argcp = n;
@@ -582,10 +582,10 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
INSIST(result == ISC_R_SUCCESS);
if (cfg_obj_isboolean(obj))
ixfrdiff = cfg_obj_asboolean(obj);
- else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
ztype == dns_zone_master)
ixfrdiff = ISC_TRUE;
- else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
+ else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
ztype == dns_zone_slave)
ixfrdiff = ISC_TRUE;
else
@@ -614,7 +614,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-sibling", &obj);
INSIST(result == ISC_R_SUCCESS);
- dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
+ dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
cfg_obj_asboolean(obj));
obj = NULL;
@@ -633,7 +633,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
"allow-update", ac, zone,
dns_zone_setupdateacl,
dns_zone_clearupdateacl));
-
+
updateacl = dns_zone_getupdateacl(zone);
if (updateacl != NULL && dns_acl_isinsecure(updateacl))
isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -641,7 +641,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
"zone '%s' allows updates by IP "
"address, which is insecure",
zname);
-
+
RETERR(configure_zone_ssutable(zoptions, zone));
obj = NULL;
@@ -689,7 +689,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "check-integrity", &obj);
INSIST(obj != NULL);
- dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
+ dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
cfg_obj_asboolean(obj));
obj = NULL;
@@ -725,7 +725,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
obj = NULL;
result = ns_config_get(maps, "update-check-ksk", &obj);
INSIST(result == ISC_R_SUCCESS);
- dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
+ dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
cfg_obj_asboolean(obj));
}
@@ -739,7 +739,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
"allow-update", ac, zone,
dns_zone_setupdateacl,
dns_zone_clearupdateacl));
-
+
updateacl = dns_zone_getupdateacl(zone);
if (updateacl != NULL && dns_acl_isinsecure(updateacl))
isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
@@ -747,7 +747,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
"zone '%s' allows updates by IP "
"address, which is insecure",
zname);
-
+
RETERR(configure_zone_ssutable(zoptions, zone));
obj = NULL;
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 7ee3370a018b3..006e17d98cc84 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
[]>
-
+
BIND 9 Administrator Reference Manual
@@ -31,6 +31,7 @@
200820092010
+ 2011Internet Systems Consortium, Inc. ("ISC")
@@ -6564,22 +6565,27 @@ avoid-v6-udp-ports {};
serial-query-rate
-
-
- Slave servers will periodically query master servers
- to find out if zone serial numbers have changed. Each such
- query uses
- a minute amount of the slave server's network bandwidth. To
- limit the
- amount of bandwidth used, BIND 9 limits the rate at which
- queries are
- sent. The value of the serial-query-rate option,
- an integer, is the maximum number of queries sent per
- second.
- The default is 20.
-
-
-
+
+
+ Slave servers will periodically query master
+ servers to find out if zone serial numbers have
+ changed. Each such query uses a minute amount of
+ the slave server's network bandwidth. To limit
+ the amount of bandwidth used, BIND 9 limits the
+ rate at which queries are sent. The value of the
+ serial-query-rate option, an
+ integer, is the maximum number of queries sent
+ per second. The default is 20.
+
+
+ In addition to controlling the rate SOA refresh
+ queries are issued at
+ serial-query-rate also controls
+ the rate at which NOTIFY messages are sent from
+ both master and slave zones.
+
+
+
serial-queries
@@ -7713,6 +7719,10 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
use the hostname as found by the gethostname() function.
The default server-id is none.
+
+ The overall rate that NOTIFY messages are sent for all
+ zones is controlled by serial-query-rate.
+
diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index acdfe609f8900..6655ed91b7243 100644
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -1,5 +1,5 @@
-
+
@@ -45,17 +45,17 @@
The Berkeley Internet Name Domain
(BIND) implements a
@@ -87,7 +87,7 @@
-Organization of This Document
+Organization of This Document
In this document, Chapter 1 introduces
the basic DNS and BIND concepts. Chapter 2
@@ -116,7 +116,7 @@
-Conventions Used in This Document
+Conventions Used in This Document
In this document, we use the following general typographic
conventions:
@@ -243,7 +243,7 @@
-The Domain Name System (DNS)
+The Domain Name System (DNS)
The purpose of this document is to explain the installation
and upkeep of the BIND (Berkeley Internet
@@ -253,7 +253,7 @@
-DNS Fundamentals
+DNS Fundamentals
The Domain Name System (DNS) is a hierarchical, distributed
database. It stores information for mapping Internet host names to
@@ -273,7 +273,7 @@
-Domains and Domain Names
+Domains and Domain Names
The data stored in the DNS is identified by domain names that are organized as a tree according to
organizational or administrative boundaries. Each node of the tree,
@@ -319,7 +319,7 @@
-Zones
+Zones
To properly operate a name server, it is important to understand
the difference between a zone
@@ -372,7 +372,7 @@
-Authoritative Name Servers
+Authoritative Name Servers
Each zone is served by at least
one authoritative name server,
@@ -389,7 +389,7 @@
-The Primary Master
+The Primary Master
The authoritative server where the master copy of the zone
data is maintained is called the
@@ -409,7 +409,7 @@
-Slave Servers
+Slave Servers
The other authoritative servers, the slave
servers (also known as secondary servers)
@@ -425,7 +425,7 @@
-Stealth Servers
+Stealth Servers
Usually all of the zone's authoritative servers are listed in
NS records in the parent zone. These NS records constitute
@@ -460,7 +460,7 @@
-Caching Name Servers
+Caching Name Servers
The resolver libraries provided by most operating systems are
stub resolvers, meaning that they are not
@@ -487,7 +487,7 @@
-Forwarding
+Forwarding
Even a caching name server does not necessarily perform
the complete recursive lookup itself. Instead, it can
@@ -514,7 +514,7 @@
-Name Servers in Multiple Roles
+Name Servers in Multiple Roles
The BIND name server can
simultaneously act as
diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html
index e9277a2d8cc44..8370ef73a9d68 100644
--- a/doc/arm/Bv9ARM.ch02.html
+++ b/doc/arm/Bv9ARM.ch02.html
@@ -1,5 +1,5 @@
-
+
DNS hardware requirements have
traditionally been quite modest.
@@ -73,7 +73,7 @@
-CPU Requirements
+CPU Requirements
CPU requirements for BIND 9 range from
i486-class machines
@@ -84,7 +84,7 @@
-Memory Requirements
+Memory Requirements
The memory of the server has to be large enough to fit the
cache and zones loaded off disk. The max-cache-size
@@ -107,7 +107,7 @@
-Name Server Intensive Environment Issues
+Name Server Intensive Environment Issues
For name server intensive environments, there are two alternative
configurations that may be used. The first is where clients and
@@ -124,7 +124,7 @@
-Supported Operating Systems
+Supported Operating Systems
ISC BIND 9 compiles and runs on a large
number of Unix-like operating systems, and on some versions of
diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html
index fff39d73b131e..86c98b52e04aa 100644
--- a/doc/arm/Bv9ARM.ch03.html
+++ b/doc/arm/Bv9ARM.ch03.html
@@ -1,5 +1,5 @@
-
+
The following sample configuration is appropriate for a caching-only
name server for use by clients internal to a corporation. All
@@ -95,7 +95,7 @@ zone "0.0.127.in-addr.arpa" {
-An Authoritative-only Name Server
+An Authoritative-only Name Server
This sample configuration is for an authoritative-only server
that is the master server for "example.com"
@@ -137,7 +137,7 @@ zone "eng.example.com" {
-Load Balancing
+Load Balancing
A primitive form of load balancing can be achieved in
the DNS by using multiple records
@@ -280,10 +280,10 @@ zone "eng.example.com" {
-Name Server Operations
+Name Server Operations
-Tools for Use With the Name Server Daemon
+Tools for Use With the Name Server Daemon
This section describes several indispensable diagnostic,
administrative and monitoring tools available to the system
@@ -739,7 +739,7 @@ controls {
-Signals
+Signals
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index fa7fb9aeb4277..8086a0fead1a1 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -1,5 +1,5 @@
-
+
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -235,7 +235,7 @@
-Example split DNS setup
+Example split DNS setup
Let's say a company named Example, Inc.
(example.com)
@@ -481,7 +481,7 @@ nameserver 172.16.72.4
-Generate Shared Keys for Each Pair of Hosts
+Generate Shared Keys for Each Pair of Hosts
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -489,7 +489,7 @@ nameserver 172.16.72.4
-Automatic Generation
+Automatic Generation
The following command will generate a 128-bit (16 byte) HMAC-MD5
key as described above. Longer keys are better, but shorter keys
@@ -514,7 +514,7 @@ nameserver 172.16.72.4
-Manual Generation
+Manual Generation
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -529,7 +529,7 @@ nameserver 172.16.72.4
-Copying the Shared Secret to Both Machines
+Copying the Shared Secret to Both Machines
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -537,7 +537,7 @@ nameserver 172.16.72.4
-Informing the Servers of the Key's Existence
+Informing the Servers of the Key's Existence
Imagine host1 and host 2
are
@@ -566,7 +566,7 @@ key host1-host2. {
-Instructing the Server to Use the Key
+Instructing the Server to Use the Key
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf file
@@ -598,7 +598,7 @@ server 10.1.2.3 {
-TSIG Key Based Access Control
+TSIG Key Based Access Control
BIND allows IP addresses and ranges
to be specified in ACL
@@ -626,7 +626,7 @@ allow-update { key host1-host2. ;};
-Errors
+Errors
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -652,7 +652,7 @@ allow-update { key host1-host2. ;};
-TKEY
+TKEY
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -688,7 +688,7 @@ allow-update { key host1-host2. ;};
-SIG(0)
+SIG(0)
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -749,7 +749,7 @@ allow-update { key host1-host2. ;};
-Generating Keys
+Generating Keys
The dnssec-keygen program is used to
generate keys.
@@ -800,7 +800,7 @@ allow-update { key host1-host2. ;};
-Signing the Zone
+Signing the Zone
The dnssec-signzone program is used
to
@@ -844,7 +844,7 @@ allow-update { key host1-host2. ;};
-Configuring Servers
+Configuring Servers
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -932,7 +932,7 @@ options {
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
BIND 9 fully supports all currently
defined forms of IPv6
@@ -971,7 +971,7 @@ options {
-Address Lookups Using AAAA Records
+Address Lookups Using AAAA Records
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -990,7 +990,7 @@ host 3600 IN AAAA 2001:db8::1
-Address to Name Lookups Using Nibble Format
+Address to Name Lookups Using Nibble Format
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index f3f4f395242e7..876e36ff8b827 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -1,5 +1,5 @@
-
+
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 0ce25a5056e5b..36fbb79760dc8 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -1,5 +1,5 @@
-
+
-masters Statement Definition and
+masters Statement Definition and
Usage
masters
lists allow for a common set of masters to be easily used by
@@ -1975,7 +1975,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
-options Statement Grammar
+options Statement Grammar
This is the grammar of the options
statement in the named.conf file:
@@ -3086,7 +3086,7 @@ options {
-Forwarding
+Forwarding
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3130,7 +3130,7 @@ options {
-Dual-stack Servers
+Dual-stack Servers
Dual-stack servers are used as servers of last resort to work
around
@@ -3286,7 +3286,7 @@ options {
-Interfaces
+Interfaces
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -3541,19 +3541,26 @@ avoid-v6-udp-ports {};
hour). The maximum value is 28 days (40320 minutes).
serial-query-rate
-
- Slave servers will periodically query master servers
- to find out if zone serial numbers have changed. Each such
- query uses
- a minute amount of the slave server's network bandwidth. To
- limit the
- amount of bandwidth used, BIND 9 limits the rate at which
- queries are
- sent. The value of the serial-query-rate option,
- an integer, is the maximum number of queries sent per
- second.
- The default is 20.
-
+
+
+ Slave servers will periodically query master
+ servers to find out if zone serial numbers have
+ changed. Each such query uses a minute amount of
+ the slave server's network bandwidth. To limit
+ the amount of bandwidth used, BIND 9 limits the
+ rate at which queries are sent. The value of the
+ serial-query-rate option, an
+ integer, is the maximum number of queries sent
+ per second. The default is 20.
+
+
+ In addition to controlling the rate SOA refresh
+ queries are issued at
+ serial-query-rate also controls
+ the rate at which NOTIFY messages are sent from
+ both master and slave zones.
+
+
serial-queries
In BIND 8, the serial-queries
@@ -3719,7 +3726,7 @@ avoid-v6-udp-ports {};
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -3922,7 +3929,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
-Periodic Task Intervals
+Periodic Task Intervals
cleaning-interval
@@ -4453,7 +4460,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
disables processing of the queries.
server-id
-
+
+
The ID of the server should report via a query of
the name ID.SERVER
with type TXT, class CHAOS.
@@ -4464,7 +4472,12 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Specifying server-id hostname; will cause named to
use the hostname as found by the gethostname() function.
The default server-id is none.
-
+
+
+ The overall rate that NOTIFY messages are sent for all
+ zones is controlled by serial-query-rate.
+
-trusted-keys Statement Definition
+trusted-keys Statement Definition
and Usage
The trusted-keys statement defines
@@ -5053,7 +5066,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
-view Statement Definition and Usage
+view Statement Definition and Usage
The view statement is a powerful
feature
@@ -5309,10 +5322,10 @@ zone zone_name [
-zone Statement Definition and Usage
+zone Statement Definition and Usage
-Zone Types
+Zone Types
@@ -5523,7 +5536,7 @@ zone zone_name [
-Class
+Class
The zone's name may optionally be followed by a class. If
a class is not specified, class IN (for Internet),
@@ -5545,7 +5558,7 @@ zone zone_name [
-Zone Options
+Zone Options
allow-notify
@@ -6046,7 +6059,7 @@ zone zone_name [
-Zone File
+Zone File
Types of Resource Records and When to Use Them
@@ -6059,7 +6072,7 @@ zone zone_name [
-Resource Records
+Resource Records
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
@@ -6749,7 +6762,7 @@ zone zone_name [
-Textual expression of RRs
+Textual expression of RRs
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form
@@ -6952,7 +6965,7 @@ zone zone_name [
-Discussion of MX Records
+Discussion of MX Records
As described above, domain servers store information as a
series of resource records, each of which contains a particular
@@ -7208,7 +7221,7 @@ zone zone_name [
-Inverse Mapping in IPv4
+Inverse Mapping in IPv4
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
@@ -7269,7 +7282,7 @@ zone zone_name [
-Other Zone File Directives
+Other Zone File Directives
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format
@@ -7284,7 +7297,7 @@ zone zone_name [
On UNIX servers, it is possible to run BIND
@@ -144,7 +144,7 @@ zone "example.com" {
-The chroot Environment
+The chroot Environment
In order for a chroot environment
to
@@ -172,7 +172,7 @@ zone "example.com" {
-Using the setuid Function
+Using the setuid Function
Prior to running the named daemon,
use
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index 3aabd142ab8f4..3548e0239cfc7 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -1,5 +1,5 @@
-
+
-It's not working; how can I figure out what's wrong?
+It's not working; how can I figure out what's wrong?
The best solution to solving installation and
configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
-Incrementing and Changing the Serial Number
+Incrementing and Changing the Serial Number
Zone serial numbers are just numbers — they aren't
date related. A lot of people set them to a number that
@@ -95,7 +95,7 @@
-Where Can I Get Help?
+Where Can I Get Help?
The Internet Systems Consortium
(ISC) offers a wide range
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index bc198147fe900..31721586a85a8 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -1,5 +1,5 @@
-
+
A Brief History of the DNS and BIND
@@ -162,7 +162,7 @@
-General DNS Reference Information
+General DNS Reference Information
IPv6 addresses (AAAA)
@@ -250,17 +250,17 @@
-Bibliography
+Bibliography
Standards
-
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
+
[RFC974] C.Partridge. Mail Routing and the Domain System. January 1986.
-
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
+
[RFC1034] P.V.Mockapetris. Domain Names — Concepts and Facilities. November 1987.
-
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
+
[RFC1035] P. V.Mockapetris. Domain Names — Implementation and
Specification. November 1987.
@@ -268,42 +268,42 @@
Proposed Standards
-
[RFC2181] R., R. BushElz. Clarifications to the DNS
+
[RFC2181] R., R. BushElz. Clarifications to the DNS
Specification. July 1997.
-
[RFC2308] M.Andrews. Negative Caching of DNS
+
[RFC2308] M.Andrews. Negative Caching of DNS
Queries. March 1998.
-
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
+
[RFC1995] M.Ohta. Incremental Zone Transfer in DNS. August 1996.
-
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
+
[RFC1996] P.Vixie. A Mechanism for Prompt Notification of Zone Changes. August 1996.
-
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
+
[RFC2136] P.Vixie, S.Thomson, Y.Rekhter, and J.Bound. Dynamic Updates in the Domain Name System. April 1997.
-
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
+
[RFC2671] P.Vixie. Extension Mechanisms for DNS (EDNS0). August 1997.
-
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
+
[RFC2672] M.Crawford. Non-Terminal DNS Name Redirection. August 1999.
-
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+
[RFC2845] P.Vixie, O.Gudmundsson, D.Eastlake, 3rd, and B.Wellington. Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
+
[RFC2930] D.Eastlake, 3rd. Secret Key Establishment for DNS (TKEY RR). September 2000.
-
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+
[RFC2931] D.Eastlake, 3rd. DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
+
[RFC3007] B.Wellington. Secure Domain Name System (DNS) Dynamic Update. November 2000.
-
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
+
[RFC3645] S.Kwan, P.Garg, J.Gilroy, L.Esibov, J.Westhead, and R.Hall. Generic Security Service Algorithm for Secret
Key Transaction Authentication for DNS
(GSS-TSIG). October 2003.
@@ -312,19 +312,19 @@
DNS Security Proposed Standards
-
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
+
[RFC3225] D.Conrad. Indicating Resolver Support of DNSSEC. December 2001.
-
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
+
[RFC3833] D.Atkins and R.Austein. Threat Analysis of the Domain Name System (DNS). August 2004.
-
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
+
[RFC4033] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. DNS Security Introduction and Requirements. March 2005.
-
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
+
[RFC4034] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Resource Records for the DNS Security Extensions. March 2005.
-
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
+
[RFC4035] R.Arends, R.Austein, M.Larson, D.Massey, and S.Rose. Protocol Modifications for the DNS
Security Extensions. March 2005.
@@ -332,146 +332,146 @@
Other Important RFCs About DNS
Implementation
-
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
+
[RFC1535] E.Gavron. A Security Problem and Proposed Correction With Widely
Deployed DNS Software.. October 1993.
-
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
+
[RFC1536] A.Kumar, J.Postel, C.Neuman, P.Danzig, and S.Miller. Common DNS Implementation
Errors and Suggested Fixes. October 1993.
-
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
+
[RFC1982] R.Elz and R.Bush. Serial Number Arithmetic. August 1996.
-
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
+
[RFC4074] Y.Morishita and T.Jinmei. Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005.
Resource Record Types
-
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
+
[RFC1183] C.F.Everhart, L. A.Mamakos, R.Ullmann, and P.Mockapetris. New DNS RR Definitions. October 1990.
-
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
+
[RFC1706] B.Manning and R.Colella. DNS NSAP Resource Records. October 1994.
-
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
+
[RFC2168] R.Daniel and M.Mealling. Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
+
[RFC1876] C.Davis, P.Vixie, T., and I.Dickinson. A Means for Expressing Location Information in the
Domain
Name System. January 1996.
-
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
+
[RFC2052] A.Gulbrandsen and P.Vixie. A DNS RR for Specifying the
Location of
Services.. October 1996.
-
[RFC2163] A.Allocchio. Using the Internet DNS to
+
[RFC2163] A.Allocchio. Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998.
-
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
+
[RFC2230] R.Atkinson. Key Exchange Delegation Record for the DNS. October 1997.
-
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2536] D.Eastlake, 3rd. DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+
[RFC2537] D.Eastlake, 3rd. RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
+
[RFC2538] D.Eastlake, 3rd and O.Gudmundsson. Storing Certificates in the Domain Name System (DNS). March 1999.
-
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+
[RFC2539] D.Eastlake, 3rd. Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
+
[RFC2540] D.Eastlake, 3rd. Detached Domain Name System (DNS) Information. March 1999.
-
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
+
[RFC2782] A.Gulbrandsen. P.Vixie. L.Esibov. A DNS RR for specifying the location of services (DNS SRV). February 2000.
-
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+
[RFC2915] M.Mealling. R.Daniel. The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+
[RFC3110] D.Eastlake, 3rd. RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+
[RFC3123] P.Koch. A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
-
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
+
[RFC3596] S.Thomson, C.Huitema, V.Ksinant, and M.Souissi. DNS Extensions to support IP
version 6. October 2003.
-
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
+
[RFC3597] A.Gustafsson. Handling of Unknown DNS Resource Record (RR) Types. September 2003.
DNS and the Internet
-
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
+
[RFC1101] P. V.Mockapetris. DNS Encoding of Network Names
and Other Types. April 1989.
-
[RFC1123] Braden. Requirements for Internet Hosts - Application and
+
[RFC1123] Braden. Requirements for Internet Hosts - Application and
Support. October 1989.
-
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
+
[RFC1591] J.Postel. Domain Name System Structure and Delegation. March 1994.
-
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
+
[RFC2317] H.Eidnes, G.de Groot, and P.Vixie. Classless IN-ADDR.ARPA Delegation. March 1998.
-
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
+
[RFC2826] Internet Architecture Board. IAB Technical Comment on the Unique DNS Root. May 2000.
-
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
+
[RFC2929] D.Eastlake, 3rd, E.Brunner-Williams, and B.Manning. Domain Name System (DNS) IANA Considerations. September 2000.
DNS Operations
-
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
+
[RFC1033] M.Lottor. Domain administrators operations guide.. November 1987.
-
[RFC1537] P.Beertema. Common DNS Data File
+
[RFC1537] P.Beertema. Common DNS Data File
Configuration Errors. October 1993.
-
[RFC1912] D.Barr. Common DNS Operational and
+
[RFC1912] D.Barr. Common DNS Operational and
Configuration Errors. February 1996.
-
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
+
[RFC2010] B.Manning and P.Vixie. Operational Criteria for Root Name Servers.. October 1996.
-
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
+
[RFC2219] M.Hamilton and R.Wright. Use of DNS Aliases for
Network Services.. October 1997.
Internationalized Domain Names
-
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
+
[RFC2825] IAB and R.Daigle. A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000.
-
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
+
[RFC3490] P.Faltstrom, P.Hoffman, and A.Costello. Internationalizing Domain Names in Applications (IDNA). March 2003.
-
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
+
[RFC3491] P.Hoffman and M.Blanchet. Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003.
-
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
+
[RFC3492] A.Costello. Punycode: A Bootstring encoding of Unicode
for Internationalized Domain Names in
Applications (IDNA). March 2003.
@@ -487,47 +487,47 @@
-
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
+
[RFC1464] R.Rosenbaum. Using the Domain Name System To Store Arbitrary String
Attributes. May 1993.
-
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
+
[RFC1713] A.Romao. Tools for DNS Debugging. November 1994.
-
[RFC1794] T.Brisco. DNS Support for Load
+
[RFC1794] T.Brisco. DNS Support for Load
Balancing. April 1995.
-
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
+
[RFC2240] O.Vaughan. A Legal Basis for Domain Name Allocation. November 1997.
-
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
+
[RFC2345] J.Klensin, T.Wolf, and G.Oglesby. Domain Names and Company Name Retrieval. May 1998.
-
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
+
[RFC2352] O.Vaughan. A Convention For Using Legal Names as Domain Names. May 1998.
-
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+
[RFC3071] J.Klensin. Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
+
[RFC3258] T.Hardie. Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002.
-
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
+
[RFC3901] A.Durand and J.Ihren. DNS IPv6 Transport Operational Guidelines. September 2004.
Obsolete and Unimplemented Experimental RFC
-
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
+
[RFC1712] C.Farrell, M.Schulze, S.Pleitner, and D.Baldoni. DNS Encoding of Geographical
Location. November 1994.
-
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
+
[RFC2673] M.Crawford. Binary Labels in the Domain Name System. August 1999.
-
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
+
[RFC2874] M.Crawford and C.Huitema. DNS Extensions to Support IPv6 Address Aggregation
and Renumbering. July 2000.
@@ -541,39 +541,39 @@
-
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
+
[RFC2065] D.Eastlake, 3rd and C.Kaufman. Domain Name System Security Extensions. January 1997.
-
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
+
[RFC2137] D.Eastlake, 3rd. Secure Domain Name System Dynamic Update. April 1997.
-
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
+
[RFC2535] D.Eastlake, 3rd. Domain Name System Security Extensions. March 1999.
-
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
+
[RFC3008] B.Wellington. Domain Name System Security (DNSSEC)
Signing Authority. November 2000.
-
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
+
[RFC3090] E.Lewis. DNS Security Extension Clarification on Zone Status. March 2001.
-
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
+
[RFC3445] D.Massey and S.Rose. Limiting the Scope of the KEY Resource Record (RR). December 2002.
-
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+
[RFC3655] B.Wellington and O.Gudmundsson. Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
+
[RFC3658] O.Gudmundsson. Delegation Signer (DS) Resource Record (RR). December 2003.
-
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+
[RFC3755] S.Weiler. Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
+
[RFC3757] O.Kolkman, J.Schlyter, and E.Lewis. Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004.
-
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+
[RFC3845] J.Schlyter. DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
@@ -594,14 +594,14 @@
-Other Documents About BIND
+Other Documents About BIND