From 42d3eba523963ab015ac451eeea0788b11631c94 Mon Sep 17 00:00:00 2001
From: Doug Barton
The Berkeley Internet Name Domain (BIND) implements a @@ -87,7 +87,7 @@
In this document, Chapter 1 introduces the basic DNS and BIND concepts. Chapter 2 @@ -116,7 +116,7 @@
In this document, we use the following general typographic conventions: @@ -243,7 +243,7 @@
The purpose of this document is to explain the installation and upkeep of the BIND (Berkeley Internet @@ -253,7 +253,7 @@
The Domain Name System (DNS) is a hierarchical, distributed database. It stores information for mapping Internet host names to @@ -275,7 +275,7 @@
The data stored in the DNS is identified by domain names that are organized as a tree according to organizational or administrative boundaries. Each node of the tree, @@ -321,7 +321,7 @@
To properly operate a name server, it is important to understand the difference between a zone @@ -374,7 +374,7 @@
Each zone is served by at least one authoritative name server, @@ -391,7 +391,7 @@
The authoritative server where the master copy of the zone data is maintained is called the @@ -411,7 +411,7 @@
The other authoritative servers, the slave servers (also known as secondary servers) @@ -427,7 +427,7 @@
Usually all of the zone's authoritative servers are listed in NS records in the parent zone. These NS records constitute @@ -462,7 +462,7 @@
The resolver libraries provided by most operating systems are stub resolvers, meaning that they are not @@ -489,7 +489,7 @@
Even a caching name server does not necessarily perform the complete recursive lookup itself. Instead, it can @@ -516,7 +516,7 @@
The BIND name server can simultaneously act as diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index a9fde322a12c5..2965781971664 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -1,5 +1,5 @@ - +
@@ -45,16 +45,16 @@Table of Contents
DNS hardware requirements have traditionally been quite modest. @@ -73,7 +73,7 @@
CPU requirements for BIND 9 range from i486-class machines @@ -84,7 +84,7 @@
The memory of the server has to be large enough to fit the cache and zones loaded off disk. The max-cache-size @@ -107,7 +107,7 @@
For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -124,7 +124,7 @@
ISC BIND 9 compiles and runs on a large number diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index aaaa96a52b71e..32000b1886590 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -1,5 +1,5 @@ - +
@@ -47,14 +47,14 @@The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All @@ -98,7 +98,7 @@ zone "0.0.127.in-addr.arpa" {
This sample configuration is for an authoritative-only server
that is the master server for "example.com
"
@@ -146,7 +146,7 @@ zone "eng.example.com" {
A primitive form of load balancing can be achieved in the DNS by using multiple records @@ -289,10 +289,10 @@ zone "eng.example.com" {
This section describes several indispensable diagnostic,
administrative and monitoring tools available to the system
@@ -670,6 +670,21 @@ zone "eng.example.com" {
set to yes
to be effective.
It defaults to enabled.
tsig-list
+ List the names of all TSIG keys currently configured + for use by named in each view. The + list both statically configured keys and dynamic + TKEY-negotiated keys. +
tsig-delete
+ keyname
+ [view
]+ Delete a given TKEY-negotated key from the server. + (This does not apply to statically configured TSIG + keys.) +
addzone
zone
[class
@@ -873,7 +888,7 @@ controls {
Certain UNIX signals cause the name server to take specific
actions, as described in the following table. These signals can
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index f1d0a6ccf13a0..202439f5af241 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -1,5 +1,5 @@
-
+
@@ -49,59 +49,59 @@
Dynamic Update
- The journal file
Incremental Zone Transfers (IXFR)
-Split DNS
-- Example split DNS setup
+Split DNS
+- Example split DNS setup
TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
-TKEY
-SIG(0)
+TKEY
+SIG(0)
DNSSEC
-- Generating Keys
-- Signing the Zone
-- Configuring Servers
+- Generating Keys
+- Signing the Zone
+- Configuring Servers
DNSSEC, Dynamic Zones, and Automatic Signing
-- Converting from insecure to secure
-- Dynamic DNS update method
-- Fully automatic zone signing
-- Private-type records
-- DNSKEY rollovers
-- Dynamic DNS update method
-- Automatic key rollovers
-- NSEC3PARAM rollovers via UPDATE
-- Converting from NSEC to NSEC3
-- Converting from NSEC3 to NSEC
-- Converting from secure to insecure
-- Periodic re-signing
-- NSEC3 and OPTOUT
+- Converting from insecure to secure
+- Dynamic DNS update method
+- Fully automatic zone signing
+- Private-type records
+- DNSKEY rollovers
+- Dynamic DNS update method
+- Automatic key rollovers
+- NSEC3PARAM rollovers via UPDATE
+- Converting from NSEC to NSEC3
+- Converting from NSEC3 to NSEC
+- Converting from secure to insecure
+- Periodic re-signing
+- NSEC3 and OPTOUT
Dynamic Trust Anchor Management
-- Validating Resolver
-- Authoritative Server
+- Validating Resolver
+- Authoritative Server
PKCS #11 (Cryptoki) support
-- Prerequisites
-- Building BIND 9 with PKCS#11
-- PKCS #11 Tools
-- Using the HSM
-- Specifying the engine on the command line
-- Running named with automatic zone re-signing
+- Prerequisites
+- Building BIND 9 with PKCS#11
+- PKCS #11 Tools
+- Using the HSM
+- Specifying the engine on the command line
+- Running named with automatic zone re-signing
-IPv6 Support in BIND 9
+IPv6 Support in BIND 9
-- Address Lookups Using AAAA Records
-- Address to Name Lookups Using Nibble Format
+- Address Lookups Using AAAA Records
+- Address to Name Lookups Using Nibble Format
@@ -247,16 +247,18 @@
to yes
.
- When acting as a slave, BIND 9 will
- attempt to use IXFR unless
- it is explicitly disabled. For more information about disabling
- IXFR, see the description of the request-ixfr clause
- of the server statement.
+ When acting as a slave, BIND 9 will attempt
+ to use IXFR unless it is explicitly disabled via the
+ request-ixfr option or the use of
+ ixfr-from-differences. For
+ more information about disabling IXFR, see the description
+ of the request-ixfr clause of the
+ server statement.
Setting up different views, or visibility, of the DNS space to
internal and external resolvers is usually referred to as a
@@ -286,7 +288,7 @@
Let's say a company named Example, Inc.
(example.com
)
@@ -543,7 +545,7 @@ nameserver 172.16.72.4
A shared secret is generated to be shared between host1 and host2.
An arbitrary key name is chosen: "host1-host2.". The key name must
@@ -551,7 +553,7 @@ nameserver 172.16.72.4
The following command will generate a 128-bit (16 byte) HMAC-SHA256
key as described above. Longer keys are better, but shorter keys
@@ -575,7 +577,7 @@ nameserver 172.16.72.4
The shared secret is simply a random sequence of bits, encoded
in base-64. Most ASCII strings are valid base-64 strings (assuming
@@ -590,7 +592,7 @@ nameserver 172.16.72.4
This is beyond the scope of DNS. A secure transport mechanism
should be used. This could be secure FTP, ssh, telephone, etc.
@@ -598,7 +600,7 @@ nameserver 172.16.72.4
Imagine host1 and host 2
are
@@ -625,7 +627,7 @@ key host1-host2. {
Since keys are shared between two hosts only, the server must
be told when keys are to be used. The following is added to the named.conf
file
@@ -657,7 +659,7 @@ server 10.1.2.3 {
BIND allows IP addresses and ranges
to be specified in ACL
@@ -684,7 +686,7 @@ allow-update { key host1-host2. ;};
The processing of TSIG signed messages can result in
several errors. If a signed message is sent to a non-TSIG aware
@@ -710,7 +712,7 @@ allow-update { key host1-host2. ;};
TKEY
is a mechanism for automatically generating a shared secret
between two hosts. There are several "modes" of
@@ -746,7 +748,7 @@ allow-update { key host1-host2. ;};
BIND 9 partially supports DNSSEC SIG(0)
transaction signatures as specified in RFC 2535 and RFC 2931.
@@ -807,7 +809,7 @@ allow-update { key host1-host2. ;};
The dnssec-keygen program is used to
generate keys.
@@ -863,7 +865,7 @@ allow-update { key host1-host2. ;};
The dnssec-signzone program is used
to sign a zone.
@@ -905,7 +907,7 @@ allow-update { key host1-host2. ;};
To enable named to respond appropriately
to DNS requests from DNSSEC aware clients,
@@ -1065,7 +1067,7 @@ options {
from insecure to signed and back again. A secure zone can use
either NSEC or NSEC3 chains.
+Converting from insecure to secure
Changing a zone from insecure to secure can be done in two
ways: using a dynamic DNS update, or the
auto-dnssec zone option.
@@ -1091,7 +1093,7 @@ options {
well. An NSEC chain will be generated as part of the initial
signing process.
+Dynamic DNS update method
To insert the keys via dynamic update:
% nsupdate
@@ -1127,7 +1129,7 @@ options {
While the initial signing and NSEC/NSEC3 chain generation
is happening, other updates are possible as well.
+Fully automatic zone signing
To enable automatic signing, add the
auto-dnssec option to the zone statement in
named.conf
.
@@ -1162,7 +1164,7 @@ options {
configuration. If this has not been done, the configuration will
fail.
+Private-type records
The state of the signing process is signaled by
private-type records (with a default type value of 65534). When
signing is complete, these records will have a nonzero value for
@@ -1203,12 +1205,12 @@ options {
+DNSKEY rollovers
As with insecure-to-secure conversions, rolling DNSSEC
keys can be done in two ways: using a dynamic DNS update, or the
auto-dnssec zone option.
+Dynamic DNS update method
To perform key rollovers via dynamic update, you need to add
the K*
files for the new keys so that
named can find them. You can then add the new
@@ -1230,7 +1232,7 @@ options {
named will clean out any signatures generated
by the old key after the update completes.
+Automatic key rollovers
When a new key reaches its activation date (as set by
dnssec-keygen or dnssec-settime),
if the auto-dnssec zone option is set to
@@ -1245,27 +1247,27 @@ options {
completes in 30 days, after which it will be safe to remove the
old key from the DNSKEY RRset.
+NSEC3PARAM rollovers via UPDATE
Add the new NSEC3PARAM record via dynamic update. When the
new NSEC3 chain has been generated, the NSEC3PARAM flag field
will be zero. At this point you can remove the old NSEC3PARAM
record. The old chain will be removed after the update request
completes.
+Converting from NSEC to NSEC3
To do this, you just need to add an NSEC3PARAM record. When
the conversion is complete, the NSEC chain will have been removed
and the NSEC3PARAM record will have a zero flag field. The NSEC3
chain will be generated before the NSEC chain is
destroyed.
+Converting from NSEC3 to NSEC
To do this, use nsupdate to
remove all NSEC3PARAM records with a zero flag
field. The NSEC chain will be generated before the NSEC3 chain is
removed.
+Converting from secure to insecure
To convert a signed zone to unsigned using dynamic DNS,
delete all the DNSKEY records from the zone apex using
nsupdate. All signatures, NSEC or NSEC3 chains,
@@ -1280,14 +1282,14 @@ options {
allow instead (or it will re-sign).
+Periodic re-signing
In any secure zone which supports dynamic updates, named
will periodically re-sign RRsets which have not been re-signed as
a result of some update action. The signature lifetimes will be
adjusted so as to spread the re-sign load over time rather than
all at once.
+NSEC3 and OPTOUT
named only supports creating new NSEC3 chains
where all the NSEC3 records in the zone have the same OPTOUT
@@ -1309,7 +1311,7 @@ options {
configuration files.
To configure a validating resolver to use RFC 5011 to
maintain a trust anchor, configure the trust anchor using a
managed-keys statement. Information about
@@ -1320,7 +1322,7 @@ options {
To set up an authoritative zone for RFC 5011 trust anchor
maintenance, generate two (or more) key signing keys (KSKs) for
the zone. Sign the zone with one of them; this is the "active"
@@ -1394,7 +1396,7 @@ $ dnssec-signzone -S -K keys example.net
<
Debian Linux, Solaris x86 and Windows Server 2003.
See the HSM vendor documentation for information about
installing, initializing, testing and troubleshooting the
HSM.
@@ -1429,13 +1431,16 @@ $ dnssec-signzone -S -K keys example.net
<
other computationally-intensive operations. The AEP Keyper
is an example of such a device.
-The modified OpenSSL code is included in the BIND 9.7.0
- release, in the form of a context diff against the latest OpenSSL.
+
The modified OpenSSL code is included in the BIND 9 release,
+ in the form of a context diff against the latest verions of
+ OpenSSL. OpenSSL 0.9.8 and 1.0.0 are both supported; there are
+ separate diffs for each version. In the examples to follow,
+ we use OpenSSL 0.9.8, but the same methods work with OpenSSL 1.0.0.
Note
- The latest OpenSSL version at the time of the BIND release
- is 0.9.8l.
+ The latest OpenSSL versions at the time of the BIND release
+ are 0.9.8s and 1.0.0f.
ISC will provide an updated patch as new versions of OpenSSL
are released. The version number in the following examples
is expected to change.
@@ -1444,18 +1449,18 @@ $ dnssec-signzone -S -K keys example.net
<
necessary to build OpenSSL with this patch in place and inform
it of the path to the HSM-specific PKCS #11 provider
library.
-Obtain OpenSSL 0.9.8l:
+Obtain OpenSSL 0.9.8s:
-$ wget http://www.openssl.org/source/openssl-0.9.8l.tar.gz
+$ wget http://www.openssl.org/source/openssl-0.9.8s.tar.gz
Extract the tarball:
-$ tar zxf openssl-0.9.8l.tar.gz
+$ tar zxf openssl-0.9.8s.tar.gz
Apply the patch from the BIND 9 release:
-$ patch -p1 -d openssl-0.9.8l \
- < bind-9.7.0/bin/pkcs11/openssl-0.9.8l-patch
+$ patch -p1 -d openssl-0.9.8s \
+ < bind9/bin/pkcs11/openssl-0.9.8s-patch
Note
(Note that the patch file may not be compatible with the
@@ -1468,7 +1473,7 @@ $ patch -p1 -d openssl-0.9.8l \
when we configure BIND 9.
The AEP Keyper is a highly secure key storage device,
but does not provide hardware cryptographic acceleration. It
can carry out cryptographic operations, but it is probably
@@ -1487,7 +1492,7 @@ $ cp pkcs11.GCC4.0.2.so.4.05 /opt/pkcs11/usr/lib
Finally, the Keyper library requires threads, so we
must specify -pthread.
-$ cd openssl-0.9.8l
+$ cd openssl-0.9.8s
$ ./Configure linux-generic32 -m32 -pthread \
--pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
--pk11-flavor=sign-only \
@@ -1500,7 +1505,7 @@ $ ./Configure linux-generic32 -m32 -pthread \
The SCA-6000 PKCS #11 provider is installed as a system
library, libpkcs11. It is a true crypto accelerator, up to 4
times faster than any CPU, so the flavor shall be
@@ -1508,7 +1513,7 @@ $ ./Configure linux-generic32 -m32 -pthread \
In this example, we are building on Solaris x86 on an
AMD64 system.
-$ cd openssl-0.9.8l
+$ cd openssl-0.9.8s
$ ./Configure solaris64-x86_64-cc \
--pk11-libname=/usr/lib/64/libpkcs11.so \
--pk11-flavor=crypto-accelerator \
@@ -1519,11 +1524,50 @@ $ ./Configure solaris64-x86_64-cc \
After configuring, run
make and
make test.
+
+
+
+SoftHSM is a software library provided by the OpenDNSSEC
+ project (http://www.opendnssec.org) which provides a PKCS#11
+ interface to a virtual HSM, implemented in the form of encrypted
+ data on the local filesystem. It uses the Botan library for
+ encryption and SQLite3 for data storage. Though less secure
+ than a true HSM, it can provide more secure key storage than
+ traditional key files, and can allow you to experiment with
+ PKCS#11 when an HSM is not available.
+The SoftHSM cryptographic store must be installed and
+ initialized before using it with OpenSSL, and the SOFTHSM_CONF
+ environment variable must always point to the SoftHSM configuration
+ file:
+
+$ cd softhsm-1.3.0
+$ configure --prefix=/opt/pkcs11/usr
+$ make
+$ make install
+$ export SOFTHSM_CONF=/opt/pkcs11/softhsm.conf
+$ echo "0:/opt/pkcs11/softhsm.db" > $SOFTHSM_CONF
+$ /opt/pkcs11/usr/bin/softhsm --init-token 0 --slot 0 --label softhsm
+
+SoftHSM can perform all cryptographic operations, but
+ since it only uses your system CPU, there is no need to use it
+ for anything but signing. Therefore, we choose the 'sign-only'
+ flavor when building OpenSSL.
+
+$ cd openssl-0.9.8s
+$ ./Configure linux-x86_64 -pthread \
+ --pk11-libname=/opt/pkcs11/usr/lib/libpkcs11.so \
+ --pk11-flavor=sign-only \
+ --prefix=/opt/pkcs11/usr
+
+After configuring, run "make"
+ and "make test".
+
Once you have built OpenSSL, run
- "apps/openssl engine pkcs11" to confirm
- that PKCS #11 support was compiled in correctly. The output
- should be one of the following lines, depending on the flavor
- selected:
+ "apps/openssl engine pkcs11" to confirm
+ that PKCS #11 support was compiled in correctly. The output
+ should be one of the following lines, depending on the flavor
+ selected:
(pkcs11) PKCS #11 engine support (sign only)
@@ -1532,24 +1576,23 @@ $ ./Configure solaris64-x86_64-cc \
(pkcs11) PKCS #11 engine support (crypto accelerator)
Next, run
- "apps/openssl engine pkcs11 -t". This will
- attempt to initialize the PKCS #11 engine. If it is able to
- do so successfully, it will report
- “[ available ]
”.
+ "apps/openssl engine pkcs11 -t". This will
+ attempt to initialize the PKCS #11 engine. If it is able to
+ do so successfully, it will report
+ “[ available ]
”.
If the output is correct, run
- "make install" which will install the
- modified OpenSSL suite to
- /opt/pkcs11/usr
.
-
+ "make install" which will install the
+ modified OpenSSL suite to
+ /opt/pkcs11/usr
.
When building BIND 9, the location of the custom-built
OpenSSL library must be specified via configure.
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
The PKCS #11 library for the AEP Keyper is currently
@@ -1557,7 +1600,7 @@ $ ./Configure solaris64-x86_64-cc \
64-bit host, we must force a 32-bit build by adding "-m32" to
the CC options on the "configure" command line.
-$ cd ../bind-9.7.0
+$ cd ../bind9
$ ./configure CC="gcc -m32" --enable-threads \
--with-openssl=/opt/pkcs11/usr \
--with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so
@@ -1565,11 +1608,11 @@ $ ./configure CC="gcc -m32" --enable-threads \
To link with the PKCS #11 provider, threads must be
enabled in the BIND 9 build.
-$ cd ../bind-9.7.0
+$ cd ../bind9
$ ./configure CC="cc -xarch=amd64" --enable-threads \
--with-openssl=/opt/pkcs11/usr \
--with-pkcs11=/usr/lib/64/libpkcs11.so
@@ -1581,14 +1624,26 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
same as the --prefix argument to the OpenSSL
Configure).
+
+
+
+$ cd ../bind9
+$ ./configure --enable-threads \
+ --with-openssl=/opt/pkcs11/usr \
+ --with-pkcs11=/opt/pkcs11/usr/lib/libpkcs11.so
+
+
After configuring, run
"make",
"make test" and
"make install".
+(Note: If "make test" fails in the "pkcs11" system test, you may
+ have forgotten to set the SOFTHSM_CONF environment variable.)
BIND 9 includes a minimal set of tools to operate the
HSM, including
pkcs11-keygen to generate a new key pair
@@ -1606,7 +1661,7 @@ $ ./configure CC="cc -xarch=amd64" --enable-thre
First, we must set up the runtime environment so the
OpenSSL and PKCS #11 libraries can be loaded:
@@ -1694,7 +1749,7 @@ example.net.signed
The OpenSSL engine can be specified in
named and all of the BIND
dnssec-* tools by using the "-E
@@ -1715,7 +1770,7 @@ $ dnssec-signzone -E '' -S example.net
If you want
named to dynamically re-sign zones using HSM
keys, and/or to to sign new records inserted via nsupdate, then
@@ -1751,7 +1806,7 @@ $ dnssec-signzone -E '' -S example.net
BIND 9 fully supports all currently
defined forms of IPv6 name to address and address to name
@@ -1789,7 +1844,7 @@ $ dnssec-signzone -E '' -S example.net
The IPv6 AAAA record is a parallel to the IPv4 A record,
and, unlike the deprecated A6 record, specifies the entire
@@ -1808,7 +1863,7 @@ host 3600 IN AAAA 2001:db8::1
When looking up an address in nibble format, the address
components are simply reversed, just as in IPv4, and
diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 99e2a9db66175..0779c970ddce7 100644
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -1,5 +1,5 @@
-
+
@@ -45,13 +45,13 @@
Table of Contents
Traditionally applications have been linked with a stub resolver
library that sends recursive DNS queries to a local caching name
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 24338616ed00c..8e7bac373a2df 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -1,5 +1,5 @@
-
+
@@ -48,58 +48,58 @@
Configuration File Elements
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and
Usage
-- include Statement Grammar
-- include Statement Definition and
+
- include Statement Grammar
+- include Statement Definition and
Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and
+
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and
Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and
+
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and
Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and
Usage
- server Statement Grammar
- server Statement Definition and
Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and
+
- statistics-channels Statement Definition and
Usage
- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Definition
and Usage
-- managed-keys Statement Grammar
+- managed-keys Statement Grammar
- managed-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
-Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics
@@ -477,7 +477,7 @@
Address Match Lists
address_match_list
= address_match_list_element ;
[ address_match_list_element; ... ]
address_match_list_element
= [ ! ] (ip_address [/length] |
@@ -486,7 +486,7 @@
Address match lists are primarily used to determine access
control for various server operations. They are also used in
@@ -570,7 +570,7 @@
The BIND 9 comment syntax allows for
comments to appear
@@ -580,7 +580,7 @@
/* This is a BIND comment as in C */
@@ -596,7 +596,7 @@
Comments may appear anywhere that whitespace may appear in
a BIND configuration file.
@@ -848,7 +848,7 @@
acl acl-name {
address_match_list
};
@@ -930,7 +930,7 @@
controls {
[ inet ( ip_addr | * ) [ port ip_port ]
allow { address_match_list
}
@@ -1054,12 +1054,12 @@
include filename
;
The include statement inserts the
@@ -1074,7 +1074,7 @@
key key_id
{
algorithm string
;
secret string
;
@@ -1083,7 +1083,7 @@
The key statement defines a shared
secret key for use with TSIG (see the section called “TSIG”)
@@ -1130,7 +1130,7 @@
logging {
[ channel channel_name
{
( file path_name
@@ -1154,7 +1154,7 @@
The logging statement configures a
@@ -1188,7 +1188,7 @@
All log output goes to one or more channels;
you can make as many of them as you want.
@@ -1748,12 +1748,25 @@ category notify { null; };
+
+
+ RPZ
+
+
+
+ Information about errors in response policy zone files,
+ rewritten responses, and at the highest
+ debug levels, mere rewriting
+ attempts.
+
+
+
The query-errors category is
specifically intended for debugging purposes: To identify
@@ -1981,7 +1994,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the lwres
statement in the named.conf
file:
@@ -1997,7 +2010,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The lwres statement configures the
name
@@ -2048,7 +2061,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters name
[port ip_port
] { ( masters_list
|
ip_addr
[port ip_port
] [key key
] ) ; [...] };
@@ -2056,7 +2069,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
masters
lists allow for a common set of masters to be easily used by
@@ -2065,7 +2078,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
This is the grammar of the options
statement in the named.conf
file:
@@ -2086,6 +2099,10 @@ badresp:1,adberr:0,findfail:0,valfail:0]
[ cache-file path_name
; ]
[ dump-file path_name
; ]
[ bindkeys-file path_name
; ]
+ [ secroots-file path_name
; ]
+ [ session-keyfile path_name
; ]
+ [ session-keyname key_name
; ]
+ [ session-keyalg algorithm_id
; ]
[ memstatistics yes_or_no
; ]
[ memstatistics-file path_name
; ]
[ pid-file path_name
; ]
@@ -2111,7 +2128,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
[ ixfr-from-differences (yes_or_no
| master
| slave
); ]
[ dnssec-enable yes_or_no
; ]
[ dnssec-validation (yes_or_no
| auto
); ]
- [ dnssec-lookaside ( auto
|
+ [ dnssec-lookaside ( auto
|
+ no
|
domain
trust-anchor domain
); ]
[ dnssec-must-be-secure domain yes_or_no
; ]
[ dnssec-accept-expired yes_or_no
; ]
@@ -2259,7 +2277,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
[ resolver-query-timeout number
; ]
[ deny-answer-addresses { address_match_list
} [ except-from { namelist
} ];]
[ deny-answer-aliases { namelist
} [ except-from { namelist
} ];]
- [ response-policy { zone_name
[ policy given
| no-op
| nxdomain
| nodata
| cname domain
] ; } ; ]
+ [ response-policy { zone_name
[ policy given | disabled | passthru | nxdomain | nodata | cname domain
] ; } ; ]
};
@@ -2517,7 +2535,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
The pathname of the file the server dumps
security roots to when instructed to do so with
rndc secroots.
- If not specified, the default is named.secroots
.
+ If not specified, the default is
+ named.secroots
.
session-keyfile
@@ -2543,14 +2562,6 @@ badresp:1,adberr:0,findfail:0,valfail:0]
hmac-sha384, hmac-sha512 and hmac-md5. If not
specified, the default is hmac-sha256.
-session-keyfile
-
- The pathname of the file into which to write a session TSIG
- key for use by nsupdate -l. (See the
- discussion of the update-policy
- statement's local
option for more
- details on this feature.)
-
port
The UDP/TCP port number the server uses for
@@ -2662,6 +2673,11 @@ options {
values for the DLV domain and trust anchor will be
used, along with a built-in key for validation.
+
+ If dnssec-lookaside is set to
+ no
, then dnssec-lookaside
+ is not used.
+
The default DLV key is stored in the file
bind.keys
;
@@ -3649,7 +3665,7 @@ options {
The forwarding facility can be used to create a large site-wide
cache on a few servers, reducing traffic over links to external
@@ -3693,7 +3709,7 @@ options {
Dual-stack servers are used as servers of last resort to work
around
@@ -3904,7 +3920,7 @@ options {
The interfaces and ports that the server will answer queries
from may be specified using the listen-on option. listen-on takes
@@ -4363,7 +4379,7 @@ avoid-v6-udp-ports {};
use-v4-udp-ports,
avoid-v4-udp-ports,
@@ -4405,7 +4421,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
The server's usage of many system resources can be limited.
Scaled values are allowed when specifying resource limits. For
@@ -4567,7 +4583,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
- cleaning-interval
@@ -4988,7 +5004,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
Specify a private RDATA type to be used when generating
key signing records. The default is
- 65535
.
+ 65534
.
It is expected that this parameter may be removed
@@ -5210,10 +5226,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
and which queries should not be sent to the Internet's root
servers. The official servers which cover these namespaces
return NXDOMAIN responses to these queries. In particular,
- these cover the reverse namespace for addresses from RFC 1918 and
- RFC 3330. They also include the reverse namespace for IPv6 local
- address (locally assigned), IPv6 link local addresses, the IPv6
- loopback address and the IPv6 unknown address.
+ these cover the reverse namespaces for addresses from
+ RFC 1918, RFC 4193, and RFC 5737. They also include the
+ reverse namespace for IPv6 local address (locally assigned),
+ IPv6 link local addresses, the IPv6 loopback address and the
+ IPv6 unknown address.
Named will attempt to determine if a built-in zone already exists
@@ -5406,7 +5423,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
BIND 9 provides the ability to filter
out DNS responses from external DNS servers containing
@@ -5529,131 +5546,228 @@ deny-answer-aliases { "example.net"; };
BIND 9 includes an intentionally limited
mechanism to modify DNS responses for recursive requests
- similar to email anti-spam DNS blacklists.
- All response policy zones are named in the
- response-policy option for the view or among the
- global options if there is no response-policy option for the view.
+ somewhat similar to email anti-spam DNS blacklists.
+ Responses can be changed to deny the existence of domains(NXDOMAIN),
+ deny the existence of IP addresses for domains (NODATA),
+ or contain other IP addresses or data.
- The rules encoded in a response policy zone (RPZ) are applied
- only to responses to queries that ask for recursion (RD=1).
- RPZs are normal DNS zones containing RRsets
+ The actions encoded in a response policy zone (RPZ) are applied
+ only to queries that ask for recursion (RD=1).
+ Response policy zones are named in the
+ response-policy option for the view or among the
+ global options if there is no response-policy option for the view.
+ RPZs are ordinary DNS zones containing RRsets
that can be queried normally if allowed.
It is usually best to restrict those queries with something like
- allow-query {none; }; or
- allow-query { 127.0.0.1; };.
+ allow-query { localhost; };.
- There are four kinds of RPZ rewrite rules. QNAME rules are
- applied to query names in requests and to targets of CNAME
- records resolved in the process of generating the response.
- The owner name of a QNAME rule is the query name relativized
+ There are four kinds of RPZ records, QNAME, IP, NSIP,
+ and NSDNAME.
+ QNAME records are applied to query names of requests and targets
+ of CNAME records resolved to generate the response.
+ The owner name of a QNAME RPZ record is the query name relativized
to the RPZ.
- The records in a rewrite rule are usually A, AAAA, or special
- CNAMEs, but can be any type except DNAME.
-
-
- IP rules are triggered by addresses in A and AAAA records.
- All IP addresses in A or AAAA RRsets are tested and the rule
- longest prefix is applied. Ties between rules with equal prefixes
- are broken in favor of the first RPZ mentioned in the
- response-policy option.
- The rule matching the smallest IP address is chosen among equal
- prefix rules from a single RPZ.
- IP rules are expressed in RRsets with owner names that are
- subdomains of rpz-ip and encoding an IP address block, reversed
- as in IN-ARPA.
- prefix.B.B.B.B with prefix between 1 and 32 and B between 1 and 255
- encodes an IPv4 address.
- IPv6 addresses are encoded by with prefix.W.W.W.W.W.W.W.W or
- prefix.WORDS.zz.WORDS. The words in the standard IPv6 text
- representation are reversed, "::" is replaced with ".zz.",
- and ":" becomes ".".
-
-
- NSDNAME rules match names in NS RRsets for the response or a
- parent. They are encoded as subdomains of rpz-nsdomain relativized
+
+
+ The second kind of RPZ record, an IP policy record,
+ is triggered by addresses in A and AAAA records
+ for the ANSWER sections of responses.
+ IP policy records have owner names that are
+ subdomains of rpz-ip
relativized to the
+ RPZ origin name and encode an IP address or address block.
+ IPv4 addresses are encoded as
+ prefixlength.B4.B3.B2.B1.rpz-ip
.
+ The prefix length must be between 1 and 32.
+ All four bytes, B4, B3, B2, and B1, must be present.
+ B4 is the decimal value of the least significant byte of the
+ IPv4 address as in IN-ADDR.ARPA.
+ IPv6 addresses are encoded in a format similar to the standard
+ IPv6 text representation,
+ prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip
.
+ Each of W8,...,W1 is a one to four digit hexadecimal number
+ representing 16 bits of the IPv6 address as in the standard text
+ representation of IPv6 addresses, but reversed as in IN-ADDR.ARPA.
+ All 8 words must be present except when consecutive
+ zero words are replaced with .zz.
+ analogous to double colons (::) in standard IPv6 text encodings.
+ The prefix length must be between 1 and 128.
+
+
+ NSDNAME policy records match names of authoritative servers
+ for the query name, a parent of the query name, a CNAME,
+ or a parent of a CNAME.
+ They are encoded as subdomains of
+ rpz-nsdomain
relativized
to the RPZ origin name.
- NSIP rules match IP addresses in A and AAAA RRsets for names of
- responsible servers or the names that can be matched by NSDNAME
- rules. The are encoded like IP rules except as subdomains of
- rpz-nsip.
+ NSIP policy records match IP addresses in A and AAAA RRsets
+ for domains that can be checked against NSDNAME policy records.
+ The are encoded like IP policies except as subdomains of
+ rpz-nsip
.
+
+
+ The query response is checked against all RPZs, so
+ two or more policy records can apply to a single response.
+ Because DNS responses can be rewritten according by at most a
+ single policy record, a single policy (other than
+ DISABLED policies) must be chosen.
+ Policies are chosen in the following order:
+
+
+- Among applicable zones, use the RPZ that appears first
+ in the response-policy option.
+
+- Prefer QNAME to IP to NSDNAME to NSIP policy records
+ in a single RPZ
+
+- Among applicable NSDNAME policy records, prefer the
+ policy record that matches the lexically smallest name
+
+- Among IP or NSIP policy records, prefer the record
+ with the longest prefix.
+
+- Among records with the same prefex length,
+ prefer the IP or NSIP policy record that matches
+ the smallest IP address.
+
+
+
+
+
+ When the processing of a response is restarted to resolve
+ DNAME or CNAME records and an applicable policy record set has
+ not been found,
+ all RPZs are again consulted for the DNAME or CNAME names
+ and addresses.
- Authority verification issues and variations in authority data in
- the current version of BIND 9 can cause
- inconsistent results from NSIP and NSDNAME. So they are available
+ Authority verification issues and variations in authority data
+ can cause inconsistent results for NSIP and NSDNAME policy records.
+ Glue NS records often differ from authoritative NS records.
+ So they are available
only when BIND is built with the
--enable-rpz-nsip
or
--enable-rpz-nsdname
options
on the "configure" command line.
- Four policies can be expressed.
- The NXDOMAIN policy causes a NXDOMAIN response
- and is expressed with an RRset consisting of a single CNAME
- whose target is the root domain (.).
- NODATA generates NODATA or ANCOUNT=1 regardless
- of query type.
- It is expressed with a CNAME whose target is the wildcard
- top-level domain (*.).
- The NO-OP policy does not change the response
- and is used to "poke holes" in policies for larger CIDR blocks or in
- zones named later in the response-policy option.
- The NO-OP policy is expressed by a CNAME with a target consisting
- of the variable part of the owner name, such as "example.com." for
- a QNAME rule or "128.1.0.0.127." for an IP rule.
- The CNAME policy is used to replace the RRsets
- of response.
- A and AAAA RRsets are most common and useful to capture
- an evil domain in a walled garden, but any valid set of RRsets
- is possible.
-
-
- All of the policies in an RPZ can be overridden with a
- policy clause.
- given says "do not override."
- no-op says "do nothing" regardless of the policy
- in RPZ records.
- nxdomain causes all RPZ rules to generate
- NXDOMAIN results.
- nodata gives nodata.
- cname domain causes all RPZ rules to act as if
- the consisted of a "cname domain" record.
+ RPZ record sets are special CNAME records or one or more
+ of any types of DNS record except DNAME or DNSSEC.
+ Except when a policy record is a CNAME, there can be more
+ more than one record and more than one type
+ in a set of policy records.
+ Except for three kinds of CNAME records that are illegal except
+ in policy zones, the records in a set are used in the response as if
+ their owner name were the query name. They are copied to the
+ response as dictated by their types.
+
+
+- A CNAME whose target is the root domain (.)
+ specifies the NXDOMAIN policy,
+ which generates an NXDOMAIN response.
+
+- A CNAME whose target is the wildcard top-level
+ domain (*.) specifies the NODATA policy,
+ which rewrites the response to NODATA or ANCOUNT=1.
+
+- A CNAME whose target is a wildcard hostname such
+ as *.example.com is used normally after the astrisk (*)
+ has been replaced with the query name.
+ These records are usually resolved with ordinary CNAMEs
+ outside the policy zones. They can be useful for logging.
+
+- The PASSTHRU policy is specified
+ by a CNAME whose target is the variable part of its own
+ owner name. It causes the response to not be rewritten
+ and is most often used to "poke holes" in policies for
+ CIDR blocks.
+
+
+
+
+
+ The policies specified in individual records
+ in an RPZ can be overridden with a policy clause
+ in the response-policy option.
+ An organization using an RPZ provided by another organization might
+ use this mechanism to redirect domains to its own walled garden.
+
+
+-
+GIVEN says "do not override."
+
+-
+DISABLED causes policy records to do
+ nothing but log what they might have done.
+ The response to the DNS query will be written according to
+ any matching policy records that are not disabled.
+ Policy zones overridden with DISABLED should
+ appear first, because they will often not be logged
+ if a higher precedence policy is found first.
+
+-
+PASSTHRU causes all policy records
+ to act as if they were CNAME records with targets the variable
+ part of their owner name. They protect the response from
+ being changed.
+
+-
+NXDOMAIN causes all RPZ records
+ to specify NXDOMAIN policies.
+
+-
+NODATA overrides with the
+ NODATA policy
+
+-
+CNAME domain causes all RPZ
+ policy records to act as if they were "cname domain" records.
+
+
+
For example, you might use this option statement
-response-policy { zone "bl"; };
+ response-policy { zone "badlist"; };
and this zone statement
-zone "bl" {type master; file "example/bl"; allow-query {none;}; };
+ zone "badlist" {type master; file "master/badlist"; allow-query {none;}; };
with this zone file
$TTL 1H
-@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+@ SOA LOCALHOST. named-mgr.example.com (1 1h 15m 30d 2h)
+ NS LOCALHOST.
+
+; QNAME policy records. There are no periods (.) after the owner names.
+nxdomain.domain.com CNAME . ; NXDOMAIN policy
+nodata.domain.com CNAME *. ; NODATA policy
+bad.domain.com A 10.0.0.1 ; redirect to a walled garden
+ AAAA 2001:2::1
+
+; do not rewrite (PASSTHRU) OK.DOMAIN.COM
+ok.domain.com CNAME ok.domain.com.
+
+bzone.domain.com CNAME garden.example.com.
+
+; redirect x.bzone.domain.com to x.bzone.domain.com.garden.example.com
+*.bzone.domain.com CNAME *.garden.example.com.
-; QNAME rules
-nxdomain.domain.com CNAME .
-nodata.domain.com CNAME *.
-bad.domain.com A 10.0.0.1
- AAAA 2001:2::1
-ok.domain.com CNAME ok.domain.com.
-*.badzone.domain.com CNAME garden.example.com.
-; IP rules rewriting all answers for 127/8 except 127.0.0.1
-8.0.0.0.127.ip CNAME .
-32.1.0.0.127.ip CNAME 32.1.0.0.127.
+; IP policy records that rewrite all answers for 127/8 except 127.0.0.1
+8.0.0.0.127.rpz-ip CNAME .
+32.1.0.0.127.rpz-ip CNAME 32.1.0.0.127. ; PASSTHRU for 127.0.0.1
-; NSDNAME and NSIP rules
+; NSDNAME and NSIP policy records
ns.domain.com.rpz-nsdname CNAME .
48.zz.2.2001.rpz-nsip CNAME .
@@ -5867,7 +5981,7 @@ ns.domain.com.rpz-nsdname CNAME .
The statistics-channels statement
@@ -5927,7 +6041,7 @@ ns.domain.com.rpz-nsdname CNAME .
The trusted-keys statement defines
@@ -5967,7 +6081,7 @@ ns.domain.com.rpz-nsdname CNAME .
managed-keys {
string
initial-key number
number
number
string
;
[ string
initial-key number
number
number
string
; [...]]
@@ -6102,7 +6216,7 @@ ns.domain.com.rpz-nsdname CNAME .
The view statement is a powerful
feature
@@ -6391,10 +6505,10 @@ zone zone_name
[
@@ -6654,7 +6768,7 @@ zone zone_name
[
The zone's name may optionally be followed by a class. If
a class is not specified, class IN
(for Internet
),
@@ -6676,7 +6790,7 @@ zone zone_name
[
- allow-notify
@@ -7553,7 +7667,7 @@ example.com. NS ns2.example.net.
@@ -7566,7 +7680,7 @@ example.com. NS ns2.example.net.
A domain name identifies a node. Each node has a set of
resource information, which may be empty. The set of resource
@@ -8303,7 +8417,7 @@ example.com. NS ns2.example.net.
RRs are represented in binary form in the packets of the DNS
protocol, and are usually represented in highly encoded form
@@ -8506,7 +8620,7 @@ example.com. NS ns2.example.net.
As described above, domain servers store information as a
series of resource records, each of which contains a particular
@@ -8762,7 +8876,7 @@ example.com. NS ns2.example.net.
Reverse name resolution (that is, translation from IP address
to name) is achieved by means of the in-addr.arpa domain
@@ -8823,7 +8937,7 @@ example.com. NS ns2.example.net.
The Master File Format was initially defined in RFC 1035 and
has subsequently been extended. While the Master File Format
@@ -8838,7 +8952,7 @@ example.com. NS ns2.example.net.
When used in the label (or name) field, the asperand or
at-sign (@) symbol represents the current origin.
@@ -8849,7 +8963,7 @@ example.com. NS ns2.example.net.
Syntax: $ORIGIN
domain-name
@@ -8878,7 +8992,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
Syntax: $INCLUDE
filename
@@ -8914,7 +9028,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
Syntax: $TTL
default-ttl
@@ -8933,7 +9047,7 @@ WWW.EXAMPLE.COM. CNAME MAIN-SERVER.EXAMPLE.COM.
Syntax: $GENERATE
range
@@ -9357,7 +9471,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -9914,7 +10028,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -10068,7 +10182,7 @@ HOST-127.EXAMPLE. MX 0 .
@@ -10451,7 +10565,7 @@ HOST-127.EXAMPLE. MX 0 .
Socket I/O statistics counters are defined per socket
types, which are
@@ -10606,7 +10720,7 @@ HOST-127.EXAMPLE. MX 0 .
Most statistics counters that were available
in BIND 8 are also supported in
diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index f2c50e2865629..3900f707c82e9 100644
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -1,5 +1,5 @@
-
+
@@ -46,10 +46,10 @@
Table of Contents
@@ -84,9 +84,8 @@
// RFC1918 space and some reserved space, which is
// commonly used in spoofing attacks.
acl bogusnets {
- 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24;
- 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12;
- 192.168.0.0/16;
+ 0.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3;
+ 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
};
// Set up an ACL called our-nets. Replace this with the
@@ -122,7 +121,7 @@ zone "example.com" {
On UNIX servers, it is possible to run BIND
@@ -148,7 +147,7 @@ zone "example.com" {
In order for a chroot environment
to
@@ -176,7 +175,7 @@ zone "example.com" {
Prior to running the named daemon,
use
diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index faa3a0434c0bf..8a59dc66712ea 100644
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -1,5 +1,5 @@
-
+
@@ -45,18 +45,18 @@
Table of Contents
The best solution to solving installation and
configuration issues is to take preventative measures by setting
@@ -68,7 +68,7 @@
Zone serial numbers are just numbers — they aren't
date related. A lot of people set them to a number that
@@ -95,7 +95,7 @@
The Internet Systems Consortium
(ISC) offers a wide range
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index cda5f6c30d3a3..d627284af52de 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -1,5 +1,5 @@
-
+
@@ -45,31 +45,31 @@
Table of Contents
Standards
-[RFC974] Mail Routing and the Domain System. January 1986.
+[RFC974] Mail Routing and the Domain System. January 1986.
@@ -278,42 +278,42 @@
Proposed Standards
-[RFC1995] Incremental Zone Transfer in DNS. August 1996.
+[RFC1995] Incremental Zone Transfer in DNS. August 1996.
-[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
+[RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996.
-[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
+[RFC2136] Dynamic Updates in the Domain Name System. April 1997.
-[RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997.
+[RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997.
-[RFC2672] Non-Terminal DNS Name Redirection. August 1999.
+[RFC2672] Non-Terminal DNS Name Redirection. August 1999.
-[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
+[RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000.
-[RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000.
+[RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000.
-[RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000.
+[RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000.
-[RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000.
+[RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000.
-[RFC3645] Generic Security Service Algorithm for Secret
+[RFC3645] Generic Security Service Algorithm for Secret
Key Transaction Authentication for DNS
(GSS-TSIG). October 2003.
@@ -322,19 +322,19 @@
DNS Security Proposed Standards
-[RFC3225] Indicating Resolver Support of DNSSEC. December 2001.
+[RFC3225] Indicating Resolver Support of DNSSEC. December 2001.
-[RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004.
+[RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004.
-[RFC4033] DNS Security Introduction and Requirements. March 2005.
+[RFC4033] DNS Security Introduction and Requirements. March 2005.
-[RFC4034] Resource Records for the DNS Security Extensions. March 2005.
+[RFC4034] Resource Records for the DNS Security Extensions. March 2005.
-[RFC4035] Protocol Modifications for the DNS
+[RFC4035] Protocol Modifications for the DNS
Security Extensions. March 2005.
@@ -342,146 +342,146 @@
Other Important RFCs About DNS
Implementation
-[RFC1535] A Security Problem and Proposed Correction With Widely
+[RFC1535] A Security Problem and Proposed Correction With Widely
Deployed DNS Software.. October 1993.
-[RFC1536] Common DNS Implementation
+[RFC1536] Common DNS Implementation
Errors and Suggested Fixes. October 1993.
-[RFC4074] Common Misbehaviour Against DNS
+[RFC4074] Common Misbehaviour Against DNS
Queries for IPv6 Addresses. May 2005.
Resource Record Types
-[RFC1706] DNS NSAP Resource Records. October 1994.
+[RFC1706] DNS NSAP Resource Records. October 1994.
-[RFC2168] Resolution of Uniform Resource Identifiers using
+[RFC2168] Resolution of Uniform Resource Identifiers using
the Domain Name System. June 1997.
-[RFC1876] A Means for Expressing Location Information in the
+[RFC1876] A Means for Expressing Location Information in the
Domain
Name System. January 1996.
-[RFC2052] A DNS RR for Specifying the
+[RFC2052] A DNS RR for Specifying the
Location of
Services.. October 1996.
-[RFC2163] Using the Internet DNS to
+[RFC2163] Using the Internet DNS to
Distribute MIXER
Conformant Global Address Mapping. January 1998.
-[RFC2230] Key Exchange Delegation Record for the DNS. October 1997.
+[RFC2230] Key Exchange Delegation Record for the DNS. October 1997.
-[RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
+[RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999.
-[RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
+[RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999.
-[RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999.
+[RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999.
-[RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
+[RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999.
-[RFC2540] Detached Domain Name System (DNS) Information. March 1999.
+[RFC2540] Detached Domain Name System (DNS) Information. March 1999.
-[RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000.
+[RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000.
-[RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
+[RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000.
-[RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
+[RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001.
-[RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
+[RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001.
DNS and the Internet
-[RFC1101] DNS Encoding of Network Names
+[RFC1101] DNS Encoding of Network Names
and Other Types. April 1989.
-[RFC1123] Requirements for Internet Hosts - Application and
+[RFC1123] Requirements for Internet Hosts - Application and
Support. October 1989.
-[RFC1591] Domain Name System Structure and Delegation. March 1994.
+[RFC1591] Domain Name System Structure and Delegation. March 1994.
-[RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998.
+[RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998.
DNS Operations
-[RFC1033] Domain administrators operations guide.. November 1987.
+[RFC1033] Domain administrators operations guide.. November 1987.
-[RFC1912] Common DNS Operational and
+[RFC1912] Common DNS Operational and
Configuration Errors. February 1996.
Internationalized Domain Names
-[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
+[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
and the Other Internet protocols. May 2000.
-[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003.
+[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003.
@@ -497,47 +497,47 @@
-[RFC1464] Using the Domain Name System To Store Arbitrary String
+[RFC1464] Using the Domain Name System To Store Arbitrary String
Attributes. May 1993.
-[RFC1713] Tools for DNS Debugging. November 1994.
+[RFC1713] Tools for DNS Debugging. November 1994.
-[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
+[RFC2240] A Legal Basis for Domain Name Allocation. November 1997.
-[RFC2345] Domain Names and Company Name Retrieval. May 1998.
+[RFC2345] Domain Names and Company Name Retrieval. May 1998.
-[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
+[RFC2352] A Convention For Using Legal Names as Domain Names. May 1998.
-[RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
+[RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001.
-[RFC3258] Distributing Authoritative Name Servers via
+[RFC3258] Distributing Authoritative Name Servers via
Shared Unicast Addresses. April 2002.
-[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004.
+[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004.
Obsolete and Unimplemented Experimental RFC
-[RFC1712] DNS Encoding of Geographical
+[RFC1712] DNS Encoding of Geographical
Location. November 1994.
@@ -551,39 +551,39 @@
-[RFC2065] Domain Name System Security Extensions. January 1997.
+[RFC2065] Domain Name System Security Extensions. January 1997.
-[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
+[RFC2137] Secure Domain Name System Dynamic Update. April 1997.
-[RFC2535] Domain Name System Security Extensions. March 1999.
+[RFC2535] Domain Name System Security Extensions. March 1999.
-[RFC3008] Domain Name System Security (DNSSEC)
+[RFC3008] Domain Name System Security (DNSSEC)
Signing Authority. November 2000.
-[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001.
+[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001.
-[RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002.
+[RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002.
-[RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003.
+[RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003.
-[RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003.
+[RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003.
-[RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
+[RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004.
-[RFC3757] Domain Name System KEY (DNSKEY) Resource Record
+[RFC3757] Domain Name System KEY (DNSKEY) Resource Record
(RR) Secure Entry Point (SEP) Flag. April 2004.
-[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
+[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004.
@@ -604,14 +604,14 @@
-DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
+DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
@@ -648,7 +648,7 @@
GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
@@ -657,7 +657,7 @@
$ ./configure --enable-exportlib [other flags]
$ make
@@ -672,7 +672,7 @@ $ make
$ cd lib/export
$ make install
@@ -694,7 +694,7 @@ $ make install
Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
@@ -734,7 +734,7 @@ $ make
The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
@@ -752,14 +752,14 @@ $ make
Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
@@ -823,7 +823,7 @@ $ make
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
@@ -864,7 +864,7 @@ $ make
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
@@ -905,7 +905,7 @@ $ make
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -922,7 +922,7 @@ $ make
It accepts a single update command as a
command-line argument, sends an update request message to the
@@ -1017,7 +1017,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
It checks a set
of domains to see the name servers of the domains behave
@@ -1074,7 +1074,7 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html
index 7ff08e1a9f007..1484ecf469beb 100644
--- a/doc/arm/Bv9ARM.ch10.html
+++ b/doc/arm/Bv9ARM.ch10.html
@@ -1,5 +1,5 @@
-
+
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 7751cfaf4f8d9..b3703f69732c0 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -1,5 +1,5 @@
-
+
@@ -40,8 +40,8 @@
-Copyright © 2004-2011 Internet Systems Consortium, Inc. ("ISC")
+BIND 9 Administrator Reference Manual
+Copyright © 2004-2012 Internet Systems Consortium, Inc. ("ISC")
Copyright © 2000-2003 Internet Software Consortium.
@@ -51,39 +51,39 @@
- 1. Introduction
- 2. BIND Resource Requirements
- 3. Name Server Configuration
- 4. Advanced DNS Features
@@ -92,64 +92,64 @@
- Dynamic Update
- Incremental Zone Transfers (IXFR)
-- Split DNS
-
+- Split DNS
+
- TSIG
-- Generate Shared Keys for Each Pair of Hosts
-- Copying the Shared Secret to Both Machines
-- Informing the Servers of the Key's Existence
-- Instructing the Server to Use the Key
-- TSIG Key Based Access Control
-- Errors
+- Generate Shared Keys for Each Pair of Hosts
+- Copying the Shared Secret to Both Machines
+- Informing the Servers of the Key's Existence
+- Instructing the Server to Use the Key
+- TSIG Key Based Access Control
+- Errors
-- TKEY
-- SIG(0)
+- TKEY
+- SIG(0)
- DNSSEC
- DNSSEC, Dynamic Zones, and Automatic Signing
-- Converting from insecure to secure
-- Dynamic DNS update method
-- Fully automatic zone signing
-- Private-type records
-- DNSKEY rollovers
-- Dynamic DNS update method
-- Automatic key rollovers
-- NSEC3PARAM rollovers via UPDATE
-- Converting from NSEC to NSEC3
-- Converting from NSEC3 to NSEC
-- Converting from secure to insecure
-- Periodic re-signing
-- NSEC3 and OPTOUT
+- Converting from insecure to secure
+- Dynamic DNS update method
+- Fully automatic zone signing
+- Private-type records
+- DNSKEY rollovers
+- Dynamic DNS update method
+- Automatic key rollovers
+- NSEC3PARAM rollovers via UPDATE
+- Converting from NSEC to NSEC3
+- Converting from NSEC3 to NSEC
+- Converting from secure to insecure
+- Periodic re-signing
+- NSEC3 and OPTOUT
- Dynamic Trust Anchor Management
- PKCS #11 (Cryptoki) support
-- Prerequisites
-- Building BIND 9 with PKCS#11
-- PKCS #11 Tools
-- Using the HSM
-- Specifying the engine on the command line
-- Running named with automatic zone re-signing
+- Prerequisites
+- Building BIND 9 with PKCS#11
+- PKCS #11 Tools
+- Using the HSM
+- Specifying the engine on the command line
+- Running named with automatic zone re-signing
-- IPv6 Support in BIND 9
+- IPv6 Support in BIND 9
5. The BIND 9 Lightweight Resolver
6. BIND 9 Configuration Reference
@@ -157,58 +157,58 @@
Configuration File Elements
Configuration File Grammar
-- acl Statement Grammar
+- acl Statement Grammar
- acl Statement Definition and
Usage
-- controls Statement Grammar
+- controls Statement Grammar
- controls Statement Definition and
Usage
-- include Statement Grammar
-- include Statement Definition and
+
- include Statement Grammar
+- include Statement Definition and
Usage
-- key Statement Grammar
-- key Statement Definition and Usage
-- logging Statement Grammar
-- logging Statement Definition and
+
- key Statement Grammar
+- key Statement Definition and Usage
+- logging Statement Grammar
+- logging Statement Definition and
Usage
-- lwres Statement Grammar
-- lwres Statement Definition and Usage
-- masters Statement Grammar
-- masters Statement Definition and
+
- lwres Statement Grammar
+- lwres Statement Definition and Usage
+- masters Statement Grammar
+- masters Statement Definition and
Usage
-- options Statement Grammar
+- options Statement Grammar
- options Statement Definition and
Usage
- server Statement Grammar
- server Statement Definition and
Usage
- statistics-channels Statement Grammar
-- statistics-channels Statement Definition and
+
- statistics-channels Statement Definition and
Usage
- trusted-keys Statement Grammar
-- trusted-keys Statement Definition
+
- trusted-keys Statement Definition
and Usage
-- managed-keys Statement Grammar
+- managed-keys Statement Grammar
- managed-keys Statement Definition
and Usage
- view Statement Grammar
-- view Statement Definition and Usage
+- view Statement Definition and Usage
- zone
Statement Grammar
-- zone Statement Definition and Usage
+- zone Statement Definition and Usage
-Zone File
+Zone File
- Types of Resource Records and When to Use Them
-- Discussion of MX Records
+- Discussion of MX Records
- Setting TTLs
-- Inverse Mapping in IPv4
-- Other Zone File Directives
-- BIND Master File Extension: the $GENERATE Directive
+- Inverse Mapping in IPv4
+- Other Zone File Directives
+- BIND Master File Extension: the $GENERATE Directive
- Additional File Formats
BIND9 Statistics
@@ -217,41 +217,41 @@
7. BIND 9 Security Considerations
8. Troubleshooting
A. Appendices
I. Manual pages
diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 6a1cb97f0a2b3..3333bccb7ea2a 100644
--- a/doc/arm/Bv9ARM.pdf
+++ b/doc/arm/Bv9ARM.pdf
@@ -444,939 +444,951 @@ endobj
(4.11.1.2 Building OpenSSL for the SCA 6000 on Solaris)
endobj
301 0 obj
-<< /S /GoTo /D (subsection.4.11.2) >>
+<< /S /GoTo /D (subsubsection.4.11.1.3) >>
endobj
304 0 obj
-(4.11.2 Building BIND 9 with PKCS\04311)
+(4.11.1.3 Building OpenSSL for SoftHSM)
endobj
305 0 obj
-<< /S /GoTo /D (subsubsection.4.11.2.1) >>
+<< /S /GoTo /D (subsection.4.11.2) >>
endobj
308 0 obj
-(4.11.2.1 Configuring BIND 9 for Linux)
+(4.11.2 Building BIND 9 with PKCS\04311)
endobj
309 0 obj
-<< /S /GoTo /D (subsubsection.4.11.2.2) >>
+<< /S /GoTo /D (subsubsection.4.11.2.1) >>
endobj
312 0 obj
-(4.11.2.2 Configuring BIND 9 for Solaris)
+(4.11.2.1 Configuring BIND 9 for Linux with the AEP Keyper)
endobj
313 0 obj
-<< /S /GoTo /D (subsection.4.11.3) >>
+<< /S /GoTo /D (subsubsection.4.11.2.2) >>
endobj
316 0 obj
-(4.11.3 PKCS \04311 Tools)
+(4.11.2.2 Configuring BIND 9 for Solaris with the SCA 6000)
endobj
317 0 obj
-<< /S /GoTo /D (subsection.4.11.4) >>
+<< /S /GoTo /D (subsubsection.4.11.2.3) >>
endobj
320 0 obj
-(4.11.4 Using the HSM)
+(4.11.2.3 Configuring BIND 9 for SoftHSM)
endobj
321 0 obj
-<< /S /GoTo /D (subsection.4.11.5) >>
+<< /S /GoTo /D (subsection.4.11.3) >>
endobj
324 0 obj
-(4.11.5 Specifying the engine on the command line)
+(4.11.3 PKCS \04311 Tools)
endobj
325 0 obj
-<< /S /GoTo /D (subsection.4.11.6) >>
+<< /S /GoTo /D (subsection.4.11.4) >>
endobj
328 0 obj
-(4.11.6 Running named with automatic zone re-signing)
+(4.11.4 Using the HSM)
endobj
329 0 obj
-<< /S /GoTo /D (section.4.12) >>
+<< /S /GoTo /D (subsection.4.11.5) >>
endobj
332 0 obj
-(4.12 IPv6 Support in BIND 9)
+(4.11.5 Specifying the engine on the command line)
endobj
333 0 obj
-<< /S /GoTo /D (subsection.4.12.1) >>
+<< /S /GoTo /D (subsection.4.11.6) >>
endobj
336 0 obj
-(4.12.1 Address Lookups Using AAAA Records)
+(4.11.6 Running named with automatic zone re-signing)
endobj
337 0 obj
-<< /S /GoTo /D (subsection.4.12.2) >>
+<< /S /GoTo /D (section.4.12) >>
endobj
340 0 obj
-(4.12.2 Address to Name Lookups Using Nibble Format)
+(4.12 IPv6 Support in BIND 9)
endobj
341 0 obj
-<< /S /GoTo /D (chapter.5) >>
+<< /S /GoTo /D (subsection.4.12.1) >>
endobj
344 0 obj
-(5 The BIND 9 Lightweight Resolver)
+(4.12.1 Address Lookups Using AAAA Records)
endobj
345 0 obj
-<< /S /GoTo /D (section.5.1) >>
+<< /S /GoTo /D (subsection.4.12.2) >>
endobj
348 0 obj
-(5.1 The Lightweight Resolver Library)
+(4.12.2 Address to Name Lookups Using Nibble Format)
endobj
349 0 obj
-<< /S /GoTo /D (section.5.2) >>
+<< /S /GoTo /D (chapter.5) >>
endobj
352 0 obj
-(5.2 Running a Resolver Daemon)
+(5 The BIND 9 Lightweight Resolver)
endobj
353 0 obj
-<< /S /GoTo /D (chapter.6) >>
+<< /S /GoTo /D (section.5.1) >>
endobj
356 0 obj
-(6 BIND 9 Configuration Reference)
+(5.1 The Lightweight Resolver Library)
endobj
357 0 obj
-<< /S /GoTo /D (section.6.1) >>
+<< /S /GoTo /D (section.5.2) >>
endobj
360 0 obj
-(6.1 Configuration File Elements)
+(5.2 Running a Resolver Daemon)
endobj
361 0 obj
-<< /S /GoTo /D (subsection.6.1.1) >>
+<< /S /GoTo /D (chapter.6) >>
endobj
364 0 obj
-(6.1.1 Address Match Lists)
+(6 BIND 9 Configuration Reference)
endobj
365 0 obj
-<< /S /GoTo /D (subsubsection.6.1.1.1) >>
+<< /S /GoTo /D (section.6.1) >>
endobj
368 0 obj
-(6.1.1.1 Syntax)
+(6.1 Configuration File Elements)
endobj
369 0 obj
-<< /S /GoTo /D (subsubsection.6.1.1.2) >>
+<< /S /GoTo /D (subsection.6.1.1) >>
endobj
372 0 obj
-(6.1.1.2 Definition and Usage)
+(6.1.1 Address Match Lists)
endobj
373 0 obj
-<< /S /GoTo /D (subsection.6.1.2) >>
+<< /S /GoTo /D (subsubsection.6.1.1.1) >>
endobj
376 0 obj
-(6.1.2 Comment Syntax)
+(6.1.1.1 Syntax)
endobj
377 0 obj
-<< /S /GoTo /D (subsubsection.6.1.2.1) >>
+<< /S /GoTo /D (subsubsection.6.1.1.2) >>
endobj
380 0 obj
-(6.1.2.1 Syntax)
+(6.1.1.2 Definition and Usage)
endobj
381 0 obj
-<< /S /GoTo /D (subsubsection.6.1.2.2) >>
+<< /S /GoTo /D (subsection.6.1.2) >>
endobj
384 0 obj
-(6.1.2.2 Definition and Usage)
+(6.1.2 Comment Syntax)
endobj
385 0 obj
-<< /S /GoTo /D (section.6.2) >>
+<< /S /GoTo /D (subsubsection.6.1.2.1) >>
endobj
388 0 obj
-(6.2 Configuration File Grammar)
+(6.1.2.1 Syntax)
endobj
389 0 obj
-<< /S /GoTo /D (subsection.6.2.1) >>
+<< /S /GoTo /D (subsubsection.6.1.2.2) >>
endobj
392 0 obj
-(6.2.1 acl Statement Grammar)
+(6.1.2.2 Definition and Usage)
endobj
393 0 obj
-<< /S /GoTo /D (subsection.6.2.2) >>
+<< /S /GoTo /D (section.6.2) >>
endobj
396 0 obj
-(6.2.2 acl Statement Definition and Usage)
+(6.2 Configuration File Grammar)
endobj
397 0 obj
-<< /S /GoTo /D (subsection.6.2.3) >>
+<< /S /GoTo /D (subsection.6.2.1) >>
endobj
400 0 obj
-(6.2.3 controls Statement Grammar)
+(6.2.1 acl Statement Grammar)
endobj
401 0 obj
-<< /S /GoTo /D (subsection.6.2.4) >>
+<< /S /GoTo /D (subsection.6.2.2) >>
endobj
404 0 obj
-(6.2.4 controls Statement Definition and Usage)
+(6.2.2 acl Statement Definition and Usage)
endobj
405 0 obj
-<< /S /GoTo /D (subsection.6.2.5) >>
+<< /S /GoTo /D (subsection.6.2.3) >>
endobj
408 0 obj
-(6.2.5 include Statement Grammar)
+(6.2.3 controls Statement Grammar)
endobj
409 0 obj
-<< /S /GoTo /D (subsection.6.2.6) >>
+<< /S /GoTo /D (subsection.6.2.4) >>
endobj
412 0 obj
-(6.2.6 include Statement Definition and Usage)
+(6.2.4 controls Statement Definition and Usage)
endobj
413 0 obj
-<< /S /GoTo /D (subsection.6.2.7) >>
+<< /S /GoTo /D (subsection.6.2.5) >>
endobj
416 0 obj
-(6.2.7 key Statement Grammar)
+(6.2.5 include Statement Grammar)
endobj
417 0 obj
-<< /S /GoTo /D (subsection.6.2.8) >>
+<< /S /GoTo /D (subsection.6.2.6) >>
endobj
420 0 obj
-(6.2.8 key Statement Definition and Usage)
+(6.2.6 include Statement Definition and Usage)
endobj
421 0 obj
-<< /S /GoTo /D (subsection.6.2.9) >>
+<< /S /GoTo /D (subsection.6.2.7) >>
endobj
424 0 obj
-(6.2.9 logging Statement Grammar)
+(6.2.7 key Statement Grammar)
endobj
425 0 obj
-<< /S /GoTo /D (subsection.6.2.10) >>
+<< /S /GoTo /D (subsection.6.2.8) >>
endobj
428 0 obj
-(6.2.10 logging Statement Definition and Usage)
+(6.2.8 key Statement Definition and Usage)
endobj
429 0 obj
-<< /S /GoTo /D (subsubsection.6.2.10.1) >>
+<< /S /GoTo /D (subsection.6.2.9) >>
endobj
432 0 obj
-(6.2.10.1 The channel Phrase)
+(6.2.9 logging Statement Grammar)
endobj
433 0 obj
-<< /S /GoTo /D (subsubsection.6.2.10.2) >>
+<< /S /GoTo /D (subsection.6.2.10) >>
endobj
436 0 obj
-(6.2.10.2 The category Phrase)
+(6.2.10 logging Statement Definition and Usage)
endobj
437 0 obj
-<< /S /GoTo /D (subsubsection.6.2.10.3) >>
+<< /S /GoTo /D (subsubsection.6.2.10.1) >>
endobj
440 0 obj
-(6.2.10.3 The query-errors Category)
+(6.2.10.1 The channel Phrase)
endobj
441 0 obj
-<< /S /GoTo /D (subsection.6.2.11) >>
+<< /S /GoTo /D (subsubsection.6.2.10.2) >>
endobj
444 0 obj
-(6.2.11 lwres Statement Grammar)
+(6.2.10.2 The category Phrase)
endobj
445 0 obj
-<< /S /GoTo /D (subsection.6.2.12) >>
+<< /S /GoTo /D (subsubsection.6.2.10.3) >>
endobj
448 0 obj
-(6.2.12 lwres Statement Definition and Usage)
+(6.2.10.3 The query-errors Category)
endobj
449 0 obj
-<< /S /GoTo /D (subsection.6.2.13) >>
+<< /S /GoTo /D (subsection.6.2.11) >>
endobj
452 0 obj
-(6.2.13 masters Statement Grammar)
+(6.2.11 lwres Statement Grammar)
endobj
453 0 obj
-<< /S /GoTo /D (subsection.6.2.14) >>
+<< /S /GoTo /D (subsection.6.2.12) >>
endobj
456 0 obj
-(6.2.14 masters Statement Definition and Usage)
+(6.2.12 lwres Statement Definition and Usage)
endobj
457 0 obj
-<< /S /GoTo /D (subsection.6.2.15) >>
+<< /S /GoTo /D (subsection.6.2.13) >>
endobj
460 0 obj
-(6.2.15 options Statement Grammar)
+(6.2.13 masters Statement Grammar)
endobj
461 0 obj
-<< /S /GoTo /D (subsection.6.2.16) >>
+<< /S /GoTo /D (subsection.6.2.14) >>
endobj
464 0 obj
-(6.2.16 options Statement Definition and Usage)
+(6.2.14 masters Statement Definition and Usage)
endobj
465 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.1) >>
+<< /S /GoTo /D (subsection.6.2.15) >>
endobj
468 0 obj
-(6.2.16.1 Boolean Options)
+(6.2.15 options Statement Grammar)
endobj
469 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.2) >>
+<< /S /GoTo /D (subsection.6.2.16) >>
endobj
472 0 obj
-(6.2.16.2 Forwarding)
+(6.2.16 options Statement Definition and Usage)
endobj
473 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.3) >>
+<< /S /GoTo /D (subsubsection.6.2.16.1) >>
endobj
476 0 obj
-(6.2.16.3 Dual-stack Servers)
+(6.2.16.1 Boolean Options)
endobj
477 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.4) >>
+<< /S /GoTo /D (subsubsection.6.2.16.2) >>
endobj
480 0 obj
-(6.2.16.4 Access Control)
+(6.2.16.2 Forwarding)
endobj
481 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.5) >>
+<< /S /GoTo /D (subsubsection.6.2.16.3) >>
endobj
484 0 obj
-(6.2.16.5 Interfaces)
+(6.2.16.3 Dual-stack Servers)
endobj
485 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.6) >>
+<< /S /GoTo /D (subsubsection.6.2.16.4) >>
endobj
488 0 obj
-(6.2.16.6 Query Address)
+(6.2.16.4 Access Control)
endobj
489 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.7) >>
+<< /S /GoTo /D (subsubsection.6.2.16.5) >>
endobj
492 0 obj
-(6.2.16.7 Zone Transfers)
+(6.2.16.5 Interfaces)
endobj
493 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.8) >>
+<< /S /GoTo /D (subsubsection.6.2.16.6) >>
endobj
496 0 obj
-(6.2.16.8 UDP Port Lists)
+(6.2.16.6 Query Address)
endobj
497 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.9) >>
+<< /S /GoTo /D (subsubsection.6.2.16.7) >>
endobj
500 0 obj
-(6.2.16.9 Operating System Resource Limits)
+(6.2.16.7 Zone Transfers)
endobj
501 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.10) >>
+<< /S /GoTo /D (subsubsection.6.2.16.8) >>
endobj
504 0 obj
-(6.2.16.10 Server Resource Limits)
+(6.2.16.8 UDP Port Lists)
endobj
505 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.11) >>
+<< /S /GoTo /D (subsubsection.6.2.16.9) >>
endobj
508 0 obj
-(6.2.16.11 Periodic Task Intervals)
+(6.2.16.9 Operating System Resource Limits)
endobj
509 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.12) >>
+<< /S /GoTo /D (subsubsection.6.2.16.10) >>
endobj
512 0 obj
-(6.2.16.12 Topology)
+(6.2.16.10 Server Resource Limits)
endobj
513 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.13) >>
+<< /S /GoTo /D (subsubsection.6.2.16.11) >>
endobj
516 0 obj
-(6.2.16.13 The sortlist Statement)
+(6.2.16.11 Periodic Task Intervals)
endobj
517 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.14) >>
+<< /S /GoTo /D (subsubsection.6.2.16.12) >>
endobj
520 0 obj
-(6.2.16.14 RRset Ordering)
+(6.2.16.12 Topology)
endobj
521 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.15) >>
+<< /S /GoTo /D (subsubsection.6.2.16.13) >>
endobj
524 0 obj
-(6.2.16.15 Tuning)
+(6.2.16.13 The sortlist Statement)
endobj
525 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.16) >>
+<< /S /GoTo /D (subsubsection.6.2.16.14) >>
endobj
528 0 obj
-(6.2.16.16 Built-in server information zones)
+(6.2.16.14 RRset Ordering)
endobj
529 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.17) >>
+<< /S /GoTo /D (subsubsection.6.2.16.15) >>
endobj
532 0 obj
-(6.2.16.17 Built-in Empty Zones)
+(6.2.16.15 Tuning)
endobj
533 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.18) >>
+<< /S /GoTo /D (subsubsection.6.2.16.16) >>
endobj
536 0 obj
-(6.2.16.18 Additional Section Caching)
+(6.2.16.16 Built-in server information zones)
endobj
537 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.19) >>
+<< /S /GoTo /D (subsubsection.6.2.16.17) >>
endobj
540 0 obj
-(6.2.16.19 Content Filtering)
+(6.2.16.17 Built-in Empty Zones)
endobj
541 0 obj
-<< /S /GoTo /D (subsubsection.6.2.16.20) >>
+<< /S /GoTo /D (subsubsection.6.2.16.18) >>
endobj
544 0 obj
-(6.2.16.20 Response Policy Zone \(RPZ\) Rewriting)
+(6.2.16.18 Additional Section Caching)
endobj
545 0 obj
-<< /S /GoTo /D (subsection.6.2.17) >>
+<< /S /GoTo /D (subsubsection.6.2.16.19) >>
endobj
548 0 obj
-(6.2.17 server Statement Grammar)
+(6.2.16.19 Content Filtering)
endobj
549 0 obj
-<< /S /GoTo /D (subsection.6.2.18) >>
+<< /S /GoTo /D (subsubsection.6.2.16.20) >>
endobj
552 0 obj
-(6.2.18 server Statement Definition and Usage)
+(6.2.16.20 Response Policy Zone \(RPZ\) Rewriting)
endobj
553 0 obj
-<< /S /GoTo /D (subsection.6.2.19) >>
+<< /S /GoTo /D (subsection.6.2.17) >>
endobj
556 0 obj
-(6.2.19 statistics-channels Statement Grammar)
+(6.2.17 server Statement Grammar)
endobj
557 0 obj
-<< /S /GoTo /D (subsection.6.2.20) >>
+<< /S /GoTo /D (subsection.6.2.18) >>
endobj
560 0 obj
-(6.2.20 statistics-channels Statement Definition and Usage)
+(6.2.18 server Statement Definition and Usage)
endobj
561 0 obj
-<< /S /GoTo /D (subsection.6.2.21) >>
+<< /S /GoTo /D (subsection.6.2.19) >>
endobj
564 0 obj
-(6.2.21 trusted-keys Statement Grammar)
+(6.2.19 statistics-channels Statement Grammar)
endobj
565 0 obj
-<< /S /GoTo /D (subsection.6.2.22) >>
+<< /S /GoTo /D (subsection.6.2.20) >>
endobj
568 0 obj
-(6.2.22 trusted-keys Statement Definition and Usage)
+(6.2.20 statistics-channels Statement Definition and Usage)
endobj
569 0 obj
-<< /S /GoTo /D (subsection.6.2.23) >>
+<< /S /GoTo /D (subsection.6.2.21) >>
endobj
572 0 obj
-(6.2.23 managed-keys Statement Grammar)
+(6.2.21 trusted-keys Statement Grammar)
endobj
573 0 obj
-<< /S /GoTo /D (subsection.6.2.24) >>
+<< /S /GoTo /D (subsection.6.2.22) >>
endobj
576 0 obj
-(6.2.24 managed-keys Statement Definition and Usage)
+(6.2.22 trusted-keys Statement Definition and Usage)
endobj
577 0 obj
-<< /S /GoTo /D (subsection.6.2.25) >>
+<< /S /GoTo /D (subsection.6.2.23) >>
endobj
580 0 obj
-(6.2.25 view Statement Grammar)
+(6.2.23 managed-keys Statement Grammar)
endobj
581 0 obj
-<< /S /GoTo /D (subsection.6.2.26) >>
+<< /S /GoTo /D (subsection.6.2.24) >>
endobj
584 0 obj
-(6.2.26 view Statement Definition and Usage)
+(6.2.24 managed-keys Statement Definition and Usage)
endobj
585 0 obj
-<< /S /GoTo /D (subsection.6.2.27) >>
+<< /S /GoTo /D (subsection.6.2.25) >>
endobj
588 0 obj
-(6.2.27 zone Statement Grammar)
+(6.2.25 view Statement Grammar)
endobj
589 0 obj
-<< /S /GoTo /D (subsection.6.2.28) >>
+<< /S /GoTo /D (subsection.6.2.26) >>
endobj
592 0 obj
-(6.2.28 zone Statement Definition and Usage)
+(6.2.26 view Statement Definition and Usage)
endobj
593 0 obj
-<< /S /GoTo /D (subsubsection.6.2.28.1) >>
+<< /S /GoTo /D (subsection.6.2.27) >>
endobj
596 0 obj
-(6.2.28.1 Zone Types)
+(6.2.27 zone Statement Grammar)
endobj
597 0 obj
-<< /S /GoTo /D (subsubsection.6.2.28.2) >>
+<< /S /GoTo /D (subsection.6.2.28) >>
endobj
600 0 obj
-(6.2.28.2 Class)
+(6.2.28 zone Statement Definition and Usage)
endobj
601 0 obj
-<< /S /GoTo /D (subsubsection.6.2.28.3) >>
+<< /S /GoTo /D (subsubsection.6.2.28.1) >>
endobj
604 0 obj
-(6.2.28.3 Zone Options)
+(6.2.28.1 Zone Types)
endobj
605 0 obj
-<< /S /GoTo /D (subsubsection.6.2.28.4) >>
+<< /S /GoTo /D (subsubsection.6.2.28.2) >>
endobj
608 0 obj
-(6.2.28.4 Dynamic Update Policies)
+(6.2.28.2 Class)
endobj
609 0 obj
-<< /S /GoTo /D (section.6.3) >>
+<< /S /GoTo /D (subsubsection.6.2.28.3) >>
endobj
612 0 obj
-(6.3 Zone File)
+(6.2.28.3 Zone Options)
endobj
613 0 obj
-<< /S /GoTo /D (subsection.6.3.1) >>
+<< /S /GoTo /D (subsubsection.6.2.28.4) >>
endobj
616 0 obj
-(6.3.1 Types of Resource Records and When to Use Them)
+(6.2.28.4 Dynamic Update Policies)
endobj
617 0 obj
-<< /S /GoTo /D (subsubsection.6.3.1.1) >>
+<< /S /GoTo /D (section.6.3) >>
endobj
620 0 obj
-(6.3.1.1 Resource Records)
+(6.3 Zone File)
endobj
621 0 obj
-<< /S /GoTo /D (subsubsection.6.3.1.2) >>
+<< /S /GoTo /D (subsection.6.3.1) >>
endobj
624 0 obj
-(6.3.1.2 Textual expression of RRs)
+(6.3.1 Types of Resource Records and When to Use Them)
endobj
625 0 obj
-<< /S /GoTo /D (subsection.6.3.2) >>
+<< /S /GoTo /D (subsubsection.6.3.1.1) >>
endobj
628 0 obj
-(6.3.2 Discussion of MX Records)
+(6.3.1.1 Resource Records)
endobj
629 0 obj
-<< /S /GoTo /D (subsection.6.3.3) >>
+<< /S /GoTo /D (subsubsection.6.3.1.2) >>
endobj
632 0 obj
-(6.3.3 Setting TTLs)
+(6.3.1.2 Textual expression of RRs)
endobj
633 0 obj
-<< /S /GoTo /D (subsection.6.3.4) >>
+<< /S /GoTo /D (subsection.6.3.2) >>
endobj
636 0 obj
-(6.3.4 Inverse Mapping in IPv4)
+(6.3.2 Discussion of MX Records)
endobj
637 0 obj
-<< /S /GoTo /D (subsection.6.3.5) >>
+<< /S /GoTo /D (subsection.6.3.3) >>
endobj
640 0 obj
-(6.3.5 Other Zone File Directives)
+(6.3.3 Setting TTLs)
endobj
641 0 obj
-<< /S /GoTo /D (subsubsection.6.3.5.1) >>
+<< /S /GoTo /D (subsection.6.3.4) >>
endobj
644 0 obj
-(6.3.5.1 The @ \(at-sign\))
+(6.3.4 Inverse Mapping in IPv4)
endobj
645 0 obj
-<< /S /GoTo /D (subsubsection.6.3.5.2) >>
+<< /S /GoTo /D (subsection.6.3.5) >>
endobj
648 0 obj
-(6.3.5.2 The \044ORIGIN Directive)
+(6.3.5 Other Zone File Directives)
endobj
649 0 obj
-<< /S /GoTo /D (subsubsection.6.3.5.3) >>
+<< /S /GoTo /D (subsubsection.6.3.5.1) >>
endobj
652 0 obj
-(6.3.5.3 The \044INCLUDE Directive)
+(6.3.5.1 The @ \(at-sign\))
endobj
653 0 obj
-<< /S /GoTo /D (subsubsection.6.3.5.4) >>
+<< /S /GoTo /D (subsubsection.6.3.5.2) >>
endobj
656 0 obj
-(6.3.5.4 The \044TTL Directive)
+(6.3.5.2 The \044ORIGIN Directive)
endobj
657 0 obj
-<< /S /GoTo /D (subsection.6.3.6) >>
+<< /S /GoTo /D (subsubsection.6.3.5.3) >>
endobj
660 0 obj
-(6.3.6 BIND Master File Extension: the \044GENERATE Directive)
+(6.3.5.3 The \044INCLUDE Directive)
endobj
661 0 obj
-<< /S /GoTo /D (subsection.6.3.7) >>
+<< /S /GoTo /D (subsubsection.6.3.5.4) >>
endobj
664 0 obj
-(6.3.7 Additional File Formats)
+(6.3.5.4 The \044TTL Directive)
endobj
665 0 obj
-<< /S /GoTo /D (section.6.4) >>
+<< /S /GoTo /D (subsection.6.3.6) >>
endobj
668 0 obj
-(6.4 BIND9 Statistics)
+(6.3.6 BIND Master File Extension: the \044GENERATE Directive)
endobj
669 0 obj
-<< /S /GoTo /D (subsubsection.6.4.0.1) >>
+<< /S /GoTo /D (subsection.6.3.7) >>
endobj
672 0 obj
-(6.4.0.1 The Statistics File)
+(6.3.7 Additional File Formats)
endobj
673 0 obj
-<< /S /GoTo /D (subsection.6.4.1) >>
+<< /S /GoTo /D (section.6.4) >>
endobj
676 0 obj
-(6.4.1 Statistics Counters)
+(6.4 BIND9 Statistics)
endobj
677 0 obj
-<< /S /GoTo /D (subsubsection.6.4.1.1) >>
+<< /S /GoTo /D (subsubsection.6.4.0.1) >>
endobj
680 0 obj
-(6.4.1.1 Name Server Statistics Counters)
+(6.4.0.1 The Statistics File)
endobj
681 0 obj
-<< /S /GoTo /D (subsubsection.6.4.1.2) >>
+<< /S /GoTo /D (subsection.6.4.1) >>
endobj
684 0 obj
-(6.4.1.2 Zone Maintenance Statistics Counters)
+(6.4.1 Statistics Counters)
endobj
685 0 obj
-<< /S /GoTo /D (subsubsection.6.4.1.3) >>
+<< /S /GoTo /D (subsubsection.6.4.1.1) >>
endobj
688 0 obj
-(6.4.1.3 Resolver Statistics Counters)
+(6.4.1.1 Name Server Statistics Counters)
endobj
689 0 obj
-<< /S /GoTo /D (subsubsection.6.4.1.4) >>
+<< /S /GoTo /D (subsubsection.6.4.1.2) >>
endobj
692 0 obj
-(6.4.1.4 Socket I/O Statistics Counters)
+(6.4.1.2 Zone Maintenance Statistics Counters)
endobj
693 0 obj
-<< /S /GoTo /D (subsubsection.6.4.1.5) >>
+<< /S /GoTo /D (subsubsection.6.4.1.3) >>
endobj
696 0 obj
-(6.4.1.5 Compatibility with BIND 8 Counters)
+(6.4.1.3 Resolver Statistics Counters)
endobj
697 0 obj
-<< /S /GoTo /D (chapter.7) >>
+<< /S /GoTo /D (subsubsection.6.4.1.4) >>
endobj
700 0 obj
-(7 BIND 9 Security Considerations)
+(6.4.1.4 Socket I/O Statistics Counters)
endobj
701 0 obj
-<< /S /GoTo /D (section.7.1) >>
+<< /S /GoTo /D (subsubsection.6.4.1.5) >>
endobj
704 0 obj
-(7.1 Access Control Lists)
+(6.4.1.5 Compatibility with BIND 8 Counters)
endobj
705 0 obj
-<< /S /GoTo /D (section.7.2) >>
+<< /S /GoTo /D (chapter.7) >>
endobj
708 0 obj
-(7.2 Chroot and Setuid)
+(7 BIND 9 Security Considerations)
endobj
709 0 obj
-<< /S /GoTo /D (subsection.7.2.1) >>
+<< /S /GoTo /D (section.7.1) >>
endobj
712 0 obj
-(7.2.1 The chroot Environment)
+(7.1 Access Control Lists)
endobj
713 0 obj
-<< /S /GoTo /D (subsection.7.2.2) >>
+<< /S /GoTo /D (section.7.2) >>
endobj
716 0 obj
-(7.2.2 Using the setuid Function)
+(7.2 Chroot and Setuid)
endobj
717 0 obj
-<< /S /GoTo /D (section.7.3) >>
+<< /S /GoTo /D (subsection.7.2.1) >>
endobj
720 0 obj
-(7.3 Dynamic Update Security)
+(7.2.1 The chroot Environment)
endobj
721 0 obj
-<< /S /GoTo /D (chapter.8) >>
+<< /S /GoTo /D (subsection.7.2.2) >>
endobj
724 0 obj
-(8 Troubleshooting)
+(7.2.2 Using the setuid Function)
endobj
725 0 obj
-<< /S /GoTo /D (section.8.1) >>
+<< /S /GoTo /D (section.7.3) >>
endobj
728 0 obj
-(8.1 Common Problems)
+(7.3 Dynamic Update Security)
endobj
729 0 obj
-<< /S /GoTo /D (subsection.8.1.1) >>
+<< /S /GoTo /D (chapter.8) >>
endobj
732 0 obj
-(8.1.1 It's not working; how can I figure out what's wrong?)
+(8 Troubleshooting)
endobj
733 0 obj
-<< /S /GoTo /D (section.8.2) >>
+<< /S /GoTo /D (section.8.1) >>
endobj
736 0 obj
-(8.2 Incrementing and Changing the Serial Number)
+(8.1 Common Problems)
endobj
737 0 obj
-<< /S /GoTo /D (section.8.3) >>
+<< /S /GoTo /D (subsection.8.1.1) >>
endobj
740 0 obj
-(8.3 Where Can I Get Help?)
+(8.1.1 It's not working; how can I figure out what's wrong?)
endobj
741 0 obj
-<< /S /GoTo /D (appendix.A) >>
+<< /S /GoTo /D (section.8.2) >>
endobj
744 0 obj
-(A Appendices)
+(8.2 Incrementing and Changing the Serial Number)
endobj
745 0 obj
-<< /S /GoTo /D (section.A.1) >>
+<< /S /GoTo /D (section.8.3) >>
endobj
748 0 obj
-(A.1 Acknowledgments)
+(8.3 Where Can I Get Help?)
endobj
749 0 obj
-<< /S /GoTo /D (subsection.A.1.1) >>
+<< /S /GoTo /D (appendix.A) >>
endobj
752 0 obj
-(A.1.1 A Brief History of the DNS and BIND)
+(A Appendices)
endobj
753 0 obj
-<< /S /GoTo /D (section.A.2) >>
+<< /S /GoTo /D (section.A.1) >>
endobj
756 0 obj
-(A.2 General DNS Reference Information)
+(A.1 Acknowledgments)
endobj
757 0 obj
-<< /S /GoTo /D (subsection.A.2.1) >>
+<< /S /GoTo /D (subsection.A.1.1) >>
endobj
760 0 obj
-(A.2.1 IPv6 addresses \(AAAA\))
+(A.1.1 A Brief History of the DNS and BIND)
endobj
761 0 obj
-<< /S /GoTo /D (section.A.3) >>
+<< /S /GoTo /D (section.A.2) >>
endobj
764 0 obj
-(A.3 Bibliography \(and Suggested Reading\))
+(A.2 General DNS Reference Information)
endobj
765 0 obj
-<< /S /GoTo /D (subsection.A.3.1) >>
+<< /S /GoTo /D (subsection.A.2.1) >>
endobj
768 0 obj
-(A.3.1 Request for Comments \(RFCs\))
+(A.2.1 IPv6 addresses \(AAAA\))
endobj
769 0 obj
-<< /S /GoTo /D (subsection.A.3.2) >>
+<< /S /GoTo /D (section.A.3) >>
endobj
772 0 obj
-(A.3.2 Internet Drafts)
+(A.3 Bibliography \(and Suggested Reading\))
endobj
773 0 obj
-<< /S /GoTo /D (subsection.A.3.3) >>
+<< /S /GoTo /D (subsection.A.3.1) >>
endobj
776 0 obj
-(A.3.3 Other Documents About BIND)
+(A.3.1 Request for Comments \(RFCs\))
endobj
777 0 obj
-<< /S /GoTo /D (section.A.4) >>
+<< /S /GoTo /D (subsection.A.3.2) >>
endobj
780 0 obj
-(A.4 BIND 9 DNS Library Support)
+(A.3.2 Internet Drafts)
endobj
781 0 obj
-<< /S /GoTo /D (subsection.A.4.1) >>
+<< /S /GoTo /D (subsection.A.3.3) >>
endobj
784 0 obj
-(A.4.1 Prerequisite)
+(A.3.3 Other Documents About BIND)
endobj
785 0 obj
-<< /S /GoTo /D (subsection.A.4.2) >>
+<< /S /GoTo /D (section.A.4) >>
endobj
788 0 obj
-(A.4.2 Compilation)
+(A.4 BIND 9 DNS Library Support)
endobj
789 0 obj
-<< /S /GoTo /D (subsection.A.4.3) >>
+<< /S /GoTo /D (subsection.A.4.1) >>
endobj
792 0 obj
-(A.4.3 Installation)
+(A.4.1 Prerequisite)
endobj
793 0 obj
-<< /S /GoTo /D (subsection.A.4.4) >>
+<< /S /GoTo /D (subsection.A.4.2) >>
endobj
796 0 obj
-(A.4.4 Known Defects/Restrictions)
+(A.4.2 Compilation)
endobj
797 0 obj
-<< /S /GoTo /D (subsection.A.4.5) >>
+<< /S /GoTo /D (subsection.A.4.3) >>
endobj
800 0 obj
-(A.4.5 The dns.conf File)
+(A.4.3 Installation)
endobj
801 0 obj
-<< /S /GoTo /D (subsection.A.4.6) >>
+<< /S /GoTo /D (subsection.A.4.4) >>
endobj
804 0 obj
-(A.4.6 Sample Applications)
+(A.4.4 Known Defects/Restrictions)
endobj
805 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.1) >>
+<< /S /GoTo /D (subsection.A.4.5) >>
endobj
808 0 obj
-(A.4.6.1 sample: a simple stub resolver utility)
+(A.4.5 The dns.conf File)
endobj
809 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.2) >>
+<< /S /GoTo /D (subsection.A.4.6) >>
endobj
812 0 obj
-(A.4.6.2 sample-async: a simple stub resolver, working asynchronously)
+(A.4.6 Sample Applications)
endobj
813 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.3) >>
+<< /S /GoTo /D (subsubsection.A.4.6.1) >>
endobj
816 0 obj
-(A.4.6.3 sample-request: a simple DNS transaction client)
+(A.4.6.1 sample: a simple stub resolver utility)
endobj
817 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.4) >>
+<< /S /GoTo /D (subsubsection.A.4.6.2) >>
endobj
820 0 obj
-(A.4.6.4 sample-gai: getaddrinfo\(\) and getnameinfo\(\) test code)
+(A.4.6.2 sample-async: a simple stub resolver, working asynchronously)
endobj
821 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.5) >>
+<< /S /GoTo /D (subsubsection.A.4.6.3) >>
endobj
824 0 obj
-(A.4.6.5 sample-update: a simple dynamic update client program)
+(A.4.6.3 sample-request: a simple DNS transaction client)
endobj
825 0 obj
-<< /S /GoTo /D (subsubsection.A.4.6.6) >>
+<< /S /GoTo /D (subsubsection.A.4.6.4) >>
endobj
828 0 obj
-(A.4.6.6 nsprobe: domain/name server checker in terms of RFC 4074)
+(A.4.6.4 sample-gai: getaddrinfo\(\) and getnameinfo\(\) test code)
endobj
829 0 obj
-<< /S /GoTo /D (subsection.A.4.7) >>
+<< /S /GoTo /D (subsubsection.A.4.6.5) >>
endobj
832 0 obj
-(A.4.7 Library References)
+(A.4.6.5 sample-update: a simple dynamic update client program)
endobj
833 0 obj
-<< /S /GoTo /D (appendix.B) >>
+<< /S /GoTo /D (subsubsection.A.4.6.6) >>
endobj
836 0 obj
-(B Manual pages)
+(A.4.6.6 nsprobe: domain/name server checker in terms of RFC 4074)
endobj
837 0 obj
-<< /S /GoTo /D (section.B.1) >>
+<< /S /GoTo /D (subsection.A.4.7) >>
endobj
840 0 obj
-(B.1 dig)
+(A.4.7 Library References)
endobj
841 0 obj
-<< /S /GoTo /D (section.B.2) >>
+<< /S /GoTo /D (appendix.B) >>
endobj
844 0 obj
-(B.2 host)
+(B Manual pages)
endobj
845 0 obj
-<< /S /GoTo /D (section.B.3) >>
+<< /S /GoTo /D (section.B.1) >>
endobj
848 0 obj
-(B.3 dnssec-dsfromkey)
+(B.1 dig)
endobj
849 0 obj
-<< /S /GoTo /D (section.B.4) >>
+<< /S /GoTo /D (section.B.2) >>
endobj
852 0 obj
-(B.4 dnssec-keyfromlabel)
+(B.2 host)
endobj
853 0 obj
-<< /S /GoTo /D (section.B.5) >>
+<< /S /GoTo /D (section.B.3) >>
endobj
856 0 obj
-(B.5 dnssec-keygen)
+(B.3 dnssec-dsfromkey)
endobj
857 0 obj
-<< /S /GoTo /D (section.B.6) >>
+<< /S /GoTo /D (section.B.4) >>
endobj
860 0 obj
-(B.6 dnssec-revoke)
+(B.4 dnssec-keyfromlabel)
endobj
861 0 obj
-<< /S /GoTo /D (section.B.7) >>
+<< /S /GoTo /D (section.B.5) >>
endobj
864 0 obj
-(B.7 dnssec-settime)
+(B.5 dnssec-keygen)
endobj
865 0 obj
-<< /S /GoTo /D (section.B.8) >>
+<< /S /GoTo /D (section.B.6) >>
endobj
868 0 obj
-(B.8 dnssec-signzone)
+(B.6 dnssec-revoke)
endobj
869 0 obj
-<< /S /GoTo /D (section.B.9) >>
+<< /S /GoTo /D (section.B.7) >>
endobj
872 0 obj
-(B.9 named-checkconf)
+(B.7 dnssec-settime)
endobj
873 0 obj
-<< /S /GoTo /D (section.B.10) >>
+<< /S /GoTo /D (section.B.8) >>
endobj
876 0 obj
-(B.10 named-checkzone)
+(B.8 dnssec-signzone)
endobj
877 0 obj
-<< /S /GoTo /D (section.B.11) >>
+<< /S /GoTo /D (section.B.9) >>
endobj
880 0 obj
-(B.11 named)
+(B.9 named-checkconf)
endobj
881 0 obj
-<< /S /GoTo /D (section.B.12) >>
+<< /S /GoTo /D (section.B.10) >>
endobj
884 0 obj
-(B.12 named-journalprint)
+(B.10 named-checkzone)
endobj
885 0 obj
-<< /S /GoTo /D (section.B.13) >>
+<< /S /GoTo /D (section.B.11) >>
endobj
888 0 obj
-(B.13 nsupdate)
+(B.11 named)
endobj
889 0 obj
-<< /S /GoTo /D (section.B.14) >>
+<< /S /GoTo /D (section.B.12) >>
endobj
892 0 obj
-(B.14 rndc)
+(B.12 named-journalprint)
endobj
893 0 obj
-<< /S /GoTo /D (section.B.15) >>
+<< /S /GoTo /D (section.B.13) >>
endobj
896 0 obj
-(B.15 rndc.conf)
+(B.13 nsupdate)
endobj
897 0 obj
-<< /S /GoTo /D (section.B.16) >>
+<< /S /GoTo /D (section.B.14) >>
endobj
900 0 obj
-(B.16 rndc-confgen)
+(B.14 rndc)
endobj
901 0 obj
-<< /S /GoTo /D (section.B.17) >>
+<< /S /GoTo /D (section.B.15) >>
endobj
904 0 obj
-(B.17 ddns-confgen)
+(B.15 rndc.conf)
endobj
905 0 obj
-<< /S /GoTo /D (section.B.18) >>
+<< /S /GoTo /D (section.B.16) >>
endobj
908 0 obj
-(B.18 arpaname)
+(B.16 rndc-confgen)
endobj
909 0 obj
-<< /S /GoTo /D (section.B.19) >>
+<< /S /GoTo /D (section.B.17) >>
endobj
912 0 obj
-(B.19 genrandom)
+(B.17 ddns-confgen)
endobj
913 0 obj
-<< /S /GoTo /D (section.B.20) >>
+<< /S /GoTo /D (section.B.18) >>
endobj
916 0 obj
-(B.20 isc-hmac-fixup)
+(B.18 arpaname)
endobj
917 0 obj
-<< /S /GoTo /D (section.B.21) >>
+<< /S /GoTo /D (section.B.19) >>
endobj
920 0 obj
-(B.21 nsec3hash)
+(B.19 genrandom)
endobj
921 0 obj
-<< /S /GoTo /D [922 0 R /FitH ] >>
+<< /S /GoTo /D (section.B.20) >>
+endobj
+924 0 obj
+(B.20 isc-hmac-fixup)
+endobj
+925 0 obj
+<< /S /GoTo /D (section.B.21) >>
+endobj
+928 0 obj
+(B.21 nsec3hash)
+endobj
+929 0 obj
+<< /S /GoTo /D [930 0 R /FitH ] >>
endobj
-925 0 obj <<
+933 0 obj <<
/Length 240
/Filter /FlateDecode
>>
@@ -1384,32 +1396,32 @@ stream
xÚ•OKAÅïó)rl›N2Éü9ZªRA¡27ñ°´[)¸[ºÖïïlWË‚^$0ïý˜y[Š *Z—BTK
ÛÖXx+Þ½¡oFÔ¡Šsåð‡[ LÁ+T\@1M±_8±Eo=C¥BÈÌ~À—Ù,CyÄŠƒÂ•Ë»—Ùrý´š——ì,ãf׺Ãǹ¯ÏÇ~”ž›}Ó7ݶ™¿æ a$/¾äKc¼\óXwŸõûà›Û|
§â1'p®äðqH'`Ôð3‹zšüßÚ±y±n VG³1°™ž07l(%tî[þM^Xúendstream
endobj
-922 0 obj <<
+930 0 obj <<
/Type /Page
-/Contents 925 0 R
-/Resources 924 0 R
+/Contents 933 0 R
+/Resources 932 0 R
/MediaBox [0 0 595.2756 841.8898]
-/Parent 931 0 R
+/Parent 939 0 R
>> endobj
-923 0 obj <<
+931 0 obj <<
/Type /XObject
/Subtype /Form
/FormType 1
/PTEX.FileName (./isc-logo.pdf)
/PTEX.PageNumber 1
-/PTEX.InfoDict 932 0 R
+/PTEX.InfoDict 940 0 R
/Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000]
/BBox [0.00000000 0.00000000 612.00000000 792.00000000]
/PieceInfo <<
-/Illustrator 933 0 R
+/Illustrator 941 0 R
>>
/Resources <<
/ColorSpace <<
-/CS0 934 0 R
+/CS0 942 0 R
>>/Properties <<
-/MC0 935 0 R
+/MC0 943 0 R
>>/ExtGState <<
-/GS0 936 0 R
+/GS0 944 0 R
>>>>
/Length 843
/Filter /FlateDecode
@@ -1425,7 +1437,7 @@ BqÕ•l9u
!=§ ¨Œø†vGc £I#/'~<1‚ÀÔRPy±´ýl1½Í¶w1 чd
}¡þa #fßËþÚF¯ÞƒÇY}ïAô
Ë9b :žÎÞF"‹>64”~0IGD˜Ëذ$ÙtMâ¯%Z½Gð¾¥Úñ§aÑÌ‘I¼ý—/øýzü+À 0huendstream
endobj
-932 0 obj
+940 0 obj
<<
/CreationDate (D:20100303120319-08'00')
/Creator (Adobe Illustrator CS3)
@@ -1434,24 +1446,24 @@ endobj
/Title (ISC_logo_only_RGB)
>>
endobj
-933 0 obj
+941 0 obj
<<
-/Private 937 0 R
+/Private 945 0 R
/LastModified (D:20100412113400-07'00')
>>
endobj
-934 0 obj
-[/ICCBased 938 0 R]
+942 0 obj
+[/ICCBased 946 0 R]
endobj
-935 0 obj
+943 0 obj
<<
-/Intent 939 0 R
-/Usage 940 0 R
+/Intent 947 0 R
+/Usage 948 0 R
/Name (Layer 1)
/Type /OCG
>>
endobj
-936 0 obj
+944 0 obj
<<
/OPM 1
/BM /Normal
@@ -1465,22 +1477,22 @@ endobj
/SA true
>>
endobj
-937 0 obj
+945 0 obj
<<
/RoundtripVersion 13
/ContainerVersion 11
/CreatorVersion 13
-/AIMetaData 941 0 R
-/AIPrivateData1 942 0 R
-/AIPrivateData2 943 0 R
-/AIPrivateData3 944 0 R
-/AIPrivateData4 945 0 R
-/AIPrivateData5 946 0 R
+/AIMetaData 949 0 R
+/AIPrivateData1 950 0 R
+/AIPrivateData2 951 0 R
+/AIPrivateData3 952 0 R
+/AIPrivateData4 953 0 R
+/AIPrivateData5 954 0 R
/NumBlock 5
/RoundtripStreamType 1
>>
endobj
-938 0 obj
+946 0 obj
<<
/Length 281
/Filter /FlateDecode
@@ -1491,10 +1503,10 @@ H
rwRˆˆŒR`?ÏÀÆÀÌ ‰ÉÅŽ> v^~^*øvD_Ö™…)p%• é?@l”’ZœÌÀÀh dg—— Åç Ù"IÙ`ö»($ÈÈ>dó¥CØW@ì$û ˆ]ôý¤>Ìfâ ›aË€Ø%© {œó*‹2Ó3J---Sò“R‚+‹KRs‹<ó’ó‹
ò‹KRS€j!îAˆBPˆi 5Zh’èo‚ Öç@pø2ŠAˆ!@riQ”ÉÈdL˜0cŽƒÿR–?1“^†:üSbj†úûæ ÀÆOýendstream
endobj
-939 0 obj
+947 0 obj
[/View/Design]
endobj
-940 0 obj
+948 0 obj
<<
/CreatorInfo <<
/Subtype /Artwork
@@ -1502,21 +1514,21 @@ endobj
>>
>>
endobj
-941 0 obj
+949 0 obj
<<
/Length 981
>>
stream
%!PS-Adobe-3.0
%%Creator: Adobe Illustrator(R) 13.0
%%AI8_CreatorVersion: 13.0.2
%%For: (Brian Reid) ()
%%Title: (ISC_logo_only_RGB.ai)
%%CreationDate: 4/12/10 11:34 AM
%%BoundingBox: 247 367 366 413
%%HiResBoundingBox: 247.0869 367.5654 365.0859 412.583
%%DocumentProcessColors: Cyan Magenta Yellow Black
%AI5_FileFormat 9.0
%AI12_BuildNumber: 434
%AI3_ColorUsage: Color
%AI7_ImageSettings: 0
%%RGBProcessColor: 0 0.658824 0.8 (ISC logo blue)
%%+ 0.372549 0.376471 0.384314 (PANTONE 425 U)
%%+ 0 0 0 ([Registration])
%AI3_TemplateBox: 306.5 395.5 306.5 395.5
%AI3_TileBox: 18 33.1201 594 786.96
%AI3_DocumentPreview: None
%AI5_ArtSize: 612 792
%AI5_RulerUnits: 3
%AI9_ColorModel: 1
%AI5_ArtFlags: 0 0 0 1 0 0 0 0 0
%AI5_TargetResolution: 800
%AI5_NumLayers: 1
%AI9_OpenToView: -381 793 0.92 1268 743 26 0 0 117 75 0 0 1 1 1 0 1
%AI5_OpenViewLayers: 7
%%PageOrigin:0 0
%AI7_GridSettings: 72 8 72 8 1 0 0.8 0.8 0.8 0.9 0.9 0.9
%AI9_Flatten: 1
%AI12_CMSettings: 00.MS
%%EndComments
endstream
endobj
-942 0 obj
+950 0 obj
<<
/Length 11082
>>
stream
%%BoundingBox: 247 367 366 413
%%HiResBoundingBox: 247.0869 367.5654 365.0859 412.583
%AI7_Thumbnail: 128 52 8
%%BeginData: 10932 Hex Bytes
%0000330000660000990000CC0033000033330033660033990033CC0033FF
%0066000066330066660066990066CC0066FF009900009933009966009999
%0099CC0099FF00CC0000CC3300CC6600CC9900CCCC00CCFF00FF3300FF66
%00FF9900FFCC3300003300333300663300993300CC3300FF333300333333
%3333663333993333CC3333FF3366003366333366663366993366CC3366FF
%3399003399333399663399993399CC3399FF33CC0033CC3333CC6633CC99
%33CCCC33CCFF33FF0033FF3333FF6633FF9933FFCC33FFFF660000660033
%6600666600996600CC6600FF6633006633336633666633996633CC6633FF
%6666006666336666666666996666CC6666FF669900669933669966669999
%6699CC6699FF66CC0066CC3366CC6666CC9966CCCC66CCFF66FF0066FF33
%66FF6666FF9966FFCC66FFFF9900009900339900669900999900CC9900FF
%9933009933339933669933999933CC9933FF996600996633996666996699
%9966CC9966FF9999009999339999669999999999CC9999FF99CC0099CC33
%99CC6699CC9999CCCC99CCFF99FF0099FF3399FF6699FF9999FFCC99FFFF
%CC0000CC0033CC0066CC0099CC00CCCC00FFCC3300CC3333CC3366CC3399
%CC33CCCC33FFCC6600CC6633CC6666CC6699CC66CCCC66FFCC9900CC9933
%CC9966CC9999CC99CCCC99FFCCCC00CCCC33CCCC66CCCC99CCCCCCCCCCFF
%CCFF00CCFF33CCFF66CCFF99CCFFCCCCFFFFFF0033FF0066FF0099FF00CC
%FF3300FF3333FF3366FF3399FF33CCFF33FFFF6600FF6633FF6666FF6699
%FF66CCFF66FFFF9900FF9933FF9966FF9999FF99CCFF99FFFFCC00FFCC33
%FFCC66FFCC99FFCCCCFFCCFFFFFF33FFFF66FFFF99FFFFCC110000001100
%000011111111220000002200000022222222440000004400000044444444
%550000005500000055555555770000007700000077777777880000008800
%000088888888AA000000AA000000AAAAAAAABB000000BB000000BBBBBBBB
%DD000000DD000000DDDDDDDDEE000000EE000000EEEEEEEE0000000000FF
%00FF0000FFFFFF0000FF00FFFFFF00FFFFFF
%524C45FD1F52285252A8FD04FFFD05A8FFFFFFA87DFD4F52285252522852
%525228525252285252522852525228525252285252522852277DA8FFFFA8
%7D7D525227FD04527DA8FFFFA85252275252522852525228525252285252
%522852525228525252285252522852525228525252285252522852525228
%52525228525252285252522852525228525252285252522852525228FD21
%52A8FFFF7D7D525227FD0752275252A8FFFF7DFD215227FD2A522E522752
%2E5227522E5227522E5227522E5227522E5227522E5227527DFFFFA85252
%27522E5227522E5227522E5227522752A8FF7D5227522E5227522E522752
%2E5227522E5227522E5227522E5227522E522752277D7D7D275227522E52
%27522E5227522E5227522E5227522E5227522E5227522E5227522E522752
%2E5227FD1A52277DA8FFA87D2EFD11522E527DFFA853FD1D52A8FFFFFF7D
%28FD285228525252285252522852525228525252285252522852277DFFFF
%7D522752525228525252285252522852525228525252275252FFA8522752
%285252522852525228525252285252522852525228525252277DFFA852A8
%FF5227525252285252522852525228525252285252522852525228525252
%285252522852525228FD1852277DFFFFFD1B52FFA8FD1A527DFFA8275252
%FF7DFD265227522E5227522E5227522E5227522E5227522E522752277DFF
%FF525227522E5227522E5227522E5227522E5227522E5227522E52275252
%FFA852275227522E5227522E5227522E5227522E5227522E522752A8A827
%522E527DA9275227522E5227522E5227522E5227522E5227522E52275227
%5227522E5227522E5227522EFD17527DFFA8FD1E527DFFA8FD17527DFFFD
%0452287DFFFD155228FD075228FD08522852525228525252285252522852
%5252285252522852527D2752525228525252285252522852525228525252
%2852525228525252285252527DFF7D522852525228525252285252522852
%525228FD0452FF7D5228FD0452FF52522852525228525252285252522752
%2752527DA1A8A8FFCACFA8CAA17D5252275228FD3C52A8FFFD145228A8FF
%53FD0652FFA82EFD0C527D7DCAFD04FFAFAF85AF85AFAFFFFFFFA87DFD05
%522E5227522E5227522E5227522E5227522E5227522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522752A8
%FF275227522E5227522E5227522E5227522E522752FFA827522E5227522E
%FF7D522E5227522E522752275252A8FFFFAFAF603CFD041413FD04143C60
%AFFFFF535227FD3A52277DFFA827FD11527DFFFD0852A8FFFD0952A8CFFF
%FFAF3C3D1414141A141A141A141A141A14141461AFFFA8FD045228525252
%285252522852525228525252285252522852525228525252285252522852
%5252285252522852525228525252285252522852525227A8FF5227525252
%2852525228525252285252522EFFA85227525252285228A87D5252522852
%27527DFFFFAF603CFD07141A1414141A1414141AFD041460FFA8FD3D52FF
%A8FD10527DFF7DFD0F527DFFFFA9611414141A141A141A141A141A141A14
%1A141A141A141A14143CFFA827522E5227522E5227522E5227522E522752
%2E5227522E5227522E5227522E5227522E5227522E5227522E5227522E52
%27522E5227522E5227522E527DFF525227522E5227522E5227522E522752
%A8FF27522E5227522E5227522852275252A8FFFF3C1413FD191436FFFD3C
%5259FFA828FD0E52FF7DFD0D527DFFFF8B1414141A141A141A141A141A14
%1A141A141A141A141A141A141A141A141460285252522852525228525252
%285252522852525228525252275227522752275227525252285252522852
%52522852525228525252285252522852525227A8FF7D2752525228525252
%2852525227A8FF52275252522852525228522752A8FFA93CFD05141A1414
%141A1414141A1414141A1414141A1414141A1414141A1414FD1552285252
%7D527D597D527DFD065227FD1852FFA8FD0D52FFFFFD0A52277DFFFF601A
%141A141A141A141A141A141A141A141A141A141A141A141A141A141A141A
%141A142E5227522E5227522E5227522E5227522752527D7DA8A8FD09FFA8
%FFA8A87D532852275227522E5227522E5227522E5227522E5227522E527D
%FF525227522E5227522E52275252FF7D522E5227522E522752277DFFFF36
%FD2314FD0E527D7DFD07FFA8A87DA87DA87DFD04A8FD05FFA87DFD15527D
%FFA827FD0A52A8FF7DFD0952A8FFAF1414141A141A141A141A141A141A14
%1A141A141A141A141A141A141A141A141A141A141A145252285252522852
%525227527DA8FFFFFFA87D7D52522752275227522752275227522752527D
%A8FFFFFFA87E52522752525228525252285252522852525227A8FF522752
%5252285252522752FFA8275252522852525227A8FF85FD05141A1414141A
%1414141A1414141A1414141A1414141A1414141A1414141A1414141AFD07
%52275253A8FFFFFFA8FD045227FD0F522EFD04527D7DFFFFFFA87DFD1052
%7DFF7DFD0A52FF7DFD0852A8FF8B1414141A141A141A141A141A141A141A
%141A141A141A141A141A141A141A141A141A141A141A1427522E52275227
%7DA8FFFFA85252275227522E5227522E5227522E5227522E5227522E5227
%522E52275227527DFFFFFF7D52275227522E5227522E5227522752A8A827
%5227522E52275227A8FF5227522752525227A8FF6113FD2714FD0652A8FF
%FF7D7D28FD22527DA8FFFF7DFD0C5227A8FF7DFD0852A8FFFD06522EA8FF
%61141A141A141A141A141A141A141A141A141A141A141A141A141A141A14
%1A141A141A141A141A141A14285227527DFFFF7D52522752285252522852
%525228525252285252522852525228525252285252522852525228522752
%52FFFFA8525228522852525228FD0452FF7D5228525252285252FF7D5252
%52285227A8FF611414141A1414141A1414141A1414141A1414141A141414
%1A1414141A1414141A1414141A1414141A141452277DFFFFA87D28FD2952
%287DFFFF7EFD0B52A8FFFD065227A8FF7D2752525227A8FF8B141A141A14
%1A141A141A141A141A141A141A141A141A141A141A141A141A141A141A14
%1A141A141A141A1428A8FFFF525227522E5227522E5227522E5227522E52
%27522E5227522E5227522E5227522E5227522E5227522E5227522E522752
%7DFFA87D275227522E522752277EFF52275227522852A8FF52522752277D
%FF8BFD121413FD0F1413FD0914FFFFA8FD3352FFFFA8FD0952FF7DFD0652
%FFA8FD04527DFFAF141A141A141A141A141A141A141A141A141A14613C3C
%141A141A141A141A141A141A143D3C3C141A141A141A14FF7D2752525228
%525252285252522852525228525252285252522852525228525252285252
%522852525228525252285252522852525227A8FFA8FD045228525252A8A8
%27522852277DFF7D27522752A8FFFD051461A9AF848B1414141A141436AF
%AFFFFFFFAFAF36FD04141A14141461A9FFAFFFAFAF601A1414141A7D2EFD
%3552277DFFFFFD0752A8FFFD05527DFFFD04527DFF3C14141A141484FFFF
%FFAF1A141A141A85FD09FF841A141A141A14AFFD08FF841A141A1427522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522E5227522E5227522E5227522E5227522E5227522E52277DA8FF52522E
%5227527DFF52522E5227FFA852275252FF60FD061485FFFFFFAFFD041460
%FD0BFF36FD0414AFFD0AFF60141414FD3A5253FFFF7DFD04527DFFA85252
%527DFFA8285252FFAF1A141A141A141A84FFFFFFAF3D141A14FD05FF603D
%60FD04FFAF141A1461FD04FFA96136AFFD04FF141A142852525228525252
%285252522852525228525252285252522852525228525252285252522852
%52522852525228525252285252522852525228522752A8FF5252285252FF
%A8FD0452FF7D5227A8FF3C141AFD051485FFFFFFAF14141460FD04FF3614
%141460FFFFFFA91A141484FFFFFFA91A141414FD04FF611414FD3D52A8FF
%FD0452A8FF525228A8FF7D277DFF8B141A141A141A141A85FFFFFFAF1A14
%1A60FD04FF3C141A1461FD04FF141A14FD04FF8B141A141AAFFFFFFF601A
%142E5227522E5227522E5227522E5227522E5227522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522752A8FF5252277DFF7D2752A8FF2752A8FFFD08141385FFFFFFAF1414
%1361FD04FF36FD04148584856014133CFD04FF60FD0414FD04FF851314FD
%3D52287DFFFF525252FF7D5252FFA8527DFF3C1A141A141A141A141A85FF
%FFFFAF1A141A60FD04FFAF141A141A141A141A141A3CFD04FF61141A141A
%3C616061361A145252285252522852525228525252285252522852525228
%525252285252522852525228525252285252522852525228525252275252
%522752525228525252277DFF7E2752FFA82753FF7E27FFA914141A141414
%1A1414148BFFFFFFAF1414143CAFFD04FFAFFD091461FD04FF3614141AFD
%07141AFD2B522852285227FD075227FD075227A8FF7D27FFA8527DFF7D7D
%FF3D141A141A141A141A141484FFFFFFA91A141A1485FD06FF603C141A14
%1A14143CFD04FF61141A141A141A141A141A1427522E5227522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E522752275227
%FD04527D7DA8A8FFA8FFA8FFA8A87D7D52522752275227FFA8527DFF277D
%FF52A8AF13FD0A1485FFFFFFAFFD0414138BFD06FFA860FD05143CFD04FF
%36FD0B14FD2852A8A8FD07FFA8FFA8FFA8FD06FFA87D5227527DFF7D7DFF
%7DA8FF7DFF3C1A141A141A141A141A141A84FFFFFFAF3D141A141A148BFD
%07FF8B141A141A3CFD04FF61141A141A141A141A141A1428525252285252
%522852525228525252285252522852525228525252285252522752275252
%A8A8FFFFFFA8A87D7DFD065227FD04527D7DA8FFFFA87D2752A8FF52FF7D
%A8A8CAA914141A1414141A1414141A1485FFFFFFAFFD071460A8FD06FF8B
%1414143CFD04FF36FD04141A1414141A1414FD2252A8FD04FF7D7D525228
%5227FD0B52275252527DFFFFFF5253FFA8A8A8FFA8FF61141A141A141A14
%1A141A141A85FFFFFFAF1A141A141A141A141A60FD06FF85141A3CFD04FF
%61141A141A141A141A141A142E5227522E5227522E5227522E5227522E52
%27522E5227522E5227522752277DA8FFFFA859522752275227522E522752
%2E5227522E5227522E5227522752277DA8FF7DA8FFFFA8FFFFAFFD0C1413
%85FFFFFFAFFD061413FD0414AFFD04FFA9141360FD04FF36FD051413FD05
%14FD1D527DFFFFFF7D7DFD1E52A8FFA8FD05FF601A141A141A141A141A14
%1A141A85FFFFFFAF1A141A143D363D141A141A14FD05FF3C1A3CFD04FF61
%141A141A60AF85AF601A1452522852525228525252285252522852525228
%52525228525252277DFFFFA87D2E52275252522852525228525252285252
%52285252522852525228525252285228527DFD06FF3C141A1414141A1414
%141A1414148BFFFFFFAF141414AFFFFFAF8BFD04143CFD04FF3C143CFD04
%FF60FD04148BFFFFFFAF1414FD1752285259FFFFA9525227FD2352A8FD04
%FFAF141A141A141A141A141A141A141484FFFFFFA91A141484FFFFFFA91A
%141A1461FD04FF3C1414FD04FF8B141A141AA9FFFFFF85141427522E5227
%522E5227522E5227522E5227522E52275227527DFFA87D27522E5227522E
%5227522E5227522E5227522E5227522E5227522E5227522E5227522E5227
%522752A8FFFFFF60FD0E1485FFFFFFAF14141485FD04FFFD041436FD04FF
%3C141484FFFFFFA8FD0414FD04FF611414FD16527DFFFF7D5228FD275227
%A8FFFFFF3D141A141A141A141A141A141A141A84FFFFFFAF3D141460FD04
%FFAF363C3CFD05FF141A1461FD04FF853C148BFD04FF3C1A142752275227
%52275227522752275227522752275227A8FFA82852275227522752275227
%522752275227522752275227522752275227522752275227522752275227
%52275252FFFFAFFD0F1485FFFFFFAFFD0414A8FD05FFAFFD05FF36FD0414
%AFFD0AFF841414147D527D527D527D527D527D527D527D527D527D52A8FF
%FF527D527D527D527D527D527D527D527D527D527D527D527D527D527D52
%7D527D527D527D527D527D527D527D527DA8FF853C363D3C3C363D3C3C36
%3D3C3C363D85FFFFFFAF3D363D3685FD0AFFAF3C363D3C3C60FD0AFF6136
%3D3CFD16FFA8FD49FFAFFD11FFAFFD09FFAFFFFFFF
%%EndData
endstream
endobj
-943 0 obj
+951 0 obj
<<
/Length 65536
>>
@@ -1790,7 +1802,7 @@ s
Dx^QÜ×}Ì 'Bñ[:à)B½R, S´èšðfB×É4ÂèìÙasÌÁ(ͤWYĤ1,]©±¤ÉãÊ3’ÞÔo`(g¾w,Qì(Áê|ê”[àŽ%hXTMw®GKuQ*´b‹½Mˆ˜ÓZê[MYŒåA_qjRdÒGq¥(
ŽüÕw”ÄH‰Öç-튵¨ù‹ôk¥ kÄu6™i^T6_÷òÂïµÆë¶Rί¥_¡zÐ$SÑW¡×$JÕŽ;ÚcÂíPQþˆýš²Ü‘~Ê
Ìû›Žhq•hMâT‚oÁá¡ä‘³µ%±ÓêÒ2¢'[ÝDJÖ@n#Œ ¡‰G€’HÞt‚ $Ö¬X®:[ôM¥àkiºU_wÂÉ„ßs¬‰Åw)Õ!ºRbã’è #öp £0?Û9B“%«¡þ!
MÓ³a¾“ܶrh%[íZyGÚ
˜ØyY‰Ÿ‹©
¨zŽ…N¬V¥%™‚¨™@“£=HU˜ü¢³l0¼Tq_PIÐ/u,dÆö¶fý"íŒØ¾MMæu [endstream
endobj
-944 0 obj
+952 0 obj
<<
/Length 65536
>>
@@ -2032,7 +2044,7 @@ qlޯ
¶“¬ûVG=# [ül&wJ΂fkíY”&{öñß1øÀ ÛÄ%'DSì ]-†ø,^¥·ä†¸ùì²WU`×z0,PZ“Ny}7/ì%ñ«×Ð
F?؆F߮U
E2,„Ò-[‰Ðð~Eô׈bˆ¨<Þë‹uAhÜš:®—Ú[ɬëxÏ*}ñ Š–È¤”=cf身O©½S«!Ikà•O7C/¶ž[\ð9³Y%“׆Œ 95ToÂK‰ýÐ2ïmñ\¤•_afbµîpe"YRC+ç°>…JÊò`u81‡¸[å8¼ÝŠ2#aG9u&«`æÚ3Æ KÞH¨ÃNk“‹:6÷ð¦/F
²ÈO}|}3RÖ$Yé…u:²—wENú쇦3,I=¡ÔwM{
æjˆ¼=ßîúÑýSTÛT¿}0GjÏŒ—©;èçæŸYÕ#•ÈGq •›«NÙÔo¾äØvöM¶¼¼ú¡ÜAWDœçoHÈ Í'L“…ÓÔöÌ\Kôæ4ûÉœoYäÍŸ›¦×ºð<ƒ\qùßôFs¦ç¹¨'¬‡~ž kS_LÓ`%AwMÈFH«ãϋ҈‚¤*»Ra6éñ‰RL/㤨RœDR«ï¥&ÐÍÄýÇF¾«h¾vxïªý«¢Š~¥A$kïKDØ×+2
ÂHþòúvŸûA]„‡~çË臖AÝõ±VpÞû¡Þfêýàíд³endstream
endobj
-945 0 obj
+953 0 obj
<<
/Length 65536
>>
@@ -2255,7 +2267,7 @@ uAL
]×g1ͼ‘ôAÚF¥5³ò(ª®Í
]0_†ì›ðÆ„e
@kB “0€«ŠÕ¬adóŒ‘qìsê‹ ²¯dy1‹y†KôëP¦àpµMõ˨º¨õH¥ôèÅ2#pÃC¤€Zraeü$JÔSÂûkbüDÁ@fÞèÛ6¦1Oîõ)VÝå¶K
m6o°Êwµ˜Íô‰iƒMlã!Qáiªk´ª²endstream
endobj
-946 0 obj
+954 0 obj
<<
/Length 53114
>>
@@ -2452,43 +2464,43 @@ Y
œ;ø#ñ<ݰ'€å‰íöÐ"W€ Ü$IDà Ù,šg¾˜/ZOàx ÿ9{«<˜9zºÌòè Â_ȬÚIJRÞ|ÒÀŸiÀ¾òhq€5çЄ8È8|Ž$ë ʈ€f+ Þ¬ ÀIŠ€ŒÛ¸ýY -×x–4&äôi#¸A6%ˆØ!ÍÁÝ£éÀžÐÜÀAÐ1%+äá´s`»à„,q$`ZÈ¢·pLTÁç´¾²Y¸¿è‰˜GEÛ°œ¶Oæ3°À%¬•¹R—·íS0<”Ñ*$‡_ Üúœ ˆ¹X@Û"B\…s$À‰¼õ¬?3…dBÛl
Ö^IYïc çBô“Ïsö_²ù ¹(äÂVO&q˜ãa$fUD{bµÒ)d ì)ÏóÚÌÅ‚Æå È#¦ £i ú³þŒKgóBl[m=àdpw5‰â°7y.¶õÎ#Y!*™¬±n×EQ^“.N>ù+QWã™ýÁXSÎÂíáûh8tÂê«<ê†ß‡.¦©5JšÂÔG¤Ök&v*¿t/¹×êã‹*ÿÕ
˃Áp,»#ð&ü¢tÕñP邇Ã'à£9PDOj¡ÿIHÈ”endstream
endobj
-926 0 obj <<
-/D [922 0 R /XYZ 85.0394 794.5015 null]
+934 0 obj <<
+/D [930 0 R /XYZ 85.0394 794.5015 null]
>> endobj
-927 0 obj <<
-/D [922 0 R /XYZ 85.0394 769.5949 null]
+935 0 obj <<
+/D [930 0 R /XYZ 85.0394 769.5949 null]
>> endobj
-924 0 obj <<
-/Font << /F21 930 0 R >>
-/XObject << /Im1 923 0 R >>
+932 0 obj <<
+/Font << /F21 938 0 R >>
+/XObject << /Im1 931 0 R >>
/ProcSet [ /PDF /Text ]
>> endobj
-949 0 obj <<
-/Length 1063
+957 0 obj <<
+/Length 1065
/Filter /FlateDecode
>>
stream
-xÚµV]“ª8}Ÿ_ÁãX5D’0ûÆ *[.àÚÚ»ŒâHÕŒXÂ\kþývH Qwj_¶|H‡»OŸî|`Í€Ö˜…,N¸fs13móñ`ho°6À
-c2Š˜I)Lî¬êˆB5šhÞ.Q7hf#Š)×t›qdQø ŸÓ‡ñŒ#nKKwšEáŒh*Ýþõè–ǯSñ¶¯G§¿kÌ@¶Á¢†!±0žaó“Nmq[Ó/p?!S ÅA®"O"†a>tÂa²Þ´zÓîÍIoòÎÄFobiù‡:?òZÎ’¯ªÎ?*9qËCUžêâóã©ÅnÐH§Ø ÆÌøIˆé'®`ŠE^ÚI‹)A̲,Í61•³oëСõKøm!0µ¡ø6ï½þ[%ÈÿY‰^G÷&éMzWÝrWŸ³ÓOók‰Ñµ~Ðå„Í&xZ“ïÛXõKôzl‚ˆApïS¤³ÊOEUåArªK9~V¹ÊgòŽ0ÆjþQn‹ÝàKvØŽË“´·EUŸŠ×ÏZåXïÕPÕMþ»öOÙáKÇÏÓ±¬Ôò¹¨÷ÒjqâKù©ôÜå
-Dá1F„Boè`pÛU¤·ÏeÀWàí”AQ¶Šø±Y,Û|ÛÒÍêÖRî³×òWÞK!;™ÊºØä× ¯¤ÀÇ;#奖çw^«¾·í+…â|{.KuþºE=¸œÜì½€‹æPd“ÁÃÞô©#ÝSញíëúøÛx|>Ÿ…¨¨6¨lH½onmõ€¥‰'ê~¾þN!–Éendstream
+xÚÅV]ªH}Ÿ_Á㘌m@Cl\À;ÙìÝFq$™#Ì5óïoA7 j&û¶ñ¡«écÕ©SÕDÃð#šÁTh¦Ð‘‰¡m>°ökó¢0ºÁ¡3“;«c]7‘‰¹ÐÆLGx»DÝ 9EL›†@œQV£Ÿ“‡ÉŒRM Á)×’ÆMd̵•lÿytŠã×)ÛW£“?5CXˆ†ÃX6õÂdFôOcŠL.Lm|û ™Jè (¡ró¬Acýi4¦®M£7yoš½iõ¦èL‚{“ô&•–w¨²Ó!«ä,þ*«ì£”§8”Å©Ê??žZì5i&Î8$D†AUFþI©îÅN=À”Ôè7é¤'¤ç4¥™º®[§=¾„ߊ0¨”nŠÞëÿR©^gÜëŒio²»’»êœžFÄzÌ®uG×úÁ. [š º[„ðoåkÁãKôz†…(¦¤÷Y§³ÊNyYæÅArª
+9~–™ÊgòŽ!jþQlóÝàKzØNŠ“´·yYò×ÏJåXísÕeåMþ»öOéáKÇÏÓ±(Õò9¯öÒjqõ—âSé¹Ë4½JeЃVÝg2à«
+ðvJ¡([EüØ,¿òm¶mé¦Uk)÷ékñ+ë¥ÖLE•o²Nƒë„WÒàÇc–ª¬rµž¾¿ËD„…æF› ‘M\ó¬”ÛrL±@LgPrb"Á¨Õ@’…«Z-œ%/#AíH}ñb9®¢ð‡7u§rVï^;nõLÚv0m?:Ò˜‚åÛÞRmß—†ŠÙAâ¹jñÅKҊܹMå¶„ÓšÑaq’ZýPB“EKñùÀñ×S/˜_÷–+ßks¹Ç$œÉqéFÎF¦þh?{¾—üÝ'Z³ãHè–9|æ%Ǩå Ç@ñu¸àO^ôŒZ½žuß³Ÿ}eϨªÂÇ+×ñlÿ©Õ8r†c{7ŸÀEÓ #>Ó ƒØýk
¬À£rh/íy§ÅuðÁêË®£$q‰Emõâµß|í¤ŸEáR%ƽÈ5%Œà`¼*ð:vÛܤû¦ C>Б tüÔòp¡‹£¡æv;:‰ÃÒBÚId4
+ܹïÍÝÀq‡‘ÂÆsÍÞÔ"ÃrËfŒFÌ„|Ãu|R9¶#/î¤×ÉIxŘîã~[tûô”µÞø‚‘¡ˆ+7‚ÎYÚ}>³ï¶ÌÍUB GD˜H¼’o¯’<¾@ß^%”DLKt>k¢÷^×]“&¥°Ýê/¬ÀûôŽ”—JžßY¥úž#“˜W
+EÙö\êüuòjp99é{Í!OºoPvÓ§¶tÏj÷tHl_UÇ?&“óù\+ŒòrƒŠ†ÔÛäæÖV\f ú ûŸŸ·¿—~endstream
endobj
-948 0 obj <<
+956 0 obj <<
/Type /Page
-/Contents 949 0 R
-/Resources 947 0 R
+/Contents 957 0 R
+/Resources 955 0 R
/MediaBox [0 0 595.2756 841.8898]
-/Parent 931 0 R
+/Parent 939 0 R
>> endobj
-950 0 obj <<
-/D [948 0 R /XYZ 56.6929 794.5015 null]
+958 0 obj <<
+/D [956 0 R /XYZ 56.6929 794.5015 null]
>> endobj
-947 0 obj <<
-/Font << /F22 953 0 R /F14 956 0 R >>
+955 0 obj <<
+/Font << /F22 961 0 R /F14 964 0 R >>
/ProcSet [ /PDF /Text ]
>> endobj
-959 0 obj <<
+967 0 obj <<
/Length 2886
/Filter /FlateDecode
>>
@@ -2501,1768 +2513,1775 @@ x6$a
¿Z×U½n—÷Ð̈ƒ2fûHBÎ’ †PˆH¨ó–Ãi€ð-g'W«eµ\·
hGPü.6¶¾Šþ>EÉúCL(¢$LÔùx7 Šdœ‡""ÌE.–×U1\üìP†~IÜÍ)“ýD’¼ÝFHÚ9ß×1Ý’‹CiÇ{lýA¨É¥ëbÖO®îítÆ/1Y•E»iÊõd¦ÂÉ>³r2
"+‡;çí34½O‡df×k¬Pç%yΆ^†¥Ãwu»üdgööJÝ£§G¾ÕŒ0àÅH½¡!r
n‰‰#
õHSÆëÂæW^=TÅÊ—uﮊÖÞÍM¦ýß¹<'34Úa1‚vƒÀ Â\‡r€KM²\fž qrèg{ÿª7-ücÓ”w»æÀÍÓ¸ñéMbä@ùØôb,ŒÔ{|„$:×® ëQçÕblMñàtN†=jŠjý)´›vãŸÿõõ‡ái|gÏœIT|6“Q†*P-•H*¨÷€ŠoTn|Eä[S.în—-,>ÔB¿åpäeHfbŒA™1Æ"q`Œ¡ÞÇ{£Ä¦/÷…{ÙÙ/`Ó~ý˜¹îoe»¹ëJ$±Ïpøô%Ã18 ´êuÛ?ö©¿®Ë ÏN²öÀÓfŸÓií#q`Ú£ÞÃÚ:ËìŠ*>j6[N6m½*Â^‹ƒaxÏÞ—ß§'Y|`ˆ‰Ó‰‰õ>Нíä™f@{¿¯ò¶¨6~…όگße(YþÑSä7L{Ìõ8æ+J¨ï6ì´÷{*§õÝCh°ûçÇþ‹ÒM˜]YÚÖ®5¨ö[ïoûŽÁ®_ñø>7ɪCLv˜{L÷H˜ð¨÷Qy‘‘ÜV’Ayÿ¢¨óÊÞÇWíác¶þn>µUÀÜgg¿,×mYuObfL}gšû¬$k1ÍaÖ1Í#q`š£ÞG͹"Æ·všË ùºmŽÍQ÷Jè á·/ðÐhè¦#úù,k…l%³ 1 |ú=¤±80Pï#LŒÉ€‚)Ç0¯Šžá5µ'‹E¹^‡gÚáÁ«¾BÐÏ»á.¨æò–Åh‡1TÁØ
#s=AѾӯ#¿iá¬TÆþÃëež|Ú“†QPV©HS¨w¿ver¢Xækí—®~<û[׬#KW_m‰Ô+‘J°C ƒ:#ŒE‚@C]{²ŒHßh§³~wæüM·3G‡m9Iób_m@󊤒ìÒ Þ|úm¨‘ °us=¾ÓŸîÞEŒïWywqqvj':ûñ Ì7ƒÊ%?•©ÑA
‹µÁPá_ù™óœ˜ØûÆ»Õõ Î…~‰‰&Áº"15s_êb["_ø3yoÿ>ªendstream
endobj
-958 0 obj <<
+966 0 obj <<
/Type /Page
-/Contents 959 0 R
-/Resources 957 0 R
+/Contents 967 0 R
+/Resources 965 0 R
/MediaBox [0 0 595.2756 841.8898]
-/Parent 931 0 R
-/Annots [ 962 0 R 963 0 R 964 0 R 965 0 R 966 0 R 967 0 R 968 0 R 969 0 R 970 0 R 971 0 R 972 0 R 973 0 R 974 0 R 975 0 R 976 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R 1004 0 R 1005 0 R 1006 0 R 1007 0 R 1008 0 R 1009 0 R 1010 0 R 1011 0 R ]
+/Parent 939 0 R
+/Annots [ 970 0 R 971 0 R 972 0 R 973 0 R 974 0 R 975 0 R 976 0 R 977 0 R 978 0 R 979 0 R 980 0 R 981 0 R 982 0 R 983 0 R 984 0 R 985 0 R 986 0 R 987 0 R 988 0 R 989 0 R 990 0 R 991 0 R 992 0 R 993 0 R 994 0 R 995 0 R 996 0 R 997 0 R 998 0 R 999 0 R 1000 0 R 1001 0 R 1002 0 R 1003 0 R 1004 0 R 1005 0 R 1006 0 R 1007 0 R 1008 0 R 1009 0 R 1010 0 R 1011 0 R 1012 0 R 1013 0 R 1014 0 R 1015 0 R 1016 0 R 1017 0 R 1018 0 R 1019 0 R ]
>> endobj
-962 0 obj <<
+970 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 688.709 539.579 697.4212]
/Subtype /Link
/A << /S /GoTo /D (chapter.1) >>
>> endobj
-963 0 obj <<
+971 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 676.5858 539.579 685.5919]
/Subtype /Link
/A << /S /GoTo /D (section.1.1) >>
>> endobj
-964 0 obj <<
+972 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 664.4876 539.579 673.4937]
/Subtype /Link
/A << /S /GoTo /D (section.1.2) >>
>> endobj
-965 0 obj <<
+973 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 652.3894 539.579 661.3954]
/Subtype /Link
/A << /S /GoTo /D (section.1.3) >>
>> endobj
-966 0 obj <<
+974 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 640.2911 539.579 649.1477]
/Subtype /Link
/A << /S /GoTo /D (section.1.4) >>
>> endobj
-967 0 obj <<
+975 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 628.1929 539.579 637.0495]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.1) >>
>> endobj
-968 0 obj <<
+976 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 616.0946 539.579 624.9512]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.2) >>
>> endobj
-969 0 obj <<
+977 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 603.9964 539.579 612.853]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.3) >>
>> endobj
-970 0 obj <<
+978 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 591.7985 539.579 600.7547]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.4) >>
>> endobj
-971 0 obj <<
+979 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 579.7002 539.579 588.6565]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.1.4.4.1) >>
>> endobj
-972 0 obj <<
+980 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 567.6019 539.579 576.5582]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.1.4.4.2) >>
>> endobj
-973 0 obj <<
+981 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 555.5037 539.579 564.46]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.1.4.4.3) >>
>> endobj
-974 0 obj <<
+982 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 543.5051 539.579 552.5112]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.5) >>
>> endobj
-975 0 obj <<
+983 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 531.4069 539.579 540.413]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.1.4.5.1) >>
>> endobj
-976 0 obj <<
+984 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 519.3086 539.579 528.3147]
/Subtype /Link
/A << /S /GoTo /D (subsection.1.4.6) >>
>> endobj
-977 0 obj <<
+985 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 496.5559 539.579 505.288]
/Subtype /Link
/A << /S /GoTo /D (chapter.2) >>
>> endobj
-978 0 obj <<
+986 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 484.4775 539.579 493.4338]
/Subtype /Link
/A << /S /GoTo /D (section.2.1) >>
>> endobj
-979 0 obj <<
+987 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 472.3792 539.579 481.3355]
/Subtype /Link
/A << /S /GoTo /D (section.2.2) >>
>> endobj
-980 0 obj <<
+988 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 460.281 539.579 469.2373]
/Subtype /Link
/A << /S /GoTo /D (section.2.3) >>
>> endobj
-981 0 obj <<
+989 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 448.1827 539.579 457.139]
/Subtype /Link
/A << /S /GoTo /D (section.2.4) >>
>> endobj
-982 0 obj <<
+990 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 436.0845 539.579 445.0408]
/Subtype /Link
/A << /S /GoTo /D (section.2.5) >>
>> endobj
-983 0 obj <<
+991 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 413.5759 539.579 422.1635]
/Subtype /Link
/A << /S /GoTo /D (chapter.3) >>
>> endobj
-984 0 obj <<
+992 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 401.4527 539.579 410.3093]
/Subtype /Link
/A << /S /GoTo /D (section.3.1) >>
>> endobj
-985 0 obj <<
+993 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 389.3544 539.579 398.2111]
/Subtype /Link
/A << /S /GoTo /D (subsection.3.1.1) >>
>> endobj
-986 0 obj <<
+994 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 377.2562 539.579 386.1128]
/Subtype /Link
/A << /S /GoTo /D (subsection.3.1.2) >>
>> endobj
-987 0 obj <<
+995 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 365.0583 539.579 374.0146]
/Subtype /Link
/A << /S /GoTo /D (section.3.2) >>
>> endobj
-988 0 obj <<
+996 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 352.96 539.579 361.9163]
/Subtype /Link
/A << /S /GoTo /D (section.3.3) >>
>> endobj
-989 0 obj <<
+997 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 340.8618 539.579 349.818]
/Subtype /Link
/A << /S /GoTo /D (subsection.3.3.1) >>
>> endobj
-990 0 obj <<
+998 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 328.7635 539.579 337.7198]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.3.3.1.1) >>
>> endobj
-991 0 obj <<
+999 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [532.6051 316.6653 539.579 325.6216]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.3.3.1.2) >>
>> endobj
-992 0 obj <<
+1000 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 304.567 539.579 313.6728]
/Subtype /Link
/A << /S /GoTo /D (subsection.3.3.2) >>
>> endobj
-993 0 obj <<
+1001 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 281.9139 539.579 290.7706]
/Subtype /Link
/A << /S /GoTo /D (chapter.4) >>
>> endobj
-994 0 obj <<
+1002 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 269.8356 539.579 278.9413]
/Subtype /Link
/A << /S /GoTo /D (section.4.1) >>
>> endobj
-995 0 obj <<
+1003 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 257.7373 539.579 266.8431]
/Subtype /Link
/A << /S /GoTo /D (section.4.2) >>
>> endobj
-996 0 obj <<
+1004 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 245.6391 539.579 254.7448]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.2.1) >>
>> endobj
-997 0 obj <<
+1005 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 233.5408 539.579 242.6465]
/Subtype /Link
/A << /S /GoTo /D (section.4.3) >>
>> endobj
-998 0 obj <<
+1006 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 221.4426 539.579 230.5483]
/Subtype /Link
/A << /S /GoTo /D (section.4.4) >>
>> endobj
-999 0 obj <<
+1007 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 209.444 539.579 218.4501]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.4.1) >>
>> endobj
-1000 0 obj <<
+1008 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 197.2461 539.579 206.3518]
/Subtype /Link
/A << /S /GoTo /D (section.4.5) >>
>> endobj
-1001 0 obj <<
+1009 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 185.1478 539.579 194.1041]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.1) >>
>> endobj
-1002 0 obj <<
+1010 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 173.0496 539.579 182.0058]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.4.5.1.1) >>
>> endobj
-1003 0 obj <<
+1011 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 160.9513 539.579 169.9076]
/Subtype /Link
/A << /S /GoTo /D (subsubsection.4.5.1.2) >>
>> endobj
-1004 0 obj <<
+1012 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 148.8531 539.579 157.8094]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.2) >>
>> endobj
-1005 0 obj <<
+1013 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 136.7548 539.579 145.7111]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.3) >>
>> endobj
-1006 0 obj <<
+1014 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 124.7562 539.579 133.7623]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.4) >>
>> endobj
-1007 0 obj <<
+1015 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 112.658 539.579 121.6641]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.5) >>
>> endobj
-1008 0 obj <<
+1016 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 100.5597 539.579 109.5658]
/Subtype /Link
/A << /S /GoTo /D (subsection.4.5.6) >>
>> endobj
-1009 0 obj <<
+1017 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 88.4615 539.579 97.4676]
/Subtype /Link
/A << /S /GoTo /D (section.4.6) >>
>> endobj
-1010 0 obj <<
+1018 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 76.3632 539.579 85.2199]
/Subtype /Link
/A << /S /GoTo /D (section.4.7) >>
>> endobj
-1011 0 obj <<
+1019 0 obj <<
/Type /Annot
/Border[0 0 0]/H/I/C[1 0 0]
/Rect [527.6238 64.265 539.579 73.1216]
/Subtype /Link
/A << /S /GoTo /D (section.4.8) >>
>> endobj
-960 0 obj <<
-/D [958 0 R /XYZ 85.0394 794.5015 null]
+968 0 obj <<
+/D [966 0 R /XYZ 85.0394 794.5015 null]
>> endobj
-961 0 obj <<
-/D [958 0 R /XYZ 85.0394 711.9273 null]
+969 0 obj <<
+/D [966 0 R /XYZ 85.0394 711.9273 null]
>> endobj
-957 0 obj <<
-/Font << /F21 930 0 R /F22 953 0 R >>
+965 0 obj <<
+/Font << /F21 938 0 R /F22 961 0 R >>
/ProcSet [ /PDF /Text ]
>> endobj
-1014 0 obj <<
-/Length 3289
+1022 0 obj <<
+/Length 3273
/Filter /FlateDecode
>>
stream
-xÚímS#7Çßó)\uo ê¬=K/ Ëæ’ì²ÜÚ{UwI^8f\ñ1ö&äÓŸÆ3icMƒrû8©Z{ÚÝôÿçVK£±y¯ÿóž6Ìxá{Ö+¦®{ãÙAÑ»Ï}{À›súpRŸõÍðà/¥íyæ0½áûžÒš ½y1Ç
-çxoxñãáÉ›³áéÙppôóðûƒÓa|U왲zÉß~ü¹è]„ ¾?(˜ôN÷~¿Œ{/z³¥%ÓJJxdz08øW|AôìÆ4ù—ð‚ iDâOý)Õ“š÷¬öÌH!7ˆbŽñ£>Eqøm9/—£Õd~yÔº8ü¡¼½9ê;#ÙQ_‡ßåýG{±»R!ëVš6Ÿ;Ú,/{õÁ[¬Øõ±á®Z»¯_é%ÄN ~*ŠÒ;°¢,3Ea"+¢ae0¹œGPVWe}ðßÅ<ÙÂì‰!‰¬fƒ)b°jBv“ˆƒ"†ôÄHÍ´q>#bNóŸŠB\®—‘›A¹üP.«ÃåsE¥“Èc6#ÈbëD1’ˆƒb„ôny(9&"ŒjÒŠ)/΃ӓ¿×p¼¸f“q[Xnš'Fó‹úàx½ZÌÂxÕœK’²ê« SrÈJ¶äÈ’g]ènÉqP’“Þ¡,p:
‰MG(¡´MÇûåw‡‹YýÛd~SŽ×›‡š!fµ¨âǽ•¶t ˆR0`A(qP0ÞŒ÷LYé#ÐUl½çC5¨Ö×£U#ÿ¬\]-Âûßzù<Ƙ«\°!ÁÁ–©8hïÀ³L)‡Ø+¼\O§·Mµß.òn:ÌM€ro”~’
B'µl"!EVE˜n"qPDÞ«™
-½@$B5Dœ/'Bè¯n¯ýëâ?^l~^„&Ò:»o"ï éÌFR¨`¹(TqP¨Þ#™´®D4"gƒNÿƒ YL§‹zža±Ÿ’¦Ilf“‚)R°ZÂv“’ˆƒ"…ô¤hΤjgÌìÛN WÙ CЬÅA"ŠÒ;p C‡Áu;¸Ø†ƒ;É_ËÛdõÐÊ퇔˜Äl@!‰$é – ']Ä5€œ
NOäù‘‡Ço_'á¨ú0ÕïÎ_Yu8<
¿;÷„zOÈP¶úÈR+@©ŸˆƒRŸôêóÍ•Õ÷Z¢¨ØØ^šØÐrÔwÚ<Ù)¤*dHa€¥®ƒD¤wÀ L4áEÕ8>¹ËÁÓÆ R•2¤0ÀRP$â 0 ½7hÏw®8]˕ۙOqÁ2&,lHÀ°%C*Ú;À`ƒþÚ¶C5çår²¸€Æ±–·ß®Lq÷Ì/„v ͆R°`Á(XqP°ÞcZµ°È4DÄkXo·4oÞ
CU0~¿B³A† X$
-D ¤w¸ü©µf…óŒªÁÐw¯x|UPÜáúfÕ\Ëúøõh>º,gå|UÉaŸ$/h@ö²Ñ@†X
-D¤w¨J²ÂÄ9H0nºŽW“ÏÑtrög½-oÓЋõ¥ÐûuÍ4,ÐlX!Œ‚%é`‘œ²P-,MWr¼^…J1YV>”x«MhI´Ú÷"w4f#‚)D°LÂw#’ˆƒB„ô‡î˜÷Î#¼jÎ8iV»ÿV=TüTèâdy{½Zü: ÇÍ£7ëëëÅ2Œ2V=?p:‰¤fƒ)b°h1‰8(bHïPT
-ŠSÎa:¯g7õ¿¿'7“UY{ºG¼ÙóË
Kål‚!EVQÝ%â "½sa˜’\õT`ÉË8ªª(r¡ž|³žL/bóæºœ¯š…hnãvâãÓó¸ýºlž]Ì럯&óõáE¥ú2mhü#s%Ć„„[I”¼SÂT„„´÷VB'˜/¤ÅŠ¿ áàä¸>0EQl8XLGËI(!^Š/ZÎãßš$2¤”Ť”LÄA)Izoʹ²sñÒ7çÐ"n‹øÍwg/ê#_ÿø}²ºªªN¡îŒzý ¤,›†ÖŽ‚ "»oæHA¡@¹nßÓÚ1§
-‰`€²œØœ¿ÃD|s7•W®}wŸVmHJ¶ÜÈÒ'<¥8齕\æ
-ÔþÉÅ_¼ÕÂ