Vendor import of BIND 9.3.2 - src

diff options


context:
space:
mode:

author	Doug Barton <dougb@FreeBSD.org>	2005-12-29 04:22:58 +0000
committer	Doug Barton <dougb@FreeBSD.org>	2005-12-29 04:22:58 +0000
commit	a00aca3467ce973cd6d2414c81fd5e39559374b3 (patch)
tree	570b6e4f35462e81147786cc2f272d28fac7f470 /contrib/bind9/bin/named
parent	adaaaab975815edcabdc20da6c7f0ad57ca75402 (diff)

Notes

Diffstat (limited to 'contrib/bind9/bin/named')

-rw-r--r--

contrib/bind9/bin/named/aclconf.c

-rw-r--r--

contrib/bind9/bin/named/client.c

-rw-r--r--

contrib/bind9/bin/named/control.c

-rw-r--r--

contrib/bind9/bin/named/include/named/client.h

-rw-r--r--

contrib/bind9/bin/named/include/named/ns_smf_globals.h

-rw-r--r--

contrib/bind9/bin/named/log.c

-rw-r--r--

contrib/bind9/bin/named/lwresd.8

174

-rw-r--r--

contrib/bind9/bin/named/lwresd.docbook

-rw-r--r--

contrib/bind9/bin/named/lwresd.html

594

-rw-r--r--

contrib/bind9/bin/named/main.c

135

-rw-r--r--

contrib/bind9/bin/named/named.8

225

-rw-r--r--

contrib/bind9/bin/named/named.conf.5

493

-rw-r--r--

contrib/bind9/bin/named/named.conf.docbook

-rw-r--r--

contrib/bind9/bin/named/named.conf.html

2263

-rw-r--r--

contrib/bind9/bin/named/named.docbook

-rw-r--r--

contrib/bind9/bin/named/named.html

775

-rw-r--r--

contrib/bind9/bin/named/query.c

108

-rw-r--r--

contrib/bind9/bin/named/server.c

-rw-r--r--

contrib/bind9/bin/named/unix/os.c

-rw-r--r--

contrib/bind9/bin/named/update.c

-rw-r--r--

contrib/bind9/bin/named/xfrout.c

-rw-r--r--

contrib/bind9/bin/named/zoneconf.c

22 files changed, 1649 insertions, 3514 deletions

diff --git a/contrib/bind9/bin/named/aclconf.c b/contrib/bind9/bin/named/aclconf.c
index ef36c5681f48..8b6d0c767d4f 100644
--- a/contrib/bind9/bin/named/aclconf.c
+++ b/contrib/bind9/bin/named/aclconf.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: aclconf.c,v 1.27.12.3 2004/03/08 04:04:18 marka Exp $ */

+/* $Id: aclconf.c,v 1.27.12.5 2005/03/17 03:58:25 marka Exp $ */

#include <config.h>

@@ -31,6 +31,8 @@

#include <named/aclconf.h>

+#define LOOP_MAGIC ISC_MAGIC('L','O','O','P')

void

ns_aclconfctx_init(ns_aclconfctx_t *ctx) {

ISC_LIST_INIT(ctx->named_acl_cache);

@@ -81,6 +83,7 @@ convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,

isc_result_t result;

cfg_obj_t *cacl = NULL;

dns_acl_t *dacl;

+ dns_acl_t loop;

char *aclname = cfg_obj_asstring(nameobj);

/* Look for an already-converted version. */

@@ -89,6 +92,11 @@ convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,

dacl = ISC_LIST_NEXT(dacl, nextincache))

{

if (strcasecmp(aclname, dacl->name) == 0) {

+ if (ISC_MAGIC_VALID(dacl, LOOP_MAGIC)) {

+ cfg_obj_log(nameobj, dns_lctx, ISC_LOG_ERROR,

+ "acl loop detected: %s", aclname);

+ return (ISC_R_FAILURE);

+ }

dns_acl_attach(dacl, target);

return (ISC_R_SUCCESS);

}

@@ -100,7 +108,18 @@ convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,

"undefined ACL '%s'", aclname);

return (result);

}

+ /*

+ * Add a loop detection element.

+ */

+ memset(&loop, 0, sizeof(loop));

+ ISC_LINK_INIT(&loop, nextincache);

+ loop.name = aclname;

+ loop.magic = LOOP_MAGIC;

+ ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);

result = ns_acl_fromconfig(cacl, cctx, ctx, mctx, &dacl);

+ ISC_LIST_UNLINK(ctx->named_acl_cache, &loop, nextincache);

+ loop.magic = 0;

+ loop.name = NULL;

if (result != ISC_R_SUCCESS)

return (result);

dacl->name = isc_mem_strdup(dacl->mctx, aclname);

diff --git a/contrib/bind9/bin/named/client.c b/contrib/bind9/bin/named/client.c
index 259f8d9dc299..baecc2345cb9 100644
--- a/contrib/bind9/bin/named/client.c
+++ b/contrib/bind9/bin/named/client.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: client.c,v 1.176.2.13.4.23 2004/09/26 22:37:43 marka Exp $ */

+/* $Id: client.c,v 1.176.2.13.4.26 2005/07/27 02:53:14 marka Exp $ */

#include <config.h>

@@ -177,20 +177,10 @@ static void client_request(isc_task_t *task, isc_event_t *event);

static void ns_client_dumpmessage(ns_client_t *client, const char *reason);

void

-ns_client_recursing(ns_client_t *client, isc_boolean_t killoldest) {

- ns_client_t *oldest;

+ns_client_recursing(ns_client_t *client) {

REQUIRE(NS_CLIENT_VALID(client));

LOCK(&client->manager->lock);

- if (killoldest) {

- oldest = ISC_LIST_HEAD(client->manager->recursing);

- if (oldest != NULL) {

- ns_query_cancel(oldest);

- ISC_LIST_UNLINK(*oldest->list, oldest, link);

- ISC_LIST_APPEND(client->manager->active, oldest, link);

- oldest->list = &client->manager->active;

- }

ISC_LIST_UNLINK(*client->list, client, link);

ISC_LIST_APPEND(client->manager->recursing, client, link);

client->list = &client->manager->recursing;

@@ -198,6 +188,22 @@ ns_client_recursing(ns_client_t *client, isc_boolean_t killoldest) {

}

void

+ns_client_killoldestquery(ns_client_t *client) {

+ ns_client_t *oldest;

+ REQUIRE(NS_CLIENT_VALID(client));

+ LOCK(&client->manager->lock);

+ oldest = ISC_LIST_HEAD(client->manager->recursing);

+ if (oldest != NULL) {

+ ns_query_cancel(oldest);

+ ISC_LIST_UNLINK(*oldest->list, oldest, link);

+ ISC_LIST_APPEND(client->manager->active, oldest, link);

+ oldest->list = &client->manager->active;

+ }

+ UNLOCK(&client->manager->lock);

+void

ns_client_settimeout(ns_client_t *client, unsigned int seconds) {

isc_result_t result;

isc_interval_t interval;

@@ -1603,8 +1609,7 @@ client_timeout(isc_task_t *task, isc_event_t *event) {

}

static isc_result_t

-client_create(ns_clientmgr_t *manager, ns_client_t **clientp)

+client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {

ns_client_t *client;

isc_result_t result;

diff --git a/contrib/bind9/bin/named/control.c b/contrib/bind9/bin/named/control.c
index b6ff6fe2cbc8..c9d17abe0276 100644
--- a/contrib/bind9/bin/named/control.c
+++ b/contrib/bind9/bin/named/control.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: control.c,v 1.7.2.2.2.11 2004/09/03 03:43:31 marka Exp $ */

+/* $Id: control.c,v 1.7.2.2.2.14 2005/04/29 01:04:47 marka Exp $ */

#include <config.h>

@@ -37,6 +37,9 @@

#include <named/log.h>

#include <named/os.h>

#include <named/server.h>

+#ifdef HAVE_LIBSCF

+#include <named/ns_smf_globals.h>

+#endif

static isc_boolean_t

command_compare(const char *text, const char *command) {

@@ -58,6 +61,9 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {

isccc_sexpr_t *data;

char *command;

isc_result_t result;

+#ifdef HAVE_LIBSCF

+ ns_smf_want_disable = 0;

+#endif

data = isccc_alist_lookup(message, "_data");

if (data == NULL) {

@@ -92,11 +98,41 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {

} else if (command_compare(command, NS_COMMAND_RETRANSFER)) {

result = ns_server_retransfercommand(ns_g_server, command);

} else if (command_compare(command, NS_COMMAND_HALT)) {

+#ifdef HAVE_LIBSCF

+ /*

+ * If we are managed by smf(5), AND in chroot, then

+ * we cannot connect to the smf repository, so just

+ * return with an appropriate message back to rndc.

+ */

+ if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) {

+ result = ns_smf_add_message(text);

+ return (result);

+ }

+ /*

+ * If we are managed by smf(5) but not in chroot,

+ * try to disable ourselves the smf way.

+ */

+ if (ns_smf_got_instance == 1 && ns_smf_chroot == 0)

+ ns_smf_want_disable = 1;

+ /*

+ * If ns_smf_got_instance = 0, ns_smf_chroot

+ * is not relevant and we fall through to

+ * isc_app_shutdown below.

+ */

+#endif

ns_server_flushonshutdown(ns_g_server, ISC_FALSE);

ns_os_shutdownmsg(command, text);

isc_app_shutdown();

result = ISC_R_SUCCESS;

} else if (command_compare(command, NS_COMMAND_STOP)) {

+#ifdef HAVE_LIBSCF

+ if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) {

+ result = ns_smf_add_message(text);

+ return (result);

+ }

+ if (ns_smf_got_instance == 1 && ns_smf_chroot == 0)

+ ns_smf_want_disable = 1;

+#endif

ns_server_flushonshutdown(ns_g_server, ISC_TRUE);

ns_os_shutdownmsg(command, text);

isc_app_shutdown();

diff --git a/contrib/bind9/bin/named/include/named/client.h b/contrib/bind9/bin/named/include/named/client.h
index 97951a41683c..7097a3bb05b5 100644
--- a/contrib/bind9/bin/named/include/named/client.h
+++ b/contrib/bind9/bin/named/include/named/client.h

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: client.h,v 1.60.2.2.10.8 2004/07/23 02:56:52 marka Exp $ */

+/* $Id: client.h,v 1.60.2.2.10.10 2005/07/29 00:13:08 marka Exp $ */

#ifndef NAMED_CLIENT_H

#define NAMED_CLIENT_H 1

@@ -322,13 +322,19 @@ ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,

DNS_RDATACLASS_FORMATSIZE + sizeof(x) + sizeof("'/'"))

void

-ns_client_recursing(ns_client_t *client, isc_boolean_t killoldest);

-/*

+ns_client_recursing(ns_client_t *client);

+/*%

* Add client to end of recursing list. If 'killoldest' is true

* kill the oldest recursive client (list head).

void

+ns_client_killoldestquery(ns_client_t *client);

+/*%

+ * Kill the oldest recursive query (recursing list head).

+ */

+void

ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager);

* Dump the outstanding recursive queries to 'f'.

diff --git a/contrib/bind9/bin/named/include/named/ns_smf_globals.h b/contrib/bind9/bin/named/include/named/ns_smf_globals.h
new file mode 100644
index 000000000000..49aa31dc5c06
--- /dev/null
+++ b/contrib/bind9/bin/named/include/named/ns_smf_globals.h

@@ -0,0 +1,44 @@

+/*

+ *

+ * Permission to use, copy, modify, and distribute this software for any

+ * purpose with or without fee is hereby granted, provided that the above

+ * copyright notice and this permission notice appear in all copies.

+ *

+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

+ * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

+ * PERFORMANCE OF THIS SOFTWARE.

+ */

+/* $Id: ns_smf_globals.h,v 1.2.4.4 2005/05/13 01:22:33 marka Exp $ */

+#ifndef NS_SMF_GLOBALS_H

+#define NS_SMF_GLOBALS_H 1

+#include <libscf.h>

+#undef EXTERN

+#undef INIT

+#ifdef NS_MAIN

+#define EXTERN

+#define INIT(v) = (v)

+#else

+#define EXTERN extern

+#define INIT(v)

+#endif

+EXTERN unsigned int ns_smf_got_instance INIT(0);

+EXTERN unsigned int ns_smf_chroot INIT(0);

+EXTERN unsigned int ns_smf_want_disable INIT(0);

+isc_result_t ns_smf_add_message(isc_buffer_t *text);

+isc_result_t ns_smf_get_instance(char **name, int debug, isc_mem_t *mctx);

+#undef EXTERN

+#undef INIT

+#endif /* NS_SMF_GLOBALS_H */

diff --git a/contrib/bind9/bin/named/log.c b/contrib/bind9/bin/named/log.c
index 31af4bdd13c7..9032af795d4f 100644
--- a/contrib/bind9/bin/named/log.c
+++ b/contrib/bind9/bin/named/log.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: log.c,v 1.33.2.1.10.4 2004/03/08 09:04:14 marka Exp $ */

+/* $Id: log.c,v 1.33.2.1.10.6 2005/05/24 23:58:17 marka Exp $ */

#include <config.h>

@@ -154,6 +154,9 @@ ns_log_setdefaultchannels(isc_logconfig_t *lcfg) {

isc_result_t

ns_log_setsafechannels(isc_logconfig_t *lcfg) {

isc_result_t result;

+#if ISC_FACILITY != LOG_DAEMON

+ isc_logdestination_t destination;

+#endif

if (! ns_g_logstderr) {

result = isc_log_createchannel(lcfg, "default_debug",

@@ -172,6 +175,15 @@ ns_log_setsafechannels(isc_logconfig_t *lcfg) {

isc_log_setdebuglevel(ns_g_lctx, ns_g_debuglevel);

}

+#if ISC_FACILITY != LOG_DAEMON

+ destination.facility = ISC_FACILITY;

+ result = isc_log_createchannel(lcfg, "default_syslog",

+ ISC_LOG_TOSYSLOG, ISC_LOG_INFO,

+ &destination, 0);

+ if (result != ISC_R_SUCCESS)

+ goto cleanup;

+#endif

result = ISC_R_SUCCESS;

cleanup:

diff --git a/contrib/bind9/bin/named/lwresd.8 b/contrib/bind9/bin/named/lwresd.8
index bbc177d0ff69..58f24b062374 100644
--- a/contrib/bind9/bin/named/lwresd.8
+++ b/contrib/bind9/bin/named/lwresd.8

@@ -1,135 +1,135 @@

-.\"

+.\"

.\" Permission to use, copy, modify, and distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

.\" copyright notice and this permission notice appear in all copies.

-.\"

+.\"

.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: lwresd.8,v 1.13.208.2 2004/06/03 05:35:47 marka Exp $

+.\" $Id: lwresd.8,v 1.13.208.5 2005/10/13 02:33:47 marka Exp $

.\"

-.TH "LWRESD" "8" "June 30, 2000" "BIND9" ""

-.SH NAME

+.hy 0

+.ad l

+.\" ** You probably do not want to edit this file directly **

+.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).

+.\" Instead of manually editing it, you probably should edit the DocBook XML

+.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.

+.TH "LWRESD" "8" "June 30, 2000" "BIND9" "BIND9"

+.\" disable hyphenation

+.nh

+.\" disable justification (adjust text to left margin only)

+.ad l

+.SH "NAME"

lwresd \- lightweight resolver daemon

-.SH SYNOPSIS

-.sp

-\fBlwresd\fR [ \fB-C \fIconfig-file\fB\fR ] [ \fB-d \fIdebug-level\fB\fR ] [ \fB-f\fR ] [ \fB-g\fR ] [ \fB-i \fIpid-file\fB\fR ] [ \fB-n \fI#cpus\fB\fR ] [ \fB-P \fIport\fB\fR ] [ \fB-p \fIport\fB\fR ] [ \fB-s\fR ] [ \fB-t \fIdirectory\fB\fR ] [ \fB-u \fIuser\fB\fR ] [ \fB-v\fR ]

+.SH "SYNOPSIS"

+.HP 7

+\fBlwresd\fR [\fB\-C\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-i\ \fR\fB\fIpid\-file\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-P\ \fR\fB\fIport\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR]

.SH "DESCRIPTION"

.PP

-\fBlwresd\fR is the daemon providing name lookup

-services to clients that use the BIND 9 lightweight resolver

-library. It is essentially a stripped-down, caching-only name

-server that answers queries using the BIND 9 lightweight

-resolver protocol rather than the DNS protocol.

+\fBlwresd\fR

+is the daemon providing name lookup services to clients that use the BIND 9 lightweight resolver library. It is essentially a stripped\-down, caching\-only name server that answers queries using the BIND 9 lightweight resolver protocol rather than the DNS protocol.

.PP

-\fBlwresd\fR listens for resolver queries on a

-UDP port on the IPv4 loopback interface, 127.0.0.1. This

-means that \fBlwresd\fR can only be used by

-processes running on the local machine. By default UDP port

-number 921 is used for lightweight resolver requests and

-responses.

+\fBlwresd\fR

+listens for resolver queries on a UDP port on the IPv4 loopback interface, 127.0.0.1. This means that

+\fBlwresd\fR

+can only be used by processes running on the local machine. By default UDP port number 921 is used for lightweight resolver requests and responses.

.PP

-Incoming lightweight resolver requests are decoded by the

-server which then resolves them using the DNS protocol. When

-the DNS lookup completes, \fBlwresd\fR encodes

-the answers in the lightweight resolver format and returns

-them to the client that made the request.

+Incoming lightweight resolver requests are decoded by the server which then resolves them using the DNS protocol. When the DNS lookup completes,

+\fBlwresd\fR

+encodes the answers in the lightweight resolver format and returns them to the client that made the request.

.PP

-If \fI/etc/resolv.conf\fR contains any

-\fBnameserver\fR entries, \fBlwresd\fR

-sends recursive DNS queries to those servers. This is similar

-to the use of forwarders in a caching name server. If no

-\fBnameserver\fR entries are present, or if

-forwarding fails, \fBlwresd\fR resolves the

-queries autonomously starting at the root name servers, using

-a built-in list of root server hints.

+If

+\fI/etc/resolv.conf\fR

+contains any

+\fBnameserver\fR

+entries,

+\fBlwresd\fR

+sends recursive DNS queries to those servers. This is similar to the use of forwarders in a caching name server. If no

+\fBnameserver\fR

+entries are present, or if forwarding fails,

+\fBlwresd\fR

+resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints.

.SH "OPTIONS"

.TP

-\fB-C \fIconfig-file\fB\fR

-Use \fIconfig-file\fR as the

-configuration file instead of the default,

+\-C \fIconfig\-file\fR

+Use

+\fIconfig\-file\fR

+as the configuration file instead of the default,

\fI/etc/resolv.conf\fR.

.TP

-\fB-d \fIdebug-level\fB\fR

-Set the daemon's debug level to \fIdebug-level\fR.

-Debugging traces from \fBlwresd\fR become

-more verbose as the debug level increases.

+\-d \fIdebug\-level\fR

+Set the daemon's debug level to

+\fIdebug\-level\fR. Debugging traces from

+\fBlwresd\fR

+become more verbose as the debug level increases.

.TP

-\fB-f\fR

+\-f

Run the server in the foreground (i.e. do not daemonize).

.TP

-\fB-g\fR

-Run the server in the foreground and force all logging

-to \fIstderr\fR.

+\-g

+Run the server in the foreground and force all logging to

+\fIstderr\fR.

.TP

-\fB-n \fI#cpus\fB\fR

-Create \fI#cpus\fR worker threads

-to take advantage of multiple CPUs. If not specified,

-\fBlwresd\fR will try to determine the

-number of CPUs present and create one thread per CPU.

-If it is unable to determine the number of CPUs, a

-single worker thread will be created.

+\-n \fI#cpus\fR

+Create

+\fI#cpus\fR

+worker threads to take advantage of multiple CPUs. If not specified,

+\fBlwresd\fR

+will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.

.TP

-\fB-P \fIport\fB\fR

+\-P \fIport\fR

Listen for lightweight resolver queries on port

-\fIport\fR. If

-not specified, the default is port 921.

+\fIport\fR. If not specified, the default is port 921.

.TP

-\fB-p \fIport\fB\fR

-Send DNS lookups to port \fIport\fR. If not

-specified, the default is port 53. This provides a

-way of testing the lightweight resolver daemon with a

-name server that listens for queries on a non-standard

-port number.

+\-p \fIport\fR

+Send DNS lookups to port

+\fIport\fR. If not specified, the default is port 53. This provides a way of testing the lightweight resolver daemon with a name server that listens for queries on a non\-standard port number.

.TP

-\fB-s\fR

-Write memory usage statistics to \fIstdout\fR

+\-s

+Write memory usage statistics to

+\fIstdout\fR

on exit.

-.sp

.RS

.B "Note:"

-This option is mainly of interest to BIND 9 developers

-and may be removed or changed in a future release.

+This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.

.RE

-.sp

.TP

-\fB-t \fIdirectory\fB\fR

-\fBchroot()\fR to \fIdirectory\fR after

-processing the command line arguments, but before

-reading the configuration file.

-.sp

+\-t \fIdirectory\fR

+\fBchroot()\fR

+to

+\fIdirectory\fR

+after processing the command line arguments, but before reading the configuration file.

.RS

.B "Warning:"

This option should be used in conjunction with the

-\fB-u\fR option, as chrooting a process

-running as root doesn't enhance security on most

-systems; the way \fBchroot()\fR is

-defined allows a process with root privileges to

-escape a chroot jail.

+\fB\-u\fR

+option, as chrooting a process running as root doesn't enhance security on most systems; the way

+\fBchroot()\fR

+is defined allows a process with root privileges to escape a chroot jail.

.RE

-.sp

.TP

-\fB-u \fIuser\fB\fR

-\fBsetuid()\fR to \fIuser\fR after completing

-privileged operations, such as creating sockets that

-listen on privileged ports.

+\-u \fIuser\fR

+\fBsetuid()\fR

+to

+\fIuser\fR

+after completing privileged operations, such as creating sockets that listen on privileged ports.

.TP

-\fB-v\fR

+\-v

Report the version number and exit.

.SH "FILES"

.TP

-\fB\fI/etc/resolv.conf\fB\fR

+\fI/etc/resolv.conf\fR

The default configuration file.

.TP

-\fB\fI/var/run/lwresd.pid\fB\fR

-The default process-id file.

+\fI/var/run/lwresd.pid\fR

+The default process\-id file.

.SH "SEE ALSO"

.PP

\fBnamed\fR(8),

diff --git a/contrib/bind9/bin/named/lwresd.docbook b/contrib/bind9/bin/named/lwresd.docbook
index 46314c2614ea..c1f500bb8300 100644
--- a/contrib/bind9/bin/named/lwresd.docbook
+++ b/contrib/bind9/bin/named/lwresd.docbook

@@ -1,6 +1,8 @@

-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">

+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"

+ "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"

+ [<!ENTITY mdash "—">]>

<!--

- Permission to use, copy, modify, and distribute this software for any

@@ -16,7 +18,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

@@ -29,6 +31,19 @@

</refmeta>

+ <docinfo>

+ <copyright>

+ <year>2004</year>

+ <year>2005</year>

+ <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

+ </copyright>

+ <copyright>

+ <year>2000</year>

+ <year>2001</year>

+ <holder>Internet Software Consortium.</holder>

+ </copyright>

+ </docinfo>

<refname><application>lwresd</application></refname>

<refpurpose>lightweight resolver daemon</refpurpose>

diff --git a/contrib/bind9/bin/named/lwresd.html b/contrib/bind9/bin/named/lwresd.html
index afe7af22f480..439153aa826a 100644
--- a/contrib/bind9/bin/named/lwresd.html
+++ b/contrib/bind9/bin/named/lwresd.html

@@ -1,497 +1,189 @@

<!--

- -

+ -

- Permission to use, copy, modify, and distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- copyright notice and this permission notice appear in all copies.

- -

+ -

- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

- - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

-<HTML

-><HEAD

-><TITLE

->lwresd</TITLE

-><META

-NAME="GENERATOR"

-CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD

-><BODY

-CLASS="REFENTRY"

-BGCOLOR="#FFFFFF"

-TEXT="#000000"

-LINK="#0000FF"

-VLINK="#840084"

-ALINK="#0000FF"

-><H1

-><A

-NAME="AEN1"

-></A

-><SPAN

-CLASS="APPLICATION"

->lwresd</SPAN

-></H1

-><DIV

-CLASS="REFNAMEDIV"

-><A

-NAME="AEN9"

-></A

-><H2

->Name</H2

-><SPAN

-CLASS="APPLICATION"

->lwresd</SPAN

-> -- lightweight resolver daemon</DIV

-><DIV

-CLASS="REFSYNOPSISDIV"

-><A

-NAME="AEN13"

-></A

-><H2

->Synopsis</H2

-><P

-><B

-CLASS="COMMAND"

->lwresd</B

-> [<VAR

-CLASS="OPTION"

->-C <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-d <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-f</VAR

->] [<VAR

-CLASS="OPTION"

->-g</VAR

->] [<VAR

-CLASS="OPTION"

->-i <VAR

-CLASS="REPLACEABLE"

->pid-file</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-n <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-P <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-p <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-s</VAR

->] [<VAR

-CLASS="OPTION"

->-t <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-u <VAR

-CLASS="REPLACEABLE"

->user</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-v</VAR

->]</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN48"

-></A

-><H2

->DESCRIPTION</H2

-><P

-> <B

-CLASS="COMMAND"

->lwresd</B

-> is the daemon providing name lookup

+

+<html>

+<head>

+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

+<title>lwresd</title>

+<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">

+</head>

+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">

+<a name="id2463721"></a><div class="titlepage"></div>

+<div class="refnamediv">

+<h2>Name</h2>

+lwresd — lightweight resolver daemon

+</div>

+<div class="refsynopsisdiv">

+<h2>Synopsis</h2>

+<div class="cmdsynopsis"><code class="command">lwresd</code> [<code class="option">-C <code>config-file</code></code>] [<code class="option">-d <code>debug-level</code></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <code>pid-file</code></code>] [<code class="option">-n <code>#cpus</code></code>] [<code class="option">-P <code>port</code></code>] [<code class="option">-p <code>port</code></code>] [<code class="option">-s</code>] [<code class="option">-t <code>directory</code></code>] [<code class="option">-u <code>user</code></code>] [<code class="option">-v</code>]</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525920"></a><h2>DESCRIPTION</h2>

+

+ lwresd is the daemon providing name lookup

services to clients that use the BIND 9 lightweight resolver

library. It is essentially a stripped-down, caching-only name

server that answers queries using the BIND 9 lightweight

resolver protocol rather than the DNS protocol.

- </P

-><P

-> <B

-CLASS="COMMAND"

->lwresd</B

-> listens for resolver queries on a

+

+

+ lwresd listens for resolver queries on a

UDP port on the IPv4 loopback interface, 127.0.0.1. This

- means that <B

-CLASS="COMMAND"

->lwresd</B

-> can only be used by

+ means that lwresd can only be used by

processes running on the local machine. By default UDP port

number 921 is used for lightweight resolver requests and

responses.

- </P

-><P

-> Incoming lightweight resolver requests are decoded by the

+

+

+ Incoming lightweight resolver requests are decoded by the

server which then resolves them using the DNS protocol. When

- the DNS lookup completes, <B

-CLASS="COMMAND"

->lwresd</B

-> encodes

+ the DNS lookup completes, lwresd encodes

the answers in the lightweight resolver format and returns

them to the client that made the request.

- </P

-><P

-> If <TT

-CLASS="FILENAME"

->/etc/resolv.conf</TT

-> contains any

- <VAR

-CLASS="OPTION"

->nameserver</VAR

-> entries, <B

-CLASS="COMMAND"

->lwresd</B

+

+

+ If <code class="filename">/etc/resolv.conf</code> contains any

+ <code class="option">nameserver</code> entries, lwresd

sends recursive DNS queries to those servers. This is similar

to the use of forwarders in a caching name server. If no

- <VAR

-CLASS="OPTION"

->nameserver</VAR

-> entries are present, or if

- forwarding fails, <B

-CLASS="COMMAND"

->lwresd</B

-> resolves the

+ <code class="option">nameserver</code> entries are present, or if

+ forwarding fails, lwresd resolves the

queries autonomously starting at the root name servers, using

a built-in list of root server hints.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN63"

-></A

-><H2

->OPTIONS</H2

-><P

-></P

-><DIV

-CLASS="VARIABLELIST"

-><DL

-><DT

->-C <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-></DT

-><DD

-><P

-> Use <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-> as the

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525969"></a><h2>OPTIONS</h2>

+<div class="variablelist"><dl>

+<dt>-C <code>config-file</code></dt>

+<dd>

+ Use <code>config-file</code> as the

configuration file instead of the default,

- <TT

-CLASS="FILENAME"

->/etc/resolv.conf</TT

->.

- </P

-></DD

-><DT

->-d <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

-></DT

-><DD

-><P

-> Set the daemon's debug level to <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

->.

- Debugging traces from <B

-CLASS="COMMAND"

->lwresd</B

-> become

+ <code class="filename">/etc/resolv.conf</code>.

+ </dd>

+<dt>-d <code>debug-level</code></dt>

+<dd>

+ Set the daemon's debug level to <code>debug-level</code>.

+ Debugging traces from lwresd become

more verbose as the debug level increases.

- </P

-></DD

-><DT

->-f</DT

-><DD

-><P

-> Run the server in the foreground (i.e. do not daemonize).

- </P

-></DD

-><DT

->-g</DT

-><DD

-><P

-> Run the server in the foreground and force all logging

- to <TT

-CLASS="FILENAME"

->stderr</TT

->.

- </P

-></DD

-><DT

->-n <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-></DT

-><DD

-><P

-> Create <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-> worker threads

+ </dd>

+<dt>-f</dt>

+<dd>

+ Run the server in the foreground (i.e. do not daemonize).

+ </dd>

+<dt>-g</dt>

+<dd>

+ Run the server in the foreground and force all logging

+ to <code class="filename">stderr</code>.

+ </dd>

+<dt>-n <code>#cpus</code></dt>

+<dd>

+ Create <code>#cpus</code> worker threads

to take advantage of multiple CPUs. If not specified,

- <B

-CLASS="COMMAND"

->lwresd</B

-> will try to determine the

+ lwresd will try to determine the

number of CPUs present and create one thread per CPU.

If it is unable to determine the number of CPUs, a

single worker thread will be created.

- </P

-></DD

-><DT

->-P <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></DT

-><DD

-><P

-> Listen for lightweight resolver queries on port

- <VAR

-CLASS="REPLACEABLE"

->port</VAR

->. If

+ </dd>

+<dt>-P <code>port</code></dt>

+<dd>

+ Listen for lightweight resolver queries on port

+ <code>port</code>. If

not specified, the default is port 921.

- </P

-></DD

-><DT

->-p <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></DT

-><DD

-><P

-> Send DNS lookups to port <VAR

-CLASS="REPLACEABLE"

->port</VAR

->. If not

+ </dd>

+<dt>-p <code>port</code></dt>

+<dd>

+ Send DNS lookups to port <code>port</code>. If not

specified, the default is port 53. This provides a

way of testing the lightweight resolver daemon with a

name server that listens for queries on a non-standard

port number.

- </P

-></DD

-><DT

->-s</DT

-><DD

-><P

-> Write memory usage statistics to <TT

-CLASS="FILENAME"

->stdout</TT

+ </dd>

+<dt>-s</dt>

+<dd>

+

+ Write memory usage statistics to <code class="filename">stdout</code>

on exit.

- </P

-><DIV

-CLASS="NOTE"

-><BLOCKQUOTE

-CLASS="NOTE"

-><P

-><B

->Note: </B

-> This option is mainly of interest to BIND 9 developers

+

+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Note</h3>

+

+ This option is mainly of interest to BIND 9 developers

and may be removed or changed in a future release.

- </P

-></BLOCKQUOTE

-></DIV

-></DD

-><DT

->-t <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-></DT

-><DD

-><P

-> <CODE

-CLASS="FUNCTION"

->chroot()</CODE

-> to <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-> after

+

+</div>

+</dd>

+<dt>-t <code>directory</code></dt>

+<dd>

+

+ <code class="function">chroot()</code> to <code>directory</code> after

processing the command line arguments, but before

reading the configuration file.

- </P

-><DIV

-CLASS="WARNING"

-><P

-></P

-><TABLE

-CLASS="WARNING"

-BORDER="1"

-WIDTH="90%"

-><TR

-><TD

-ALIGN="CENTER"

-><B

->Warning</B

-></TD

-></TR

-><TR

-><TD

-ALIGN="LEFT"

-><P

-> This option should be used in conjunction with the

- <VAR

-CLASS="OPTION"

->-u</VAR

-> option, as chrooting a process

+

+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Warning</h3>

+

+ This option should be used in conjunction with the

+ <code class="option">-u</code> option, as chrooting a process

running as root doesn't enhance security on most

- systems; the way <CODE

-CLASS="FUNCTION"

->chroot()</CODE

-> is

+ systems; the way <code class="function">chroot()</code> is

defined allows a process with root privileges to

escape a chroot jail.

- </P

-></TD

-></TR

-></TABLE

-></DIV

-></DD

-><DT

->-u <VAR

-CLASS="REPLACEABLE"

->user</VAR

-></DT

-><DD

-><P

-> <CODE

-CLASS="FUNCTION"

->setuid()</CODE

-> to <VAR

-CLASS="REPLACEABLE"

->user</VAR

-> after completing

+

+</div>

+</dd>

+<dt>-u <code>user</code></dt>

+<dd>

+ <code class="function">setuid()</code> to <code>user</code> after completing

privileged operations, such as creating sockets that

listen on privileged ports.

- </P

-></DD

-><DT

->-v</DT

-><DD

-><P

-> Report the version number and exit.

- </P

-></DD

-></DL

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN137"

-></A

-><H2

->FILES</H2

-><P

-></P

-><DIV

-CLASS="VARIABLELIST"

-><DL

-><DT

-><TT

-CLASS="FILENAME"

->/etc/resolv.conf</TT

-></DT

-><DD

-><P

-> The default configuration file.

- </P

-></DD

-><DT

-><TT

-CLASS="FILENAME"

->/var/run/lwresd.pid</TT

-></DT

-><DD

-><P

-> The default process-id file.

- </P

-></DD

-></DL

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN150"

-></A

-><H2

->SEE ALSO</H2

-><P

-> <SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->named</SPAN

->(8)</SPAN

->,

- <SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->lwres</SPAN

->(3)</SPAN

->,

- <SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->resolver</SPAN

->(5)</SPAN

->.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN162"

-></A

-><H2

->AUTHOR</H2

-><P

-> Internet Systems Consortium

- </P

-></DIV

-></BODY

-></HTML

+ </dd>

+<dt>-v</dt>

+<dd>

+ Report the version number and exit.

+ </dd>

+</dl></div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526237"></a><h2>FILES</h2>

+<div class="variablelist"><dl>

+<dt><code class="filename">/etc/resolv.conf</code></dt>

+<dd>

+ The default configuration file.

+ </dd>

+<dt><code class="filename">/var/run/lwresd.pid</code></dt>

+<dd>

+ The default process-id file.

+ </dd>

+</dl></div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526277"></a><h2>SEE ALSO</h2>

+

+ named(8),

+ lwres(3),

+ resolver(5).

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526315"></a><h2>AUTHOR</h2>

+

+ Internet Systems Consortium

+

+</div>

+</div></body>

+</html>

diff --git a/contrib/bind9/bin/named/main.c b/contrib/bind9/bin/named/main.c
index f78ea247c8a7..c155291d6ca6 100644
--- a/contrib/bind9/bin/named/main.c
+++ b/contrib/bind9/bin/named/main.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: main.c,v 1.119.2.3.2.17 2004/10/25 00:42:54 marka Exp $ */

+/* $Id: main.c,v 1.119.2.3.2.22 2005/04/29 01:04:47 marka Exp $ */

#include <config.h>

@@ -47,10 +47,6 @@

#include <dst/result.h>

-#ifdef HAVE_LIBSCF

-#include <libscf.h>

-#endif

* Defining NS_MAIN provides storage declarations (rather than extern)

* for variables in named/globals.h.

@@ -66,6 +62,9 @@

#include <named/server.h>

#include <named/lwresd.h>

#include <named/main.h>

+#ifdef HAVE_LIBSCF

+#include <named/ns_smf_globals.h>

+#endif

* Include header files for database drivers here.

@@ -540,6 +539,9 @@ destroy_managers(void) {

static void

setup(void) {

isc_result_t result;

+#ifdef HAVE_LIBSCF

+ char *instance = NULL;

+#endif

* Get the user and group information before changing the root

@@ -555,6 +557,18 @@ setup(void) {

ns_os_opendevnull();

+#ifdef HAVE_LIBSCF

+ /* Check if named is under smf control, before chroot. */

+ result = ns_smf_get_instance(&instance, 0, ns_g_mctx);

+ /* We don't care about instance, just check if we got one. */

+ if (result == ISC_R_SUCCESS)

+ ns_smf_got_instance = 1;

+ else

+ ns_smf_got_instance = 0;

+ if (instance != NULL)

+ isc_mem_free(ns_g_mctx, instance);

+#endif /* HAVE_LIBSCF */

#ifdef PATH_RANDOMDEV

* Initialize system's random device as fallback entropy source

@@ -699,92 +713,73 @@ ns_main_setmemstats(const char *filename) {

#ifdef HAVE_LIBSCF

- * Get FMRI for the current named process

+ * Get FMRI for the named process.

-static char *

-scf_get_ins_name(void) {

+isc_result_t

+ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

scf_handle_t *h = NULL;

int namelen;

- char *ins_name;

+ char *instance;

+ REQUIRE(ins_name != NULL && *ins_name == NULL);

if ((h = scf_handle_create(SCF_VERSION)) == NULL) {

- UNEXPECTED_ERROR(__FILE__, __LINE__,

- "scf_handle_create() failed: %s",

- scf_strerror(scf_error()));

- return (NULL);

+ if (debug)

+ UNEXPECTED_ERROR(__FILE__, __LINE__,

+ "scf_handle_create() failed: %s",

+ scf_strerror(scf_error()));

+ return (ISC_R_FAILURE);

}

if (scf_handle_bind(h) == -1) {

- UNEXPECTED_ERROR(__FILE__, __LINE__,

- "scf_handle_bind() failed: %s",

- scf_strerror(scf_error()));

+ if (debug)

+ UNEXPECTED_ERROR(__FILE__, __LINE__,

+ "scf_handle_bind() failed: %s",

+ scf_strerror(scf_error()));

scf_handle_destroy(h);

- return (NULL);

+ return (ISC_R_FAILURE);

}

if ((namelen = scf_myname(h, NULL, 0)) == -1) {

- isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

- NS_LOGMODULE_MAIN, ISC_LOG_INFO,

- "scf_myname() failed: %s",

- scf_strerror(scf_error()));

+ if (debug)

+ UNEXPECTED_ERROR(__FILE__, __LINE__,

+ "scf_myname() failed: %s",

+ scf_strerror(scf_error()));

scf_handle_destroy(h);

- return (NULL);

+ return (ISC_R_FAILURE);

}

- if ((ins_name = malloc(namelen + 1)) == NULL) {

+ if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {

UNEXPECTED_ERROR(__FILE__, __LINE__,

- "scf_get_ins_named() memory "

+ "ns_smf_get_instance memory "

"allocation failed: %s",

isc_result_totext(ISC_R_NOMEMORY));

scf_handle_destroy(h);

- return (NULL);

+ return (ISC_R_FAILURE);

}

- if (scf_myname(h, ins_name, namelen + 1) == -1) {

- UNEXPECTED_ERROR(__FILE__, __LINE__,

- "scf_myname() failed: %s",

- scf_strerror(scf_error()));

+ if (scf_myname(h, instance, namelen + 1) == -1) {

+ if (debug)

+ UNEXPECTED_ERROR(__FILE__, __LINE__,

+ "scf_myname() failed: %s",

+ scf_strerror(scf_error()));

scf_handle_destroy(h);

- free(ins_name);

- return (NULL);

+ isc_mem_free(mctx, instance);

+ return (ISC_R_FAILURE);

}

scf_handle_destroy(h);

- isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,

- ISC_LOG_INFO, "instance name:%s", ins_name);

- return (ins_name);

-static void

-scf_cleanup(void) {

- char *s;

- char *ins_name;

- if ((ins_name = scf_get_ins_name()) != NULL) {

- if ((s = smf_get_state(ins_name)) != NULL) {

- if ((strcmp(SCF_STATE_STRING_ONLINE, s) == 0) ||

- (strcmp(SCF_STATE_STRING_DEGRADED, s) == 0)) {

- if (smf_disable_instance(ins_name, 0) != 0) {

- UNEXPECTED_ERROR(__FILE__, __LINE__,

- "smf_disable_instance() failed: %s",

- scf_strerror(scf_error()));

- }

- free(s);

- } else {

- UNEXPECTED_ERROR(__FILE__, __LINE__,

- "smf_get_state() failed: %s",

- scf_strerror(scf_error()));

- }

- free(ins_name);

- }

+ *ins_name = instance;

+ return (ISC_R_SUCCESS);

}

-#endif

+#endif /* HAVE_LIBSCF */

int

main(int argc, char *argv[]) {

isc_result_t result;

+#ifdef HAVE_LIBSCF

+ char *instance = NULL;

+#endif

* Record version in core image.

@@ -856,8 +851,20 @@ main(int argc, char *argv[]) {

} while (result != ISC_R_SUCCESS);

#ifdef HAVE_LIBSCF

- scf_cleanup();

-#endif

+ if (ns_smf_want_disable == 1) {

+ result = ns_smf_get_instance(&instance, 1, ns_g_mctx);

+ if (result == ISC_R_SUCCESS && instance != NULL) {

+ if (smf_disable_instance(instance, 0) != 0)

+ UNEXPECTED_ERROR(__FILE__, __LINE__,

+ "smf_disable_instance() ",

+ "failed for %s : %s",

+ instance,

+ scf_strerror(scf_error()));

+ }

+ if (instance != NULL)

+ isc_mem_free(ns_g_mctx, instance);

+ }

+#endif /* HAVE_LIBSCF */

cleanup();

diff --git a/contrib/bind9/bin/named/named.8 b/contrib/bind9/bin/named/named.8
index cd120ddc6f63..e072c169be3e 100644
--- a/contrib/bind9/bin/named/named.8
+++ b/contrib/bind9/bin/named/named.8

@@ -1,177 +1,182 @@

-.\"

+.\"

.\" Permission to use, copy, modify, and distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

.\" copyright notice and this permission notice appear in all copies.

-.\"

+.\"

.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: named.8,v 1.17.208.3 2004/06/03 05:35:47 marka Exp $

+.\" $Id: named.8,v 1.17.208.6 2005/10/13 02:33:46 marka Exp $

.\"

-.TH "NAMED" "8" "June 30, 2000" "BIND9" ""

-.SH NAME

+.hy 0

+.ad l

+.\" ** You probably do not want to edit this file directly **

+.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).

+.\" Instead of manually editing it, you probably should edit the DocBook XML

+.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.

+.TH "NAMED" "8" "June 30, 2000" "BIND9" "BIND9"

+.\" disable hyphenation

+.nh

+.\" disable justification (adjust text to left margin only)

+.ad l

+.SH "NAME"

named \- Internet domain name server

-.SH SYNOPSIS

-.sp

-\fBnamed\fR [ \fB-4\fR ] [ \fB-6\fR ] [ \fB-c \fIconfig-file\fB\fR ] [ \fB-d \fIdebug-level\fB\fR ] [ \fB-f\fR ] [ \fB-g\fR ] [ \fB-n \fI#cpus\fB\fR ] [ \fB-p \fIport\fB\fR ] [ \fB-s\fR ] [ \fB-t \fIdirectory\fB\fR ] [ \fB-u \fIuser\fB\fR ] [ \fB-v\fR ] [ \fB-x \fIcache-file\fB\fR ]

+.SH "SYNOPSIS"

+.HP 6

+\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]

.SH "DESCRIPTION"

.PP

-\fBnamed\fR is a Domain Name System (DNS) server,

-part of the BIND 9 distribution from ISC. For more

-information on the DNS, see RFCs 1033, 1034, and 1035.

+\fBnamed\fR

+is a Domain Name System (DNS) server, part of the BIND 9 distribution from ISC. For more information on the DNS, see RFCs 1033, 1034, and 1035.

.PP

-When invoked without arguments, \fBnamed\fR will

-read the default configuration file

-\fI/etc/named.conf\fR, read any initial

-data, and listen for queries.

+When invoked without arguments,

+\fBnamed\fR

+will read the default configuration file

+\fI/etc/named.conf\fR, read any initial data, and listen for queries.

.SH "OPTIONS"

.TP

-\fB-4\fR

+\-4

Use IPv4 only even if the host machine is capable of IPv6.

-\fB-4\fR and \fB-6\fR are mutually

-exclusive.

+\fB\-4\fR

+and

+\fB\-6\fR

+are mutually exclusive.

.TP

-\fB-6\fR

+\-6

Use IPv6 only even if the host machine is capable of IPv4.

-\fB-4\fR and \fB-6\fR are mutually

-exclusive.

+\fB\-4\fR

+and

+\fB\-6\fR

+are mutually exclusive.

.TP

-\fB-c \fIconfig-file\fB\fR

-Use \fIconfig-file\fR as the

-configuration file instead of the default,

-\fI/etc/named.conf\fR. To

-ensure that reloading the configuration file continues

-to work after the server has changed its working

-directory due to to a possible

-\fBdirectory\fR option in the configuration

-file, \fIconfig-file\fR should be

-an absolute pathname.

+\-c \fIconfig\-file\fR

+Use

+\fIconfig\-file\fR

+as the configuration file instead of the default,

+\fI/etc/named.conf\fR. To ensure that reloading the configuration file continues to work after the server has changed its working directory due to to a possible

+\fBdirectory\fR

+option in the configuration file,

+\fIconfig\-file\fR

+should be an absolute pathname.

.TP

-\fB-d \fIdebug-level\fB\fR

-Set the daemon's debug level to \fIdebug-level\fR.

-Debugging traces from \fBnamed\fR become

-more verbose as the debug level increases.

+\-d \fIdebug\-level\fR

+Set the daemon's debug level to

+\fIdebug\-level\fR. Debugging traces from

+\fBnamed\fR

+become more verbose as the debug level increases.

.TP

-\fB-f\fR

+\-f

Run the server in the foreground (i.e. do not daemonize).

.TP

-\fB-g\fR

-Run the server in the foreground and force all logging

-to \fIstderr\fR.

+\-g

+Run the server in the foreground and force all logging to

+\fIstderr\fR.

.TP

-\fB-n \fI#cpus\fB\fR

-Create \fI#cpus\fR worker threads

-to take advantage of multiple CPUs. If not specified,

-\fBnamed\fR will try to determine the

-number of CPUs present and create one thread per CPU.

-If it is unable to determine the number of CPUs, a

-single worker thread will be created.

+\-n \fI#cpus\fR

+Create

+\fI#cpus\fR

+worker threads to take advantage of multiple CPUs. If not specified,

+\fBnamed\fR

+will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.

.TP

-\fB-p \fIport\fB\fR

-Listen for queries on port \fIport\fR. If not

-specified, the default is port 53.

+\-p \fIport\fR

+Listen for queries on port

+\fIport\fR. If not specified, the default is port 53.

.TP

-\fB-s\fR

-Write memory usage statistics to \fIstdout\fR on exit.

-.sp

+\-s

+Write memory usage statistics to

+\fIstdout\fR

+on exit.

.RS

.B "Note:"

-This option is mainly of interest to BIND 9 developers

-and may be removed or changed in a future release.

+This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.

.RE

-.sp

.TP

-\fB-t \fIdirectory\fB\fR

-\fBchroot()\fR to \fIdirectory\fR after

-processing the command line arguments, but before

-reading the configuration file.

-.sp

+\-t \fIdirectory\fR

+\fBchroot()\fR

+to

+\fIdirectory\fR

+after processing the command line arguments, but before reading the configuration file.

.RS

.B "Warning:"

This option should be used in conjunction with the

-\fB-u\fR option, as chrooting a process

-running as root doesn't enhance security on most

-systems; the way \fBchroot()\fR is

-defined allows a process with root privileges to

-escape a chroot jail.

+\fB\-u\fR

+option, as chrooting a process running as root doesn't enhance security on most systems; the way

+\fBchroot()\fR

+is defined allows a process with root privileges to escape a chroot jail.

.RE

-.sp

.TP

-\fB-u \fIuser\fB\fR

-\fBsetuid()\fR to \fIuser\fR after completing

-privileged operations, such as creating sockets that

-listen on privileged ports.

-.sp

+\-u \fIuser\fR

+\fBsetuid()\fR

+to

+\fIuser\fR

+after completing privileged operations, such as creating sockets that listen on privileged ports.

.RS

.B "Note:"

-On Linux, \fBnamed\fR uses the kernel's

-capability mechanism to drop all root privileges

-except the ability to \fBbind()\fR to a

-privileged port and set process resource limits.

-Unfortunately, this means that the \fB-u\fR

-option only works when \fBnamed\fR is run

-on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or

-later, since previous kernels did not allow privileges

-to be retained after \fBsetuid()\fR.

+On Linux,

+\fBnamed\fR

+uses the kernel's capability mechanism to drop all root privileges except the ability to

+\fBbind()\fR

+to a privileged port and set process resource limits. Unfortunately, this means that the

+\fB\-u\fR

+option only works when

+\fBnamed\fR

+is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after

+\fBsetuid()\fR.

.RE

-.sp

.TP

-\fB-v\fR

+\-v

Report the version number and exit.

.TP

-\fB-x \fIcache-file\fB\fR

-Load data from \fIcache-file\fR into the

-cache of the default view.

-.sp

+\-x \fIcache\-file\fR

+Load data from

+\fIcache\-file\fR

+into the cache of the default view.

.RS

.B "Warning:"

-This option must not be used. It is only of interest

-to BIND 9 developers and may be removed or changed in a

-future release.

+This option must not be used. It is only of interest to BIND 9 developers and may be removed or changed in a future release.

.RE

-.sp

.SH "SIGNALS"

.PP

-In routine operation, signals should not be used to control

-the nameserver; \fBrndc\fR should be used

-instead.

+In routine operation, signals should not be used to control the nameserver;

+\fBrndc\fR

+should be used instead.

.TP

-\fBSIGHUP\fR

+SIGHUP

Force a reload of the server.

.TP

-\fBSIGINT, SIGTERM\fR

+SIGINT, SIGTERM

Shut down the server.

.PP

The result of sending any other signals to the server is undefined.

-.PP

.SH "CONFIGURATION"

.PP

-The \fBnamed\fR configuration file is too complex

-to describe in detail here. A complete description is

-provided in the \fIBIND 9 Administrator Reference

-Manual\fR.

+The

+\fBnamed\fR

+configuration file is too complex to describe in detail here. A complete description is provided in the

+BIND 9 Administrator Reference Manual.

.SH "FILES"

.TP

-\fB\fI/etc/named.conf\fB\fR

+\fI/etc/named.conf\fR

The default configuration file.

.TP

-\fB\fI/var/run/named.pid\fB\fR

-The default process-id file.

+\fI/var/run/named.pid\fR

+The default process\-id file.

.SH "SEE ALSO"

.PP

-\fIRFC 1033\fR,

-\fIRFC 1034\fR,

-\fIRFC 1035\fR,

+RFC 1033,

+RFC 1034,

+RFC 1035,

\fBrndc\fR(8),

\fBlwresd\fR(8),

-\fIBIND 9 Administrator Reference Manual\fR.

+BIND 9 Administrator Reference Manual.

.SH "AUTHOR"

.PP

Internet Systems Consortium

diff --git a/contrib/bind9/bin/named/named.conf.5 b/contrib/bind9/bin/named/named.conf.5
index 2b7387b9555c..d0b690b1b5a0 100644
--- a/contrib/bind9/bin/named/named.conf.5
+++ b/contrib/bind9/bin/named/named.conf.5

@@ -1,32 +1,40 @@

-.\"

+.\"

.\" Permission to use, copy, modify, and distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

.\" copyright notice and this permission notice appear in all copies.

-.\"

+.\"

.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

-.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+.\" AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: named.conf.5,v 1.1.4.3 2004/10/18 02:33:06 marka Exp $

+.\" $Id: named.conf.5,v 1.1.4.6 2005/10/13 02:33:47 marka Exp $

.\"

-.TH "NAMED.CONF" "5" "Aug 13, 2004" "BIND9" ""

-.SH NAME

+.hy 0

+.ad l

+.\" ** You probably do not want to edit this file directly **

+.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).

+.\" Instead of manually editing it, you probably should edit the DocBook XML

+.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.

+.TH "\\FINAMED.CONF\\FR" "5" "Aug 13, 2004" "BIND9" "BIND9"

+.\" disable hyphenation

+.nh

+.\" disable justification (adjust text to left margin only)

+.ad l

+.SH "NAME"

named.conf \- configuration file for named

-.SH SYNOPSIS

-.sp

+.SH "SYNOPSIS"

+.HP 11

\fBnamed.conf\fR

.SH "DESCRIPTION"

.PP

-\fInamed.conf\fR is the configuration file for

-\fBnamed\fR. Statements are enclosed

-in braces and terminated with a semi-colon. Clauses in

-the statements are also semi-colon terminated. The usual

-comment styles are supported:

+\fInamed.conf\fR

+is the configuration file for

+\fBnamed\fR. Statements are enclosed in braces and terminated with a semi\-colon. Clauses in the statements are also semi\-colon terminated. The usual comment styles are supported:

.PP

C style: /* */

.PP

@@ -37,7 +45,6 @@ Unix style: # to end of line

.sp

.nf

acl \fIstring\fR { \fIaddress_match_element\fR; ... };

-.sp

.fi

.SH "KEY"

.sp

@@ -46,7 +53,6 @@ key \fIdomain_name\fR {

algorithm \fIstring\fR;

secret \fIstring\fR;

};

-.sp

.fi

.SH "MASTERS"

.sp

@@ -55,7 +61,6 @@ masters \fIstring\fR [ port \fIinteger\fR ] {

( \fImasters\fR | \fIipv4_address\fR [port \fIinteger\fR] |

\fIipv6_address\fR [port \fIinteger\fR] ) [ key \fIstring\fR ]; ...

};

-.sp

.fi

.SH "SERVER"

.sp

@@ -63,27 +68,24 @@ masters \fIstring\fR [ port \fIinteger\fR ] {

server ( \fIipv4_address\fR | \fIipv6_address\fR ) {

bogus \fIboolean\fR;

edns \fIboolean\fR;

- provide-ixfr \fIboolean\fR;

- request-ixfr \fIboolean\fR;

+ provide\-ixfr \fIboolean\fR;

+ request\-ixfr \fIboolean\fR;

keys \fIserver_key\fR;

transfers \fIinteger\fR;

- transfer-format ( many-answers | one-answer );

- transfer-source ( \fIipv4_address\fR | * )

+ transfer\-format ( many\-answers | one\-answer );

+ transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- transfer-source-v6 ( \fIipv6_address\fR | * )

+ transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- support-ixfr \fIboolean\fR; // obsolete

+ support\-ixfr \fIboolean\fR; // obsolete

};

-.sp

.fi

-.SH "TRUSTED-KEYS"

+.SH "TRUSTED\-KEYS"

.sp

.nf

-trusted-keys {

+trusted\-keys {

\fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ...

};

-.sp

.fi

.SH "CONTROLS"

.sp

@@ -95,7 +97,6 @@ controls {

[ keys { \fIstring\fR; ... } ];

unix \fIunsupported\fR; // not implemented

};

-.sp

.fi

.SH "LOGGING"

.sp

@@ -107,363 +108,325 @@ logging {

null;

stderr;

severity \fIlog_severity\fR;

- print-time \fIboolean\fR;

- print-severity \fIboolean\fR;

- print-category \fIboolean\fR;

+ print\-time \fIboolean\fR;

+ print\-severity \fIboolean\fR;

+ print\-category \fIboolean\fR;

};

category \fIstring\fR { \fIstring\fR; ... };

};

-.sp

.fi

.SH "LWRES"

.sp

.nf

lwres {

- listen-on [ port \fIinteger\fR ] {

+ listen\-on [ port \fIinteger\fR ] {

( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ...

};

view \fIstring\fR \fIoptional_class\fR;

search { \fIstring\fR; ... };

ndots \fIinteger\fR;

};

-.sp

.fi

.SH "OPTIONS"

.sp

.nf

options {

- avoid-v4-udp-ports { \fIport\fR; ... };

- avoid-v6-udp-ports { \fIport\fR; ... };

+ avoid\-v4\-udp\-ports { \fIport\fR; ... };

+ avoid\-v6\-udp\-ports { \fIport\fR; ... };

blackhole { \fIaddress_match_element\fR; ... };

coresize \fIsize\fR;

datasize \fIsize\fR;

directory \fIquoted_string\fR;

- dump-file \fIquoted_string\fR;

+ dump\-file \fIquoted_string\fR;

files \fIsize\fR;

- heartbeat-interval \fIinteger\fR;

- host-statistics \fIboolean\fR; // not implemented

- host-statistics-max \fInumber\fR; // not implemented

+ heartbeat\-interval \fIinteger\fR;

+ host\-statistics \fIboolean\fR; // not implemented

+ host\-statistics\-max \fInumber\fR; // not implemented

hostname ( \fIquoted_string\fR | none );

- interface-interval \fIinteger\fR;

- listen-on [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... };

- listen-on-v6 [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... };

- match-mapped-addresses \fIboolean\fR;

- memstatistics-file \fIquoted_string\fR;

- pid-file ( \fIquoted_string\fR | none );

+ interface\-interval \fIinteger\fR;

+ listen\-on [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... };

+ listen\-on\-v6 [ port \fIinteger\fR ] { \fIaddress_match_element\fR; ... };

+ match\-mapped\-addresses \fIboolean\fR;

+ memstatistics\-file \fIquoted_string\fR;

+ pid\-file ( \fIquoted_string\fR | none );

port \fIinteger\fR;

querylog \fIboolean\fR;

- recursing-file \fIquoted_string\fR;

- random-device \fIquoted_string\fR;

- recursive-clients \fIinteger\fR;

- serial-query-rate \fIinteger\fR;

- server-id ( \fIquoted_string\fR | none |;

+ recursing\-file \fIquoted_string\fR;

+ random\-device \fIquoted_string\fR;

+ recursive\-clients \fIinteger\fR;

+ serial\-query\-rate \fIinteger\fR;

+ server\-id ( \fIquoted_string\fR | none |;

stacksize \fIsize\fR;

- statistics-file \fIquoted_string\fR;

- statistics-interval \fIinteger\fR; // not yet implemented

- tcp-clients \fIinteger\fR;

- tcp-listen-queue \fIinteger\fR;

- tkey-dhkey \fIquoted_string\fR \fIinteger\fR;

- tkey-gssapi-credential \fIquoted_string\fR;

- tkey-domain \fIquoted_string\fR;

- transfers-per-ns \fIinteger\fR;

- transfers-in \fIinteger\fR;

- transfers-out \fIinteger\fR;

- use-ixfr \fIboolean\fR;

+ statistics\-file \fIquoted_string\fR;

+ statistics\-interval \fIinteger\fR; // not yet implemented

+ tcp\-clients \fIinteger\fR;

+ tcp\-listen\-queue \fIinteger\fR;

+ tkey\-dhkey \fIquoted_string\fR \fIinteger\fR;

+ tkey\-gssapi\-credential \fIquoted_string\fR;

+ tkey\-domain \fIquoted_string\fR;

+ transfers\-per\-ns \fIinteger\fR;

+ transfers\-in \fIinteger\fR;

+ transfers\-out \fIinteger\fR;

+ use\-ixfr \fIboolean\fR;

version ( \fIquoted_string\fR | none );

- allow-recursion { \fIaddress_match_element\fR; ... };

+ allow\-recursion { \fIaddress_match_element\fR; ... };

sortlist { \fIaddress_match_element\fR; ... };

topology { \fIaddress_match_element\fR; ... }; // not implemented

- auth-nxdomain \fIboolean\fR; // default changed

- minimal-responses \fIboolean\fR;

+ auth\-nxdomain \fIboolean\fR; // default changed

+ minimal\-responses \fIboolean\fR;

recursion \fIboolean\fR;

- rrset-order {

+ rrset\-order {

[ class \fIstring\fR ] [ type \fIstring\fR ]

[ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; ...

};

- provide-ixfr \fIboolean\fR;

- request-ixfr \fIboolean\fR;

- rfc2308-type1 \fIboolean\fR; // not yet implemented

- additional-from-auth \fIboolean\fR;

- additional-from-cache \fIboolean\fR;

- query-source \fIquerysource4\fR;

- query-source-v6 \fIquerysource6\fR;

- cleaning-interval \fIinteger\fR;

- min-roots \fIinteger\fR; // not implemented

- lame-ttl \fIinteger\fR;

- max-ncache-ttl \fIinteger\fR;

- max-cache-ttl \fIinteger\fR;

- transfer-format ( many-answers | one-answer );

- max-cache-size \fIsize_no_default\fR;

- check-names ( master | slave | response )

+ provide\-ixfr \fIboolean\fR;

+ request\-ixfr \fIboolean\fR;

+ rfc2308\-type1 \fIboolean\fR; // not yet implemented

+ additional\-from\-auth \fIboolean\fR;

+ additional\-from\-cache \fIboolean\fR;

+ query\-source \fIquerysource4\fR;

+ query\-source\-v6 \fIquerysource6\fR;

+ cleaning\-interval \fIinteger\fR;

+ min\-roots \fIinteger\fR; // not implemented

+ lame\-ttl \fIinteger\fR;

+ max\-ncache\-ttl \fIinteger\fR;

+ max\-cache\-ttl \fIinteger\fR;

+ transfer\-format ( many\-answers | one\-answer );

+ max\-cache\-size \fIsize_no_default\fR;

+ check\-names ( master | slave | response )

( fail | warn | ignore );

- cache-file \fIquoted_string\fR;

- suppress-initial-notify \fIboolean\fR; // not yet implemented

- preferred-glue \fIstring\fR;

- dual-stack-servers [ port \fIinteger\fR ] {

+ cache\-file \fIquoted_string\fR;

+ suppress\-initial\-notify \fIboolean\fR; // not yet implemented

+ preferred\-glue \fIstring\fR;

+ dual\-stack\-servers [ port \fIinteger\fR ] {

( \fIquoted_string\fR [port \fIinteger\fR] |

\fIipv4_address\fR [port \fIinteger\fR] |

\fIipv6_address\fR [port \fIinteger\fR] ); ...

}

- edns-udp-size \fIinteger\fR;

- root-delegation-only [ exclude { \fIquoted_string\fR; ... } ];

- disable-algorithms \fIstring\fR { \fIstring\fR; ... };

- dnssec-enable \fIboolean\fR;

- dnssec-lookaside \fIstring\fR trust-anchor \fIstring\fR;

- dnssec-must-be-secure \fIstring\fR \fIboolean\fR;

+ edns\-udp\-size \fIinteger\fR;

+ root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ];

+ disable\-algorithms \fIstring\fR { \fIstring\fR; ... };

+ dnssec\-enable \fIboolean\fR;

+ dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;

+ dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;

dialup \fIdialuptype\fR;

- ixfr-from-differences \fIixfrdiff\fR;

- allow-query { \fIaddress_match_element\fR; ... };

- allow-transfer { \fIaddress_match_element\fR; ... };

- allow-update-forwarding { \fIaddress_match_element\fR; ... };

+ ixfr\-from\-differences \fIixfrdiff\fR;

+ allow\-query { \fIaddress_match_element\fR; ... };

+ allow\-transfer { \fIaddress_match_element\fR; ... };

+ allow\-update\-forwarding { \fIaddress_match_element\fR; ... };

notify \fInotifytype\fR;

- notify-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- notify-source-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- also-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

+ notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

[ port \fIinteger\fR ]; ... };

- allow-notify { \fIaddress_match_element\fR; ... };

+ allow\-notify { \fIaddress_match_element\fR; ... };

forward ( first | only );

forwarders [ port \fIinteger\fR ] {

( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ...

};

- max-journal-size \fIsize_no_default\fR;

- max-transfer-time-in \fIinteger\fR;

- max-transfer-time-out \fIinteger\fR;

- max-transfer-idle-in \fIinteger\fR;

- max-transfer-idle-out \fIinteger\fR;

- max-retry-time \fIinteger\fR;

- min-retry-time \fIinteger\fR;

- max-refresh-time \fIinteger\fR;

- min-refresh-time \fIinteger\fR;

- multi-master \fIboolean\fR;

- sig-validity-interval \fIinteger\fR;

- transfer-source ( \fIipv4_address\fR | * )

+ max\-journal\-size \fIsize_no_default\fR;

+ max\-transfer\-time\-in \fIinteger\fR;

+ max\-transfer\-time\-out \fIinteger\fR;

+ max\-transfer\-idle\-in \fIinteger\fR;

+ max\-transfer\-idle\-out \fIinteger\fR;

+ max\-retry\-time \fIinteger\fR;

+ min\-retry\-time \fIinteger\fR;

+ max\-refresh\-time \fIinteger\fR;

+ min\-refresh\-time \fIinteger\fR;

+ multi\-master \fIboolean\fR;

+ sig\-validity\-interval \fIinteger\fR;

+ transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- transfer-source-v6 ( \fIipv6_address\fR | * )

+ transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source ( \fIipv4_address\fR | * )

+ alt\-transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source-v6 ( \fIipv6_address\fR | * )

+ alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- use-alt-transfer-source \fIboolean\fR;

- zone-statistics \fIboolean\fR;

- key-directory \fIquoted_string\fR;

- allow-v6-synthesis { \fIaddress_match_element\fR; ... }; // obsolete

- deallocate-on-exit \fIboolean\fR; // obsolete

- fake-iquery \fIboolean\fR; // obsolete

- fetch-glue \fIboolean\fR; // obsolete

- has-old-clients \fIboolean\fR; // obsolete

- maintain-ixfr-base \fIboolean\fR; // obsolete

- max-ixfr-log-size \fIsize\fR; // obsolete

- multiple-cnames \fIboolean\fR; // obsolete

- named-xfer \fIquoted_string\fR; // obsolete

- serial-queries \fIinteger\fR; // obsolete

- treat-cr-as-space \fIboolean\fR; // obsolete

- use-id-pool \fIboolean\fR; // obsolete

+ use\-alt\-transfer\-source \fIboolean\fR;

+ zone\-statistics \fIboolean\fR;

+ key\-directory \fIquoted_string\fR;

+ allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete

+ deallocate\-on\-exit \fIboolean\fR; // obsolete

+ fake\-iquery \fIboolean\fR; // obsolete

+ fetch\-glue \fIboolean\fR; // obsolete

+ has\-old\-clients \fIboolean\fR; // obsolete

+ maintain\-ixfr\-base \fIboolean\fR; // obsolete

+ max\-ixfr\-log\-size \fIsize\fR; // obsolete

+ multiple\-cnames \fIboolean\fR; // obsolete

+ named\-xfer \fIquoted_string\fR; // obsolete

+ serial\-queries \fIinteger\fR; // obsolete

+ treat\-cr\-as\-space \fIboolean\fR; // obsolete

+ use\-id\-pool \fIboolean\fR; // obsolete

};

-.sp

.fi

.SH "VIEW"

.sp

.nf

view \fIstring\fR \fIoptional_class\fR {

- match-clients { \fIaddress_match_element\fR; ... };

- match-destinations { \fIaddress_match_element\fR; ... };

- match-recursive-only \fIboolean\fR;

+ match\-clients { \fIaddress_match_element\fR; ... };

+ match\-destinations { \fIaddress_match_element\fR; ... };

+ match\-recursive\-only \fIboolean\fR;

key \fIstring\fR {

algorithm \fIstring\fR;

secret \fIstring\fR;

};

zone \fIstring\fR \fIoptional_class\fR {

...

};

server ( \fIipv4_address\fR | \fIipv6_address\fR ) {

...

};

- trusted-keys {

+ trusted\-keys {

\fIstring\fR \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; ...

};

- allow-recursion { \fIaddress_match_element\fR; ... };

+ allow\-recursion { \fIaddress_match_element\fR; ... };

sortlist { \fIaddress_match_element\fR; ... };

topology { \fIaddress_match_element\fR; ... }; // not implemented

- auth-nxdomain \fIboolean\fR; // default changed

- minimal-responses \fIboolean\fR;

+ auth\-nxdomain \fIboolean\fR; // default changed

+ minimal\-responses \fIboolean\fR;

recursion \fIboolean\fR;

- rrset-order {

+ rrset\-order {

[ class \fIstring\fR ] [ type \fIstring\fR ]

[ name \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; ...

};

- provide-ixfr \fIboolean\fR;

- request-ixfr \fIboolean\fR;

- rfc2308-type1 \fIboolean\fR; // not yet implemented

- additional-from-auth \fIboolean\fR;

- additional-from-cache \fIboolean\fR;

- query-source \fIquerysource4\fR;

- query-source-v6 \fIquerysource6\fR;

- cleaning-interval \fIinteger\fR;

- min-roots \fIinteger\fR; // not implemented

- lame-ttl \fIinteger\fR;

- max-ncache-ttl \fIinteger\fR;

- max-cache-ttl \fIinteger\fR;

- transfer-format ( many-answers | one-answer );

- max-cache-size \fIsize_no_default\fR;

- check-names ( master | slave | response )

+ provide\-ixfr \fIboolean\fR;

+ request\-ixfr \fIboolean\fR;

+ rfc2308\-type1 \fIboolean\fR; // not yet implemented

+ additional\-from\-auth \fIboolean\fR;

+ additional\-from\-cache \fIboolean\fR;

+ query\-source \fIquerysource4\fR;

+ query\-source\-v6 \fIquerysource6\fR;

+ cleaning\-interval \fIinteger\fR;

+ min\-roots \fIinteger\fR; // not implemented

+ lame\-ttl \fIinteger\fR;

+ max\-ncache\-ttl \fIinteger\fR;

+ max\-cache\-ttl \fIinteger\fR;

+ transfer\-format ( many\-answers | one\-answer );

+ max\-cache\-size \fIsize_no_default\fR;

+ check\-names ( master | slave | response )

( fail | warn | ignore );

- cache-file \fIquoted_string\fR;

- suppress-initial-notify \fIboolean\fR; // not yet implemented

- preferred-glue \fIstring\fR;

- dual-stack-servers [ port \fIinteger\fR ] {

+ cache\-file \fIquoted_string\fR;

+ suppress\-initial\-notify \fIboolean\fR; // not yet implemented

+ preferred\-glue \fIstring\fR;

+ dual\-stack\-servers [ port \fIinteger\fR ] {

( \fIquoted_string\fR [port \fIinteger\fR] |

\fIipv4_address\fR [port \fIinteger\fR] |

\fIipv6_address\fR [port \fIinteger\fR] ); ...

};

- edns-udp-size \fIinteger\fR;

- root-delegation-only [ exclude { \fIquoted_string\fR; ... } ];

- disable-algorithms \fIstring\fR { \fIstring\fR; ... };

- dnssec-enable \fIboolean\fR;

- dnssec-lookaside \fIstring\fR trust-anchor \fIstring\fR;

- dnssec-must-be-secure \fIstring\fR \fIboolean\fR;

+ edns\-udp\-size \fIinteger\fR;

+ root\-delegation\-only [ exclude { \fIquoted_string\fR; ... } ];

+ disable\-algorithms \fIstring\fR { \fIstring\fR; ... };

+ dnssec\-enable \fIboolean\fR;

+ dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;

+ dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;

dialup \fIdialuptype\fR;

- ixfr-from-differences \fIixfrdiff\fR;

- allow-query { \fIaddress_match_element\fR; ... };

- allow-transfer { \fIaddress_match_element\fR; ... };

- allow-update-forwarding { \fIaddress_match_element\fR; ... };

+ ixfr\-from\-differences \fIixfrdiff\fR;

+ allow\-query { \fIaddress_match_element\fR; ... };

+ allow\-transfer { \fIaddress_match_element\fR; ... };

+ allow\-update\-forwarding { \fIaddress_match_element\fR; ... };

notify \fInotifytype\fR;

- notify-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- notify-source-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- also-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

+ notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

[ port \fIinteger\fR ]; ... };

- allow-notify { \fIaddress_match_element\fR; ... };

+ allow\-notify { \fIaddress_match_element\fR; ... };

forward ( first | only );

forwarders [ port \fIinteger\fR ] {

( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ...

};

- max-journal-size \fIsize_no_default\fR;

- max-transfer-time-in \fIinteger\fR;

- max-transfer-time-out \fIinteger\fR;

- max-transfer-idle-in \fIinteger\fR;

- max-transfer-idle-out \fIinteger\fR;

- max-retry-time \fIinteger\fR;

- min-retry-time \fIinteger\fR;

- max-refresh-time \fIinteger\fR;

- min-refresh-time \fIinteger\fR;

- multi-master \fIboolean\fR;

- sig-validity-interval \fIinteger\fR;

- transfer-source ( \fIipv4_address\fR | * )

+ max\-journal\-size \fIsize_no_default\fR;

+ max\-transfer\-time\-in \fIinteger\fR;

+ max\-transfer\-time\-out \fIinteger\fR;

+ max\-transfer\-idle\-in \fIinteger\fR;

+ max\-transfer\-idle\-out \fIinteger\fR;

+ max\-retry\-time \fIinteger\fR;

+ min\-retry\-time \fIinteger\fR;

+ max\-refresh\-time \fIinteger\fR;

+ min\-refresh\-time \fIinteger\fR;

+ multi\-master \fIboolean\fR;

+ sig\-validity\-interval \fIinteger\fR;

+ transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- transfer-source-v6 ( \fIipv6_address\fR | * )

+ transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source ( \fIipv4_address\fR | * )

+ alt\-transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source-v6 ( \fIipv6_address\fR | * )

+ alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- use-alt-transfer-source \fIboolean\fR;

- zone-statistics \fIboolean\fR;

- key-directory \fIquoted_string\fR;

- allow-v6-synthesis { \fIaddress_match_element\fR; ... }; // obsolete

- fetch-glue \fIboolean\fR; // obsolete

- maintain-ixfr-base \fIboolean\fR; // obsolete

- max-ixfr-log-size \fIsize\fR; // obsolete

+ use\-alt\-transfer\-source \fIboolean\fR;

+ zone\-statistics \fIboolean\fR;

+ key\-directory \fIquoted_string\fR;

+ allow\-v6\-synthesis { \fIaddress_match_element\fR; ... }; // obsolete

+ fetch\-glue \fIboolean\fR; // obsolete

+ maintain\-ixfr\-base \fIboolean\fR; // obsolete

+ max\-ixfr\-log\-size \fIsize\fR; // obsolete

};

-.sp

.fi

.SH "ZONE"

.sp

.nf

zone \fIstring\fR \fIoptional_class\fR {

type ( master | slave | stub | hint |

- forward | delegation-only );

+ forward | delegation\-only );

file \fIquoted_string\fR;

masters [ port \fIinteger\fR ] {

( \fImasters\fR |

\fIipv4_address\fR [port \fIinteger\fR] |

\fIipv6_address\fR [ port \fIinteger\fR ] ) [ key \fIstring\fR ]; ...

};

database \fIstring\fR;

- delegation-only \fIboolean\fR;

- check-names ( fail | warn | ignore );

+ delegation\-only \fIboolean\fR;

+ check\-names ( fail | warn | ignore );

dialup \fIdialuptype\fR;

- ixfr-from-differences \fIboolean\fR;

- allow-query { \fIaddress_match_element\fR; ... };

- allow-transfer { \fIaddress_match_element\fR; ... };

- allow-update { \fIaddress_match_element\fR; ... };

- allow-update-forwarding { \fIaddress_match_element\fR; ... };

- update-policy {

+ ixfr\-from\-differences \fIboolean\fR;

+ allow\-query { \fIaddress_match_element\fR; ... };

+ allow\-transfer { \fIaddress_match_element\fR; ... };

+ allow\-update { \fIaddress_match_element\fR; ... };

+ allow\-update\-forwarding { \fIaddress_match_element\fR; ... };

+ update\-policy {

( grant | deny ) \fIstring\fR

( name | subdomain | wildcard | self ) \fIstring\fR

\fIrrtypelist\fR; ...

};

notify \fInotifytype\fR;

- notify-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- notify-source-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

- also-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

+ notify\-source ( \fIipv4_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ notify\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * ) ];

+ also\-notify [ port \fIinteger\fR ] { ( \fIipv4_address\fR | \fIipv6_address\fR )

[ port \fIinteger\fR ]; ... };

- allow-notify { \fIaddress_match_element\fR; ... };

+ allow\-notify { \fIaddress_match_element\fR; ... };

forward ( first | only );

forwarders [ port \fIinteger\fR ] {

( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; ...

};

- max-journal-size \fIsize_no_default\fR;

- max-transfer-time-in \fIinteger\fR;

- max-transfer-time-out \fIinteger\fR;

- max-transfer-idle-in \fIinteger\fR;

- max-transfer-idle-out \fIinteger\fR;

- max-retry-time \fIinteger\fR;

- min-retry-time \fIinteger\fR;

- max-refresh-time \fIinteger\fR;

- min-refresh-time \fIinteger\fR;

- multi-master \fIboolean\fR;

- sig-validity-interval \fIinteger\fR;

- transfer-source ( \fIipv4_address\fR | * )

+ max\-journal\-size \fIsize_no_default\fR;

+ max\-transfer\-time\-in \fIinteger\fR;

+ max\-transfer\-time\-out \fIinteger\fR;

+ max\-transfer\-idle\-in \fIinteger\fR;

+ max\-transfer\-idle\-out \fIinteger\fR;

+ max\-retry\-time \fIinteger\fR;

+ min\-retry\-time \fIinteger\fR;

+ max\-refresh\-time \fIinteger\fR;

+ min\-refresh\-time \fIinteger\fR;

+ multi\-master \fIboolean\fR;

+ sig\-validity\-interval \fIinteger\fR;

+ transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- transfer-source-v6 ( \fIipv6_address\fR | * )

+ transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source ( \fIipv4_address\fR | * )

+ alt\-transfer\-source ( \fIipv4_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- alt-transfer-source-v6 ( \fIipv6_address\fR | * )

+ alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * )

[ port ( \fIinteger\fR | * ) ];

- use-alt-transfer-source \fIboolean\fR;

- zone-statistics \fIboolean\fR;

- key-directory \fIquoted_string\fR;

- ixfr-base \fIquoted_string\fR; // obsolete

- ixfr-tmp-file \fIquoted_string\fR; // obsolete

- maintain-ixfr-base \fIboolean\fR; // obsolete

- max-ixfr-log-size \fIsize\fR; // obsolete

+ use\-alt\-transfer\-source \fIboolean\fR;

+ zone\-statistics \fIboolean\fR;

+ key\-directory \fIquoted_string\fR;

+ ixfr\-base \fIquoted_string\fR; // obsolete

+ ixfr\-tmp\-file \fIquoted_string\fR; // obsolete

+ maintain\-ixfr\-base \fIboolean\fR; // obsolete

+ max\-ixfr\-log\-size \fIsize\fR; // obsolete

pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; // obsolete

};

-.sp

.fi

.SH "FILES"

.PP

@@ -472,4 +435,4 @@ zone \fIstring\fR \fIoptional_class\fR {

.PP

\fBnamed\fR(8),

\fBrndc\fR(8),

-\fBBIND 9 Adminstrators Reference Manual\fR.

+\fBBIND 9 Adminstrators Reference Manual\fR().

diff --git a/contrib/bind9/bin/named/named.conf.docbook b/contrib/bind9/bin/named/named.conf.docbook
index b5a71dcf1b3c..4ba10844cc32 100644
--- a/contrib/bind9/bin/named/named.conf.docbook
+++ b/contrib/bind9/bin/named/named.conf.docbook

@@ -1,6 +1,8 @@

-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">

+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"

+ "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"

+ [<!ENTITY mdash "—">]>

<!--

- Permission to use, copy, modify, and distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

@@ -15,7 +17,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

@@ -28,6 +30,14 @@

</refmeta>

+ <docinfo>

+ <copyright>

+ <year>2004</year>

+ <year>2005</year>

+ <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

+ </copyright>

+ </docinfo>

<refname><filename>named.conf</filename></refname>

<refpurpose>configuration file for named</refpurpose>

@@ -61,35 +71,35 @@

-<LITERALLAYOUT>

+<literallayout>

acl <replaceable>string</replaceable> { <replaceable>address_match_element</replaceable>; ... };

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

-<LITERALLAYOUT>

+<literallayout>

key <replaceable>domain_name</replaceable> {

algorithm <replaceable>string</replaceable>;

secret <replaceable>string</replaceable>;

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>MASTERS</title>

-<LITERALLAYOUT>

+<literallayout>

masters <replaceable>string</replaceable> <optional> port <replaceable>integer</replaceable> </optional> {

( <replaceable>masters</replaceable> | <replaceable>ipv4_address</replaceable> <optional>port <replaceable>integer</replaceable></optional> |

<replaceable>ipv6_address</replaceable> <optional>port <replaceable>integer</replaceable></optional> ) <optional> key <replaceable>string</replaceable> </optional>; ...

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>SERVER</title>

-<LITERALLAYOUT>

+<literallayout>

server ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) {

bogus <replaceable>boolean</replaceable>;

edns <replaceable>boolean</replaceable>;

@@ -105,21 +115,21 @@ server ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</re

support-ixfr <replaceable>boolean</replaceable>; // obsolete

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>TRUSTED-KEYS</title>

-<LITERALLAYOUT>

+<literallayout>

trusted-keys {

<replaceable>domain_name</replaceable> <replaceable>flags</replaceable> <replaceable>protocol</replaceable> <replaceable>algorithm</replaceable> <replaceable>key</replaceable>; ...

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>CONTROLS</title>

-<LITERALLAYOUT>

+<literallayout>

controls {

inet ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> | * )

<optional> port ( <replaceable>integer</replaceable> | * ) </optional>

@@ -127,12 +137,12 @@ controls {

<optional> keys { <replaceable>string</replaceable>; ... } </optional>;

unix <replaceable>unsupported</replaceable>; // not implemented

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>LOGGING</title>

-<LITERALLAYOUT>

+<literallayout>

logging {

channel <replaceable>string</replaceable> {

file <replaceable>log_file</replaceable>;

@@ -146,12 +156,12 @@ logging {

};

category <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>LWRES</title>

-<LITERALLAYOUT>

+<literallayout>

lwres {

listen-on <optional> port <replaceable>integer</replaceable> </optional> {

( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) <optional> port <replaceable>integer</replaceable> </optional>; ...

@@ -160,12 +170,12 @@ lwres {

search { <replaceable>string</replaceable>; ... };

ndots <replaceable>integer</replaceable>;

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

<title>OPTIONS</title>

-<LITERALLAYOUT>

+<literallayout>

options {

avoid-v4-udp-ports { <replaceable>port</replaceable>; ... };

avoid-v6-udp-ports { <replaceable>port</replaceable>; ... };

@@ -304,12 +314,12 @@ options {

treat-cr-as-space <replaceable>boolean</replaceable>; // obsolete

use-id-pool <replaceable>boolean</replaceable>; // obsolete

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

-<LITERALLAYOUT>

+<literallayout>

view <replaceable>string</replaceable> <replaceable>optional_class</replaceable> {

match-clients { <replaceable>address_match_element</replaceable>; ... };

match-destinations { <replaceable>address_match_element</replaceable>; ... };

@@ -423,12 +433,12 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>

maintain-ixfr-base <replaceable>boolean</replaceable>; // obsolete

max-ixfr-log-size <replaceable>size</replaceable>; // obsolete

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

-<LITERALLAYOUT>

+<literallayout>

zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable> {

type ( master | slave | stub | hint |

forward | delegation-only );

@@ -500,7 +510,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>

max-ixfr-log-size <replaceable>size</replaceable>; // obsolete

pubkey <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>integer</replaceable> <replaceable>quoted_string</replaceable>; // obsolete

};

-</LITERALLAYOUT>

+</literallayout>

</refsect1>

diff --git a/contrib/bind9/bin/named/named.conf.html b/contrib/bind9/bin/named/named.conf.html
index 7f8bb2ec61f3..8b3b517d7d73 100644
--- a/contrib/bind9/bin/named/named.conf.html
+++ b/contrib/bind9/bin/named/named.conf.html

@@ -1,1897 +1,500 @@

<!--

- -

+ -

- Permission to use, copy, modify, and distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- copyright notice and this permission notice appear in all copies.

- -

+ -

- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

- - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

-<HTML

-><HEAD

-><TITLE

->named.conf</TITLE

-><META

-NAME="GENERATOR"

-CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD

-><BODY

-CLASS="REFENTRY"

-BGCOLOR="#FFFFFF"

-TEXT="#000000"

-LINK="#0000FF"

-VLINK="#840084"

-ALINK="#0000FF"

-><H1

-><A

-NAME="AEN1"

-></A

-><TT

-CLASS="FILENAME"

->named.conf</TT

-></H1

-><DIV

-CLASS="REFNAMEDIV"

-><A

-NAME="AEN9"

-></A

-><H2

->Name</H2

-><TT

-CLASS="FILENAME"

->named.conf</TT

-> -- configuration file for named</DIV

-><DIV

-CLASS="REFSYNOPSISDIV"

-><A

-NAME="AEN13"

-></A

-><H2

->Synopsis</H2

-><P

-><B

-CLASS="COMMAND"

->named.conf</B

-> </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN16"

-></A

-><H2

->DESCRIPTION</H2

-><P

-> <TT

-CLASS="FILENAME"

->named.conf</TT

-> is the configuration file for

- <B

-CLASS="COMMAND"

->named</B

->. Statements are enclosed

+

+<html>

+<head>

+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

+<title>named.conf</title>

+<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">

+</head>

+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">

+<a name="id2463721"></a><div class="titlepage"></div>

+<div class="refnamediv">

+<h2>Name</h2>

+<code class="filename">named.conf</code> — configuration file for named

+</div>

+<div class="refsynopsisdiv">

+<h2>Synopsis</h2>

+<div class="cmdsynopsis"><code class="command">named.conf</code> </div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525889"></a><h2>DESCRIPTION</h2>

+

+ <code class="filename">named.conf</code> is the configuration file for

+ named. Statements are enclosed

in braces and terminated with a semi-colon. Clauses in

the statements are also semi-colon terminated. The usual

comment styles are supported:

- </P

-><P

-> C style: /* */

- </P

-><P

-> C++ style: // to end of line

- </P

-><P

-> Unix style: # to end of line

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN24"

-></A

-><H2

->ACL</H2

-><P

-CLASS="LITERALLAYOUT"

->acl <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }; </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN29"

-></A

-><H2

->KEY</H2

-><P

-CLASS="LITERALLAYOUT"

->key <VAR

-CLASS="REPLACEABLE"

->domain_name</VAR

-> {

- algorithm <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- secret <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN35"

-></A

-><H2

->MASTERS</H2

-><P

-CLASS="LITERALLAYOUT"

->masters <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->masters</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] ) [<SPAN

-CLASS="OPTIONAL"

-> key <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->]; ...

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN50"

-></A

-><H2

->SERVER</H2

-><P

-CLASS="LITERALLAYOUT"

->server ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) {

- bogus <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- edns <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- provide-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- request-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- keys <VAR

-CLASS="REPLACEABLE"

->server_key</VAR

->;

- transfers <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- transfer-format ( many-answers | one-answer );

- transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

+

+

+ C style: /* */

+

+

+ C++ style: // to end of line

+

+

+ Unix style: # to end of line

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525917"></a><h2>ACL</h2>

+<div class="literallayout">

+acl�<code>string</code>�{�<code>address_match_element</code>;�...�};

- support-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN68"

-></A

-><H2

->TRUSTED-KEYS</H2

-><P

-CLASS="LITERALLAYOUT"

->trusted-keys {

- <VAR

-CLASS="REPLACEABLE"

->domain_name</VAR

-> <VAR

-CLASS="REPLACEABLE"

->flags</VAR

-> <VAR

-CLASS="REPLACEABLE"

->protocol</VAR

-> <VAR

-CLASS="REPLACEABLE"

->algorithm</VAR

-> <VAR

-CLASS="REPLACEABLE"

->key</VAR

->; ...

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN76"

-></A

-><H2

->CONTROLS</H2

-><P

-CLASS="LITERALLAYOUT"

->controls {

- inet ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->]

- allow { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }

- [<SPAN

-CLASS="OPTIONAL"

-> keys { <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ... } </SPAN

->];

- unix <VAR

-CLASS="REPLACEABLE"

->unsupported</VAR

->; // not implemented

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN87"

-></A

-><H2

->LOGGING</H2

-><P

-CLASS="LITERALLAYOUT"

->logging {

- channel <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> {

- file <VAR

-CLASS="REPLACEABLE"

->log_file</VAR

->;

- syslog <VAR

-CLASS="REPLACEABLE"

->optional_facility</VAR

->;

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525933"></a><h2>KEY</h2>

+<div class="literallayout">

+key�<code>domain_name</code>�{

+ algorithm�<code>string</code>;

+ secret�<code>string</code>;

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525953"></a><h2>MASTERS</h2>

+<div class="literallayout">

+masters�<code>string</code>�[�port�<code>integer</code>�]�{

+ (�<code>masters</code>�|�<code>ipv4_address</code>�[port�<code>integer</code>]�|

+ <code>ipv6_address</code>�[port�<code>integer</code>]�)�[�key�<code>string</code>�];�...

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525998"></a><h2>SERVER</h2>

+<div class="literallayout">

+server�(�<code>ipv4_address</code>�|�<code>ipv6_address</code>�)�{

+ bogus�<code>boolean</code>;

+ edns�<code>boolean</code>;

+ provide-ixfr�<code>boolean</code>;

+ request-ixfr�<code>boolean</code>;

+ keys�<code>server_key</code>;

+ transfers�<code>integer</code>;

+ transfer-format�(�many-answers�|�one-answer�);

+ transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+

+ support-ixfr�<code>boolean</code>;�//�obsolete

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526056"></a><h2>TRUSTED-KEYS</h2>

+<div class="literallayout">

+trusted-keys�{

+ <code>domain_name</code>�<code>flags</code>�<code>protocol</code>�<code>algorithm</code>�<code>key</code>;�...�

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526082"></a><h2>CONTROLS</h2>

+<div class="literallayout">

+controls�{

+ inet�(�<code>ipv4_address</code>�|�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�]

+ allow�{�<code>address_match_element</code>;�...�}

+ [�keys�{�<code>string</code>;�...�}�];

+ unix�<code>unsupported</code>;�//�not�implemented

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526117"></a><h2>LOGGING</h2>

+<div class="literallayout">

+logging�{

+ channel�<code>string</code>�{

+ file�<code>log_file</code>;

+ syslog�<code>optional_facility</code>;

null;

stderr;

- severity <VAR

-CLASS="REPLACEABLE"

->log_severity</VAR

->;

- print-time <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- print-severity <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- print-category <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ severity�<code>log_severity</code>;

+ print-time�<code>boolean</code>;

+ print-severity�<code>boolean</code>;

+ print-category�<code>boolean</code>;

};

- category <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> { <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ... };

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN99"

-></A

-><H2

->LWRES</H2

-><P

-CLASS="LITERALLAYOUT"

->lwres {

- listen-on [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ...

+ category�<code>string</code>�{�<code>string</code>;�...�};

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526155"></a><h2>LWRES</h2>

+<div class="literallayout">

+lwres�{

+ listen-on�[�port�<code>integer</code>�]�{

+ (�<code>ipv4_address</code>�|�<code>ipv6_address</code>�)�[�port�<code>integer</code>�];�...

};

- view <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->optional_class</VAR

->;

- search { <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ... };

- ndots <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN112"

-></A

-><H2

->OPTIONS</H2

-><P

-CLASS="LITERALLAYOUT"

->options {

- avoid-v4-udp-ports { <VAR

-CLASS="REPLACEABLE"

->port</VAR

->; ... };

- avoid-v6-udp-ports { <VAR

-CLASS="REPLACEABLE"

->port</VAR

->; ... };

- blackhole { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- coresize <VAR

-CLASS="REPLACEABLE"

->size</VAR

->;

- datasize <VAR

-CLASS="REPLACEABLE"

->size</VAR

->;

- directory <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- dump-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- files <VAR

-CLASS="REPLACEABLE"

->size</VAR

->;

- heartbeat-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- host-statistics <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // not implemented

- host-statistics-max <VAR

-CLASS="REPLACEABLE"

->number</VAR

->; // not implemented

- hostname ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> | none );

- interface-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- listen-on [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- listen-on-v6 [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- match-mapped-addresses <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- memstatistics-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- pid-file ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> | none );

- port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- querylog <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- recursing-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- random-device <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- recursive-clients <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- serial-query-rate <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- server-id ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> | none |;

- stacksize <VAR

-CLASS="REPLACEABLE"

->size</VAR

->;

- statistics-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- statistics-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->; // not yet implemented

- tcp-clients <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- tcp-listen-queue <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- tkey-dhkey <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- tkey-gssapi-credential <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- tkey-domain <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- transfers-per-ns <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- transfers-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- transfers-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- use-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- version ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> | none );

- allow-recursion { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- sortlist { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- topology { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }; // not implemented

- auth-nxdomain <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // default changed

- minimal-responses <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- recursion <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- rrset-order {

- [<SPAN

-CLASS="OPTIONAL"

-> class <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->] [<SPAN

-CLASS="OPTIONAL"

-> type <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->]

- [<SPAN

-CLASS="OPTIONAL"

-> name <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> </SPAN

->] <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ...

+ view�<code>string</code>�<code>optional_class</code>;

+ search�{�<code>string</code>;�...�};

+ ndots�<code>integer</code>;

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526197"></a><h2>OPTIONS</h2>

+<div class="literallayout">

+options�{

+ avoid-v4-udp-ports�{�<code>port</code>;�...�};

+ avoid-v6-udp-ports�{�<code>port</code>;�...�};

+ blackhole�{�<code>address_match_element</code>;�...�};

+ coresize�<code>size</code>;

+ datasize�<code>size</code>;

+ directory�<code>quoted_string</code>;

+ dump-file�<code>quoted_string</code>;

+ files�<code>size</code>;

+ heartbeat-interval�<code>integer</code>;

+ host-statistics�<code>boolean</code>;�//�not�implemented

+ host-statistics-max�<code>number</code>;�//�not�implemented

+ hostname�(�<code>quoted_string</code>�|�none�);

+ interface-interval�<code>integer</code>;

+ listen-on�[�port�<code>integer</code>�]�{�<code>address_match_element</code>;�...�};

+ listen-on-v6�[�port�<code>integer</code>�]�{�<code>address_match_element</code>;�...�};

+ match-mapped-addresses�<code>boolean</code>;

+ memstatistics-file�<code>quoted_string</code>;

+ pid-file�(�<code>quoted_string</code>�|�none�);

+ port�<code>integer</code>;

+ querylog�<code>boolean</code>;

+ recursing-file�<code>quoted_string</code>;

+ random-device�<code>quoted_string</code>;

+ recursive-clients�<code>integer</code>;

+ serial-query-rate�<code>integer</code>;

+ server-id�(�<code>quoted_string</code>�|�none�|;

+ stacksize�<code>size</code>;

+ statistics-file�<code>quoted_string</code>;

+ statistics-interval�<code>integer</code>;�//�not�yet�implemented

+ tcp-clients�<code>integer</code>;

+ tcp-listen-queue�<code>integer</code>;

+ tkey-dhkey�<code>quoted_string</code>�<code>integer</code>;

+ tkey-gssapi-credential�<code>quoted_string</code>;

+ tkey-domain�<code>quoted_string</code>;

+ transfers-per-ns�<code>integer</code>;

+ transfers-in�<code>integer</code>;

+ transfers-out�<code>integer</code>;

+ use-ixfr�<code>boolean</code>;

+ version�(�<code>quoted_string</code>�|�none�);

+ allow-recursion�{�<code>address_match_element</code>;�...�};

+ sortlist�{�<code>address_match_element</code>;�...�};

+ topology�{�<code>address_match_element</code>;�...�};�//�not�implemented

+ auth-nxdomain�<code>boolean</code>;�//�default�changed

+ minimal-responses�<code>boolean</code>;

+ recursion�<code>boolean</code>;

+ rrset-order�{

+ [�class�<code>string</code>�]�[�type�<code>string</code>�]

+ [�name�<code>quoted_string</code>�]�<code>string</code>�<code>string</code>;�...

};

- provide-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- request-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- rfc2308-type1 <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // not yet implemented

- additional-from-auth <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- additional-from-cache <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- query-source <VAR

-CLASS="REPLACEABLE"

->querysource4</VAR

->;

- query-source-v6 <VAR

-CLASS="REPLACEABLE"

->querysource6</VAR

->;

- cleaning-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-roots <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->; // not implemented

- lame-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-ncache-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-cache-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- transfer-format ( many-answers | one-answer );

- max-cache-size <VAR

-CLASS="REPLACEABLE"

->size_no_default</VAR

->;

- check-names ( master | slave | response )

- ( fail | warn | ignore );

- cache-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- suppress-initial-notify <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // not yet implemented

- preferred-glue <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- dual-stack-servers [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] ); ...

+ provide-ixfr�<code>boolean</code>;

+ request-ixfr�<code>boolean</code>;

+ rfc2308-type1�<code>boolean</code>;�//�not�yet�implemented

+ additional-from-auth�<code>boolean</code>;

+ additional-from-cache�<code>boolean</code>;

+ query-source�<code>querysource4</code>;

+ query-source-v6�<code>querysource6</code>;

+ cleaning-interval�<code>integer</code>;

+ min-roots�<code>integer</code>;�//�not�implemented

+ lame-ttl�<code>integer</code>;

+ max-ncache-ttl�<code>integer</code>;

+ max-cache-ttl�<code>integer</code>;

+ transfer-format�(�many-answers�|�one-answer�);

+ max-cache-size�<code>size_no_default</code>;

+ check-names�(�master�|�slave�|�response�)

+ (�fail�|�warn�|�ignore�);

+ cache-file�<code>quoted_string</code>;

+ suppress-initial-notify�<code>boolean</code>;�//�not�yet�implemented

+ preferred-glue�<code>string</code>;

+ dual-stack-servers�[�port�<code>integer</code>�]�{

+ (�<code>quoted_string</code>�[port�<code>integer</code>]�|

+ <code>ipv4_address</code>�[port�<code>integer</code>]�|

+ <code>ipv6_address</code>�[port�<code>integer</code>]�);�...

}

- edns-udp-size <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- root-delegation-only [<SPAN

-CLASS="OPTIONAL"

-> exclude { <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; ... } </SPAN

->];

- disable-algorithms <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> { <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ... };

- dnssec-enable <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- dnssec-lookaside <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> trust-anchor <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- dnssec-must-be-secure <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ edns-udp-size�<code>integer</code>;

+ root-delegation-only�[�exclude�{�<code>quoted_string</code>;�...�}�];

+ disable-algorithms�<code>string</code>�{�<code>string</code>;�...�};

+ dnssec-enable�<code>boolean</code>;

+ dnssec-lookaside�<code>string</code>�trust-anchor�<code>string</code>;

+ dnssec-must-be-secure�<code>string</code>�<code>boolean</code>;

- dialup <VAR

-CLASS="REPLACEABLE"

->dialuptype</VAR

->;

- ixfr-from-differences <VAR

-CLASS="REPLACEABLE"

->ixfrdiff</VAR

->;

+ dialup�<code>dialuptype</code>;

+ ixfr-from-differences�<code>ixfrdiff</code>;

- allow-query { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-transfer { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-update-forwarding { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

+ allow-query�{�<code>address_match_element</code>;�...�};

+ allow-transfer�{�<code>address_match_element</code>;�...�};

+ allow-update-forwarding�{�<code>address_match_element</code>;�...�};

- notify <VAR

-CLASS="REPLACEABLE"

->notifytype</VAR

->;

- notify-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- notify-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- also-notify [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] { ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> )

- [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ... };

- allow-notify { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

+ notify�<code>notifytype</code>;

+ notify-source�(�<code>ipv4_address</code>�|�*�)�[�port�(�<code>integer</code>�|�*�)�];

+ notify-source-v6�(�<code>ipv6_address</code>�|�*�)�[�port�(�<code>integer</code>�|�*�)�];

+ also-notify�[�port�<code>integer</code>�]�{�(�<code>ipv4_address</code>�|�<code>ipv6_address</code>�)

+ [�port�<code>integer</code>�];�...�};

+ allow-notify�{�<code>address_match_element</code>;�...�};

- forward ( first | only );

- forwarders [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ...

+ forward�(�first�|�only�);

+ forwarders�[�port�<code>integer</code>�]�{

};

- max-journal-size <VAR

-CLASS="REPLACEABLE"

->size_no_default</VAR

->;

- max-transfer-time-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-time-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- multi-master <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- sig-validity-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

+ max-journal-size�<code>size_no_default</code>;

+ max-transfer-time-in�<code>integer</code>;

+ max-transfer-time-out�<code>integer</code>;

+ max-transfer-idle-in�<code>integer</code>;

+ max-transfer-idle-out�<code>integer</code>;

+ max-retry-time�<code>integer</code>;

+ min-retry-time�<code>integer</code>;

+ max-refresh-time�<code>integer</code>;

+ min-refresh-time�<code>integer</code>;

+ multi-master�<code>boolean</code>;

+ sig-validity-interval�<code>integer</code>;

- transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

+ transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

- alt-transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- alt-transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- use-alt-transfer-source <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ alt-transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ alt-transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ use-alt-transfer-source�<code>boolean</code>;

- zone-statistics <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- key-directory <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

+ zone-statistics�<code>boolean</code>;

+ key-directory�<code>quoted_string</code>;

- allow-v6-synthesis { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }; // obsolete

- deallocate-on-exit <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- fake-iquery <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- fetch-glue <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- has-old-clients <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- maintain-ixfr-base <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- max-ixfr-log-size <VAR

-CLASS="REPLACEABLE"

->size</VAR

->; // obsolete

- multiple-cnames <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- named-xfer <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; // obsolete

- serial-queries <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->; // obsolete

- treat-cr-as-space <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- use-id-pool <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN272"

-></A

-><H2

->VIEW</H2

-><P

-CLASS="LITERALLAYOUT"

->view <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->optional_class</VAR

-> {

- match-clients { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- match-destinations { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- match-recursive-only <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ allow-v6-synthesis�{�<code>address_match_element</code>;�...�};�//�obsolete

+ deallocate-on-exit�<code>boolean</code>;�//�obsolete

+ fake-iquery�<code>boolean</code>;�//�obsolete

+ fetch-glue�<code>boolean</code>;�//�obsolete

+ has-old-clients�<code>boolean</code>;�//�obsolete

+ maintain-ixfr-base�<code>boolean</code>;�//�obsolete

+ max-ixfr-log-size�<code>size</code>;�//�obsolete

+ multiple-cnames�<code>boolean</code>;�//�obsolete

+ named-xfer�<code>quoted_string</code>;�//�obsolete

+ serial-queries�<code>integer</code>;�//�obsolete

+ treat-cr-as-space�<code>boolean</code>;�//�obsolete

+ use-id-pool�<code>boolean</code>;�//�obsolete

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526858"></a><h2>VIEW</h2>

+<div class="literallayout">

+view�<code>string</code>�<code>optional_class</code>�{

+ match-clients�{�<code>address_match_element</code>;�...�};

+ match-destinations�{�<code>address_match_element</code>;�...�};

+ match-recursive-only�<code>boolean</code>;

- key <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> {

- algorithm <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- secret <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

+ key�<code>string</code>�{

+ algorithm�<code>string</code>;

+ secret�<code>string</code>;

};

- zone <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->optional_class</VAR

-> {

+ zone�<code>string</code>�<code>optional_class</code>�{

...

};

- server ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) {

+ server�(�<code>ipv4_address</code>�|�<code>ipv6_address</code>�)�{

...

};

- trusted-keys {

- <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; ...

+ trusted-keys�{

+ <code>string</code>�<code>integer</code>�<code>integer</code>�<code>integer</code>�<code>quoted_string</code>;�...

};

- allow-recursion { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- sortlist { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- topology { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }; // not implemented

- auth-nxdomain <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // default changed

- minimal-responses <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- recursion <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- rrset-order {

- [<SPAN

-CLASS="OPTIONAL"

-> class <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->] [<SPAN

-CLASS="OPTIONAL"

-> type <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->]

- [<SPAN

-CLASS="OPTIONAL"

-> name <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> </SPAN

->] <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ...

+ allow-recursion�{�<code>address_match_element</code>;�...�};

+ sortlist�{�<code>address_match_element</code>;�...�};

+ topology�{�<code>address_match_element</code>;�...�};�//�not�implemented

+ auth-nxdomain�<code>boolean</code>;�//�default�changed

+ minimal-responses�<code>boolean</code>;

+ recursion�<code>boolean</code>;

+ rrset-order�{

+ [�class�<code>string</code>�]�[�type�<code>string</code>�]

};

- provide-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- request-ixfr <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- rfc2308-type1 <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // not yet implemented

- additional-from-auth <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- additional-from-cache <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- query-source <VAR

-CLASS="REPLACEABLE"

->querysource4</VAR

->;

- query-source-v6 <VAR

-CLASS="REPLACEABLE"

->querysource6</VAR

->;

- cleaning-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-roots <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->; // not implemented

- lame-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-ncache-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-cache-ttl <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- transfer-format ( many-answers | one-answer );

- max-cache-size <VAR

-CLASS="REPLACEABLE"

->size_no_default</VAR

->;

- check-names ( master | slave | response )

- ( fail | warn | ignore );

- cache-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

- suppress-initial-notify <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // not yet implemented

- preferred-glue <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- dual-stack-servers [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] ); ...

+ provide-ixfr�<code>boolean</code>;

+ request-ixfr�<code>boolean</code>;

+ rfc2308-type1�<code>boolean</code>;�//�not�yet�implemented

+ additional-from-auth�<code>boolean</code>;

+ additional-from-cache�<code>boolean</code>;

+ query-source�<code>querysource4</code>;

+ query-source-v6�<code>querysource6</code>;

+ cleaning-interval�<code>integer</code>;

+ min-roots�<code>integer</code>;�//�not�implemented

+ lame-ttl�<code>integer</code>;

+ max-ncache-ttl�<code>integer</code>;

+ max-cache-ttl�<code>integer</code>;

+ transfer-format�(�many-answers�|�one-answer�);

+ max-cache-size�<code>size_no_default</code>;

+ check-names�(�master�|�slave�|�response�)

+ (�fail�|�warn�|�ignore�);

+ cache-file�<code>quoted_string</code>;

+ suppress-initial-notify�<code>boolean</code>;�//�not�yet�implemented

+ preferred-glue�<code>string</code>;

+ dual-stack-servers�[�port�<code>integer</code>�]�{

+ (�<code>quoted_string</code>�[port�<code>integer</code>]�|

+ <code>ipv4_address</code>�[port�<code>integer</code>]�|

+ <code>ipv6_address</code>�[port�<code>integer</code>]�);�...

};

- edns-udp-size <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- root-delegation-only [<SPAN

-CLASS="OPTIONAL"

-> exclude { <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; ... } </SPAN

->];

- disable-algorithms <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> { <VAR

-CLASS="REPLACEABLE"

->string</VAR

->; ... };

- dnssec-enable <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- dnssec-lookaside <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> trust-anchor <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

+ edns-udp-size�<code>integer</code>;

+ root-delegation-only�[�exclude�{�<code>quoted_string</code>;�...�}�];

+ disable-algorithms�<code>string</code>�{�<code>string</code>;�...�};

+ dnssec-enable�<code>boolean</code>;

+ dnssec-lookaside�<code>string</code>�trust-anchor�<code>string</code>;

- dnssec-must-be-secure <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- dialup <VAR

-CLASS="REPLACEABLE"

->dialuptype</VAR

->;

- ixfr-from-differences <VAR

-CLASS="REPLACEABLE"

->ixfrdiff</VAR

->;

+ dnssec-must-be-secure�<code>string</code>�<code>boolean</code>;

+ dialup�<code>dialuptype</code>;

+ ixfr-from-differences�<code>ixfrdiff</code>;

- allow-query { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-transfer { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-update-forwarding { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

+ allow-query�{�<code>address_match_element</code>;�...�};

+ allow-transfer�{�<code>address_match_element</code>;�...�};

+ allow-update-forwarding�{�<code>address_match_element</code>;�...�};

- notify <VAR

-CLASS="REPLACEABLE"

->notifytype</VAR

->;

- notify-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- notify-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- also-notify [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] { ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> )

- [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ... };

- allow-notify { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

+ notify�<code>notifytype</code>;

+ [�port�<code>integer</code>�];�...�};

+ allow-notify�{�<code>address_match_element</code>;�...�};

- forward ( first | only );

- forwarders [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ...

+ forward�(�first�|�only�);

+ forwarders�[�port�<code>integer</code>�]�{

};

- max-journal-size <VAR

-CLASS="REPLACEABLE"

->size_no_default</VAR

->;

- max-transfer-time-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-time-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- multi-master <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- sig-validity-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

+ max-journal-size�<code>size_no_default</code>;

+ max-transfer-time-in�<code>integer</code>;

+ max-transfer-time-out�<code>integer</code>;

+ max-transfer-idle-in�<code>integer</code>;

+ max-transfer-idle-out�<code>integer</code>;

+ max-retry-time�<code>integer</code>;

+ min-retry-time�<code>integer</code>;

+ max-refresh-time�<code>integer</code>;

+ min-refresh-time�<code>integer</code>;

+ multi-master�<code>boolean</code>;

+ sig-validity-interval�<code>integer</code>;

- transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

+ transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

- alt-transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- alt-transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- use-alt-transfer-source <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ alt-transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ alt-transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ use-alt-transfer-source�<code>boolean</code>;

- zone-statistics <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- key-directory <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

+ zone-statistics�<code>boolean</code>;

+ key-directory�<code>quoted_string</code>;

- allow-v6-synthesis { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... }; // obsolete

- fetch-glue <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- maintain-ixfr-base <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- max-ixfr-log-size <VAR

-CLASS="REPLACEABLE"

->size</VAR

->; // obsolete

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN398"

-></A

-><H2

->ZONE</H2

-><P

-CLASS="LITERALLAYOUT"

->zone <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> <VAR

-CLASS="REPLACEABLE"

->optional_class</VAR

-> {

- type ( master | slave | stub | hint |

- forward | delegation-only );

- file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

+ allow-v6-synthesis�{�<code>address_match_element</code>;�...�};�//�obsolete

+ fetch-glue�<code>boolean</code>;�//�obsolete

+ maintain-ixfr-base�<code>boolean</code>;�//�obsolete

+ max-ixfr-log-size�<code>size</code>;�//�obsolete

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2527269"></a><h2>ZONE</h2>

+<div class="literallayout">

+zone�<code>string</code>�<code>optional_class</code>�{

+ type�(�master�|�slave�|�stub�|�hint�|

+ forward�|�delegation-only�);

+ file�<code>quoted_string</code>;

- masters [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->masters</VAR

-> |

- <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

->port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-></SPAN

->] |

- <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] ) [<SPAN

-CLASS="OPTIONAL"

-> key <VAR

-CLASS="REPLACEABLE"

->string</VAR

-> </SPAN

->]; ...

+ masters�[�port�<code>integer</code>�]�{

+ (�<code>masters</code>�|

+ <code>ipv4_address</code>�[port�<code>integer</code>]�|

+ <code>ipv6_address</code>�[�port�<code>integer</code>�]�)�[�key�<code>string</code>�];�...

};

- database <VAR

-CLASS="REPLACEABLE"

->string</VAR

->;

- delegation-only <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- check-names ( fail | warn | ignore );

- dialup <VAR

-CLASS="REPLACEABLE"

->dialuptype</VAR

->;

- ixfr-from-differences <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ database�<code>string</code>;

+ delegation-only�<code>boolean</code>;

+ check-names�(�fail�|�warn�|�ignore�);

+ dialup�<code>dialuptype</code>;

+ ixfr-from-differences�<code>boolean</code>;

- allow-query { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-transfer { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-update { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- allow-update-forwarding { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

- update-policy {

- ( grant | deny ) <VAR

-CLASS="REPLACEABLE"

->string</VAR

->

- ( name | subdomain | wildcard | self ) <VAR

-CLASS="REPLACEABLE"

->string</VAR

->

- <VAR

-CLASS="REPLACEABLE"

->rrtypelist</VAR

->; ...

+ allow-query�{�<code>address_match_element</code>;�...�};

+ allow-transfer�{�<code>address_match_element</code>;�...�};

+ allow-update�{�<code>address_match_element</code>;�...�};

+ allow-update-forwarding�{�<code>address_match_element</code>;�...�};

+ update-policy�{

+ (�grant�|�deny�)�<code>string</code>

+ (�name�|�subdomain�|�wildcard�|�self�)�<code>string</code>

+ <code>rrtypelist</code>;�...

};

- notify <VAR

-CLASS="REPLACEABLE"

->notifytype</VAR

->;

- notify-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- notify-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * ) [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- also-notify [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] { ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> )

- [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ... };

- allow-notify { <VAR

-CLASS="REPLACEABLE"

->address_match_element</VAR

->; ... };

+ notify�<code>notifytype</code>;

+ [�port�<code>integer</code>�];�...�};

+ allow-notify�{�<code>address_match_element</code>;�...�};

- forward ( first | only );

- forwarders [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->] {

- ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> ) [<SPAN

-CLASS="OPTIONAL"

-> port <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> </SPAN

->]; ...

+ forward�(�first�|�only�);

+ forwarders�[�port�<code>integer</code>�]�{

};

- max-journal-size <VAR

-CLASS="REPLACEABLE"

->size_no_default</VAR

->;

- max-transfer-time-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-time-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-in <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-transfer-idle-out <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-retry-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- max-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- min-refresh-time <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

- multi-master <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- sig-validity-interval <VAR

-CLASS="REPLACEABLE"

->integer</VAR

->;

+ max-journal-size�<code>size_no_default</code>;

+ max-transfer-time-in�<code>integer</code>;

+ max-transfer-time-out�<code>integer</code>;

+ max-transfer-idle-in�<code>integer</code>;

+ max-transfer-idle-out�<code>integer</code>;

+ max-retry-time�<code>integer</code>;

+ min-retry-time�<code>integer</code>;

+ max-refresh-time�<code>integer</code>;

+ min-refresh-time�<code>integer</code>;

+ multi-master�<code>boolean</code>;

+ sig-validity-interval�<code>integer</code>;

- transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

+ transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

- alt-transfer-source ( <VAR

-CLASS="REPLACEABLE"

->ipv4_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- alt-transfer-source-v6 ( <VAR

-CLASS="REPLACEABLE"

->ipv6_address</VAR

-> | * )

- [<SPAN

-CLASS="OPTIONAL"

-> port ( <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> | * ) </SPAN

->];

- use-alt-transfer-source <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

+ alt-transfer-source�(�<code>ipv4_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ alt-transfer-source-v6�(�<code>ipv6_address</code>�|�*�)

+ [�port�(�<code>integer</code>�|�*�)�];

+ use-alt-transfer-source�<code>boolean</code>;

- zone-statistics <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->;

- key-directory <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->;

+ zone-statistics�<code>boolean</code>;

+ key-directory�<code>quoted_string</code>;

- ixfr-base <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; // obsolete

- ixfr-tmp-file <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; // obsolete

- maintain-ixfr-base <VAR

-CLASS="REPLACEABLE"

->boolean</VAR

->; // obsolete

- max-ixfr-log-size <VAR

-CLASS="REPLACEABLE"

->size</VAR

->; // obsolete

- pubkey <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->integer</VAR

-> <VAR

-CLASS="REPLACEABLE"

->quoted_string</VAR

->; // obsolete

-};</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN480"

-></A

-><H2

->FILES</H2

-><P

-><TT

-CLASS="FILENAME"

->/etc/named.conf</TT

-></P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN484"

-></A

-><H2

->SEE ALSO</H2

-><P

-><SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->named</SPAN

->(8)</SPAN

->,

-<SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->rndc</SPAN

->(8)</SPAN

->,

-<SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->BIND 9 Adminstrators Reference Manual</SPAN

-></SPAN

->.</P

-></DIV

-></BODY

-></HTML

+ ixfr-base�<code>quoted_string</code>;�//�obsolete

+ ixfr-tmp-file�<code>quoted_string</code>;�//�obsolete

+ maintain-ixfr-base�<code>boolean</code>;�//�obsolete

+ max-ixfr-log-size�<code>size</code>;�//�obsolete

+ pubkey�<code>integer</code>�<code>integer</code>�<code>integer</code>�<code>quoted_string</code>;�//�obsolete

+};

+</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2527606"></a><h2>FILES</h2>

+

+<code class="filename">/etc/named.conf</code>

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2527619"></a><h2>SEE ALSO</h2>

+

+named(8),

+rndc(8),

+BIND 9 Adminstrators Reference Manual.

+

+</div>

+</div></body>

+</html>

diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook
index 754f1a07c141..47ccf54b38e8 100644
--- a/contrib/bind9/bin/named/named.docbook
+++ b/contrib/bind9/bin/named/named.docbook

@@ -1,6 +1,8 @@

-<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">

+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"

+ "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"

+ [<!ENTITY mdash "—">]>

<!--

- Permission to use, copy, modify, and distribute this software for any

@@ -16,7 +18,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

@@ -29,6 +31,20 @@

</refmeta>

+ <docinfo>

+ <copyright>

+ <year>2004</year>

+ <year>2005</year>

+ <holder>Internet Systems Consortium, Inc. ("ISC")</holder>

+ </copyright>

+ <copyright>

+ <year>2000</year>

+ <year>2001</year>

+ <year>2003</year>

+ <holder>Internet Software Consortium.</holder>

+ </copyright>

+ </docinfo>

<refname><application>named</application></refname>

<refpurpose>Internet domain name server</refpurpose>

diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html
index 8ee16e684f1d..f266e70af554 100644
--- a/contrib/bind9/bin/named/named.html
+++ b/contrib/bind9/bin/named/named.html

@@ -1,625 +1,240 @@

<!--

- -

+ -

- Permission to use, copy, modify, and distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- copyright notice and this permission notice appear in all copies.

- -

+ -

- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

- - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

+ - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,

- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

-<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

-<HTML

-><HEAD

-><TITLE

->named</TITLE

-><META

-NAME="GENERATOR"

-CONTENT="Modular DocBook HTML Stylesheet Version 1.7"></HEAD

-><BODY

-CLASS="REFENTRY"

-BGCOLOR="#FFFFFF"

-TEXT="#000000"

-LINK="#0000FF"

-VLINK="#840084"

-ALINK="#0000FF"

-><H1

-><A

-NAME="AEN1"

-></A

-><SPAN

-CLASS="APPLICATION"

->named</SPAN

-></H1

-><DIV

-CLASS="REFNAMEDIV"

-><A

-NAME="AEN9"

-></A

-><H2

->Name</H2

-><SPAN

-CLASS="APPLICATION"

->named</SPAN

-> -- Internet domain name server</DIV

-><DIV

-CLASS="REFSYNOPSISDIV"

-><A

-NAME="AEN13"

-></A

-><H2

->Synopsis</H2

-><P

-><B

-CLASS="COMMAND"

->named</B

-> [<VAR

-CLASS="OPTION"

->-4</VAR

->] [<VAR

-CLASS="OPTION"

->-6</VAR

->] [<VAR

-CLASS="OPTION"

->-c <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-d <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-f</VAR

->] [<VAR

-CLASS="OPTION"

->-g</VAR

->] [<VAR

-CLASS="OPTION"

->-n <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-p <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-s</VAR

->] [<VAR

-CLASS="OPTION"

->-t <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-u <VAR

-CLASS="REPLACEABLE"

->user</VAR

-></VAR

->] [<VAR

-CLASS="OPTION"

->-v</VAR

->] [<VAR

-CLASS="OPTION"

->-x <VAR

-CLASS="REPLACEABLE"

->cache-file</VAR

-></VAR

->]</P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN49"

-></A

-><H2

->DESCRIPTION</H2

-><P

-> <B

-CLASS="COMMAND"

->named</B

-> is a Domain Name System (DNS) server,

+

+<html>

+<head>

+<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

+<title>named</title>

+<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">

+</head>

+<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">

+<a name="id2463721"></a><div class="titlepage"></div>

+<div class="refnamediv">

+<h2>Name</h2>

+named — Internet domain name server

+</div>

+<div class="refsynopsisdiv">

+<h2>Synopsis</h2>

+<div class="cmdsynopsis"><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <code>config-file</code></code>] [<code class="option">-d <code>debug-level</code></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <code>#cpus</code></code>] [<code class="option">-p <code>port</code></code>] [<code class="option">-s</code>] [<code class="option">-t <code>directory</code></code>] [<code class="option">-u <code>user</code></code>] [<code class="option">-v</code>] [<code class="option">-x <code>cache-file</code></code>]</div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525923"></a><h2>DESCRIPTION</h2>

+

+ named is a Domain Name System (DNS) server,

part of the BIND 9 distribution from ISC. For more

information on the DNS, see RFCs 1033, 1034, and 1035.

- </P

-><P

-> When invoked without arguments, <B

-CLASS="COMMAND"

->named</B

-> will

+

+

+ When invoked without arguments, named will

read the default configuration file

- <TT

-CLASS="FILENAME"

->/etc/named.conf</TT

->, read any initial

+ <code class="filename">/etc/named.conf</code>, read any initial

data, and listen for queries.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN56"

-></A

-><H2

->OPTIONS</H2

-><P

-></P

-><DIV

-CLASS="VARIABLELIST"

-><DL

-><DT

->-4</DT

-><DD

-><P

-> Use IPv4 only even if the host machine is capable of IPv6.

- <VAR

-CLASS="OPTION"

->-4</VAR

-> and <VAR

-CLASS="OPTION"

->-6</VAR

-> are mutually

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2525948"></a><h2>OPTIONS</h2>

+<div class="variablelist"><dl>

+<dt>-4</dt>

+<dd>

+ Use IPv4 only even if the host machine is capable of IPv6.

+ <code class="option">-4</code> and <code class="option">-6</code> are mutually

exclusive.

- </P

-></DD

-><DT

->-6</DT

-><DD

-><P

-> Use IPv6 only even if the host machine is capable of IPv4.

- <VAR

-CLASS="OPTION"

->-4</VAR

-> and <VAR

-CLASS="OPTION"

->-6</VAR

-> are mutually

+ </dd>

+<dt>-6</dt>

+<dd>

+ Use IPv6 only even if the host machine is capable of IPv4.

+ <code class="option">-4</code> and <code class="option">-6</code> are mutually

exclusive.

- </P

-></DD

-><DT

->-c <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-></DT

-><DD

-><P

-> Use <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-> as the

+ </dd>

+<dt>-c <code>config-file</code></dt>

+<dd>

+ Use <code>config-file</code> as the

configuration file instead of the default,

- <TT

-CLASS="FILENAME"

->/etc/named.conf</TT

->. To

+ <code class="filename">/etc/named.conf</code>. To

ensure that reloading the configuration file continues

to work after the server has changed its working

directory due to to a possible

- <VAR

-CLASS="OPTION"

->directory</VAR

-> option in the configuration

- file, <VAR

-CLASS="REPLACEABLE"

->config-file</VAR

-> should be

+ <code class="option">directory</code> option in the configuration

+ file, <code>config-file</code> should be

an absolute pathname.

- </P

-></DD

-><DT

->-d <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

-></DT

-><DD

-><P

-> Set the daemon's debug level to <VAR

-CLASS="REPLACEABLE"

->debug-level</VAR

->.

- Debugging traces from <B

-CLASS="COMMAND"

->named</B

-> become

+ </dd>

+<dt>-d <code>debug-level</code></dt>

+<dd>

+ Set the daemon's debug level to <code>debug-level</code>.

+ Debugging traces from named become

more verbose as the debug level increases.

- </P

-></DD

-><DT

->-f</DT

-><DD

-><P

-> Run the server in the foreground (i.e. do not daemonize).

- </P

-></DD

-><DT

->-g</DT

-><DD

-><P

-> Run the server in the foreground and force all logging

- to <TT

-CLASS="FILENAME"

->stderr</TT

->.

- </P

-></DD

-><DT

->-n <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-></DT

-><DD

-><P

-> Create <VAR

-CLASS="REPLACEABLE"

->#cpus</VAR

-> worker threads

+ </dd>

+<dt>-f</dt>

+<dd>

+ Run the server in the foreground (i.e. do not daemonize).

+ </dd>

+<dt>-g</dt>

+<dd>

+ Run the server in the foreground and force all logging

+ to <code class="filename">stderr</code>.

+ </dd>

+<dt>-n <code>#cpus</code></dt>

+<dd>

+ Create <code>#cpus</code> worker threads

to take advantage of multiple CPUs. If not specified,

- <B

-CLASS="COMMAND"

->named</B

-> will try to determine the

+ named will try to determine the

number of CPUs present and create one thread per CPU.

If it is unable to determine the number of CPUs, a

single worker thread will be created.

- </P

-></DD

-><DT

->-p <VAR

-CLASS="REPLACEABLE"

->port</VAR

-></DT

-><DD

-><P

-> Listen for queries on port <VAR

-CLASS="REPLACEABLE"

->port</VAR

->. If not

+ </dd>

+<dt>-p <code>port</code></dt>

+<dd>

+ Listen for queries on port <code>port</code>. If not

specified, the default is port 53.

- </P

-></DD

-><DT

->-s</DT

-><DD

-><P

-> Write memory usage statistics to <TT

-CLASS="FILENAME"

->stdout</TT

-> on exit.

- </P

-><DIV

-CLASS="NOTE"

-><BLOCKQUOTE

-CLASS="NOTE"

-><P

-><B

->Note: </B

-> This option is mainly of interest to BIND 9 developers

+ </dd>

+<dt>-s</dt>

+<dd>

+

+ Write memory usage statistics to <code class="filename">stdout</code> on exit.

+

+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Note</h3>

+

+ This option is mainly of interest to BIND 9 developers

and may be removed or changed in a future release.

- </P

-></BLOCKQUOTE

-></DIV

-></DD

-><DT

->-t <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-></DT

-><DD

-><P

-> <CODE

-CLASS="FUNCTION"

->chroot()</CODE

-> to <VAR

-CLASS="REPLACEABLE"

->directory</VAR

-> after

+

+</div>

+</dd>

+<dt>-t <code>directory</code></dt>

+<dd>

+

+ <code class="function">chroot()</code> to <code>directory</code> after

processing the command line arguments, but before

reading the configuration file.

- </P

-><DIV

-CLASS="WARNING"

-><P

-></P

-><TABLE

-CLASS="WARNING"

-BORDER="1"

-WIDTH="90%"

-><TR

-><TD

-ALIGN="CENTER"

-><B

->Warning</B

-></TD

-></TR

-><TR

-><TD

-ALIGN="LEFT"

-><P

-> This option should be used in conjunction with the

- <VAR

-CLASS="OPTION"

->-u</VAR

-> option, as chrooting a process

+

+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Warning</h3>

+

+ This option should be used in conjunction with the

+ <code class="option">-u</code> option, as chrooting a process

running as root doesn't enhance security on most

- systems; the way <CODE

-CLASS="FUNCTION"

->chroot()</CODE

-> is

+ systems; the way <code class="function">chroot()</code> is

defined allows a process with root privileges to

escape a chroot jail.

- </P

-></TD

-></TR

-></TABLE

-></DIV

-></DD

-><DT

->-u <VAR

-CLASS="REPLACEABLE"

->user</VAR

-></DT

-><DD

-><P

-> <CODE

-CLASS="FUNCTION"

->setuid()</CODE

-> to <VAR

-CLASS="REPLACEABLE"

->user</VAR

-> after completing

+

+</div>

+</dd>

+<dt>-u <code>user</code></dt>

+<dd>

+

+ <code class="function">setuid()</code> to <code>user</code> after completing

privileged operations, such as creating sockets that

listen on privileged ports.

- </P

-><DIV

-CLASS="NOTE"

-><BLOCKQUOTE

-CLASS="NOTE"

-><P

-><B

->Note: </B

-> On Linux, <B

-CLASS="COMMAND"

->named</B

-> uses the kernel's

+

+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Note</h3>

+

+ On Linux, named uses the kernel's

capability mechanism to drop all root privileges

- except the ability to <CODE

-CLASS="FUNCTION"

->bind()</CODE

-> to a

+ except the ability to <code class="function">bind()</code> to a

privileged port and set process resource limits.

- Unfortunately, this means that the <VAR

-CLASS="OPTION"

->-u</VAR

- option only works when <B

-CLASS="COMMAND"

->named</B

-> is run

+ Unfortunately, this means that the <code class="option">-u</code>

+ option only works when named is run

on kernel 2.2.18 or later, or kernel 2.3.99-pre3 or

later, since previous kernels did not allow privileges

- to be retained after <CODE

-CLASS="FUNCTION"

->setuid()</CODE

->.

- </P

-></BLOCKQUOTE

-></DIV

-></DD

-><DT

->-v</DT

-><DD

-><P

-> Report the version number and exit.

- </P

-></DD

-><DT

->-x <VAR

-CLASS="REPLACEABLE"

->cache-file</VAR

-></DT

-><DD

-><P

-> Load data from <VAR

-CLASS="REPLACEABLE"

->cache-file</VAR

-> into the

+ to be retained after <code class="function">setuid()</code>.

+

+</div>

+</dd>

+<dt>-v</dt>

+<dd>

+ Report the version number and exit.

+ </dd>

+<dt>-x <code>cache-file</code></dt>

+<dd>

+

+ Load data from <code>cache-file</code> into the

cache of the default view.

- </P

-><DIV

-CLASS="WARNING"

-><P

-></P

-><TABLE

-CLASS="WARNING"

-BORDER="1"

-WIDTH="90%"

-><TR

-><TD

-ALIGN="CENTER"

-><B

->Warning</B

-></TD

-></TR

-><TR

-><TD

-ALIGN="LEFT"

-><P

-> This option must not be used. It is only of interest

+

+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Warning</h3>

+

+ This option must not be used. It is only of interest

to BIND 9 developers and may be removed or changed in a

future release.

- </P

-></TD

-></TR

-></TABLE

-></DIV

-></DD

-></DL

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN153"

-></A

-><H2

->SIGNALS</H2

-><P

-> In routine operation, signals should not be used to control

- the nameserver; <B

-CLASS="COMMAND"

->rndc</B

-> should be used

+

+</div>

+</dd>

+</dl></div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526297"></a><h2>SIGNALS</h2>

+

+ In routine operation, signals should not be used to control

+ the nameserver; rndc should be used

instead.

- </P

-><P

-></P

-><DIV

-CLASS="VARIABLELIST"

-><DL

-><DT

->SIGHUP</DT

-><DD

-><P

-> Force a reload of the server.

- </P

-></DD

-><DT

->SIGINT, SIGTERM</DT

-><DD

-><P

-> Shut down the server.

- </P

-></DD

-></DL

-></DIV

-><P

-> The result of sending any other signals to the server is undefined.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN167"

-></A

-><H2

->CONFIGURATION</H2

-><P

-> The <B

-CLASS="COMMAND"

->named</B

-> configuration file is too complex

+

+<div class="variablelist"><dl>

+<dt>SIGHUP</dt>

+<dd>

+ Force a reload of the server.

+ </dd>

+<dt>SIGINT, SIGTERM</dt>

+<dd>

+ Shut down the server.

+ </dd>

+</dl></div>

+

+ The result of sending any other signals to the server is undefined.

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526412"></a><h2>CONFIGURATION</h2>

+

+ The named configuration file is too complex

to describe in detail here. A complete description is

- provided in the <I

-CLASS="CITETITLE"

->BIND 9 Administrator Reference

- Manual</I

->.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN172"

-></A

-><H2

->FILES</H2

-><P

-></P

-><DIV

-CLASS="VARIABLELIST"

-><DL

-><DT

-><TT

-CLASS="FILENAME"

->/etc/named.conf</TT

-></DT

-><DD

-><P

-> The default configuration file.

- </P

-></DD

-><DT

-><TT

-CLASS="FILENAME"

->/var/run/named.pid</TT

-></DT

-><DD

-><P

-> The default process-id file.

- </P

-></DD

-></DL

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN185"

-></A

-><H2

->SEE ALSO</H2

-><P

-> <I

-CLASS="CITETITLE"

->RFC 1033</I

->,

- <I

-CLASS="CITETITLE"

->RFC 1034</I

->,

- <I

-CLASS="CITETITLE"

->RFC 1035</I

->,

- <SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->rndc</SPAN

->(8)</SPAN

->,

- <SPAN

-CLASS="CITEREFENTRY"

-><SPAN

-CLASS="REFENTRYTITLE"

->lwresd</SPAN

->(8)</SPAN

->,

- <I

-CLASS="CITETITLE"

->BIND 9 Administrator Reference Manual</I

->.

- </P

-></DIV

-><DIV

-CLASS="REFSECT1"

-><A

-NAME="AEN198"

-></A

-><H2

->AUTHOR</H2

-><P

-> Internet Systems Consortium

- </P

-></DIV

-></BODY

-></HTML

+ provided in the BIND 9 Administrator Reference

+ Manual.

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526429"></a><h2>FILES</h2>

+<div class="variablelist"><dl>

+<dt><code class="filename">/etc/named.conf</code></dt>

+<dd>

+ The default configuration file.

+ </dd>

+<dt><code class="filename">/var/run/named.pid</code></dt>

+<dd>

+ The default process-id file.

+ </dd>

+</dl></div>

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526469"></a><h2>SEE ALSO</h2>

+

+ RFC 1033,

+ RFC 1034,

+ RFC 1035,

+ rndc(8),

+ lwresd(8),

+ BIND 9 Administrator Reference Manual.

+

+</div>

+<div class="refsect1" lang="en">

+<a name="id2526512"></a><h2>AUTHOR</h2>

+

+ Internet Systems Consortium

+

+</div>

+</div></body>

+</html>

diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c
index a5411af3433f..75102fd1369d 100644
--- a/contrib/bind9/bin/named/query.c
+++ b/contrib/bind9/bin/named/query.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: query.c,v 1.198.2.13.4.30 2004/06/30 14:13:05 marka Exp $ */

+/* $Id: query.c,v 1.198.2.13.4.36 2005/08/11 05:25:20 marka Exp $ */

#include <config.h>

@@ -1198,17 +1198,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {

* recursing to add address records, which in turn can cause

* recursion to add KEYs.

- if (type == dns_rdatatype_a || type == dns_rdatatype_aaaa) {

- /*

- * RFC 2535 section 3.5 says that when A or AAAA records are

- * retrieved as additional data, any KEY RRs for the owner name

- * should be added to the additional data section.

- *

- * XXXRTH We should lower the priority here. Alternatively,

- * we could raise the priority of glue records.

- */

- eresult = query_addadditional(client, name, dns_rdatatype_dnskey);

- } else if (type == dns_rdatatype_srv && trdataset != NULL) {

+ if (type == dns_rdatatype_srv && trdataset != NULL) {

* If we're adding SRV records to the additional data

* section, it's helpful if we add the SRV additional data

@@ -1241,8 +1231,6 @@ static inline void

query_addrdataset(ns_client_t *client, dns_name_t *fname,

dns_rdataset_t *rdataset)

{

- dns_rdatatype_t type = rdataset->type;

* Add 'rdataset' and any pertinent additional data to

* 'fname', a name in the response message for 'client'.

@@ -1266,22 +1254,6 @@ query_addrdataset(ns_client_t *client, dns_name_t *fname,

(void)dns_rdataset_additionaldata(rdataset,

query_addadditional, client);

- /*

- * RFC 2535 section 3.5 says that when NS, SOA, A, or AAAA records

- * are retrieved, any KEY RRs for the owner name should be added

- * to the additional data section. We treat A6 records the same way.

- *

- * We don't care if query_addadditional() fails.

- */

- if (type == dns_rdatatype_ns || type == dns_rdatatype_soa ||

- type == dns_rdatatype_a || type == dns_rdatatype_aaaa ||

- type == dns_rdatatype_a6) {

- /*

- * XXXRTH We should lower the priority here. Alternatively,

- * we could raise the priority of glue records.

- */

- (void)query_addadditional(client, fname, dns_rdatatype_dnskey);

- }

CTRACE("query_addrdataset: done");

}

@@ -2116,33 +2088,37 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,

* connection was accepted (if allowed by the TCP quota).

if (client->recursionquota == NULL) {

- isc_boolean_t killoldest = ISC_FALSE;

result = isc_quota_attach(&ns_g_server->recursionquota,

&client->recursionquota);

- if (result == ISC_R_SOFTQUOTA) {

+ if (result == ISC_R_SOFTQUOTA) {

ns_client_log(client, NS_LOGCATEGORY_CLIENT,

NS_LOGMODULE_QUERY, ISC_LOG_WARNING,

- "recursive-clients limit exceeded, "

+ "recursive-clients soft limit exceeded, "

"aborting oldest query");

- killoldest = ISC_TRUE;

+ ns_client_killoldestquery(client);

result = ISC_R_SUCCESS;

- }

- if (dns_resolver_nrunning(client->view->resolver) >

- (unsigned int)ns_g_server->recursionquota.max)

- result = ISC_R_QUOTA;

- if (result == ISC_R_SUCCESS && !client->mortal &&

- (client->attributes & NS_CLIENTATTR_TCP) == 0)

- result = ns_client_replace(client);

- if (result != ISC_R_SUCCESS) {

+ } else if (result == ISC_R_QUOTA) {

ns_client_log(client, NS_LOGCATEGORY_CLIENT,

NS_LOGMODULE_QUERY, ISC_LOG_WARNING,

"no more recursive clients: %s",

isc_result_totext(result));

- if (client->recursionquota != NULL)

+ ns_client_killoldestquery(client);

+ }

+ if (result == ISC_R_SUCCESS && !client->mortal &&

+ (client->attributes & NS_CLIENTATTR_TCP) == 0) {

+ result = ns_client_replace(client);

+ if (result != ISC_R_SUCCESS) {

+ ns_client_log(client, NS_LOGCATEGORY_CLIENT,

+ NS_LOGMODULE_QUERY,

+ ISC_LOG_WARNING,

+ "ns_client_replace() failed: %s",

+ isc_result_totext(result));

isc_quota_detach(&client->recursionquota);

- return (result);

+ }

}

- ns_client_recursing(client, killoldest);

+ if (result != ISC_R_SUCCESS)

+ return (result);

+ ns_client_recursing(client);

}

@@ -2319,6 +2295,34 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {

query_releasename(client, &fname);

}

+static inline void

+answer_in_glue(ns_client_t *client, dns_rdatatype_t qtype) {

+ dns_name_t *name;

+ dns_message_t *msg;

+ dns_section_t section = DNS_SECTION_ADDITIONAL;

+ dns_rdataset_t *rdataset = NULL;

+ msg = client->message;

+ for (name = ISC_LIST_HEAD(msg->sections[section]);

+ name != NULL;

+ name = ISC_LIST_NEXT(name, link))

+ if (dns_name_equal(name, client->query.qname)) {

+ for (rdataset = ISC_LIST_HEAD(name->list);

+ rdataset != NULL;

+ rdataset = ISC_LIST_NEXT(rdataset, link))

+ if (rdataset->type == qtype)

+ break;

+ }

+ if (rdataset != NULL) {

+ ISC_LIST_UNLINK(msg->sections[section], name, link);

+ ISC_LIST_PREPEND(msg->sections[section], name, link);

+ ISC_LIST_UNLINK(name->list, rdataset, link);

+ ISC_LIST_PREPEND(name->list, rdataset, link);

+ rdataset->attributes |= DNS_RDATASETATTR_REQUIREDGLUE;

+ }

* Do the bulk of query processing for the current query of 'client'.

* If 'event' is non-NULL, we are returning from recursion and 'qtype'

@@ -2875,7 +2879,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

* Add SOA. If the query was for a SOA record force the

* ttl to zero so that it is possible for clients to find

- * the containing zone of a arbitary name with a stub

+ * the containing zone of an arbitrary name with a stub

* resolver and not have it cached.

if (qtype == dns_rdatatype_soa)

@@ -3338,6 +3342,16 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

setup_query_sortlist(client);

+ /*

+ * If this is a referral and the answer to the question

+ * is in the glue sort it to the start of the additional

+ * section.

+ */

+ if (client->message->counts[DNS_SECTION_ANSWER] == 0 &&

+ client->message->rcode == dns_rcode_noerror &&

+ (qtype == dns_rdatatype_a || qtype == dns_rdatatype_aaaa))

+ answer_in_glue(client, qtype);

if (client->message->rcode == dns_rcode_nxdomain &&

client->view->auth_nxdomain == ISC_TRUE)

client->message->flags |= DNS_MESSAGEFLAG_AA;

diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c
index d0b6afc0e59a..b9d30d02f644 100644
--- a/contrib/bind9/bin/named/server.c
+++ b/contrib/bind9/bin/named/server.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: server.c,v 1.339.2.15.2.59 2004/11/10 22:13:56 marka Exp $ */

+/* $Id: server.c,v 1.339.2.15.2.65 2005/07/27 02:53:15 marka Exp $ */

#include <config.h>

@@ -81,6 +81,10 @@

#include <named/tkeyconf.h>

#include <named/tsigconf.h>

#include <named/zoneconf.h>

+#ifdef HAVE_LIBSCF

+#include <named/ns_smf_globals.h>

+#include <stdlib.h>

+#endif

* Check an operation for failure. Assumes that the function

@@ -1798,7 +1802,7 @@ configure_server_quota(cfg_obj_t **maps, const char *name, isc_quota_t *quota)

result = ns_config_get(maps, name, &obj);

INSIST(result == ISC_R_SUCCESS);

- quota->max = cfg_obj_asuint32(obj);

+ isc_quota_max(quota, cfg_obj_asuint32(obj));

}

@@ -1937,9 +1941,13 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {

* At this point the zone list may contain a stale zone

* just removed from the configuration. To see the validity,

* check if the corresponding view is in our current view list.

+ * There may also be old zones that are still in the process

+ * of shutting down and have detached from their old view

+ * (zoneview == NULL).

zoneview = dns_zone_getview(zone);

- INSIST(zoneview != NULL);

+ if (zoneview == NULL)

+ continue;

for (view = ISC_LIST_HEAD(server->viewlist);

view != NULL && view != zoneview;

view = ISC_LIST_NEXT(view, link))

@@ -2221,6 +2229,11 @@ load_configuration(const char *filename, ns_server_t *server,

configure_server_quota(maps, "tcp-clients", &server->tcpquota);

configure_server_quota(maps, "recursive-clients",

&server->recursionquota);

+ if (server->recursionquota.max > 1000)

+ isc_quota_soft(&server->recursionquota,

+ server->recursionquota.max - 100);

+ else

+ isc_quota_soft(&server->recursionquota, 0);

CHECK(configure_view_acl(NULL, config, "blackhole", &aclconfctx,

ns_g_mctx, &server->blackholeacl));

@@ -2948,7 +2961,6 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {

RUNTIME_CHECK(result == ISC_R_SUCCESS);

result = isc_quota_init(&server->recursionquota, 100);

RUNTIME_CHECK(result == ISC_R_SUCCESS);

- isc_quota_soft(&server->recursionquota, ISC_FALSE);

result = dns_aclenv_init(mctx, &server->aclenv);

RUNTIME_CHECK(result == ISC_R_SUCCESS);

@@ -3637,6 +3649,15 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {

struct viewlistentry *vle;

isc_result_t result = ISC_R_SUCCESS;

+ /*

+ * Prevent duplicate views.

+ */

+ for (vle = ISC_LIST_HEAD(dctx->viewlist);

+ vle != NULL;

+ vle = ISC_LIST_NEXT(vle, link))

+ if (vle->view == view)

+ return (ISC_R_SUCCESS);

vle = isc_mem_get(dctx->mctx, sizeof *vle);

if (vle == NULL)

return (ISC_R_NOMEMORY);

@@ -3700,9 +3721,11 @@ dumpdone(void *arg, isc_result_t result) {

if (dctx->view == NULL)

goto done;

INSIST(dctx->zone == NULL);

- }

+ } else

+ goto resume;

nextview:

fprintf(dctx->fp, ";\n; Start view %s\n;\n", dctx->view->view->name);

+ resume:

if (dctx->zone == NULL && dctx->cache == NULL && dctx->dumpcache) {

style = &dns_master_style_cache;

/* start cache dump */

@@ -3763,9 +3786,12 @@ dumpdone(void *arg, isc_result_t result) {

&dctx->mdctx);

if (result == DNS_R_CONTINUE)

return;

- if (result == ISC_R_NOTIMPLEMENTED)

+ if (result == ISC_R_NOTIMPLEMENTED) {

fprintf(dctx->fp, "; %s\n",

dns_result_totext(result));

+ result = ISC_R_SUCCESS;

+ goto nextzone;

+ }

if (result != ISC_R_SUCCESS)

goto cleanup;

}

@@ -3789,7 +3815,6 @@ dumpdone(void *arg, isc_result_t result) {

dumpcontext_destroy(dctx);

}

isc_result_t

ns_server_dumpdb(ns_server_t *server, char *args) {

struct dumpcontext *dctx = NULL;

@@ -3845,6 +3870,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {

ptr = next_token(&args, " \t");

}

+ nextview:

for (view = ISC_LIST_HEAD(server->viewlist);

view != NULL;

view = ISC_LIST_NEXT(view, link))

@@ -3853,6 +3879,11 @@ ns_server_dumpdb(ns_server_t *server, char *args) {

continue;

CHECK(add_view_tolist(dctx, view));

}

+ if (ptr != NULL) {

+ ptr = next_token(&args, " \t");

+ if (ptr != NULL)

+ goto nextview;

+ }

dumpdone(dctx, ISC_R_SUCCESS);

return (ISC_R_SUCCESS);

@@ -4101,3 +4132,22 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {

dns_zone_detach(&zone);

return (result);

}

+#ifdef HAVE_LIBSCF

+/*

+ * This function adds a message for rndc to echo if named

+ * is managed by smf and is also running chroot.

+ */

+isc_result_t

+ns_smf_add_message(isc_buffer_t *text) {

+ unsigned int n;

+ n = snprintf((char *)isc_buffer_used(text),

+ isc_buffer_availablelength(text),

+ "use svcadm(1M) to manage named");

+ if (n >= isc_buffer_availablelength(text))

+ return (ISC_R_NOSPACE);

+ isc_buffer_add(text, n);

+ return (ISC_R_SUCCESS);

+#endif /* HAVE_LIBSCF */

diff --git a/contrib/bind9/bin/named/unix/os.c b/contrib/bind9/bin/named/unix/os.c
index 797754948de3..f306f1462259 100644
--- a/contrib/bind9/bin/named/unix/os.c
+++ b/contrib/bind9/bin/named/unix/os.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: os.c,v 1.46.2.4.8.19 2004/10/07 02:34:20 marka Exp $ */

+/* $Id: os.c,v 1.46.2.4.8.22 2005/05/20 01:37:19 marka Exp $ */

#include <config.h>

#include <stdarg.h>

@@ -46,6 +46,9 @@

#include <named/main.h>

#include <named/os.h>

+#ifdef HAVE_LIBSCF

+#include <named/ns_smf_globals.h>

+#endif

static char *pidfile = NULL;

static int devnullfd = -1;

@@ -159,7 +162,7 @@ linux_setcaps(unsigned int caps) {

memset(&cap, 0, sizeof(cap));

cap.effective = caps;

cap.permitted = caps;

- cap.inheritable = caps;

+ cap.inheritable = 0;

if (syscall(SYS_capset, &caphead, &cap) < 0) {

isc__strerror(errno, strbuf, sizeof(strbuf));

ns_main_earlyfatal("capset failed: %s:"

@@ -417,6 +420,9 @@ all_digits(const char *s) {

void

ns_os_chroot(const char *root) {

char strbuf[ISC_STRERRORSIZE];

+#ifdef HAVE_LIBSCF

+ ns_smf_chroot = 0;

+#endif

if (root != NULL) {

if (chroot(root) < 0) {

isc__strerror(errno, strbuf, sizeof(strbuf));

@@ -426,6 +432,10 @@ ns_os_chroot(const char *root) {

isc__strerror(errno, strbuf, sizeof(strbuf));

ns_main_earlyfatal("chdir(/): %s", strbuf);

}

+#ifdef HAVE_LIBSCF

+ /* Set ns_smf_chroot flag on successful chroot. */

+ ns_smf_chroot = 1;

+#endif

}

diff --git a/contrib/bind9/bin/named/update.c b/contrib/bind9/bin/named/update.c
index 325381a85be0..6c2d7597f797 100644
--- a/contrib/bind9/bin/named/update.c
+++ b/contrib/bind9/bin/named/update.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: update.c,v 1.88.2.5.2.25 2004/10/21 01:40:22 marka Exp $ */

+/* $Id: update.c,v 1.88.2.5.2.27 2005/10/08 00:21:06 marka Exp $ */

#include <config.h>

@@ -2723,8 +2723,8 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {

INSIST(client->nupdates > 0);

client->nupdates--;

respond(client, uev->result);

- ns_client_detach(&client);

isc_event_free(&event);

+ ns_client_detach(&client);

}

@@ -2740,8 +2740,8 @@ forward_fail(isc_task_t *task, isc_event_t *event) {

INSIST(client->nupdates > 0);

client->nupdates--;

respond(client, DNS_R_SERVFAIL);

- ns_client_detach(&client);

isc_event_free(&event);

+ ns_client_detach(&client);

}

diff --git a/contrib/bind9/bin/named/xfrout.c b/contrib/bind9/bin/named/xfrout.c
index 9fb2697a45d6..687c287f4bda 100644
--- a/contrib/bind9/bin/named/xfrout.c
+++ b/contrib/bind9/bin/named/xfrout.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: xfrout.c,v 1.101.2.5.2.10 2004/04/02 06:08:17 marka Exp $ */

+/* $Id: xfrout.c,v 1.101.2.5.2.12 2005/10/14 02:13:05 marka Exp $ */

#include <config.h>

@@ -868,7 +868,7 @@ xfrout_log1(ns_client_t *client, dns_name_t *zonename,

const char *fmt, ...) ISC_FORMAT_PRINTF(5, 6);

static void

-xfrout_log(xfrout_ctx_t *xfr, unsigned int level, const char *fmt, ...)

+xfrout_log(xfrout_ctx_t *xfr, int level, const char *fmt, ...)

ISC_FORMAT_PRINTF(3, 4);

/**************************************************************************/

@@ -1710,7 +1710,7 @@ xfrout_log1(ns_client_t *client, dns_name_t *zonename,

* Logging function for use when there is a xfrout_ctx_t.

static void

-xfrout_log(xfrout_ctx_t *xfr, unsigned int level, const char *fmt, ...) {

+xfrout_log(xfrout_ctx_t *xfr, int level, const char *fmt, ...) {

va_list ap;

va_start(ap, fmt);

xfrout_logv(xfr->client, xfr->qname, xfr->qclass, level, fmt, ap);

diff --git a/contrib/bind9/bin/named/zoneconf.c b/contrib/bind9/bin/named/zoneconf.c
index afafa534d2b6..41ce69d6a627 100644
--- a/contrib/bind9/bin/named/zoneconf.c
+++ b/contrib/bind9/bin/named/zoneconf.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: zoneconf.c,v 1.87.2.4.10.13 2004/04/20 14:12:09 marka Exp $ */

+/* $Id: zoneconf.c,v 1.87.2.4.10.15 2005/09/06 02:12:39 marka Exp $ */

#include <config.h>

@@ -375,17 +375,30 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,

obj = NULL;

result = cfg_map_get(zoptions, "database", &obj);

if (result == ISC_R_SUCCESS)

- cpval = cfg_obj_asstring(obj);

+ cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));

else

cpval = default_dbtype;

- RETERR(strtoargv(mctx, cpval, &dbargc, &dbargv));

+ if (cpval == NULL)

+ return(ISC_R_NOMEMORY);

+ result = strtoargv(mctx, cpval, &dbargc, &dbargv);

+ if (result != ISC_R_SUCCESS && cpval != default_dbtype) {

+ isc_mem_free(mctx, cpval);

+ return (result);

+ }

* ANSI C is strange here. There is no logical reason why (char **)

* cannot be promoted automatically to (const char * const *) by the

* compiler w/o generating a warning.

- RETERR(dns_zone_setdbtype(zone, dbargc, (const char * const *)dbargv));

+ result = dns_zone_setdbtype(zone, dbargc, (const char * const *)dbargv);

isc_mem_put(mctx, dbargv, dbargc * sizeof(*dbargv));

+ if (cpval != default_dbtype)

+ isc_mem_free(mctx, cpval);

+ if (result != ISC_R_SUCCESS)

+ return (result);

obj = NULL;

result = cfg_map_get(zoptions, "file", &obj);