From owner-p4-projects@FreeBSD.ORG Fri Jul 27 05:36:30 2007 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 7599A16A41A; Fri, 27 Jul 2007 05:36:30 +0000 (UTC) Delivered-To: perforce@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 21A8B16A419 for ; Fri, 27 Jul 2007 05:36:30 +0000 (UTC) (envelope-from imp@freebsd.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 127C313C480 for ; Fri, 27 Jul 2007 05:36:30 +0000 (UTC) (envelope-from imp@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id l6R5aTNW032668 for ; Fri, 27 Jul 2007 05:36:29 GMT (envelope-from imp@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id l6R5aR3d032665 for perforce@freebsd.org; Fri, 27 Jul 2007 05:36:27 GMT (envelope-from imp@freebsd.org) Date: Fri, 27 Jul 2007 05:36:27 GMT Message-Id: <200707270536.l6R5aR3d032665@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to imp@freebsd.org using -f From: Warner Losh To: Perforce Change Reviews Cc: Subject: PERFORCE change 124154 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Jul 2007 05:36:30 -0000 http://perforce.freebsd.org/chv.cgi?CH=124154 Change 124154 by imp@imp_paco-paco on 2007/07/27 05:35:47 IFC @124148 Affected files ... .. //depot/projects/mips2/src/contrib/bind9/CHANGES#4 integrate .. //depot/projects/mips2/src/contrib/bind9/README#4 integrate .. //depot/projects/mips2/src/contrib/bind9/bin/named/client.c#4 integrate .. //depot/projects/mips2/src/contrib/bind9/bin/named/server.c#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM-book.xml#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch01.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch02.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch03.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch04.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch05.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch06.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch07.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch08.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch09.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch10.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.html#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.pdf#4 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.dig.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.dnssec-keygen.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.dnssec-signzone.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.host.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.named-checkconf.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.named-checkzone.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.named.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.rndc-confgen.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.rndc.conf.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/doc/arm/man.rndc.html#2 integrate .. //depot/projects/mips2/src/contrib/bind9/lib/dns/dispatch.c#4 integrate .. //depot/projects/mips2/src/contrib/bind9/lib/dns/include/dns/dispatch.h#3 integrate .. //depot/projects/mips2/src/contrib/bind9/version#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/HISTORY#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/README#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/VERSION#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/audit/audit.8#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/audit/audit.c#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/auditd/audit_warn.c#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/auditd/auditd.8#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/auditd/auditd.c#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/auditd/auditd.h#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/bin/auditreduce/auditreduce.c#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/config/config.h#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/configure#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/configure.ac#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/etc/audit_event#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/libbsm/au_control.3#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/libbsm/au_event.3#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/libbsm/audit_submit.3#3 integrate .. //depot/projects/mips2/src/contrib/openbsm/libbsm/bsm_io.c#4 integrate .. //depot/projects/mips2/src/contrib/openbsm/libbsm/bsm_token.c#4 integrate .. //depot/projects/mips2/src/etc/mtree/BSD.usr.dist#4 integrate .. //depot/projects/mips2/src/etc/rc.d/netif#3 integrate .. //depot/projects/mips2/src/lib/libc/net/sctp_sys_calls.c#3 integrate .. //depot/projects/mips2/src/lib/libc/yp/yplib.c#3 integrate .. //depot/projects/mips2/src/lib/libpam/modules/pam_lastlog/pam_lastlog.c#3 integrate .. //depot/projects/mips2/src/libexec/getty/ttys.5#2 integrate .. //depot/projects/mips2/src/release/doc/en_US.ISO8859-1/relnotes/article.sgml#5 integrate .. //depot/projects/mips2/src/sbin/Makefile#5 integrate .. //depot/projects/mips2/src/sbin/iscontrol/Makefile#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/auth_subr.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/config.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/fsm.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/iscontrol.8#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/iscontrol.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/iscontrol.h#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/iscsi.conf.5#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/login.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/misc.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/pdu.c#1 branch .. //depot/projects/mips2/src/sbin/iscontrol/pdu.h#1 branch .. //depot/projects/mips2/src/share/examples/kld/syscall/module/syscall.c#2 integrate .. //depot/projects/mips2/src/share/man/man4/Makefile#7 integrate .. //depot/projects/mips2/src/share/man/man4/iscsi_initiator.4#1 branch .. //depot/projects/mips2/src/share/man/man4/udav.4#3 integrate .. //depot/projects/mips2/src/share/man/man4/usb.4#3 integrate .. //depot/projects/mips2/src/share/man/man7/ports.7#5 integrate .. //depot/projects/mips2/src/share/man/man8/rc.8#4 integrate .. //depot/projects/mips2/src/share/mk/version_gen.awk#3 integrate .. //depot/projects/mips2/src/sys/amd64/amd64/trap.c#5 integrate .. //depot/projects/mips2/src/sys/amd64/isa/clock.c#4 integrate .. //depot/projects/mips2/src/sys/bsm/audit.h#4 integrate .. //depot/projects/mips2/src/sys/bsm/audit_internal.h#4 integrate .. //depot/projects/mips2/src/sys/bsm/audit_kevents.h#5 integrate .. //depot/projects/mips2/src/sys/bsm/audit_record.h#5 integrate .. //depot/projects/mips2/src/sys/cam/scsi/scsi_cd.c#6 integrate .. //depot/projects/mips2/src/sys/compat/ndis/subr_ntoskrnl.c#4 integrate .. //depot/projects/mips2/src/sys/conf/NOTES#6 integrate .. //depot/projects/mips2/src/sys/conf/files#8 integrate .. //depot/projects/mips2/src/sys/conf/options#6 integrate .. //depot/projects/mips2/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c#4 integrate .. //depot/projects/mips2/src/sys/dev/acpica/acpi_hpet.c#4 integrate .. //depot/projects/mips2/src/sys/dev/if_ndis/if_ndis.c#4 integrate .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/isc_cam.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/isc_sm.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/isc_soc.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/isc_subr.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/iscsi.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/iscsi.h#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/iscsi_subr.c#1 branch .. //depot/projects/mips2/src/sys/dev/iscsi/initiator/iscsivar.h#1 branch .. //depot/projects/mips2/src/sys/dev/nfe/if_nfe.c#4 integrate .. //depot/projects/mips2/src/sys/dev/nfe/if_nfevar.h#4 integrate .. //depot/projects/mips2/src/sys/dev/ral/rt2560.c#6 integrate .. //depot/projects/mips2/src/sys/dev/ral/rt2661.c#4 integrate .. //depot/projects/mips2/src/sys/dev/re/if_re.c#5 integrate .. //depot/projects/mips2/src/sys/dev/usb/if_udav.c#4 integrate .. //depot/projects/mips2/src/sys/dev/usb/ukbd.c#4 integrate .. //depot/projects/mips2/src/sys/dev/usb/ums.c#4 integrate .. //depot/projects/mips2/src/sys/dev/usb/usb_quirks.c#4 integrate .. //depot/projects/mips2/src/sys/dev/usb/usbdevs#6 integrate .. //depot/projects/mips2/src/sys/fs/devfs/devfs_vnops.c#7 integrate .. //depot/projects/mips2/src/sys/fs/fifofs/fifo_vnops.c#5 integrate .. //depot/projects/mips2/src/sys/fs/msdosfs/msdosfs_vfsops.c#4 integrate .. //depot/projects/mips2/src/sys/fs/tmpfs/tmpfs_vfsops.c#2 integrate .. //depot/projects/mips2/src/sys/i386/i386/trap.c#6 integrate .. //depot/projects/mips2/src/sys/i386/isa/clock.c#4 integrate .. //depot/projects/mips2/src/sys/ia64/ia64/clock.c#3 integrate .. //depot/projects/mips2/src/sys/kern/kern_kse.c#4 integrate .. //depot/projects/mips2/src/sys/kern/kern_thread.c#4 integrate .. //depot/projects/mips2/src/sys/kern/subr_clock.c#3 integrate .. //depot/projects/mips2/src/sys/kern/uipc_usrreq.c#6 integrate .. //depot/projects/mips2/src/sys/kern/vfs_mount.c#5 integrate .. //depot/projects/mips2/src/sys/kern/vfs_vnops.c#4 integrate .. //depot/projects/mips2/src/sys/modules/Makefile#6 integrate .. //depot/projects/mips2/src/sys/modules/iscsi/Makefile#1 branch .. //depot/projects/mips2/src/sys/modules/iscsi/initiator/Makefile#1 branch .. //depot/projects/mips2/src/sys/net/if_bridge.c#5 integrate .. //depot/projects/mips2/src/sys/net/if_bridgevar.h#5 integrate .. //depot/projects/mips2/src/sys/net/if_lagg.c#3 integrate .. //depot/projects/mips2/src/sys/netgraph/ng_bpf.c#2 integrate .. //depot/projects/mips2/src/sys/netgraph/ng_eiface.c#3 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_asconf.c#3 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_asconf.h#3 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_indata.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_input.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_os_bsd.h#3 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_output.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_pcb.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_pcb.h#4 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_structs.h#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_timer.c#4 integrate .. //depot/projects/mips2/src/sys/netinet/sctp_usrreq.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctputil.c#5 integrate .. //depot/projects/mips2/src/sys/netinet/sctputil.h#5 integrate .. //depot/projects/mips2/src/sys/netinet/tcp_input.c#6 integrate .. //depot/projects/mips2/src/sys/netinet/tcp_subr.c#6 integrate .. //depot/projects/mips2/src/sys/netinet/tcp_syncache.c#6 integrate .. //depot/projects/mips2/src/sys/netinet/tcp_syncache.h#1 branch .. //depot/projects/mips2/src/sys/netinet/tcp_var.h#6 integrate .. //depot/projects/mips2/src/sys/netinet6/sctp6_usrreq.c#4 integrate .. //depot/projects/mips2/src/sys/netinet6/udp6_output.c#4 delete .. //depot/projects/mips2/src/sys/netinet6/udp6_usrreq.c#5 integrate .. //depot/projects/mips2/src/sys/netinet6/udp6_var.h#3 integrate .. //depot/projects/mips2/src/sys/pc98/cbus/clock.c#4 integrate .. //depot/projects/mips2/src/sys/pci/if_rl.c#3 integrate .. //depot/projects/mips2/src/sys/pci/if_rlreg.h#5 integrate .. //depot/projects/mips2/src/sys/security/mac_mls/mac_mls.c#5 integrate .. //depot/projects/mips2/src/sys/sparc64/sparc64/eeprom.c#3 integrate .. //depot/projects/mips2/src/sys/sparc64/sparc64/rtc.c#3 integrate .. //depot/projects/mips2/src/sys/sys/proc.h#5 integrate .. //depot/projects/mips2/src/sys/vm/vnode_pager.c#7 integrate .. //depot/projects/mips2/src/usr.bin/su/su.1#3 integrate .. //depot/projects/mips2/src/usr.sbin/periodic/periodic.8#3 integrate Differences ... ==== //depot/projects/mips2/src/contrib/bind9/CHANGES#4 (text+ko) ==== @@ -1,4 +1,34 @@ + --- 9.4.1-P1 released --- + +2206. [security] "allow-query-cache" and "allow-recursion" now + cross inherit from each other. + + If allow-query-cache is not set in named.conf then + allow-recursion is used if set, otherwise allow-query + is used if set, otherwise the default (localnets; + localhost;) is used. + + If allow-recursion is not set in named.conf then + allow-query-cache is used if set, otherwise allow-query + is used if set, otherwise the default (localnets; + localhost;) is used. + + [RT #16987] + +2203. [security] Query id generation was cryptographically weak. + [RT # 16915] + +2202. [security] The default acls for allow-query-cache and + allow-recursion were not being applied. [RT #16960] + +2193. [port] win32: BINDInstall.exe is now linked statically. + [RT #16906] + +2192. [port] win32: use vcredist_x86.exe to install Visual + Studio's redistributable dlls if building with + Visual Stdio 2005 or later. + --- 9.4.1 released --- 2172. [bug] query_addsoa() was being called with a non zone db. ==== //depot/projects/mips2/src/contrib/bind9/README#4 (text+ko) ==== @@ -43,6 +43,11 @@ Nominum, Inc. +BIND 9.4.1-P1 + + BIND 9.4.1-P1 is a security release, containing a fixes for a + security bugs in BIND 9.4.1. + BIND 9.4.1 BIND 9.4.1 is a security release, containing a fix for a ==== //depot/projects/mips2/src/contrib/bind9/bin/named/client.c#4 (text+ko) ==== @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: client.c,v 1.219.18.20 2006/07/22 01:02:36 marka Exp $ */ +/* $Id: client.c,v 1.219.18.20.14.1 2007/06/26 02:58:54 marka Exp $ */ #include @@ -1440,6 +1440,14 @@ } /* + * Hash the incoming request here as it is after + * dns_dispatch_importrecv(). + */ + dns_dispatch_hash(&client->now, sizeof(client->now)); + dns_dispatch_hash(isc_buffer_base(buffer), + isc_buffer_usedlength(buffer)); + + /* * It's a request. Parse it. */ result = dns_message_parse(client->message, buffer, 0); ==== //depot/projects/mips2/src/contrib/bind9/bin/named/server.c#4 (text+ko) ==== @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: server.c,v 1.419.18.49 2006/12/07 05:24:19 marka Exp $ */ +/* $Id: server.c,v 1.419.18.49.12.2 2007/07/09 02:23:16 marka Exp $ */ /*! \file */ @@ -1435,12 +1435,12 @@ view->additionalfromcache = ISC_TRUE; } + /* + * Set "allow-query-cache" and "allow-recursion" acls if + * configured in named.conf. + */ CHECK(configure_view_acl(vconfig, config, "allow-query-cache", actx, ns_g_mctx, &view->queryacl)); - if (view->queryacl == NULL) - CHECK(configure_view_acl(NULL, ns_g_defaults, - "allow-query-cache", actx, - ns_g_mctx, &view->queryacl)); if (strcmp(view->name, "_bind") != 0) CHECK(configure_view_acl(vconfig, config, "allow-recursion", @@ -1460,11 +1460,29 @@ "active%s%s", forview, viewname); /* - * Set default "allow-recursion" acl. + * "allow-query-cache" inherits from "allow-recursion" if set, + * otherwise from "allow-query" if set. + * "allow-recursion" inherits from "allow-query-cache" if set, + * otherwise from "allow-query" if set. + */ + if (view->queryacl == NULL && view->recursionacl != NULL) + dns_acl_attach(view->recursionacl, &view->queryacl); + if (view->queryacl == NULL) + CHECK(configure_view_acl(vconfig, config, "allow-query", + actx, ns_g_mctx, &view->queryacl)); + if (view->recursionacl == NULL && view->queryacl != NULL) + dns_acl_attach(view->queryacl, &view->recursionacl); + + /* + * Set default "allow-recursion" and "allow-query-cache" acls. */ if (view->recursionacl == NULL && view->recursion) - CHECK(configure_view_acl(NULL, ns_g_defaults, "allow-recursion", + CHECK(configure_view_acl(NULL, ns_g_config, "allow-recursion", actx, ns_g_mctx, &view->recursionacl)); + if (view->queryacl == NULL) + CHECK(configure_view_acl(NULL, ns_g_config, + "allow-query-cache", actx, + ns_g_mctx, &view->queryacl)); CHECK(configure_view_acl(vconfig, config, "sortlist", actx, ns_g_mctx, &view->sortlist)); ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM-book.xml#4 (text+ko) ==== @@ -18,7 +18,7 @@ - PERFORMANCE OF THIS SOFTWARE. --> - + BIND 9 Administrator Reference Manual @@ -5827,32 +5827,29 @@ Specifies which hosts are allowed to get answers - from the cache. The default is the builtin acls - localnets and - localhost. + from the cache. If allow-query-cache + is not set then allow-recursion + is used if set, otherwise allow-query + is used if set, otherwise the default + (localnets; + localhost;) is used. - - The way to set query access to the cache is now - via allow-query-cache. - This differs from earlier versions which used - allow-query. - allow-recursion - + Specifies which hosts are allowed to make recursive - queries through this server. If not specified, - the default is to allow recursive queries from - the builtin acls localnets and - localhost. - Note that disallowing recursive queries for a - host does not prevent the host from retrieving - data that is already in the server's cache. - + queries through this server. If + allow-recursion is not set + then allow-query-cache is + used if set, otherwise allow-query + is used if set, otherwise the default + (localnets; + localhost;) is used. + ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch01.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -47,15 +47,15 @@
Scope of Document
Organization of This Document
-
Conventions Used in This Document
-
The Domain Name System (DNS)
+
Conventions Used in This Document
+
The Domain Name System (DNS)
-
DNS Fundamentals
-
Domains and Domain Names
-
Zones
-
Authoritative Name Servers
-
Caching Name Servers
-
Name Servers in Multiple Roles
+
DNS Fundamentals
+
Domains and Domain Names
+
Zones
+
Authoritative Name Servers
+
Caching Name Servers
+
Name Servers in Multiple Roles
@@ -116,7 +116,7 @@

-Conventions Used in This Document

+Conventions Used in This Document

In this document, we use the following general typographic conventions: @@ -243,7 +243,7 @@

-The Domain Name System (DNS)

+The Domain Name System (DNS)

The purpose of this document is to explain the installation and upkeep of the BIND software @@ -253,7 +253,7 @@

-DNS Fundamentals

+DNS Fundamentals

The Domain Name System (DNS) is a hierarchical, distributed database. It stores information for mapping Internet host names to @@ -273,7 +273,7 @@

-Domains and Domain Names

+Domains and Domain Names

The data stored in the DNS is identified by domain names that are organized as a tree according to organizational or administrative boundaries. Each node of the tree, @@ -319,7 +319,7 @@

-Zones

+Zones

To properly operate a name server, it is important to understand the difference between a zone @@ -372,7 +372,7 @@

-Authoritative Name Servers

+Authoritative Name Servers

Each zone is served by at least one authoritative name server, @@ -389,7 +389,7 @@

-The Primary Master

+The Primary Master

The authoritative server where the master copy of the zone data is maintained is called the @@ -409,7 +409,7 @@

-Slave Servers

+Slave Servers

The other authoritative servers, the slave servers (also known as secondary servers) @@ -425,7 +425,7 @@

-Stealth Servers

+Stealth Servers

Usually all of the zone's authoritative servers are listed in NS records in the parent zone. These NS records constitute @@ -460,7 +460,7 @@

-Caching Name Servers

+Caching Name Servers

The resolver libraries provided by most operating systems are stub resolvers, meaning that they are not @@ -487,7 +487,7 @@

-Forwarding

+Forwarding

Even a caching name server does not necessarily perform the complete recursive lookup itself. Instead, it can @@ -514,7 +514,7 @@

-Name Servers in Multiple Roles

+Name Servers in Multiple Roles

The BIND name server can simultaneously act as ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch02.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -45,16 +45,16 @@

Table of Contents

-
Hardware requirements
-
CPU Requirements
-
Memory Requirements
-
Name Server Intensive Environment Issues
-
Supported Operating Systems
+
Hardware requirements
+
CPU Requirements
+
Memory Requirements
+
Name Server Intensive Environment Issues
+
Supported Operating Systems

-Hardware requirements

+Hardware requirements

DNS hardware requirements have traditionally been quite modest. @@ -73,7 +73,7 @@

-CPU Requirements

+CPU Requirements

CPU requirements for BIND 9 range from i486-class machines @@ -84,7 +84,7 @@

-Memory Requirements

+Memory Requirements

The memory of the server has to be large enough to fit the cache and zones loaded off disk. The max-cache-size @@ -107,7 +107,7 @@

-Name Server Intensive Environment Issues

+Name Server Intensive Environment Issues

For name server intensive environments, there are two alternative configurations that may be used. The first is where clients and @@ -124,7 +124,7 @@

-Supported Operating Systems

+Supported Operating Systems

ISC BIND 9 compiles and runs on a large number ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch03.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -47,14 +47,14 @@

Sample Configurations
-
A Caching-only Name Server
-
An Authoritative-only Name Server
+
A Caching-only Name Server
+
An Authoritative-only Name Server
-
Load Balancing
-
Name Server Operations
+
Load Balancing
+
Name Server Operations
-
Tools for Use With the Name Server Daemon
-
Signals
+
Tools for Use With the Name Server Daemon
+
Signals
@@ -68,7 +68,7 @@ Sample Configurations

-A Caching-only Name Server

+A Caching-only Name Server

The following sample configuration is appropriate for a caching-only name server for use by clients internal to a corporation. All @@ -95,7 +95,7 @@

-An Authoritative-only Name Server

+An Authoritative-only Name Server

This sample configuration is for an authoritative-only server that is the master server for "example.com" @@ -137,7 +137,7 @@

-Load Balancing

+Load Balancing

A primitive form of load balancing can be achieved in the DNS by using multiple A records for @@ -280,10 +280,10 @@

-Name Server Operations

+Name Server Operations

-Tools for Use With the Name Server Daemon

+Tools for Use With the Name Server Daemon

This section describes several indispensable diagnostic, administrative and monitoring tools available to the system @@ -741,7 +741,7 @@

-Signals

+Signals

Certain UNIX signals cause the name server to take specific actions, as described in the following table. These signals can ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch04.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -49,28 +49,28 @@

Dynamic Update
The journal file
Incremental Zone Transfers (IXFR)
-
Split DNS
+
Split DNS
TSIG
-
Generate Shared Keys for Each Pair of Hosts
-
Copying the Shared Secret to Both Machines
-
Informing the Servers of the Key's Existence
-
Instructing the Server to Use the Key
-
TSIG Key Based Access Control
-
Errors
+
Generate Shared Keys for Each Pair of Hosts
+
Copying the Shared Secret to Both Machines
+
Informing the Servers of the Key's Existence
+
Instructing the Server to Use the Key
+
TSIG Key Based Access Control
+
Errors
-
TKEY
-
SIG(0)
+
TKEY
+
SIG(0)
DNSSEC
-
Generating Keys
-
Signing the Zone
-
Configuring Servers
+
Generating Keys
+
Signing the Zone
+
Configuring Servers
-
IPv6 Support in BIND 9
+
IPv6 Support in BIND 9
-
Address Lookups Using AAAA Records
-
Address to Name Lookups Using Nibble Format
+
Address Lookups Using AAAA Records
+
Address to Name Lookups Using Nibble Format
@@ -204,7 +204,7 @@

-Split DNS

+Split DNS

Setting up different views, or visibility, of the DNS space to internal and external resolvers is usually referred to as a @@ -479,7 +479,7 @@

-Generate Shared Keys for Each Pair of Hosts

+Generate Shared Keys for Each Pair of Hosts

A shared secret is generated to be shared between host1 and host2. An arbitrary key name is chosen: "host1-host2.". The key name must @@ -487,7 +487,7 @@

-Automatic Generation

+Automatic Generation

The following command will generate a 128-bit (16 byte) HMAC-MD5 key as described above. Longer keys are better, but shorter keys @@ -512,7 +512,7 @@

-Manual Generation

+Manual Generation

The shared secret is simply a random sequence of bits, encoded in base-64. Most ASCII strings are valid base-64 strings (assuming @@ -527,7 +527,7 @@

-Copying the Shared Secret to Both Machines

+Copying the Shared Secret to Both Machines

This is beyond the scope of DNS. A secure transport mechanism should be used. This could be secure FTP, ssh, telephone, etc. @@ -535,7 +535,7 @@

-Informing the Servers of the Key's Existence

+Informing the Servers of the Key's Existence

Imagine host1 and host 2 are @@ -564,7 +564,7 @@

-Instructing the Server to Use the Key

+Instructing the Server to Use the Key

Since keys are shared between two hosts only, the server must be told when keys are to be used. The following is added to the named.conf file @@ -596,7 +596,7 @@

-TSIG Key Based Access Control

+TSIG Key Based Access Control

BIND allows IP addresses and ranges to be specified in ACL @@ -624,7 +624,7 @@

-Errors

+Errors

The processing of TSIG signed messages can result in several errors. If a signed message is sent to a non-TSIG aware @@ -650,7 +650,7 @@

-TKEY

+TKEY

TKEY is a mechanism for automatically generating a shared secret between two hosts. There are several "modes" of @@ -686,7 +686,7 @@

-SIG(0)

+SIG(0)

BIND 9 partially supports DNSSEC SIG(0) transaction signatures as specified in RFC 2535 and RFC2931. @@ -747,7 +747,7 @@

-Generating Keys

+Generating Keys

The dnssec-keygen program is used to generate keys. @@ -798,7 +798,7 @@

-Signing the Zone

+Signing the Zone

The dnssec-signzone program is used to @@ -842,7 +842,7 @@

-Configuring Servers

+Configuring Servers

To enable named to respond appropriately to DNS requests from DNSSEC aware clients, @@ -930,7 +930,7 @@

-IPv6 Support in BIND 9

+IPv6 Support in BIND 9

BIND 9 fully supports all currently defined forms of IPv6 @@ -969,7 +969,7 @@

-Address Lookups Using AAAA Records

+Address Lookups Using AAAA Records

The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -988,7 +988,7 @@

-Address to Name Lookups Using Nibble Format

+Address to Name Lookups Using Nibble Format

When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch05.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -45,13 +45,13 @@

Table of Contents

-
The Lightweight Resolver Library
+
The Lightweight Resolver Library
Running a Resolver Daemon

-The Lightweight Resolver Library

+The Lightweight Resolver Library

Traditionally applications have been linked with a stub resolver library that sends recursive DNS queries to a local caching name ==== //depot/projects/mips2/src/contrib/bind9/doc/arm/Bv9ARM.ch06.html#4 (text+ko) ==== @@ -14,7 +14,7 @@ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR - PERFORMANCE OF THIS SOFTWARE. --> - + @@ -48,52 +48,52 @@

Configuration File Elements
Address Match Lists
-
Comment Syntax
+
Comment Syntax
Configuration File Grammar
-
acl Statement Grammar
+
acl Statement Grammar
acl Statement Definition and Usage
-
controls Statement Grammar
+
controls Statement Grammar
controls Statement Definition and Usage
-
include Statement Grammar
-
include Statement Definition and +
include Statement Grammar
+
include Statement Definition and Usage
-
key Statement Grammar
-
key Statement Definition and Usage
-
logging Statement Grammar
-
logging Statement Definition and +
key Statement Grammar
+
key Statement Definition and Usage
+
logging Statement Grammar
+
logging Statement Definition and Usage
-
lwres Statement Grammar
-
lwres Statement Definition and Usage
-
masters Statement Grammar
-
masters Statement Definition and +
lwres Statement Grammar
+
lwres Statement Definition and Usage
+
masters Statement Grammar
+
masters Statement Definition and Usage
-
options Statement Grammar
+
options Statement Grammar
options Statement Definition and Usage
server Statement Grammar
server Statement Definition and Usage
-
trusted-keys Statement Grammar
-
trusted-keys Statement Definition +
trusted-keys Statement Grammar
+
trusted-keys Statement Definition and Usage
view Statement Grammar
-
view Statement Definition and Usage
+
view Statement Definition and Usage
zone Statement Grammar
-
zone Statement Definition and Usage
+
zone Statement Definition and Usage
-
Zone File
+
Zone File
Types of Resource Records and When to Use Them
-
Discussion of MX Records
+
Discussion of MX Records
Setting TTLs
-
Inverse Mapping in IPv4
-
Other Zone File Directives
-
BIND Master File Extension: the $GENERATE Directive
+
Inverse Mapping in IPv4
+
Other Zone File Directives
+
BIND Master File Extension: the $GENERATE Directive
Additional File Formats
@@ -428,7 +428,7 @@ Address Match Lists

-Syntax

+Syntax
address_match_list = address_match_list_element ;

>>> TRUNCATED FOR MAIL (1000 lines) <<<