From owner-svn-src-all@freebsd.org Wed Dec 16 13:56:44 2015 Return-Path: Delivered-To: svn-src-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 135E6A49D35; Wed, 16 Dec 2015 13:56:44 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id C79B31133; Wed, 16 Dec 2015 13:56:43 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tBG6A7vW094132; Wed, 16 Dec 2015 06:10:07 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id tBG6A5ER094107; Wed, 16 Dec 2015 06:10:05 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201512160610.tBG6A5ER094107@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Wed, 16 Dec 2015 06:10:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-9@freebsd.org Subject: svn commit: r292320 - in stable/9/contrib/bind9: . doc/arm lib/dns lib/dns/include/dns lib/lwres/man X-SVN-Group: stable-9 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2015 13:56:44 -0000 Author: delphij Date: Wed Dec 16 06:10:05 2015 New Revision: 292320 URL: https://svnweb.freebsd.org/changeset/base/292320 Log: MFV r292314: Update BIND to 9.9.8-P2. See release notes for notable changes: https://kb.isc.org/article/AA-01326 Note this is a direct commit to stable/9 as BIND is no longer in head. Modified: stable/9/contrib/bind9/CHANGES stable/9/contrib/bind9/README stable/9/contrib/bind9/configure.in stable/9/contrib/bind9/doc/arm/Bv9ARM.ch01.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch02.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch03.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch04.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch05.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch06.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch07.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch08.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch09.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch10.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch11.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch12.html stable/9/contrib/bind9/doc/arm/Bv9ARM.ch13.html stable/9/contrib/bind9/doc/arm/Bv9ARM.html stable/9/contrib/bind9/doc/arm/Bv9ARM.pdf stable/9/contrib/bind9/doc/arm/man.arpaname.html stable/9/contrib/bind9/doc/arm/man.ddns-confgen.html stable/9/contrib/bind9/doc/arm/man.dig.html stable/9/contrib/bind9/doc/arm/man.dnssec-checkds.html stable/9/contrib/bind9/doc/arm/man.dnssec-coverage.html stable/9/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html stable/9/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html stable/9/contrib/bind9/doc/arm/man.dnssec-keygen.html stable/9/contrib/bind9/doc/arm/man.dnssec-revoke.html stable/9/contrib/bind9/doc/arm/man.dnssec-settime.html stable/9/contrib/bind9/doc/arm/man.dnssec-signzone.html stable/9/contrib/bind9/doc/arm/man.dnssec-verify.html stable/9/contrib/bind9/doc/arm/man.genrandom.html stable/9/contrib/bind9/doc/arm/man.host.html stable/9/contrib/bind9/doc/arm/man.isc-hmac-fixup.html stable/9/contrib/bind9/doc/arm/man.named-checkconf.html stable/9/contrib/bind9/doc/arm/man.named-checkzone.html stable/9/contrib/bind9/doc/arm/man.named-journalprint.html stable/9/contrib/bind9/doc/arm/man.named.html stable/9/contrib/bind9/doc/arm/man.nsec3hash.html stable/9/contrib/bind9/doc/arm/man.nsupdate.html stable/9/contrib/bind9/doc/arm/man.rndc-confgen.html stable/9/contrib/bind9/doc/arm/man.rndc.conf.html stable/9/contrib/bind9/doc/arm/man.rndc.html stable/9/contrib/bind9/doc/arm/notes.html stable/9/contrib/bind9/doc/arm/notes.pdf stable/9/contrib/bind9/doc/arm/notes.xml stable/9/contrib/bind9/lib/dns/api stable/9/contrib/bind9/lib/dns/include/dns/message.h stable/9/contrib/bind9/lib/dns/message.c stable/9/contrib/bind9/lib/dns/opensslrsa_link.c stable/9/contrib/bind9/lib/dns/resolver.c stable/9/contrib/bind9/lib/dns/rootns.c stable/9/contrib/bind9/lib/dns/xfrin.c stable/9/contrib/bind9/lib/lwres/man/lwres.html stable/9/contrib/bind9/lib/lwres/man/lwres_buffer.html stable/9/contrib/bind9/lib/lwres/man/lwres_config.html stable/9/contrib/bind9/lib/lwres/man/lwres_context.html stable/9/contrib/bind9/lib/lwres/man/lwres_gabn.html stable/9/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html stable/9/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html stable/9/contrib/bind9/lib/lwres/man/lwres_gethostent.html stable/9/contrib/bind9/lib/lwres/man/lwres_getipnode.html stable/9/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html stable/9/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html stable/9/contrib/bind9/lib/lwres/man/lwres_gnba.html stable/9/contrib/bind9/lib/lwres/man/lwres_hstrerror.html stable/9/contrib/bind9/lib/lwres/man/lwres_inetntop.html stable/9/contrib/bind9/lib/lwres/man/lwres_noop.html stable/9/contrib/bind9/lib/lwres/man/lwres_packet.html stable/9/contrib/bind9/lib/lwres/man/lwres_resutil.html stable/9/contrib/bind9/version Directory Properties: stable/9/contrib/bind9/ (props changed) Modified: stable/9/contrib/bind9/CHANGES ============================================================================== --- stable/9/contrib/bind9/CHANGES Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/CHANGES Wed Dec 16 06:10:05 2015 (r292320) @@ -1,3 +1,21 @@ + --- 9.9.8-P2 released --- + +4270. [security] Update allowed OpenSSL versions as named is + potentially vulnerable to CVE-2015-3193. + +4261. [maint] H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53. + [RT #40556] + +4260. [security] Insufficient testing when parsing a message allowed + records with an incorrect class to be be accepted, + triggering a REQUIRE failure when those records + were subsequently cached. (CVE-2015-8000) [RT #40987] + +4253. [security] Address fetch context reference count handling error + on socket error. (CVE-2015-8461) [RT#40945] + + --- 9.9.8-P1 (withdrawn) --- + --- 9.9.8 released --- --- 9.9.8rc1 released --- Modified: stable/9/contrib/bind9/README ============================================================================== --- stable/9/contrib/bind9/README Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/README Wed Dec 16 06:10:05 2015 (r292320) @@ -51,6 +51,17 @@ BIND 9 For up-to-date release notes and errata, see http://www.isc.org/software/bind9/releasenotes +BIND 9.9.8-P2 + + BIND 9.9.8-P2 is a security release addressing the flaws + described in CVE-2015-3193 (OpenSSL), CVE-2015-8000 and + CVE-2015-8461. + +BIND 9.9.8-P1 + + BIND 9.9.8-P1 was incomplete and was withdrawn prior to + publication. + BIND 9.9.8 BIND 9.9.8 is a maintenance release and addresses bugs Modified: stable/9/contrib/bind9/configure.in ============================================================================== --- stable/9/contrib/bind9/configure.in Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/configure.in Wed Dec 16 06:10:05 2015 (r292320) @@ -810,12 +810,17 @@ yes|'') int main() { if ((OPENSSL_VERSION_NUMBER >= 0x009070cfL && OPENSSL_VERSION_NUMBER < 0x00908000L) || - OPENSSL_VERSION_NUMBER >= 0x0090804fL) + (OPENSSL_VERSION_NUMBER >= 0x0090804fL && + OPENSSL_VERSION_NUMBER < 0x10002000L) || + OPENSSL_VERSION_NUMBER >= 0x1000205fL) return (0); printf("\n\nFound OPENSSL_VERSION_NUMBER %#010x\n", OPENSSL_VERSION_NUMBER); printf("Require OPENSSL_VERSION_NUMBER 0x009070cf or greater (0.9.7l)\n" - "Require OPENSSL_VERSION_NUMBER 0x0090804f or greater (0.9.8d)\n\n"); + "Require OPENSSL_VERSION_NUMBER 0x0090804f or greater (0.9.8d)\n" + "Require OPENSSL_VERSION_NUMBER 0x1000000f or greater (1.0.0)\n" + "Require OPENSSL_VERSION_NUMBER 0x1000100f or greater (1.0.1)\n" + "Require OPENSSL_VERSION_NUMBER 0x1000205f or greater (1.0.2e)\n\n"); return (1); } ], @@ -4282,15 +4287,16 @@ WARNING Your OpenSSL crypto libr WARNING one or more of the the following known security WARNING WARNING flaws: WARNING WARNING WARNING -WARNING CAN-2002-0659, CAN-2006-4339, CVE-2006-2937 and WARNING -WARNING CVE-2006-2940. WARNING +WARNING CAN-2002-0659, CAN-2006-4339, CVE-2006-2937, WARNING +WARNING CVE-2006-2940 and CVE-2015-3193. WARNING WARNING WARNING WARNING It is recommended that you upgrade to OpenSSL WARNING -WARNING version 0.9.8d/0.9.7l (or greater). WARNING +WARNING version 1.0.2e/1.0.1/1.0.0/0.9.9/0.9.8d/0.9.7l WARNING +WARNING (or greater). WARNING WARNING WARNING WARNING You can disable this warning by specifying: WARNING WARNING WARNING -WARNING --disable-openssl-version-check WARNING +WARNING --disable-openssl-version-check WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch01.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch01.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch01.html Wed Dec 16 06:10:05 2015 (r292320) @@ -556,6 +556,6 @@ -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch02.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch02.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch02.html Wed Dec 16 06:10:05 2015 (r292320) @@ -154,6 +154,6 @@ -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch03.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch03.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch03.html Wed Dec 16 06:10:05 2015 (r292320) @@ -665,6 +665,6 @@ controls { -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch04.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch04.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch04.html Wed Dec 16 06:10:05 2015 (r292320) @@ -1935,6 +1935,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2. -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch05.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch05.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch05.html Wed Dec 16 06:10:05 2015 (r292320) @@ -139,6 +139,6 @@ -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch06.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch06.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch06.html Wed Dec 16 06:10:05 2015 (r292320) @@ -12177,6 +12177,6 @@ HOST-127.EXAMPLE. MX 0 . -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch07.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch07.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch07.html Wed Dec 16 06:10:05 2015 (r292320) @@ -247,6 +247,6 @@ zone "example.com" { -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch08.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch08.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch08.html Wed Dec 16 06:10:05 2015 (r292320) @@ -135,6 +135,6 @@ -

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch09.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch09.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch09.html Wed Dec 16 06:10:05 2015 (r292320) @@ -45,7 +45,7 @@

Table of Contents

-
Release Notes for BIND Version 9.9.8
+
Release Notes for BIND Version 9.9.8-P2
Introduction
Download
@@ -60,13 +60,19 @@

-Release Notes for BIND Version 9.9.8

+Release Notes for BIND Version 9.9.8-P2

Introduction

- This document summarizes changes since the last production release - of BIND on the corresponding major release branch. + This document summarizes changes since BIND 9.9.8: +

+

+ BIND 9.9.8-P2 addresses security issues described in CVE-2015-3193 + (OpenSSL), CVE-2015-8000 and CVE-2015-8461. +

+

+ BIND 9.9.8-P1 was incomplete and was withdrawn prior to publication.

@@ -85,161 +91,39 @@ Security Fixes

  • - An incorrect boundary check in the OPENPGPKEY rdatatype - could trigger an assertion failure. This flaw is disclosed - in CVE-2015-5986. [RT #40286] + Named is potentially vulnerable to the OpenSSL vulnerabilty + described in CVE-2015-3193.

    • -
  • -

    - A buffer accounting error could trigger an assertion failure - when parsing certain malformed DNSSEC keys. -

    -

    - This flaw was discovered by Hanno B쎶ck of the Fuzzing - Project, and is disclosed in CVE-2015-5722. [RT #40212] -

    -
    • -
  • -

    - A specially crafted query could trigger an assertion failure - in message.c. -

    -

    - This flaw was discovered by Jonathan Foote, and is disclosed - in CVE-2015-5477. [RT #40046] -

    -
    • -
  • -

    - On servers configured to perform DNSSEC validation, an - assertion failure could be triggered on answers from - a specially configured server. -

    -

    - This flaw was discovered by Breno Silveira Soares, and is - disclosed in CVE-2015-4620. [RT #39795] -

    -
    • -
- -
-

-New Features

-
    -
  • -

    - New quotas have been added to limit the queries that are - sent by recursive resolvers to authoritative servers - experiencing denial-of-service attacks. When configured, - these options can both reduce the harm done to authoritative - servers and also avoid the resource exhaustion that can be - experienced by recursives when they are being used as a - vehicle for such an attack. -

    -

    - NOTE: These options are not available by default; use - configure --enable-fetchlimit to include - them in the build. -

    -

    • - fetches-per-server limits the number of - simultaneous queries that can be sent to any single - authoritative server. The configured value is a starting - point; it is automatically adjusted downward if the server is - partially or completely non-responsive. The algorithm used to - adjust the quota can be configured via the - fetch-quota-params option. -

      • -

    • - fetches-per-zone limits the number of - simultaneous queries that can be sent for names within a - single domain. (Note: Unlike "fetches-per-server", this - value is not self-tuning.) -

      • -
    -

    - Statistics counters have also been added to track the number - of queries affected by these quotas. -

    -
    • -

  • - An --enable-querytrace configure switch is - now available to enable very verbose query tracelogging. This - option can only be set at compile time. This option has a - negative performance impact and should be used only for - debugging. + Incorrect reference counting could result in an INSIST + failure if a socket error occurred while performing a + lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]

  • - EDNS COOKIE options content is now displayed as - "COOKIE: <hexvalue>". + Insufficient testing when parsing a message allowed + records with an incorrect class to be be accepted, + triggering a REQUIRE failure when those records + were subsequently cached. This flaw is disclosed + in CVE-2015-8000. [RT #40987]

+New Features

+

  • None

+
+
+

Feature Changes

-
    -

  • - Large inline-signing changes should be less disruptive. - Signature generation is now done incrementally; the number - of signatures to be generated in each quantum is controlled - by "sig-signing-signatures number;". - [RT #37927] -

    • -

  • - Retrieving the local port range from net.ipv4.ip_local_port_range - on Linux is now supported. -

    • -

  • - Active Directory names of the form gc._msdcs.<forest> are - now accepted as valid hostnames when using the - check-names option. <forest> is still - restricted to letters, digits and hyphens. -

    • -

  • - Names containing rich text are now accepted as valid - hostnames in PTR records in DNS-SD reverse lookup zones, - as specified in RFC 6763. [RT #37889] -

    • -
+

  • + Updated the compiled in addresses for H.ROOT-SERVERS.NET. +

Bug Fixes

-
    -

  • - Asynchronous zone loads were not handled correctly when the - zone load was already in progress; this could trigger a crash - in zt.c. [RT #37573] -

    • -

  • - A race during shutdown or reconfiguration could - cause an assertion failure in mem.c. [RT #38979] -

    • -

  • - Some answer formatting options didn't work correctly with - dig +short. [RT #39291] -

    • -

  • - Malformed records of some types, including NSAP and UNSPEC, - could trigger assertion failures when loading text zone files. - [RT #40274] [RT #40285] -

    • -

  • - Fixed a possible crash in ratelimiter.c caused by NOTIFY - messages being removed from the wrong rate limiter queue. - [RT #40350] -

    • -

  • - The default rrset-order of random - was inconsistently applied. [RT #40456] -

    • -

  • - BADVERS responses from broken authoritative name servers were - not handled correctly. [RT #40427] -

    • -
+

  • None

@@ -279,6 +163,6 @@

-

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch10.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch10.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch10.html Wed Dec 16 06:10:05 2015 (r292320) @@ -163,6 +163,6 @@
-

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch11.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch11.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch11.html Wed Dec 16 06:10:05 2015 (r292320) @@ -514,6 +514,6 @@
-

BIND 9.9.8 (Extended Support Version)

+

BIND 9.9.8-P2 (Extended Support Version)

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch12.html ============================================================================== --- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch12.html Wed Dec 16 05:44:53 2015 (r292319) +++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch12.html Wed Dec 16 06:10:05 2015 (r292320) @@ -47,13 +47,13 @@
BIND 9 DNS Library Support
-
Prerequisite
-
Compilation
-
Installation
-
Known Defects/Restrictions
-
The dns.conf File
-
Sample Applications
-
Library References
+
Prerequisite
+
Compilation
+
Installation
+
Known Defects/Restrictions
+
The dns.conf File
+
Sample Applications
+
Library References
@@ -89,7 +89,7 @@

-Prerequisite

+Prerequisite

GNU make is required to build the export libraries (other part of BIND 9 can still be built with other types of make). In the reminder of this document, "make" means GNU make. Note that @@ -98,7 +98,7 @@

-Compilation

+Compilation
 $ ./configure --enable-exportlib [other flags]
 $ make
@@ -113,7 +113,7 @@ $ make
 

 

-Installation

+Installation

 
 $ cd lib/export
 $ make install
@@ -135,7 +135,7 @@ $ make i
 
 

 

-Known Defects/Restrictions

+Known Defects/Restrictions

 
    
 
  • Currently, win32 is not supported for the export
       library. (Normal BIND 9 application can be built as
@@ -175,7 +175,7 @@ $ make
 
    
 
    
-The dns.conf File
    
+The dns.conf File

 
The IRS library supports an "advanced" configuration file
   related to the DNS library for configuration parameters that
   would be beyond the capability of the
@@ -193,14 +193,14 @@ $ make
 

 

-Sample Applications

+Sample Applications

 
Some sample application programs using this API are
   provided for reference. The following is a brief description of
   these applications.
   

 

 

-sample: a simple stub resolver utility

+sample: a simple stub resolver utility

 

   It sends a query of a given name (of a given optional RR type) to a
   specified recursive server, and prints the result as a list of
@@ -264,7 +264,7 @@ $ make
 

 

-sample-async: a simple stub resolver, working asynchronously

+sample-async: a simple stub resolver, working asynchronously

 

   Similar to "sample", but accepts a list
   of (query) domain names as a separate file and resolves the names
@@ -305,7 +305,7 @@ $ make
 

 

-sample-request: a simple DNS transaction client

+sample-request: a simple DNS transaction client

 

   It sends a query to a specified server, and
   prints the response with minimal processing. It doesn't act as a
@@ -346,7 +346,7 @@ $ make
 

 

-sample-gai: getaddrinfo() and getnameinfo() test code

+sample-gai: getaddrinfo() and getnameinfo() test code

 

   This is a test program
   to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -363,7 +363,7 @@ $ make
 

 

-sample-update: a simple dynamic update client program

+sample-update: a simple dynamic update client program

 

   It accepts a single update command as a
   command-line argument, sends an update request message to the
@@ -458,7 +458,7 @@ $ sample
 
 

 

-nsprobe: domain/name server checker in terms of RFC 4074

+nsprobe: domain/name server checker in terms of RFC 4074

 

   It checks a set
   of domains to see the name servers of the domains behave
@@ -515,7 +515,7 @@ $ sample
 
 

 

-Library References

+Library References

 
As of this writing, there is no formal "manual" of the
   libraries, except this document, header files (some of them
   provide pretty detailed explanations), and sample application
@@ -540,6 +540,6 @@ $ sample
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.ch13.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/Bv9ARM.ch13.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/Bv9ARM.ch13.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -140,6 +140,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/Bv9ARM.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/Bv9ARM.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -41,7 +41,7 @@
 

 

 BIND 9 Administrator Reference Manual

-
BIND Version 9.9.8

+
BIND Version 9.9.8-P2

 
Copyright © 2004-2015 Internet Systems Consortium, Inc. ("ISC")

 
Copyright © 2000-2003 Internet Software Consortium.

 

@@ -234,7 +234,7 @@
 
 
A. Release Notes

 

-
Release Notes for BIND Version 9.9.8

+
Release Notes for BIND Version 9.9.8-P2

 

 
Introduction

 
Download

@@ -262,13 +262,13 @@
 

 
BIND 9 DNS Library Support

 

-
Prerequisite

-
Compilation

-
Installation

-
Known Defects/Restrictions

-
The dns.conf File

-
Sample Applications

-
Library References

+
Prerequisite

+
Compilation

+
Installation

+
Known Defects/Restrictions

+
The dns.conf File

+
Sample Applications

+
Library References

 

 

 
I. Manual pages

@@ -365,6 +365,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/Bv9ARM.pdf
==============================================================================
Binary file (source and/or target). No diff available.

Modified: stable/9/contrib/bind9/doc/arm/man.arpaname.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.arpaname.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.arpaname.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -50,20 +50,20 @@
 
arpaname  {ipaddress ...}

 
 

-
DESCRIPTION

+
DESCRIPTION

 

       arpaname translates IP addresses (IPv4 and
       IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
     

 

 

-
SEE ALSO

+
SEE ALSO

 

       BIND 9 Administrator Reference Manual.
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

@@ -87,6 +87,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.ddns-confgen.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.ddns-confgen.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.ddns-confgen.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -50,7 +50,7 @@
 
ddns-confgen  [-a algorithm] [-h] [-k keyname] [-r randomfile] [ -s name  |   -z zone ] [-q] [name]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
ddns-confgen
       generates a key for use by nsupdate
       and named.  It simplifies configuration
@@ -77,7 +77,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a algorithm

 

@@ -144,7 +144,7 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 
nsupdate(1),
       named.conf(5),
       named(8),
@@ -152,7 +152,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

@@ -176,6 +176,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.dig.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.dig.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.dig.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -52,7 +52,7 @@
 
dig  [global-queryopt...] [query...]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dig
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -99,7 +99,7 @@
     

 

 

-
SIMPLE USAGE

+
SIMPLE USAGE

 

       A typical invocation of dig looks like:
       

@@ -152,7 +152,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-4

 

@@ -280,7 +280,7 @@
 

 

 

-
QUERY OPTIONS

+
QUERY OPTIONS

 
dig
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -649,7 +649,7 @@
     

 

 

-
MULTIPLE QUERIES

+
MULTIPLE QUERIES

 

       The BIND 9 implementation of dig 
       supports
@@ -695,7 +695,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc
     

 

 

-
IDN SUPPORT

+
IDN SUPPORT

 

       If dig has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -709,14 +709,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc
     

 

 

-
FILES

+
FILES

 
/etc/resolv.conf
     

 
${HOME}/.digrc
     

 

 

-
SEE ALSO

+
SEE ALSO

 
host(1),
       named(8),
       dnssec-keygen(8),
@@ -724,7 +724,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc
     

 

 

-
BUGS

+
BUGS

 

       There are probably too many query options.
     

@@ -747,6 +747,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc
 
 
 

-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.dnssec-checkds.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.dnssec-checkds.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.dnssec-checkds.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -51,7 +51,7 @@
 
dnssec-dsfromkey  [-l domain] [-f file] [-d dig path] [-D dsfromkey path] {zone}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-checkds
       verifies the correctness of Delegation Signer (DS) or DNSSEC
       Lookaside Validation (DLV) resource records for keys in a specified
@@ -59,7 +59,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-f file

 

@@ -88,14 +88,14 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-dsfromkey(8),
       dnssec-keygen(8),
       dnssec-signzone(8),
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

@@ -118,6 +118,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.dnssec-coverage.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.dnssec-coverage.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.dnssec-coverage.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -50,7 +50,7 @@
 
dnssec-coverage  [-K directory] [-f file] [-d DNSKEY TTL] [-m max TTL] [-r interval] [-c compilezone path] [zone]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-coverage
       verifies that the DNSSEC keys for a given zone or a set of zones
       have timing metadata set properly to ensure no future lapses in DNSSEC
@@ -78,7 +78,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-f file

 

@@ -168,7 +168,7 @@
 

 

 

-
SEE ALSO

+
SEE ALSO

 

       dnssec-checkds(8),
       dnssec-dsfromkey(8),
@@ -177,7 +177,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

@@ -201,6 +201,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.dnssec-dsfromkey.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -52,14 +52,14 @@
 
dnssec-dsfromkey  [-h] [-V]

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-dsfromkey
       outputs the Delegation Signer (DS) resource record (RR), as defined in
       RFC 3658 and RFC 4509, for the given key(s).
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-1

 

@@ -150,7 +150,7 @@
 

 

 

-
EXAMPLE

+
EXAMPLE

 

       To build the SHA-256 DS RR from the
       Kexample.com.+003+26160
@@ -165,7 +165,7 @@
     

 

 

-
FILES

+
FILES

 

       The keyfile can be designed by the key identification
       Knnnn.+aaa+iiiii or the full file name
@@ -179,13 +179,13 @@
     

 

 

-
CAVEAT

+
CAVEAT

 

       A keyfile error can give a "file not found" even if the file exists.
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
@@ -195,7 +195,7 @@
     

 

 

-
AUTHOR

+
AUTHOR

 
Internet Systems Consortium
     

 

@@ -219,6 +219,6 @@
 
 
 
-
BIND 9.9.8 (Extended Support Version)

+
BIND 9.9.8-P2 (Extended Support Version)

 
 

Modified: stable/9/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html
==============================================================================
--- stable/9/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html	Wed Dec 16 05:44:53 2015	(r292319)
+++ stable/9/contrib/bind9/doc/arm/man.dnssec-keyfromlabel.html	Wed Dec 16 06:10:05 2015	(r292320)
@@ -50,7 +50,7 @@
 
dnssec-keyfromlabel  {-l label} [-3] [-a algorithm] [-A date/offset] [-c class] [-D date/offset] [-E engine] [-f flag] [-G] [-I date/offset] [-i interval] [-k] [-K directory] [-L ttl] [-n nametype] [-P date/offset] [-p protocol] [-R date/offset] [-S key] [-t type] [-v level] [-V] [-y] {name}

 
 

-
DESCRIPTION

+
DESCRIPTION

 
dnssec-keyfromlabel
       generates a key pair of files that referencing a key object stored
       in a cryptographic hardware service module (HSM).  The private key
@@ -66,7 +66,7 @@
     

 

 

-
OPTIONS

+
OPTIONS

 

 
-a algorithm

 

@@ -209,7 +209,7 @@
 

 

 

-
TIMING OPTIONS

+
TIMING OPTIONS

 

       Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
       If the argument begins with a '+' or '-', it is interpreted as
@@ -281,7 +281,7 @@
 

 
 

-
GENERATED KEY FILES

+
GENERATED KEY FILES

 

       When dnssec-keyfromlabel completes
       successfully,
@@ -320,7 +320,7 @@
     

 

 

-
SEE ALSO

+
SEE ALSO

 
dnssec-keygen(8),
       dnssec-signzone(8),
       BIND 9 Administrator Reference Manual,
@@ -328,7 +328,7 @@
     

 

 

-
AUTHOR

+
AUTHOR


*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***