prep 9.12.3rc1

diff --git a/CHANGES b/CHANGES
index 607e772929bfc8ffe4458711e4d0d06405c91c5d..77ced9b223754531545ab5bec18b3b6f5fbcc702 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+       --- 9.12.3rc1 released ---
+
 5038.  [bug]           Chaosnet addresses were compared incorrectly.
                        [GL #562]
 

diff --git a/README b/README
index 7b07eb9e1f758962897929ac8df3c61f183e6e14..a368dac4f0477053e175d1b4031d4e28f59aff2a 100644 (file)
--- a/README
+++ b/README
@@ -141,6 +141,15 @@ BIND 9.12.2 is a maintenance release, and addresses security
 vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
 CVE-2018-5738.
 
+BIND 9.12.3
+
+BIND 9.12.3 is a maintenance release, and also addresses CVE-2018-5741 by
+correcting faulty documentation and introducing the following new feature:
+
+  * New krb5-selfsub and ms-selfsub rule types for update-policy
+    statements allow updating of subdomains based on a Kerberos or Active
+    Directory machine principal.
+
 Building BIND
 
 BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX

diff --git a/README.md b/README.md
index fefc2e86acbcef8c3f6bc2b40c8b0e7e82451424..33ad8cfa4d04c193305bcf3889ff0c9bb24e131e 100644 (file)
--- a/README.md
+++ b/README.md
@@ -158,6 +158,16 @@ BIND 9.12.2 is a maintenance release, and addresses security
 vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
 CVE-2018-5738.
 
+#### BIND 9.12.3
+
+BIND 9.12.3 is a maintenance release, and also addresses CVE-2018-5741
+by correcting faulty documentation and introducing the following new
+feature:
+
+* New `krb5-selfsub` and `ms-selfsub` rule types for `update-policy`
+  statements allow updating of subdomains based on a Kerberos or
+  Active Directory machine principal.
+
 ### <a name="build"/> Building BIND
 
 BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX

diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 6e512f7ac965fb4d5399c836ae4643cacdd517a2..80e5869780f40cdb93ad12b4db92a375f1dac2d6 100644 (file)
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -907,10 +907,10 @@ view \fIstring\fR [ \fIclass\fR ] {
                    | slave | static\-stub | stub );
                update\-check\-ksk \fIboolean\fR;
                update\-policy ( local | { ( deny | grant ) \fIstring\fR (
-                   6to4\-self | external | krb5\-self | krb5\-subdomain |
-                   ms\-self | ms\-subdomain | name | self | selfsub |
-                   selfwild | subdomain | tcp\-self | wildcard | zonesub )
-                   [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+                   6to4\-self | external | krb5\-self | krb5\-selfsub |
+                   krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
+                   name | self | selfsub | selfwild | subdomain | tcp\-self
+                   | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
                use\-alt\-transfer\-source \fIboolean\fR;
                zero\-no\-soa\-ttl \fIboolean\fR;
                zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1012,9 +1012,10 @@ zone \fIstring\fR [ \fIclass\fR ] {
            | static\-stub | stub );
        update\-check\-ksk \fIboolean\fR;
        update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
-           external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
-           | name | self | selfsub | selfwild | subdomain | tcp\-self |
-           wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+           external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
+           | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
+           | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
+           \fIrrtypelist\fR; \&.\&.\&. };
        use\-alt\-transfer\-source \fIboolean\fR;
        zero\-no\-soa\-ttl \fIboolean\fR;
        zone\-statistics ( full | terse | none | \fIboolean\fR );

diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index 6970f9a0981e13f36686f37261d502a9f16cc3f9..56bb23e1206df840db04ddcabdd25665a01b9c3d 100644 (file)
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -884,10 +884,10 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
                    | slave | static-stub | stub );
                update-check-ksk <replaceable>boolean</replaceable>;
                update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
-                   6to4-self | external | krb5-self | krb5-subdomain |
-                   ms-self | ms-subdomain | name | self | selfsub |
-                   selfwild | subdomain | tcp-self | wildcard | zonesub )
-                   [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+                   6to4-self | external | krb5-self | krb5-selfsub |
+                   krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+                   name | self | selfsub | selfwild | subdomain | tcp-self
+                   | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
                use-alt-transfer-source <replaceable>boolean</replaceable>;
                zero-no-soa-ttl <replaceable>boolean</replaceable>;
                zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -985,9 +985,10 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
            | static-stub | stub );
        update-check-ksk <replaceable>boolean</replaceable>;
        update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
-           external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
-           | name | self | selfsub | selfwild | subdomain | tcp-self |
-           wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+           external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+           | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+           | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ]
+           <replaceable>rrtypelist</replaceable>; ... };
        use-alt-transfer-source <replaceable>boolean</replaceable>;
        zero-no-soa-ttl <replaceable>boolean</replaceable>;
        zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );

diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index f50191450c609fe1b80a6ce9ec4a95729e4921e8..77e396576c584421e9ad9c2ed239002c3a49f577 100644 (file)
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -876,10 +876,10 @@ view
                    | slave | static-stub | stub );<br>
                update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
                update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-                   6to4-self | external | krb5-self | krb5-subdomain |<br>
-                   ms-self | ms-subdomain | name | self | selfsub |<br>
-                   selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-                   [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+                   6to4-self | external | krb5-self | krb5-selfsub |<br>
+                   krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+                   name | self | selfsub | selfwild | subdomain | tcp-self<br>
+                   | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
                use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
                zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
                zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -978,9 +978,10 @@ zone
            | static-stub | stub );<br>
        update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
        update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-           external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-           | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-           wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+           external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+           | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+           | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+           <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
        use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
        zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
        zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>

diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index ca2daec1b17d0aac9edf90e1f6587a10c9c6577d..fe56839aedbc011db01b90b44c74168ed6e7b8e6 100644 (file)
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -386,7 +386,7 @@ See also
 \fBrndc trace\fR\&.
 .RE
 .PP
-\fBnta \fR\fB[( \-d | \-f | \-r | \-l \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
+\fBnta \fR\fB[( \-class \fIclass\fR | \-dump | \-force | \-remove | \-lifetime \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
 .RS 4
 Sets a DNSSEC negative trust anchor (NTA) for
 \fBdomain\fR, with a lifetime of
@@ -418,7 +418,7 @@ option\&. TTL\-style suffixes can be used to specify the lifetime in seconds, mi
 to zero is equivalent to
 \fB\-remove\fR\&.
 .sp
-If
+If the
 \fB\-dump\fR
 is used, any other arguments are ignored, and a list of existing NTAs is printed (note that this may include NTAs that are expired but have not yet been cleaned up)\&.
 .sp
@@ -430,11 +430,16 @@ option in the Administrator Reference Manual for details)\&. If data can be vali
 \fB\-force\fR
 overrides this behavior and forces an NTA to persist for its entire lifetime, regardless of whether data could be validated if the NTA were not present\&.
 .sp
+The view class can be specified with
+\fB\-class\fR\&. The default is class
+\fBIN\fR, which is the only class for which DNSSEC is currently supported\&.
+.sp
 All of these options can be shortened, i\&.e\&., to
 \fB\-l\fR,
 \fB\-r\fR,
-\fB\-d\fR, and
-\fB\-f\fR\&.
+\fB\-d\fR,
+\fB\-f\fR, and
+\fB\-c\fR\&.
 .RE
 .PP
 \fBquerylog\fR [ on | off ]

diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index 97b77cb8dc5e75075e8d1e1fda4e1820eb6611ff..9a1bde881c4d0ebd0b0cb5d2569c082b092d8d72 100644 (file)
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -484,7 +484,7 @@
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>nta
-       [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
+           [<span class="optional">( -class <em class="replaceable"><code>class</code></em> | -dump | -force | -remove | -lifetime <em class="replaceable"><code>duration</code></em>)</span>]
        <em class="replaceable"><code>domain</code></em>
        [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
        </code></strong></span></dt>
@@ -532,7 +532,7 @@
            is equivalent to <code class="option">-remove</code>.
          </p>
          <p>
-           If <code class="option">-dump</code> is used, any other arguments
+           If the <code class="option">-dump</code> is used, any other arguments
            are ignored, and a list of existing NTAs is printed
            (note that this may include NTAs that are expired but
            have not yet been cleaned up).
@@ -549,10 +549,15 @@
            lifetime, regardless of whether data could be
            validated if the NTA were not present.
          </p>
+         <p>
+           The view class can be specified with <code class="option">-class</code>.
+           The default is class <strong class="userinput"><code>IN</code></strong>, which is
+           the only class for which DNSSEC is currently supported.
+         </p>
          <p>
            All of these options can be shortened, i.e., to
            <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
-           and <code class="option">-f</code>.
+           <code class="option">-f</code>, and <code class="option">-c</code>.
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional"> on | off </span>] </span></dt>

diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index 354f7a812416091667f676083112afd64e902d33..4343f510cdb60547f0e1ff941dda233075ba5f4d 100644 (file)
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html
index 376182e5f5e12cdf52e7fc6f5c4ae4f527248e87..c63558cc716f55b4264354df1fc61bfc3d36bf01 100644 (file)
--- a/doc/arm/Bv9ARM.ch02.html
+++ b/doc/arm/Bv9ARM.ch02.html
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html
index 99f223c0b14c9a4c999227348ad994fb3dc54308..34774c281541853cca1be72699c545bd64b578b9 100644 (file)
--- a/doc/arm/Bv9ARM.ch03.html
+++ b/doc/arm/Bv9ARM.ch03.html
@@ -759,6 +759,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 3d11c6d563d3c6a08196f103cc8d358bd2775751..d8f11fc11b99b92c50909585b1aa7c8a2925c300 100644 (file)
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -2867,6 +2867,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 5f23a7e29270f272a89499bb0a7c0d9df99e854c..ec3d9b92cb50672b062d9477e15ca84ec1e86a6b 100644 (file)
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -4700,6 +4700,11 @@ options {
                   <span class="command"><strong>slave</strong></span> zones respectively.
                   It is off by default.
                 </p>
+                <p>
+                  Note: if inline signing is enabled for a zone, the
+                  user-provided <span class="command"><strong>ixfr-from-differences</strong></span>
+                  setting is ignored for that zone.
+                </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>multi-master</strong></span></span></dt>
 <dd>
@@ -6764,8 +6769,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   </td>
 <td>
                     <p>
-                      Records are returned in some random order. When no
-                      ordering is specified, this is the default.
+                      Records are returned in some random order.
                     </p>
                   </td>
 </tr>
@@ -6796,7 +6800,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                       Records are returned in whatever order they were
                       retrieved from the database.  This order is
                       indeterminate, but will be consistent as long as the
-                      database is not modified.
+                      database is not modified. When no ordering is
+                      specified, this is the default.
                     </p>
                   </td>
 </tr>
@@ -9291,7 +9296,7 @@ view "external" {
        <span class="command"><strong>sig-signing-type</strong></span> <em class="replaceable"><code>integer</code></em>;
        <span class="command"><strong>sig-validity-interval</strong></span> <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];
        <span class="command"><strong>update-check-ksk</strong></span> <em class="replaceable"><code>boolean</code></em>;
-       <span class="command"><strong>update-policy</strong></span> ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };
+       <span class="command"><strong>update-policy</strong></span> ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };
        <span class="command"><strong>zero-no-soa-ttl</strong></span> <em class="replaceable"><code>boolean</code></em>;
        <span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
 };
@@ -10524,7 +10529,7 @@ example.com. NS ns2.example.net.
               has been used to create a shared secret, the identity of
               the key used to authenticate the TKEY exchange will be
               used as the identity of the shared secret.  Some rule types
-              use indentities matching the client's Kerberos principal
+              use identities matching the client's Kerberos principal
               (e.g, <strong class="userinput"><code>"host/machine@REALM"</code></strong>) or
               Windows realm (<strong class="userinput"><code>machine$@REALM</code></strong>).
             </p>
@@ -10544,12 +10549,13 @@ example.com. NS ns2.example.net.
               the rules are checked for each existing record type.
             </p>
             <p>
-              The <em class="replaceable"><code>ruletype</code></em> field has 13
+              The <em class="replaceable"><code>ruletype</code></em> field has 16
               values:
               <code class="varname">name</code>, <code class="varname">subdomain</code>,
               <code class="varname">wildcard</code>, <code class="varname">self</code>,
               <code class="varname">selfsub</code>, <code class="varname">selfwild</code>,
               <code class="varname">krb5-self</code>, <code class="varname">ms-self</code>,
+              <code class="varname">krb5-selfsub</code>, <code class="varname">ms-selfsub</code>,
               <code class="varname">krb5-subdomain</code>,
               <code class="varname">ms-subdomain</code>,
               <code class="varname">tcp-self</code>, <code class="varname">6to4-self</code>,
@@ -10694,12 +10700,41 @@ example.com. NS ns2.example.net.
                     </td>
 <td>
                       <p>
-                        This rule takes a Windows machine principal
-                        (machine$@REALM) for machine in REALM and
-                        and converts it machine.realm allowing the machine
-                        to update machine.realm.  The REALM to be matched
-                        is specified in the <em class="replaceable"><code>identity</code></em>
-                        field.  The name field should be set to "."
+                        When a client sends an UPDATE using a Windows
+                        machine principal (for example, 'machine$@REALM'),
+                        this rule allows records with the absolute name
+                        of 'machine.REALM' to be updated.
+                      </p>
+                      <p>
+                        The realm to be matched is specified in the
+                        <em class="replaceable"><code>identity</code></em> field.
+                      </p>
+                      <p>
+                        The <em class="replaceable"><code>name</code></em> field has
+                        no effect on this rule; it should be set to "."
+                        as a placeholder.
+                      </p>
+                      <p>
+                        For example,
+                        <strong class="userinput"><code>grant EXAMPLE.COM ms-self . A AAAA</code></strong>
+                        allows any machine with a valid principal in
+                        the realm <strong class="userinput"><code>EXAMPLE.COM</code></strong> to update
+                        its own address records.
+                      </p>
+                    </td>
+</tr>
+<tr>
+<td>
+                      <p>
+                        <code class="varname">ms-selfsub</code>
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        This is similar to <span class="command"><strong>ms-self</strong></span>
+                        except it also allows updates to any subdomain of
+                        the name specified in the Windows machine
+                        principal, not just to the name itself.
                       </p>
                     </td>
 </tr>
@@ -10711,13 +10746,32 @@ example.com. NS ns2.example.net.
                     </td>
 <td>
                       <p>
-                        This rule takes a Windows machine principal
-                        (machine$@REALM) for machine in REALM and
-                        converts it to machine.realm allowing the machine
-                        to update subdomains of machine.realm.  The REALM
-                        to be matched is specified in the
+                        When a client sends an UPDATE using a Windows
+                        machine principal (for example, 'machine$@REALM'),
+                        this rule allows any machine in the specified
+                        realm to update any record in the zone or in a
+                        specified subdomain of the zone.
+                      </p>
+                      <p>
+                        The realm to be matched is specified in the
                         <em class="replaceable"><code>identity</code></em> field.
                       </p>
+                      <p>
+                        The <em class="replaceable"><code>name</code></em> field
+                        specifies the subdomain that may be updated.
+                        If set to "." (or any other name at or above
+                        the zone apex), any name in the zone can be
+                        updated.
+                      </p>
+                      <p>
+                        For example, if <span class="command"><strong>update-policy</strong></span>
+                        for the zone "example.com" includes
+                        <strong class="userinput"><code>grant EXAMPLE.COM ms-subdomain hosts.example.com. A AAAA</code></strong>,
+                        any machine with a valid principal in
+                        the realm <strong class="userinput"><code>EXAMPLE.COM</code></strong> will
+                        be able to update address records at or below
+                        "hosts.example.com".
+                      </p>
                     </td>
 </tr>
 <tr>
@@ -10728,12 +10782,47 @@ example.com. NS ns2.example.net.
                     </td>
 <td>
                       <p>
-                        This rule takes a Kerberos machine principal
-                        (host/machine@REALM) for machine in REALM and
-                        and converts it machine.realm allowing the machine
-                        to update machine.realm.  The REALM to be matched
-                        is specified in the <em class="replaceable"><code>identity</code></em>
-                        field. The name field should be set to "."
+                        When a client sends an UPDATE using a
+                        Kerberos machine principal (for example,
+                        'host/machine@REALM'), this rule allows
+                        records with the absolute name of 'machine'
+                        to be updated provided it has been authenticated
+                        by REALM.  This is similar but not identical
+                        to <span class="command"><strong>ms-self</strong></span> due to the
+                        'machine' part of the Kerberos principal
+                        being an absolute name instead of a unqualified
+                        name.
+                      </p>
+                      <p>
+                        The realm to be matched is specified in the
+                        <em class="replaceable"><code>identity</code></em> field.
+                      </p>
+                      <p>
+                        The <em class="replaceable"><code>name</code></em> field has
+                        no effect on this rule; it should be set to "."
+                        as a placeholder.
+                      </p>
+                      <p>
+                        For example,
+                        <strong class="userinput"><code>grant EXAMPLE.COM krb5-self . A AAAA</code></strong>
+                        allows any machine with a valid principal in
+                        the realm <strong class="userinput"><code>EXAMPLE.COM</code></strong> to update
+                        its own address records.
+                      </p>
+                    </td>
+</tr>
+<tr>
+<td>
+                      <p>
+                        <code class="varname">krb5-selfsub</code>
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        This is similar to <span class="command"><strong>krb5-self</strong></span>
+                        except it also allows updates to any subdomain of
+                        the name specified in the 'machine' part of the
+                        Kerberos principal, not just to the name itself.
                       </p>
                     </td>
 </tr>
@@ -10745,13 +10834,11 @@ example.com. NS ns2.example.net.
                     </td>
 <td>
                       <p>
-                        This rule takes a Kerberos machine principal
-                        (host/machine@REALM) for machine in REALM and
-                        converts it to machine.realm allowing the machine
-                        to update subdomains of machine.realm.  The REALM
-                        to be matched is specified in the
-                        <em class="replaceable"><code>identity</code></em> field. The
-                        name field should be set to "."
+                        This rule is identical to
+                        <span class="command"><strong>ms-subdomain</strong></span>, except that it works
+                        with Kerberos machine principals (i.e.,
+                        'host/machine@REALM') rather than Windows machine
+                        principals.
                       </p>
                     </td>
 </tr>
@@ -14700,6 +14787,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 0488d13c3a1633be89a2d02e44b6cb18f206a6f9..2d3d55f14c2a3bc23027dea49d39f3d566cec1d4 100644 (file)
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -399,6 +399,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 4f6526d660fbe0a11cfd91d69214e6e1be081103..506acd27e4b965fdd727182d8e817924074a70b0 100644 (file)
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -136,6 +136,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index e77d89cb1010258d511a7b7217721f7ecefe1640..2b6e9a5899fb2e6a8462d0f2a19aae240364f3f4 100644 (file)
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -36,7 +36,7 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.2-P1</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.3rc1</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
@@ -52,7 +52,7 @@
 </div>
       <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.12.2-P1</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.12.3rc1</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -162,6 +162,15 @@
          necessary.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         Two new update policy rule types have been added
+         <span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
+         which allow machines with Kerberos principals to update
+         the name space at or below the machine names identified
+         in the respective principals.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -183,20 +192,39 @@
          with IDN support.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
+         between views of the same name but different class; this
+         has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
+         option. [GL #105]
+       </p>
+      </li>
 </ul></div>
   </div>
 
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         When a negative trust anchor was added to multiple views
+         using <span class="command"><strong>rndc nta</strong></span>, the text returned via
+         <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
+         first line, making it appear that only one NTA had been
+         added. This has been fixed. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
        <p>
          <span class="command"><strong>named</strong></span> now rejects excessively large
          incremental (IXFR) zone transfers in order to prevent
          possible corruption of journal files which could cause
          <span class="command"><strong>named</strong></span> to abort when loading zones. [GL #339]
        </p>
-      </li></ul></div>
+      </li>
+</ul></div>
   </div>
 
   <div class="section">
@@ -268,6 +296,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 6a4a38be036a3a4a156f1e4671bc71eb96a28af8..c376367f418782ec9b35df1843f47441b3e1d62e 100644 (file)
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html
index e254aca8521f386d44126a1cc006155e063c6009..cf6a6787a90a6f588e65e1772f2ceba155a46926 100644 (file)
--- a/doc/arm/Bv9ARM.ch10.html
+++ b/doc/arm/Bv9ARM.ch10.html
@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch11.html b/doc/arm/Bv9ARM.ch11.html
index eb736a10b3de813194dcb75c66c9dc49bd805863..d181ce18b45814d769aaa161a2763e13441b0c2f 100644 (file)
--- a/doc/arm/Bv9ARM.ch11.html
+++ b/doc/arm/Bv9ARM.ch11.html
@@ -533,6 +533,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html
index 9d7453bbca54376dd2146f9729d992dd6472be61..52980bd389c2d827aca84d93e33ab1be72214863 100644 (file)
--- a/doc/arm/Bv9ARM.ch12.html
+++ b/doc/arm/Bv9ARM.ch12.html
@@ -210,6 +210,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index a85c7be427c9308d43d9c5b8cb85a828f3c48141..80b4fb1216028b886a7d453f171197e080474b01 100644 (file)
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.12.2-P1</p></div>
+<div><p class="releaseinfo">BIND Version 9.12.3rc1</p></div>
 <div><p class="copyright">Copyright © 2000-2018 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -234,7 +234,7 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.2-P1</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.3rc1</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
@@ -429,6 +429,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 5acb000ab6106fb1b24dc92cdcdb857d6c3e6247..03707ebb87ad4254bb6bcbdbaef740ac8fad6624 100644 (file)
Binary files a/doc/arm/Bv9ARM.pdf and b/doc/arm/Bv9ARM.pdf differ

diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html
index 6eaf714dfafc078e3994e5259f5f210c7b3109e2..1fca0e9f14b33ecd0f9cf5159c7813c8d41d3d57 100644 (file)
--- a/doc/arm/man.arpaname.html
+++ b/doc/arm/man.arpaname.html
@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html
index 0a795d5b66fef0af1af8ea687c5b7351295fd612..58718afe0000691f6480b3b2c2388e0e44793846 100644 (file)
--- a/doc/arm/man.ddns-confgen.html
+++ b/doc/arm/man.ddns-confgen.html
@@ -235,6 +235,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html
index 2949a4a823fda11046305bb93b9ec9a4793781ac..413f2af3eb3fae193c98d81ed7477250ac7475ad 100644 (file)
--- a/doc/arm/man.delv.html
+++ b/doc/arm/man.delv.html
@@ -625,6 +625,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 6242459301a1e33d87e42c1c38aa2fead689eb6a..8ab737d718e2b7b3f1ea6a3bf3a42752f6d285dc 100644 (file)
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -1121,6 +1121,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-cds.html b/doc/arm/man.dnssec-cds.html
index 37a2aa9eee71b28f11b3e598008213d9a3bad601..9a27c357a49c38723e44760d9f4b76f07f031a3d 100644 (file)
--- a/doc/arm/man.dnssec-cds.html
+++ b/doc/arm/man.dnssec-cds.html
@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html
index 713fd2a3cedbc1ac498f20fba67bfc292753d322..161a891476ecf73c66c6252c4356ebe1d5922b93 100644 (file)
--- a/doc/arm/man.dnssec-checkds.html
+++ b/doc/arm/man.dnssec-checkds.html
@@ -150,6 +150,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html
index 3a6d64fc9f932695902a635c33fc6610264b64d1..8e4188dcd09ac70d22c259fc12c86e89dc370d50 100644 (file)
--- a/doc/arm/man.dnssec-coverage.html
+++ b/doc/arm/man.dnssec-coverage.html
@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html
index aefa5c0970140f1d81bea3d3541ef87225e21836..1893966a63d2f7d50057f37beff9b2ffa3ad8769 100644 (file)
--- a/doc/arm/man.dnssec-dsfromkey.html
+++ b/doc/arm/man.dnssec-dsfromkey.html
@@ -289,6 +289,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html
index cf3e4fad81188fe46f7fcf74ae2f38336a070b70..476eff01e3e028c9b70e528796e83115e7b3d108 100644 (file)
--- a/doc/arm/man.dnssec-importkey.html
+++ b/doc/arm/man.dnssec-importkey.html
@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html
index 7d9971e6b910dc6bc3ec7c0a289aa5aa76bec408..b2e3ee92ce2d9fee419dcbe2e69b07d2731c6c84 100644 (file)
--- a/doc/arm/man.dnssec-keyfromlabel.html
+++ b/doc/arm/man.dnssec-keyfromlabel.html
@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index 5ea71887777e538d7318c93d234fe0e244caf059..30c7ac75eb7ac1acdf46e44cf877e109da91efd7 100644 (file)
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -596,6 +596,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keymgr.html b/doc/arm/man.dnssec-keymgr.html
index 6a796ad693eb3a469849b6d6d89989eb02f304c3..2239e87c612ae7c24d36ffc51d9b47e231714cf0 100644 (file)
--- a/doc/arm/man.dnssec-keymgr.html
+++ b/doc/arm/man.dnssec-keymgr.html
@@ -398,6 +398,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html
index b4032f4578a9fd785258b466b3f5895b26656852..3ebcb8a4c06172fa7ee4107f80e4ec450e967312 100644 (file)
--- a/doc/arm/man.dnssec-revoke.html
+++ b/doc/arm/man.dnssec-revoke.html
@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html
index c17f85d06d82d471b3a6f71432423c530d8aac9d..5dbf73962d2aeed9506943b67761104b4b4866d7 100644 (file)
--- a/doc/arm/man.dnssec-settime.html
+++ b/doc/arm/man.dnssec-settime.html
@@ -349,6 +349,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index d8456483cf80b3a03410586d8ac2c8c72b0523de..aa64191bb46823c444c1fc69cc65fdd4848f40d3 100644 (file)
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -725,6 +725,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html
index 727d15fd98e82f2da11d54a7043d1355536fb5c7..700af92034ea42ad4e8cf4e19b4129d53d9915e4 100644 (file)
--- a/doc/arm/man.dnssec-verify.html
+++ b/doc/arm/man.dnssec-verify.html
@@ -202,6 +202,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html
index 521123e9882d322ca002ef4fc1f131953bff2ff3..a1f3ac76fc56f2b4cb8a54c5d3948285203b8fe8 100644 (file)
--- a/doc/arm/man.dnstap-read.html
+++ b/doc/arm/man.dnstap-read.html
@@ -143,6 +143,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html
index af2aba6ca6023454367f22e135df7d2e8a1989e4..55cec24dec956f4116b02b18673cd13cae1d976e 100644 (file)
--- a/doc/arm/man.genrandom.html
+++ b/doc/arm/man.genrandom.html
@@ -126,6 +126,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index 88ddf6ebd94ef314c928149d66572a394cbd461c..d7d81b5311d2f9828f957a47e5c67f4ea3fc4244 100644 (file)
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -375,6 +375,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html
index 784f76412dadeb87811c94148d7279a2ad96b0ab..cb1e8052a3c9f3c3459a1871864bb5d10349bee3 100644 (file)
--- a/doc/arm/man.mdig.html
+++ b/doc/arm/man.mdig.html
@@ -610,6 +610,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index f14fc3f5ec28ac8681f908405f376039518d5205..061f9ecba66b203889a86dbc2213f361f4fba7a7 100644 (file)
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index 2f3969c7e7c371c3adfd300b52536f1a3d5ea74d..14fdcaa9d3b1d0c6f9f71f64858e691342026e0c 100644 (file)
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -463,6 +463,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html
index 5f618002dfebcbb4aadced845243f4051c329228..f0dde8aa2381de56a196f2dc2a54c75ccba29e03 100644 (file)
--- a/doc/arm/man.named-journalprint.html
+++ b/doc/arm/man.named-journalprint.html
@@ -117,6 +117,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html
index 9d64fa97cc8cf03d456c0ac0c5ed271bb4c12879..4fff46ad2ea5f9e47b317190a52527b3182a56e8 100644 (file)
--- a/doc/arm/man.named-nzd2nzf.html
+++ b/doc/arm/man.named-nzd2nzf.html
@@ -119,6 +119,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html
index bc931287e6f72fd78635996ba767012ff2a7ffcd..db1512e08e49d5e083c16c5b8ed85e5540439d39 100644 (file)
--- a/doc/arm/man.named-rrchecker.html
+++ b/doc/arm/man.named-rrchecker.html
@@ -121,6 +121,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 1cb2d5dc96fc2bc670ce8aa849651f655bf179cf..b12fb04d6cce140d9d871bed361346b64c70c92e 100644 (file)
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -894,10 +894,10 @@ view
                    | slave | static-stub | stub );<br>
                update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
                update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-                   6to4-self | external | krb5-self | krb5-subdomain |<br>
-                   ms-self | ms-subdomain | name | self | selfsub |<br>
-                   selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-                   [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+                   6to4-self | external | krb5-self | krb5-selfsub |<br>
+                   krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+                   name | self | selfsub | selfwild | subdomain | tcp-self<br>
+                   | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
                use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
                zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
                zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -996,9 +996,10 @@ zone
            | static-stub | stub );<br>
        update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
        update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-           external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-           | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-           wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+           external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+           | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+           | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+           <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
        use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
        zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
        zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -1055,6 +1056,6 @@ zone
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 7e86f7e0ebbe1d78f987f33c7b391a6f82c1f53d..2b5366b037fc6e519833e5d1afa239414502e29e 100644 (file)
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -492,6 +492,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index bee436232159d59be5b4467490e194bb0ee9e8bb..13f57531f36f23d33940c048a6ab39f32b035a79 100644 (file)
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -155,6 +155,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html
index 56e344c99af8723632f62d160c14f3f550728c92..fb2ec0c3536ca678c2089340faa2d4f8584ab309 100644 (file)
--- a/doc/arm/man.nslookup.html
+++ b/doc/arm/man.nslookup.html
@@ -420,6 +420,6 @@ nslookup -query=hinfo  -timeout=10
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html
index 4cc4dc0da1e91c9b18253ae357e8989355350a3d..4d77ee6c4b3058f407f11ee1da62e0f98e0572f8 100644 (file)
--- a/doc/arm/man.nsupdate.html
+++ b/doc/arm/man.nsupdate.html
@@ -832,6 +832,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html
index 89917984d9e574069f364607b78394baaac40380..a885187733825641fffa3af08f4331bdf994b6da 100644 (file)
--- a/doc/arm/man.pkcs11-destroy.html
+++ b/doc/arm/man.pkcs11-destroy.html
@@ -162,6 +162,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html
index c608f9cdb3ded4426cea7aa6fc2fd2d400312d40..ef343260bfbbb6eefcc2c79de4f00cddc1239148 100644 (file)
--- a/doc/arm/man.pkcs11-keygen.html
+++ b/doc/arm/man.pkcs11-keygen.html
@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html
index 816f0448cfa41281bb27921a3959f7dbce496d63..1a56078e44a9387dce7866ceecf18f53801ae1f9 100644 (file)
--- a/doc/arm/man.pkcs11-list.html
+++ b/doc/arm/man.pkcs11-list.html
@@ -158,6 +158,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html
index d0a345a1a059d4d587e7eb501862f4c3f90debc0..5f02d11274ed203acb71ce2932bc2077d55d2ab5 100644 (file)
--- a/doc/arm/man.pkcs11-tokens.html
+++ b/doc/arm/man.pkcs11-tokens.html
@@ -123,6 +123,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index 426b077109c0e20446cd7c1033474af96e6b7f3e..3dda8364c3fb78f97957945507a37be6d3e68529 100644 (file)
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -276,6 +276,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index bdfcfaa9876856b06d92fa9398b9ed0c706b1ba1..ac8323b4652e4ff61cf9317dd99a230524fd52dc 100644 (file)
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -268,6 +268,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 4f98f09330523dafb0936e34a589deedff65b88d..60f2d4285ec65509b4cc30c48223f47fa65a264f 100644 (file)
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -500,7 +500,7 @@
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>nta
-       [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
+           [<span class="optional">( -class <em class="replaceable"><code>class</code></em> | -dump | -force | -remove | -lifetime <em class="replaceable"><code>duration</code></em>)</span>]
        <em class="replaceable"><code>domain</code></em>
        [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
        </code></strong></span></dt>
@@ -548,7 +548,7 @@
            is equivalent to <code class="option">-remove</code>.
          </p>
          <p>
-           If <code class="option">-dump</code> is used, any other arguments
+           If the <code class="option">-dump</code> is used, any other arguments
            are ignored, and a list of existing NTAs is printed
            (note that this may include NTAs that are expired but
            have not yet been cleaned up).
@@ -565,10 +565,15 @@
            lifetime, regardless of whether data could be
            validated if the NTA were not present.
          </p>
+         <p>
+           The view class can be specified with <code class="option">-class</code>.
+           The default is class <strong class="userinput"><code>IN</code></strong>, which is
+           the only class for which DNSSEC is currently supported.
+         </p>
          <p>
            All of these options can be shortened, i.e., to
            <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
-           and <code class="option">-f</code>.
+           <code class="option">-f</code>, and <code class="option">-c</code>.
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional"> on | off </span>] </span></dt>
@@ -1010,6 +1015,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.2-P1</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.3rc1</p>
 </body>
 </html>

diff --git a/doc/arm/master.zoneopt.xml b/doc/arm/master.zoneopt.xml
index f68ace8b982bb2a8d3be505f9941604da11f46be..792265312fef5df9474f9d3bb47ac639d81f6550 100644 (file)
--- a/doc/arm/master.zoneopt.xml
+++ b/doc/arm/master.zoneopt.xml
@@ -62,7 +62,7 @@
        <command>sig-signing-type</command> <replaceable>integer</replaceable>;
        <command>sig-validity-interval</command> <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
        <command>update-check-ksk</command> <replaceable>boolean</replaceable>;
-       <command>update-policy</command> ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+       <command>update-policy</command> ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
        <command>zero-no-soa-ttl</command> <replaceable>boolean</replaceable>;
        <command>zone-statistics</command> ( full | terse | none | <replaceable>boolean</replaceable> );
 };

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 4482f7ca3f662d004319f7d3c23ad60bc79847a9..e62dd59acf3f4072545c8271b1e40b9e37693d0f 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -15,7 +15,7 @@
 
   <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.2"></a>Release Notes for BIND Version 9.12.2-P1</h2></div></div></div>
+<a name="id-1.2"></a>Release Notes for BIND Version 9.12.3rc1</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -125,6 +125,15 @@
          necessary.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         Two new update policy rule types have been added
+         <span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
+         which allow machines with Kerberos principals to update
+         the name space at or below the machine names identified
+         in the respective principals.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -146,20 +155,39 @@
          with IDN support.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
+         between views of the same name but different class; this
+         has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
+         option. [GL #105]
+       </p>
+      </li>
 </ul></div>
   </div>
 
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         When a negative trust anchor was added to multiple views
+         using <span class="command"><strong>rndc nta</strong></span>, the text returned via
+         <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
+         first line, making it appear that only one NTA had been
+         added. This has been fixed. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
        <p>
          <span class="command"><strong>named</strong></span> now rejects excessively large
          incremental (IXFR) zone transfers in order to prevent
          possible corruption of journal files which could cause
          <span class="command"><strong>named</strong></span> to abort when loading zones. [GL #339]
        </p>
-      </li></ul></div>
+      </li>
+</ul></div>
   </div>
 
   <div class="section">

diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf
index 83894bd624690b5269235cb910abe30924abfbf9..ec280fbfae604c82a0a6f5187c5f5797a3cb050d 100644 (file)
Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ

diff --git a/doc/arm/notes.txt b/doc/arm/notes.txt
index b2768b858e1dae5577116ed8ee53606a1154020b..08edeccd7c94e7986bea8cb8b7d329513147199c 100644 (file)
--- a/doc/arm/notes.txt
+++ b/doc/arm/notes.txt
@@ -1,4 +1,4 @@
-Release Notes for BIND Version 9.12.2-P1
+Release Notes for BIND Version 9.12.3rc1
 
 Introduction
 
@@ -62,6 +62,11 @@ New Features
     security mechanism, and should not be disabled unless absolutely
     necessary.
 
+  * Two new update policy rule types have been added krb5-selfsub and
+    ms-selfsub which allow machines with Kerberos principals to update the
+    name space at or below the machine names identified in the respective
+    principals.
+
 Feature Changes
 
   * BIND now can be compiled against libidn2 library to add IDNA2008
@@ -71,8 +76,17 @@ Feature Changes
   * dig +noidnin can be used to disable IDN processing on the input domain
     name, when BIND is compiled with IDN support.
 
+  * The rndc nta command could not differentiate between views of the same
+    name but different class; this has been corrected with the addition of
+    a -class option. [GL #105]
+
 Bug Fixes
 
+  * When a negative trust anchor was added to multiple views using rndc
+    nta, the text returned via rndc was incorrectly truncated after the
+    first line, making it appear that only one NTA had been added. This
+    has been fixed. [GL #105]
+
   * named now rejects excessively large incremental (IXFR) zone transfers
     in order to prevent possible corruption of journal files which could
     cause named to abort when loading zones. [GL #339]

diff --git a/doc/misc/master.zoneopt b/doc/misc/master.zoneopt
index 7bec788bb65fc4f90edef6315c84c2aa297658b2..2f130a2df99c7a03237c26c0fc5ada649e1d21ad 100644 (file)
--- a/doc/misc/master.zoneopt
+++ b/doc/misc/master.zoneopt
@@ -50,7 +50,7 @@ zone <string> [ <class> ] {
        sig-signing-type <integer>;
        sig-validity-interval <integer> [ <integer> ];
        update-check-ksk <boolean>;
-       update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+       update-policy ( local | { ( deny | grant ) <string> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
        zero-no-soa-ttl <boolean>;
        zone-statistics ( full | terse | none | <boolean> );
 };

diff --git a/doc/misc/options b/doc/misc/options
index 62392b0b91758200bea566e890c0881a532516bf..5e358614f9f7a51ab596cc75f7a4f18e76a112aa 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -807,10 +807,10 @@ view <string> [ <class> ] {
                     | slave | static-stub | stub );
                 update-check-ksk <boolean>;
                 update-policy ( local | { ( deny | grant ) <string> (
-                    6to4-self | external | krb5-self | krb5-subdomain |
-                    ms-self | ms-subdomain | name | self | selfsub |
-                    selfwild | subdomain | tcp-self | wildcard | zonesub )
-                    [ <string> ] <rrtypelist>; ... };
+                    6to4-self | external | krb5-self | krb5-selfsub |
+                    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
+                    name | self | selfsub | selfwild | subdomain | tcp-self
+                    | wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
                 use-alt-transfer-source <boolean>;
                 zero-no-soa-ttl <boolean>;
                 zone-statistics ( full | terse | none | <boolean> );
@@ -909,9 +909,10 @@ zone <string> [ <class> ] {
             | static-stub | stub );
         update-check-ksk <boolean>;
         update-policy ( local | { ( deny | grant ) <string> ( 6to4-self |
-            external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
-            | name | self | selfsub | selfwild | subdomain | tcp-self |
-            wildcard | zonesub ) [ <string> ] <rrtypelist>; ... };
+            external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
+            | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
+            | subdomain | tcp-self | wildcard | zonesub ) [ <string> ]
+            <rrtypelist>; ... };
         use-alt-transfer-source <boolean>;
         zero-no-soa-ttl <boolean>;
         zone-statistics ( full | terse | none | <boolean> );

diff --git a/lib/bind9/api b/lib/bind9/api
index 915fa662e0477488ab403e634cd0be87e54116e4..86ee606161c26d6bf831391a1078bde9baf56800 100644 (file)
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1200
-LIBREVISION = 7
+LIBINTERFACE = 1201
+LIBREVISION = 0
 LIBAGE = 0

diff --git a/lib/dns/api b/lib/dns/api
index ce5821319040dcde84d6496633477433ef3f9867..93218ac06d00091f0d2eb8e81bd831c9f1b52da3 100644 (file)
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1206
-LIBREVISION = 1
-LIBAGE = 1
+LIBINTERFACE = 1207
+LIBREVISION = 0
+LIBAGE = 0

diff --git a/lib/irs/api b/lib/irs/api
index 4f4a04c50134b33424117f51325bc5bf9f1f20b2..86ee606161c26d6bf831391a1078bde9baf56800 100644 (file)
--- a/lib/irs/api
+++ b/lib/irs/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1200
-LIBREVISION = 2
+LIBINTERFACE = 1201
+LIBREVISION = 0
 LIBAGE = 0

diff --git a/lib/isc/api b/lib/isc/api
index cfd1d0e3ba634c1d4ff2778b3e4db573ac6315d9..5c94ca20c7c8d54568c1ed837e9269d72b03b08e 100644 (file)
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1203
-LIBREVISION = 3
-LIBAGE = 3
+LIBINTERFACE = 1204
+LIBREVISION = 0
+LIBAGE = 0

diff --git a/lib/isccc/api b/lib/isccc/api
index 4d31f766d213af8386475611080063f67c4c6af8..86ee606161c26d6bf831391a1078bde9baf56800 100644 (file)
--- a/lib/isccc/api
+++ b/lib/isccc/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1200
-LIBREVISION = 1
+LIBINTERFACE = 1201
+LIBREVISION = 0
 LIBAGE = 0

diff --git a/lib/isccfg/api b/lib/isccfg/api
index 3e53ccbeff458d4cc65b0affe105e86c7f4bb7a8..a814bd38241c2e28a5a93a0c68584898422370d4 100644 (file)
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1202
-LIBREVISION = 1
-LIBAGE = 2
+LIBINTERFACE = 1203
+LIBREVISION = 0
+LIBAGE = 0

diff --git a/lib/ns/api b/lib/ns/api
index 64f06611ef471db793a680ab1955d4f220a2cb8a..248d069594fee04ed9877c4d27801753da574121 100644 (file)
--- a/lib/ns/api
+++ b/lib/ns/api
@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169
 # 9.12: 1200-1299
-LIBINTERFACE = 1204
+LIBINTERFACE = 1205
 LIBREVISION = 0
-LIBAGE = 1
+LIBAGE = 0

diff --git a/version b/version
index 078865feb070411e6d61366fd6672147c3265a28..37af1c9a23a6f8463c9dfebf09160033eb71bf6a 100644 (file)
--- a/version
+++ b/version
@@ -5,7 +5,7 @@ PRODUCT=BIND
 DESCRIPTION=
 MAJORVER=9
 MINORVER=12
-PATCHVER=2
-RELEASETYPE=-P
+PATCHVER=3
+RELEASETYPE=rc
 RELEASEVER=1
 EXTENSIONS=