prep 9.13.4

diff --git a/CHANGES b/CHANGES
index 6ccb08d59edeb8316e8ae0881af5bec4c46d3f58..2751bac4618321d961db6dccdc1caeccff48a23e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+       --- 9.13.4 released ---
+
 5098.  [func]          Failed memory allocations are now fatal. [GL #674]
 
 5097.  [cleanup]       Remove embedded ATF unit testing framework

diff --git a/PLATFORMS b/PLATFORMS
index 19a18a08d2c0c29edfb79104c9429fa99373e84e..29dd9032dfb10864176c8407ae438b75ae167117 100644 (file)
--- a/PLATFORMS
+++ b/PLATFORMS
@@ -59,3 +59,31 @@ These are platforms on which BIND is known not to build or run:
   * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
   * Platforms that don't support atomic operations (via compiler or
     library)
+  * Linux without NPTL (Native POSIX Thread Library)
+
+Platform quirks
+
+ARM
+
+If the compilation ends with following error:
+
+Error: selected processor does not support `yield' in ARM mode
+
+You will need to set -march compiler option to native, so the compiler
+recognizes yield assembler instruction. The proper way to set -march=
+native would be to put it into CFLAGS, e.g. run ./configure like this:
+CFLAGS="-march=native -Os -g" ./configure plus your usual options.
+
+If that doesn't work, you can enforce the minimum CPU and FPU (taken from
+Debian armhf documentation):
+
+  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
+    recommended build option is -march=armv7-a.
+
+  * FPU should be set at VFPv3-D16 as they represent the miminum
+    specification of the processors to support here, therefore the
+    recommended build option is -mfpu=vfpv3-d16.
+
+The configure command should look like this:
+
+CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure

diff --git a/README b/README
index 4f8a6e1449702522c1f9c7b0d1f0f7202dc2d4e1..a9b20391ca92f95850447434f81c9bc15d49d72f 100644 (file)
--- a/README
+++ b/README
@@ -104,6 +104,7 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:
 
+  * Socket and task code has been refactored to improve performance.
   * QNAME minimization, as described in RFC 7816, is now supported.
   * "Root key sentinel" support, enabling validating resolvers to indicate
     via a special query which trust anchors are configured for the root

diff --git a/README.md b/README.md
index fcad367c3f78b0968d5d32285f71f2d3b21ef9b5..90bfb0085f978e2b39af53c9047729d5d1612da8 100644 (file)
--- a/README.md
+++ b/README.md
@@ -122,6 +122,7 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:
 
+* Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate
   via a special query which trust anchors are configured for the root zone.

diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index 3af79f457f562e8ff4d7a11ca6baf2e1fb985e7b..d3fdfb26c8547c6fe6cd92c07c84f94af21c6bbd 100644 (file)
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -74,7 +74,9 @@ will perform an NS query for "\&." (the root)\&.
 It is possible to set per\-user defaults for
 \fBdig\fR
 via
-${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
+${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
+\fB\-r\fR
+option disables this feature, for scripts that need predictable behaviour\&.
 .PP
 The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
 \fB\-t\fR
@@ -174,11 +176,6 @@ reads a list of lookup requests to process from the given
 using the command\-line interface\&.
 .RE
 .PP
-\-i
-.RS 4
-Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
-.RE
-.PP
 \-k \fIkeyfile\fR
 .RS 4
 Sign queries using TSIG using a key read from the given file\&. Key files can be generated using
@@ -208,6 +205,12 @@ The domain name to query\&. This is useful to distinguish the
 from other arguments\&.
 .RE
 .PP
+\-r
+.RS 4
+Do not read options from
+${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
+.RE
+.PP
 \-t \fItype\fR
 .RS 4
 The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
@@ -246,9 +249,7 @@ arguments\&.
 \fBdig\fR
 automatically performs a lookup for a name like
 94\&.2\&.0\&.192\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the
-\fB\-i\fR
-option)\&.
+and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
 .RE
 .PP
 \-y \fI[hmac:]\fR\fIkeyname:secret\fR
@@ -468,12 +469,16 @@ option is enabled\&. If short form answers are requested, the default is not to
 .PP
 \fB+[no]idnin\fR
 .RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
+Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]idnout\fR
 .RS 4
-Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+.sp
+The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]ignore\fR
@@ -795,7 +800,10 @@ has been built with IDN (internationalized domain name) support, it can accept a
 appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
 \fI+noidnin\fR
 and
-\fI+noidnout\fR\&.
+\fI+noidnout\fR
+or define the
+\fBIDN_DISABLE\fR
+environment variable\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf

diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index aebcc98469fe01f12d0783a3e79e46159e6fcc3a..bc49954b06368744d7861e8c1f17bc44290c2eb2 100644 (file)
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -106,9 +106,10 @@
 
     <p>
       It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <code class="option">-r</code> option disables this feature, for
+      scripts that need predictable behaviour.
     </p>
 
     <p>
@@ -227,14 +228,6 @@
            <span class="command"><strong>dig</strong></span> using the command-line interface.
          </p>
        </dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-         <p>
-           Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
-           domain, which is no longer in use. Obsolete bit string
-           label queries (RFC 2874) are not attempted.
-         </p>
-       </dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
 <dd>
          <p>
@@ -274,6 +267,13 @@
            the <em class="parameter"><code>name</code></em> from other arguments.
          </p>
        </dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+         <p>
+           Do not read options from <code class="filename">${HOME}/.digrc</code>.
+           This is useful for scripts that need predictable behaviour.
+         </p>
+       </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
          <p>
@@ -324,8 +324,7 @@
            <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
            query type and class to PTR and IN respectively. IPv6
            addresses are looked up using nibble format under the
-           IP6.ARPA domain (but see also the <code class="option">-i</code>
-           option).
+           IP6.ARPA domain.
          </p>
        </dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
@@ -631,7 +630,13 @@
            <p>
              Process [do not process] IDN domain names on input.
              This requires IDN SUPPORT to have been enabled at
-             compile time.  The default is to process IDN input.
+             compile time.
+           </p>
+           <p>
+             The default is to process IDN input when standard output
+             is a tty.  The IDN processing on input is disabled when
+             dig output is redirected to files, pipes, and other
+             non-tty file descriptors.
            </p>
          </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -639,7 +644,13 @@
            <p>
              Convert [do not convert] puny code on output.
              This requires IDN SUPPORT to have been enabled at
-             compile time.  The default is to convert output.
+             compile time.
+           </p>
+           <p>
+             The default is to process puny code on output when
+             standard output is a tty.  The puny code processing on
+             output is disabled when dig output is redirected to
+             files, pipes, and other non-tty file descriptors.
            </p>
          </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -1061,7 +1072,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
       reply from the server.
       If you'd like to turn off the IDN support for some reason, use
       parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em>.
+      <em class="parameter"><code>+noidnout</code></em> or define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+
     </p>
   </div>
 

diff --git a/bin/dig/host.1 b/bin/dig/host.1
index 0bd8ff1b983c55341af465657b75127b70e04a10..f4e00aca6c672164b426e434cbaf95c0e1fa1655 100644 (file)
--- a/bin/dig/host.1
+++ b/bin/dig/host.1
@@ -112,11 +112,6 @@ Print debugging traces\&. Equivalent to the
 verbose option\&.
 .RE
 .PP
-\-i
-.RS 4
-Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
-.RE
-.PP
 \-l
 .RS 4
 List zone: The
@@ -257,7 +252,7 @@ If
 \fBhost\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBhost\fR
-appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
 \fBIDN_DISABLE\fR
 environment variable\&. The IDN support is disabled if the variable is set when
 \fBhost\fR

diff --git a/bin/dig/host.html b/bin/dig/host.html
index c8a9a3fa5d77c29ea55f20f7baade4c55d208748..1e06cb05fb8ec21a85a8eea8f10c9e0eeb36befc 100644 (file)
--- a/bin/dig/host.html
+++ b/bin/dig/host.html
@@ -138,15 +138,6 @@
            Equivalent to the <code class="option">-v</code> verbose option.
          </p>
        </dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-         <p>
-           Obsolete.
-           Use the IP6.INT domain for reverse lookups of IPv6
-           addresses as defined in RFC1886 and deprecated in RFC4159.
-           The default is to use IP6.ARPA as specified in RFC3596.
-         </p>
-       </dd>
 <dt><span class="term">-l</span></dt>
 <dd>
          <p>
@@ -311,7 +302,7 @@
       <span class="command"><strong>host</strong></span> appropriately converts character encoding of
       domain name before sending a request to DNS server or displaying a
       reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
       the <code class="envar">IDN_DISABLE</code> environment variable.
       The IDN support is disabled if the variable is set when
       <span class="command"><strong>host</strong></span> runs.

diff --git a/bin/dig/nslookup.1 b/bin/dig/nslookup.1
index e95e3aa0b5288e65cb4f60c92bd96a2efd468406..873da4b68b0c0f18add749a42b10ce55ad5e0dce 100644 (file)
--- a/bin/dig/nslookup.1
+++ b/bin/dig/nslookup.1
@@ -277,6 +277,17 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 \fBnslookup\fR
 returns with an exit status of 1 if any query failed, and 0 otherwise\&.
+.SH "IDN SUPPORT"
+.PP
+If
+\fBnslookup\fR
+has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
+\fBnslookup\fR
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
+\fBIDN_DISABLE\fR
+environment variable\&. The IDN support is disabled if the variable is set when
+\fBnslookup\fR
+runs or when the standard output is not a tty\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf

diff --git a/bin/dig/nslookup.html b/bin/dig/nslookup.html
index 1ce24f5d5287fa32c11e960acf21e64d466962dd..ad6fb80d10221e16927c42a184193f62c627a421 100644 (file)
--- a/bin/dig/nslookup.html
+++ b/bin/dig/nslookup.html
@@ -362,14 +362,31 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.11"></a><h2>FILES</h2>
+<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
+
+    <p>
+      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
+      a tty.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.12"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/resolv.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.13"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)

diff --git a/bin/dnssec/dnssec-keyfromlabel.8 b/bin/dnssec/dnssec-keyfromlabel.8
index ebc20c17f99e67cdc46ada24b7c2bfe38e500f04..f0a261c3dfeb564fd5439188bb3759593e800d12 100644 (file)
--- a/bin/dnssec/dnssec-keyfromlabel.8
+++ b/bin/dnssec/dnssec-keyfromlabel.8
@@ -55,7 +55,7 @@ of the key is specified on the command line\&. This must match the name of the z
 .RS 4
 Selects the cryptographic algorithm\&. The value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&.
 .sp
 If no algorithm is specified, then RSASHA1 will be used by default, unless the
 \fB\-3\fR
@@ -63,9 +63,9 @@ option is specified, in which case NSEC3RSASHA1 will be used instead\&. (If
 \fB\-3\fR
 is used and an algorithm is specified, that algorithm will be checked for compatibility with NSEC3\&.)
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 As of BIND 9\&.12\&.0, this option is mandatory except when using the
 \fB\-S\fR

diff --git a/bin/dnssec/dnssec-keyfromlabel.html b/bin/dnssec/dnssec-keyfromlabel.html
index d25dcebd62f31bad370adefb4ce7538571a96474..83e066686a4a46d9f17cb7da356b37e3a8e30b14 100644 (file)
--- a/bin/dnssec/dnssec-keyfromlabel.html
+++ b/bin/dnssec/dnssec-keyfromlabel.html
@@ -90,7 +90,7 @@
          <p>
            Selects the cryptographic algorithm.  The value of
            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-           DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+           NSEC3RSASHA1, RSASHA256, RSASHA512,
            ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
          </p>
          <p>
@@ -103,9 +103,9 @@
          <p>
            These values are case insensitive. In some cases, abbreviations
            are supported, such as ECDSA256 for ECDSAP256SHA256 and
-           ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+           ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
            along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-           or NSEC3DSA will be used instead.
+           will be used instead.
          </p>
          <p>
            As of BIND 9.12.0, this option is mandatory except when using

diff --git a/bin/dnssec/dnssec-keygen.8 b/bin/dnssec/dnssec-keygen.8
index 5300ed81a1430aa0aafa8ac6cd111583b2fba36c..c0885df7b390dadceefe28cd38b7ad8677b32cac 100644 (file)
--- a/bin/dnssec/dnssec-keygen.8
+++ b/bin/dnssec/dnssec-keygen.8
@@ -62,13 +62,13 @@ may be preferable to direct use of
 .RS 4
 Selects the cryptographic algorithm\&. For DNSSEC keys, the value of
 \fBalgorithm\fR
-must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
+must be one of RSAMD5, RSASHA1, NSEC3RSASHA1, RSASHA256, RSASHA512, ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448\&. For TKEY, the value must be DH (Diffie Hellman); specifying his value will automatically set the
 \fB\-T KEY\fR
 option as well\&.
 .sp
-These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
+These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 is specified along with the
 \fB\-3\fR
-option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
+option, then NSEC3RSASHA1 will be used instead\&.
 .sp
 This parameter
 \fImust\fR

diff --git a/bin/dnssec/dnssec-keygen.html b/bin/dnssec/dnssec-keygen.html
index fe28bb439eab7ab0e8d3e56c67bb1d2abbfd7c69..d817ce79bc61403c5cedb193bc1461f0b04c1a0d 100644 (file)
--- a/bin/dnssec/dnssec-keygen.html
+++ b/bin/dnssec/dnssec-keygen.html
@@ -100,7 +100,7 @@
          <p>
            Selects the cryptographic algorithm.  For DNSSEC keys, the value
            of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-           DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+           NSEC3RSASHA1, RSASHA256, RSASHA512,
            ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
            TKEY, the value must be DH (Diffie Hellman); specifying
            his value will automatically set the <code class="option">-T KEY</code>
@@ -109,9 +109,9 @@
          <p>
            These values are case insensitive. In some cases, abbreviations
            are supported, such as ECDSA256 for ECDSAP256SHA256 and
-           ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+           ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
            along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-           or NSEC3DSA will be used instead.
+           will be used instead.
          </p>
          <p>
            This parameter <span class="emphasis"><em>must</em></span> be specified except

diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 8d109a00b9fe1bb96d2c6d4b49f44d951119fb3f..655c1637e12e48d74cec76b8e77959b6fed7c0c7 100644 (file)
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2018-10-23
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-10\-23" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,6 +199,7 @@ options {
            ] [ dscp \fIinteger\fR ];
        alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
            * ) ] [ dscp \fIinteger\fR ];
+       answer\-cookie \fIboolean\fR;
        attach\-cache \fIstring\fR;
        auth\-nxdomain \fIboolean\fR; // default changed
        auto\-dnssec ( allow | maintain | off );
@@ -264,8 +265,8 @@ options {
        dnssec\-secure\-to\-insecure \fIboolean\fR;
        dnssec\-update\-mode ( maintain | no\-resign );
        dnssec\-validation ( yes | no | auto );
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-           response ) ]; \&.\&.\&. };
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [
+           ( query | response ) ]; \&.\&.\&. };
        dnstap\-identity ( \fIquoted_string\fR | none | hostname );
        dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
            \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
@@ -343,6 +344,8 @@ options {
        memstatistics \fIboolean\fR;
        memstatistics\-file \fIquoted_string\fR;
        message\-compression \fIboolean\fR;
+       min\-cache\-ttl \fIttlval\fR;
+       min\-ncache\-ttl \fIttlval\fR;
        min\-refresh\-time \fIinteger\fR;
        min\-retry\-time \fIinteger\fR;
        minimal\-any \fIboolean\fR;
@@ -632,8 +635,8 @@ view \fIstring\fR [ \fIclass\fR ] {
        dnssec\-secure\-to\-insecure \fIboolean\fR;
        dnssec\-update\-mode ( maintain | no\-resign );
        dnssec\-validation ( yes | no | auto );
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
-           response ) ]; \&.\&.\&. };
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [
+           ( query | response ) ]; \&.\&.\&. };
        dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
            \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
            \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -914,10 +917,10 @@ view \fIstring\fR [ \fIclass\fR ] {
                    static\-stub | stub );
                update\-check\-ksk \fIboolean\fR;
                update\-policy ( local | { ( deny | grant ) \fIstring\fR (
-                   6to4\-self | external | krb5\-self | krb5\-subdomain |
-                   ms\-self | ms\-subdomain | name | self | selfsub |
-                   selfwild | subdomain | tcp\-self | wildcard | zonesub )
-                   [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+                   6to4\-self | external | krb5\-self | krb5\-selfsub |
+                   krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
+                   name | self | selfsub | selfwild | subdomain | tcp\-self
+                   | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
                use\-alt\-transfer\-source \fIboolean\fR;
                zero\-no\-soa\-ttl \fIboolean\fR;
                zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1020,9 +1023,10 @@ zone \fIstring\fR [ \fIclass\fR ] {
            stub );
        update\-check\-ksk \fIboolean\fR;
        update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
-           external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
-           | name | self | selfsub | selfwild | subdomain | tcp\-self |
-           wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+           external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
+           | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
+           | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
+           \fIrrtypelist\fR; \&.\&.\&. };
        use\-alt\-transfer\-source \fIboolean\fR;
        zero\-no\-soa\-ttl \fIboolean\fR;
        zone\-statistics ( full | terse | none | \fIboolean\fR );

diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index a5b2ccd7022b9e97fd01a96e534bc55dda8d638a..0211b6e8ae35248e489b1ac26e8e441178c1b4db 100644 (file)
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -180,6 +180,7 @@ options
            ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
        alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
            * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
+       answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
        attach-cache <em class="replaceable"><code>string</code></em>;<br>
        auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
        auto-dnssec ( allow | maintain | off );<br>
@@ -245,8 +246,8 @@ options
        dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
        dnssec-update-mode ( maintain | no-resign );<br>
        dnssec-validation ( yes | no | auto );<br>
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-           response ) ]; ... };<br>
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+           ( query | response ) ]; ... };<br>
        dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
        dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
            <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
@@ -324,6 +325,8 @@ options
        memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
        memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
        message-compression <em class="replaceable"><code>boolean</code></em>;<br>
+       min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+       min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
        min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
        min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
        minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -601,8 +604,8 @@ view
        dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
        dnssec-update-mode ( maintain | no-resign );<br>
        dnssec-validation ( yes | no | auto );<br>
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-           response ) ]; ... };<br>
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+           ( query | response ) ]; ... };<br>
        dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
            <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
            <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -883,10 +886,10 @@ view
                    static-stub | stub );<br>
                update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
                update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-                   6to4-self | external | krb5-self | krb5-subdomain |<br>
-                   ms-self | ms-subdomain | name | self | selfsub |<br>
-                   selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-                   [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+                   6to4-self | external | krb5-self | krb5-selfsub |<br>
+                   krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+                   name | self | selfsub | selfwild | subdomain | tcp-self<br>
+                   | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
                use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
                zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
                zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -986,9 +989,10 @@ zone
            stub );<br>
        update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
        update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-           external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-           | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-           wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+           external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+           | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+           | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+           <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
        use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
        zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
        zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>

diff --git a/bin/python/dnssec-keymgr.8 b/bin/python/dnssec-keymgr.8
index 45bd51061e9cae191b151b335a58c1aa6c07b79c..413fa1584b851cd550b4d194543b9339e9c5cd31 100644 (file)
--- a/bin/python/dnssec-keymgr.8
+++ b/bin/python/dnssec-keymgr.8
@@ -215,7 +215,7 @@ Specifies the directory in which keys should be stored\&.
 .PP
 \fBkey\-size\fR
 .RS 4
-Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 1024 bits for DSA keys and 2048 for RSA\&.
+Specifies the number of bits to use in creating keys\&. Takes two arguments: keytype (eihter "zsk" or "ksk") and size\&. A default value for this option can be set in algorithm policies as well as in policy classes or zone policies\&. If no policy is configured, the default is 2048 bits for RSA keys\&.
 .RE
 .PP
 \fBkeyttl\fR

diff --git a/bin/python/dnssec-keymgr.html b/bin/python/dnssec-keymgr.html
index 726c22c1ac5e2c607e2e0fd82d57db488ad58f95..ce0cb6700fc02835ca838af3d117ccf78efe4698 100644 (file)
--- a/bin/python/dnssec-keymgr.html
+++ b/bin/python/dnssec-keymgr.html
@@ -258,8 +258,7 @@
            Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
            A default value for this option can be set in algorithm policies
            as well as in policy classes or zone policies. If no policy is
-           configured, the default is 1024 bits for DSA keys and 2048 for
-           RSA.
+           configured, the default is 2048 bits for RSA keys.
          </p>
        </dd>
 <dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>

diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index ca2daec1b17d0aac9edf90e1f6587a10c9c6577d..1b14a417e94858bf23267aaf177498e806587ffb 100644 (file)
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -386,7 +386,7 @@ See also
 \fBrndc trace\fR\&.
 .RE
 .PP
-\fBnta \fR\fB[( \-d | \-f | \-r | \-l \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
+\fBnta \fR\fB[( \-class \fIclass\fR | \-dump | \-force | \-remove | \-lifetime \fIduration\fR)]\fR\fB \fR\fB\fIdomain\fR\fR\fB \fR\fB[\fIview\fR]\fR\fB \fR
 .RS 4
 Sets a DNSSEC negative trust anchor (NTA) for
 \fBdomain\fR, with a lifetime of
@@ -418,7 +418,7 @@ option\&. TTL\-style suffixes can be used to specify the lifetime in seconds, mi
 to zero is equivalent to
 \fB\-remove\fR\&.
 .sp
-If
+If the
 \fB\-dump\fR
 is used, any other arguments are ignored, and a list of existing NTAs is printed (note that this may include NTAs that are expired but have not yet been cleaned up)\&.
 .sp
@@ -430,11 +430,18 @@ option in the Administrator Reference Manual for details)\&. If data can be vali
 \fB\-force\fR
 overrides this behavior and forces an NTA to persist for its entire lifetime, regardless of whether data could be validated if the NTA were not present\&.
 .sp
+The view class can be specified with
+\fB\-class\fR\&. The default is class
+\fBIN\fR, which is the only class for which DNSSEC is currently supported\&.
+.sp
 All of these options can be shortened, i\&.e\&., to
 \fB\-l\fR,
 \fB\-r\fR,
-\fB\-d\fR, and
-\fB\-f\fR\&.
+\fB\-d\fR,
+\fB\-f\fR, and
+\fB\-c\fR\&.
+.sp
+Unrecognized options are treated as errors\&. To reference a domain or view name that begins with a hyphen, use a double\-hyphen on the command line to indicate the end of options\&.
 .RE
 .PP
 \fBquerylog\fR [ on | off ]
@@ -695,13 +702,14 @@ in each view\&. The list both statically configured keys and dynamic TKEY\-negot
 .PP
 \fBvalidation ( on | off | status ) \fR\fB[\fIview \&.\&.\&.\fR]\fR\fB \fR
 .RS 4
-Enable, disable, or check the current status of DNSSEC validation\&. Note
+Enable, disable, or check the current status of DNSSEC validation\&. By default, validation is enabled\&. (Note that
 \fBdnssec\-enable\fR
-also needs to be set to
+must also be
 \fByes\fR
-or
-\fBauto\fR
-to be effective\&. It defaults to enabled\&.
+(the default value) for signatures to be returned along with validated data\&. If validation is enabled while
+\fBdnssec\-enable\fR
+is set to
+\fBno\fR, the server will validate internally, but will not supply clients with the necessary records to allow validity to be confirmed\&.)
 .RE
 .PP
 \fBzonestatus \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR

diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index 97b77cb8dc5e75075e8d1e1fda4e1820eb6611ff..57b3c0b4e12f03200ec649433fcd342f777d1427 100644 (file)
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -484,7 +484,7 @@
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>nta
-       [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
+           [<span class="optional">( -class <em class="replaceable"><code>class</code></em> | -dump | -force | -remove | -lifetime <em class="replaceable"><code>duration</code></em>)</span>]
        <em class="replaceable"><code>domain</code></em>
        [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
        </code></strong></span></dt>
@@ -532,7 +532,7 @@
            is equivalent to <code class="option">-remove</code>.
          </p>
          <p>
-           If <code class="option">-dump</code> is used, any other arguments
+           If the <code class="option">-dump</code> is used, any other arguments
            are ignored, and a list of existing NTAs is printed
            (note that this may include NTAs that are expired but
            have not yet been cleaned up).
@@ -549,10 +549,21 @@
            lifetime, regardless of whether data could be
            validated if the NTA were not present.
          </p>
+         <p>
+           The view class can be specified with <code class="option">-class</code>.
+           The default is class <strong class="userinput"><code>IN</code></strong>, which is
+           the only class for which DNSSEC is currently supported.
+         </p>
          <p>
            All of these options can be shortened, i.e., to
            <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
-           and <code class="option">-f</code>.
+           <code class="option">-f</code>, and <code class="option">-c</code>.
+         </p>
+         <p>
+           Unrecognized options are treated as errors. To reference
+           a domain or view name that begins with a hyphen,
+           use a double-hyphen on the command line to indicate the
+           end of options.
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional"> on | off </span>] </span></dt>
@@ -902,11 +913,14 @@
 <dd>
          <p>
            Enable, disable, or check the current status of
-           DNSSEC validation.
-           Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
-           set to <strong class="userinput"><code>yes</code></strong> or
-           <strong class="userinput"><code>auto</code></strong> to be effective.
-           It defaults to enabled.
+           DNSSEC validation.  By default, validation is enabled.
+           (Note that <span class="command"><strong>dnssec-enable</strong></span> must also be
+           <strong class="userinput"><code>yes</code></strong> (the default value) for signatures
+           to be returned along with validated data. If validation is
+           enabled while <span class="command"><strong>dnssec-enable</strong></span> is set to
+           <strong class="userinput"><code>no</code></strong>, the server will validate internally,
+           but will not supply clients with the necessary records to allow
+           validity to be confirmed.)
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>

diff --git a/bin/tools/mdig.1 b/bin/tools/mdig.1
index 5f7658d330754bb2ec910c38cac3cacf59e3c14f..6515ad202b4ccfd45e68301bc2cffe42b4dee8fe 100644 (file)
--- a/bin/tools/mdig.1
+++ b/bin/tools/mdig.1
@@ -247,10 +247,6 @@ option sets the query type to
 \fB\-x\fR
 option is supplied to indicate a reverse lookup with the "PTR" query type\&.
 .PP
-The
-\fB\-i\fR
-option sets the reverse domain for IPv6 addresses to IP6\&.INT\&.
-.PP
 Reverse lookups \(em mapping addresses to names \(em are simplified by the
 \fB\-x\fR
 option\&.
@@ -259,9 +255,7 @@ is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 addre
 \fBmdig\fR
 automatically performs a lookup for a query name like
 11\&.12\&.13\&.10\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. By default, IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&. To use the older RFC1886 method using the IP6\&.INT domain specify the
-\fB\-i\fR
-option\&.
+and sets the query type and class to PTR and IN respectively\&. By default, IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
 .PP
 The local query options are:
 .PP

diff --git a/bin/tools/mdig.html b/bin/tools/mdig.html
index 3c866ff7dbe2af91dacbd9afb13a44cd39c089ed..f1944881606c32c02c67f7142911cc6199bd2aa0 100644 (file)
--- a/bin/tools/mdig.html
+++ b/bin/tools/mdig.html
@@ -357,11 +357,6 @@
       a reverse lookup with the "PTR" query type.
     </p>
 
-    <p>
-      The <code class="option">-i</code> option sets the reverse domain for
-      IPv6 addresses to IP6.INT.
-    </p>
-
     <p>
       Reverse lookups &#8212; mapping addresses to names &#8212; are
       simplified by the <code class="option">-x</code> option.
@@ -371,8 +366,7 @@
       query name like <code class="literal">11.12.13.10.in-addr.arpa</code> and
       sets the query type and class to PTR and IN respectively.
       By default, IPv6 addresses are looked up using nibble format
-      under the IP6.ARPA domain.  To use the older RFC1886 method
-      using the IP6.INT domain specify the <code class="option">-i</code> option.
+      under the IP6.ARPA domain.
     </p>
 
     <p>

diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html
index e7913fceb407359226e2371bfec65c3190a87f8a..2051a9536b77ff79a38bc391eb68cc53db86f822 100644 (file)
--- a/doc/arm/Bv9ARM.ch01.html
+++ b/doc/arm/Bv9ARM.ch01.html
@@ -614,6 +614,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html
index 577d149b13f716e925969e351808e79b6b731234..50532bf65bf7015cb6dc7bacf38336bf50f5fcd0 100644 (file)
--- a/doc/arm/Bv9ARM.ch02.html
+++ b/doc/arm/Bv9ARM.ch02.html
@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html
index 31fe5df2a2388a3fff78d2a29dc42f56e0b3dd25..203c21568bc290e3a7566c9b82dce551bcede27d 100644 (file)
--- a/doc/arm/Bv9ARM.ch03.html
+++ b/doc/arm/Bv9ARM.ch03.html
@@ -759,6 +759,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 3da74dbd2333438595da3de58b9c008c502229f4..f55fbf67c0ab9b7deab7c82437d9c6311cc977a3 100644 (file)
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -56,7 +56,7 @@
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_keys">Generating Keys</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_signing">Signing the Zone</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_config">Configuring Servers</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_config">Configuring Servers for DNSSEC</a></span></dt>
 </dl></dd>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
 <dd><dl>
@@ -1028,43 +1028,54 @@ allow-update { !{ !localnets; any; }; key host1-host2. ;};
 
       <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="dnssec_config"></a>Configuring Servers</h3></div></div></div>
-
+<a name="dnssec_config"></a>Configuring Servers for DNSSEC</h3></div></div></div>
         <p>
           To enable <span class="command"><strong>named</strong></span> to respond appropriately
-          to DNS requests from DNSSEC aware clients,
-          <span class="command"><strong>dnssec-enable</strong></span> must be set to yes.
-          This is the default setting.
+          to DNS requests from DNSSEC-aware clients,
+          <span class="command"><strong>dnssec-enable</strong></span> must be set to
+          <strong class="userinput"><code>yes</code></strong>. This is the default setting.
         </p>
-
         <p>
-          To enable <span class="command"><strong>named</strong></span> to validate answers from
-          other servers, the <span class="command"><strong>dnssec-enable</strong></span> option
-          must be set to <strong class="userinput"><code>yes</code></strong>, and the
+          To enable <span class="command"><strong>named</strong></span> to validate answers
+          received from other servers, the
           <span class="command"><strong>dnssec-validation</strong></span> option must be set to
           either <strong class="userinput"><code>yes</code></strong> or <strong class="userinput"><code>auto</code></strong>.
         </p>
-
         <p>
           When <span class="command"><strong>dnssec-validation</strong></span> is set to
           <strong class="userinput"><code>auto</code></strong>, a trust anchor for the DNS
           root zone will automatically be used. This trust anchor is
           provided as part of BIND and is kept up to date using RFC 5011
           key management.
-          If <span class="command"><strong>dnssec-validation</strong></span> is set to
-          <strong class="userinput"><code>yes</code></strong>, then
-          DNSSEC validation only occurs if
-          at least one trust anchor has been explicitly configured
-          in <code class="filename">named.conf</code>,
+        </p>
+        <p>
+          When <span class="command"><strong>dnssec-validation</strong></span> is set to
+          <strong class="userinput"><code>yes</code></strong>, DNSSEC validation will only occur
+          if at least one trust anchor has been explicitly configured
+          in <code class="filename">named.conf</code>
           using a <span class="command"><strong>trusted-keys</strong></span> or
           <span class="command"><strong>managed-keys</strong></span> statement.
-          If <span class="command"><strong>dnssec-validation</strong></span> is set to
-          <strong class="userinput"><code>no</code></strong>, then DNSSEC validation will
-          not occur.
+        </p>
+        <p>
+          When <span class="command"><strong>dnssec-validation</strong></span> is set to
+          <strong class="userinput"><code>no</code></strong>, DNSSEC validation will not occur.
+        </p>
+        <p>
           The default is <strong class="userinput"><code>auto</code></strong> unless BIND is
           built with <span class="command"><strong>configure --disable-auto-validation</strong></span>,
           in which case the default is <strong class="userinput"><code>yes</code></strong>.
         </p>
+        <p>
+          If <span class="command"><strong>dnssec-enable</strong></span> is set to
+          <strong class="userinput"><code>no</code></strong>, then the default for
+          <span class="command"><strong>dnssec-validation</strong></span> is also changed to
+          <strong class="userinput"><code>no</code></strong>. If
+          <span class="command"><strong>dnssec-validation</strong></span> is set to
+          <strong class="userinput"><code>yes</code></strong>, the server will
+          perform DNSSEC validation internally, but will not return
+          signatures when queried - but it will not be turned on
+          automatically.
+        </p>
 
         <p>
           <span class="command"><strong>trusted-keys</strong></span> are copies of DNSKEY RRs
@@ -2857,6 +2868,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html
index 401f9f204c7e699cc6d89471e5e2450c9981ac88..123938747d36d165c1829784b0241fc881fb09f2 100644 (file)
--- a/doc/arm/Bv9ARM.ch05.html
+++ b/doc/arm/Bv9ARM.ch05.html
@@ -2383,6 +2383,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
            ] [ dscp <em class="replaceable"><code>integer</code></em> ];
        <span class="command"><strong>alt-transfer-source-v6</strong></span> ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |
            * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];
+       <span class="command"><strong>answer-cookie</strong></span> <em class="replaceable"><code>boolean</code></em>;
        <span class="command"><strong>attach-cache</strong></span> <em class="replaceable"><code>string</code></em>;
        <span class="command"><strong>auth-nxdomain</strong></span> <em class="replaceable"><code>boolean</code></em>; // default changed
        <span class="command"><strong>auto-dnssec</strong></span> ( allow | maintain | off );
@@ -2448,8 +2449,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
        <span class="command"><strong>dnssec-secure-to-insecure</strong></span> <em class="replaceable"><code>boolean</code></em>;
        <span class="command"><strong>dnssec-update-mode</strong></span> ( maintain | no-resign );
        <span class="command"><strong>dnssec-validation</strong></span> ( yes | no | auto );
-       <span class="command"><strong>dnstap</strong></span> { ( all | auth | client | forwarder | resolver ) [ ( query |
-           <span class="command"><strong>response</strong></span> ) ]; ... };
+       <span class="command"><strong>dnstap</strong></span> { ( all | auth | client | forwarder | resolver | update ) [
+           ( query | response ) ]; ... };
        <span class="command"><strong>dnstap-identity</strong></span> ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );
        <span class="command"><strong>dnstap-output</strong></span> ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |
            <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (
@@ -2754,6 +2755,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                   <span class="command"><strong>max-ncache-ttl</strong></span>,
                   <span class="command"><strong>max-stale-ttl</strong></span>,
                   <span class="command"><strong>max-cache-size</strong></span>, and
+                  <span class="command"><strong>min-cache-ttl</strong></span>,
+                  <span class="command"><strong>min-ncache-ttl</strong></span>,
                   <span class="command"><strong>zero-no-soa-ttl</strong></span>.
                 </p>
 
@@ -2813,10 +2816,11 @@ badresp:1,adberr:0,findfail:0,valfail:0]
                 The <span class="command"><strong>dnstap</strong></span> option is a bracketed list
                 of message types to be logged. These may be set differently
                 for each view. Supported types are <code class="literal">client</code>,
-                <code class="literal">auth</code>, <code class="literal">resolver</code>, and
-                <code class="literal">forwarder</code>.  Specifying type
-                <code class="literal">all</code> will cause all <span class="command"><strong>dnstap</strong></span>
-                messages to be logged, regardless of type.
+                <code class="literal">auth</code>, <code class="literal">resolver</code>,
+                <code class="literal">forwarder</code>, and <code class="literal">update</code>.
+                Specifying type <code class="literal">all</code> will cause all
+                <span class="command"><strong>dnstap</strong></span> messages to be logged, regardless of
+                type.
               </p>
               <p>
                 Each type may take an additional argument to indicate whether
@@ -4784,34 +4788,54 @@ options {
 <dt><span class="term"><span class="command"><strong>dnssec-validation</strong></span></span></dt>
 <dd>
                 <p>
-                  Enable DNSSEC validation in <span class="command"><strong>named</strong></span>.
-                  Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
-                  set to <strong class="userinput"><code>yes</code></strong> to be effective.
+                  This enables DNSSEC validation in <span class="command"><strong>named</strong></span>.
+                  Note that <span class="command"><strong>dnssec-enable</strong></span> also needs to
+                  be set to <strong class="userinput"><code>yes</code></strong> for signatures to be
+                  returned to the client along with validated answers.
+                </p>
+                <p>
+                  If set to <strong class="userinput"><code>auto</code></strong>,
+                  DNSSEC validation is enabled, and a default trust anchor
+                  for the DNS root zone is used.
+                </p>
+                <p>
+                  If set to <strong class="userinput"><code>yes</code></strong>, DNSSEC validation is
+                  enabled, but a trust anchor must be manually configured
+                  using a <span class="command"><strong>trusted-keys</strong></span>
+                  or <span class="command"><strong>managed-keys</strong></span> statement; if there
+                  is no configured trust anchor, validation will not take
+                  place.
+                </p>
+                <p>
                   If set to <strong class="userinput"><code>no</code></strong>, DNSSEC validation
                   is disabled.
                 </p>
                 <p>
-                  If set to <strong class="userinput"><code>auto</code></strong>, DNSSEC validation
-                  is enabled, and a default trust anchor for the DNS root
-                  zone is used.  If set to <strong class="userinput"><code>yes</code></strong>,
-                  DNSSEC validation is enabled, but a trust anchor must be
-                  manually configured using a <span class="command"><strong>trusted-keys</strong></span>
-                  or <span class="command"><strong>managed-keys</strong></span> statement.  The default
-                  is <strong class="userinput"><code>yes</code></strong>.
+                  The default is <strong class="userinput"><code>auto</code></strong>, unless
+                  BIND is built with
+                  <span class="command"><strong>configure --disable-auto-validation</strong></span>,
+                  in which case the default is <strong class="userinput"><code>yes</code></strong>.
+                  If <span class="command"><strong>dnssec-enable</strong></span> is set to
+                  <strong class="userinput"><code>no</code></strong>, then the default for
+                  <span class="command"><strong>dnssec-validation</strong></span> is also
+                  <strong class="userinput"><code>no</code></strong>. Validation can still be turned on
+                  if desired - this results in a server that performs DNSSEC
+                  validation but does not return signatures when queried -
+                  but it will not be turned on automatically.
                 </p>
                 <p>
                   The default root trust anchor is stored in the file
                   <code class="filename">bind.keys</code>.
                   <span class="command"><strong>named</strong></span> will load that key at
                   startup if <span class="command"><strong>dnssec-validation</strong></span> is
-                  set to <code class="constant">auto</code>.  A copy of the file is
+                  set to <strong class="userinput"><code>auto</code></strong>.  A copy of the file is
                   installed along with BIND 9, and is current as of the
                   release date.  If the root key expires, a new copy of
                   <code class="filename">bind.keys</code> can be downloaded
                   from <a class="link" href="https://www.isc.org/bind-keys" target="_top">https://www.isc.org/bind-keys</a>.
                 </p>
                 <p>
-                  To prevent problems if <code class="filename">bind.keys</code> is
+                  (To prevent problems if <code class="filename">bind.keys</code> is
                   not found, the current trust anchor is also compiled in
                   to <span class="command"><strong>named</strong></span>.  Relying on this is not
                   recommended, however, as it requires <span class="command"><strong>named</strong></span>
@@ -4820,8 +4844,8 @@ options {
                 <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
                   <p>
-                    <span class="command"><strong>named</strong></span> <span class="emphasis"><em>only</em></span>
-                    loads the root key from <code class="filename">bind.keys</code>.
+                    <span class="command"><strong>named</strong></span> loads <span class="emphasis"><em>only</em></span>
+                    the root key from <code class="filename">bind.keys</code>.
                     The file cannot be used to store keys for other zones.
                     The root key in <code class="filename">bind.keys</code> is ignored
                     if <span class="command"><strong>dnssec-validation auto</strong></span> is not in
@@ -5289,11 +5313,16 @@ options {
 <dt><span class="term"><span class="command"><strong>allow-query-cache-on</strong></span></span></dt>
 <dd>
                 <p>
-                  Specifies which local addresses can give answers
-                  from the cache.  If not specified, the default is
-                  to allow cache queries on any address,
-                  <span class="command"><strong>localnets</strong></span> and
-                  <span class="command"><strong>localhost</strong></span>.
+                  Specifies which local addresses can send answers
+                  from the cache.  If <span class="command"><strong>allow-query-cache-on</strong></span>
+                  is not set, then <span class="command"><strong>allow-recursion-on</strong></span> is
+                  used if set.  Otherwise, the default is
+                  to allow cache responses to be sent from any address.
+                  Note: Both <span class="command"><strong>allow-query-cache</strong></span> and
+                  <span class="command"><strong>allow-query-cache-on</strong></span> must be
+                  satisfied before a cache response can be sent;
+                  a client that is blocked by one cannot be allowed
+                  by the other.
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>allow-recursion</strong></span></span></dt>
@@ -5313,8 +5342,17 @@ options {
 <dd>
                 <p>
                   Specifies which local addresses can accept recursive
-                  queries.  If not specified, the default is to allow
-                  recursive queries on all addresses.
+                  queries.  If <span class="command"><strong>allow-recursion-on</strong></span>
+                  is not set, then <span class="command"><strong>allow-query-cache-on</strong></span>
+                  is used if set; otherwise, the default is to allow
+                  recursive queries on all addresses: Any client permitted
+                  to send recursive queries can send them to any address
+                  on which <span class="command"><strong>named</strong></span> is listening.
+                  Note: Both <span class="command"><strong>allow-recursion</strong></span> and
+                  <span class="command"><strong>allow-recursion-on</strong></span> must be
+                  satisfied before recursion is allowed;
+                  a client that is blocked by one cannot be allowed
+                  by the other.
                 </p>
               </dd>
 <dt><span class="term"><span class="command"><strong>allow-update</strong></span></span></dt>
@@ -6911,6 +6949,32 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   second.
                 </p>
               </dd>
+<dt><span class="term"><span class="command"><strong>min-ncache-ttl</strong></span></span></dt>
+<dd>
+                <p>
+                  To reduce network traffic and increase performance, the server
+                  stores negative answers. <span class="command"><strong>min-ncache-ttl</strong></span> is
+                  used to set a minimum retention time for these answers in the
+                  server in seconds.  For convenience, TTL-style time unit
+                  suffixes may be used to specify the value.  The default
+                  <span class="command"><strong>min-ncache-ttl</strong></span> is <code class="literal">0</code>
+                  seconds.  <span class="command"><strong>min-ncache-ttl</strong></span> cannot exceed 90
+                  seconds and will be truncated to 90 seconds if set to a
+                  greater value.
+                </p>
+              </dd>
+<dt><span class="term"><span class="command"><strong>min-cache-ttl</strong></span></span></dt>
+<dd>
+                <p>
+                  Sets the minimum time for which the server will cache ordinary
+                  (positive) answers in seconds. For convenience, TTL-style time
+                  unit suffixes may be used to specify the value. The default
+                  <span class="command"><strong>min-cache-ttl</strong></span> is <code class="literal">0</code>
+                  seconds. <span class="command"><strong>min-cache-ttl</strong></span> cannot exceed 90
+                  seconds and will be truncated to 90 seconds if set to a
+                  greater value.
+                </p>
+              </dd>
 <dt><span class="term"><span class="command"><strong>max-ncache-ttl</strong></span></span></dt>
 <dd>
                 <p>
@@ -8917,17 +8981,6 @@ example.com                 CNAME   rpz-tcp-only.
           javascript-capable browser.
         </p>
 
-        <p>
-          Applications that depend on a particular XML schema
-          can request
-          <a class="link" href="http://127.0.0.1:8888/xml/v2" target="_top">http://127.0.0.1:8888/xml/v2</a> for version 2
-          of the statistics XML schema or
-          <a class="link" href="http://127.0.0.1:8888/xml/v3" target="_top">http://127.0.0.1:8888/xml/v3</a> for version 3.
-          If the requested schema is supported by the server, then
-          it will respond; if not, it will return a "page not found"
-          error.
-        </p>
-
         <p>
           Broken-out subsets of the statistics can be viewed at
           <a class="link" href="http://127.0.0.1:8888/xml/v3/status" target="_top">http://127.0.0.1:8888/xml/v3/status</a>
@@ -9354,7 +9407,7 @@ view "external" {
        <span class="command"><strong>sig-signing-type</strong></span> <em class="replaceable"><code>integer</code></em>;
        <span class="command"><strong>sig-validity-interval</strong></span> <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];
        <span class="command"><strong>update-check-ksk</strong></span> <em class="replaceable"><code>boolean</code></em>;
-       <span class="command"><strong>update-policy</strong></span> ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self | external | krb5-self | krb5-subdomain | ms-self | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };
+       <span class="command"><strong>update-policy</strong></span> ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self | external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };
        <span class="command"><strong>zero-no-soa-ttl</strong></span> <em class="replaceable"><code>boolean</code></em>;
        <span class="command"><strong>zone-statistics</strong></span> ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );
 };
@@ -10753,12 +10806,13 @@ example.com. NS ns2.example.net.
               the rules are checked for each existing record type.
             </p>
             <p>
-              The <em class="replaceable"><code>ruletype</code></em> field has 13
+              The <em class="replaceable"><code>ruletype</code></em> field has 16
               values:
               <code class="varname">name</code>, <code class="varname">subdomain</code>,
               <code class="varname">wildcard</code>, <code class="varname">self</code>,
               <code class="varname">selfsub</code>, <code class="varname">selfwild</code>,
               <code class="varname">krb5-self</code>, <code class="varname">ms-self</code>,
+              <code class="varname">krb5-selfsub</code>, <code class="varname">ms-selfsub</code>,
               <code class="varname">krb5-subdomain</code>,
               <code class="varname">ms-subdomain</code>,
               <code class="varname">tcp-self</code>, <code class="varname">6to4-self</code>,
@@ -10927,6 +10981,21 @@ example.com. NS ns2.example.net.
                     </td>
 </tr>
 <tr>
+<td>
+                      <p>
+                        <code class="varname">ms-selfsub</code>
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        This is similar to <span class="command"><strong>ms-self</strong></span>
+                        except it also allows updates to any subdomain of
+                        the name specified in the Windows machine
+                        principal, not just to the name itself.
+                      </p>
+                    </td>
+</tr>
+<tr>
 <td>
                       <p>
                         <code class="varname">ms-subdomain</code>
@@ -11000,6 +11069,21 @@ example.com. NS ns2.example.net.
                     </td>
 </tr>
 <tr>
+<td>
+                      <p>
+                        <code class="varname">krb5-selfsub</code>
+                      </p>
+                    </td>
+<td>
+                      <p>
+                        This is similar to <span class="command"><strong>krb5-self</strong></span>
+                        except it also allows updates to any subdomain of
+                        the name specified in the 'machine' part of the
+                        Kerberos principal, not just to the name itself.
+                      </p>
+                    </td>
+</tr>
+<tr>
 <td>
                       <p>
                         <code class="varname">krb5-subdomain</code>
@@ -14960,6 +15044,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index c2e677b410e80358f4f0cff0e4fd5cc9826cb74f..27ef70f067c62061b8a889b2fadc55c497241097 100644 (file)
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -361,6 +361,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html
index 720adf538d11e339940a6ec179b952e6766c982e..e064d1128b50f5fe8b4a113f9f704046be1a0ec6 100644 (file)
--- a/doc/arm/Bv9ARM.ch07.html
+++ b/doc/arm/Bv9ARM.ch07.html
@@ -191,6 +191,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index b93bddfff28f543f4985f36a1f75f61159a2dacd..21d9fd1643f13c3623b6307a649a03cbcea9a70c 100644 (file)
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -36,7 +36,7 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.3</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.4</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
@@ -55,7 +55,7 @@
 </div>
       <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.9.2"></a>Release Notes for BIND Version 9.13.3</h2></div></div></div>
+<a name="id-1.9.2"></a>Release Notes for BIND Version 9.13.4</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -181,6 +181,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         Task manager and socket code have been substantially modified.
+         The manager uses per-cpu queues for tasks and network stack runs
+         multiple event loops in CPU-affinitive threads. This greatly
+         improves performance on large systems, especially when using
+         multi-queue NICs.
+       </p>
+      </li>
 <li class="listitem">
        <p>
          A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
@@ -248,6 +257,34 @@
          them. [GL #237]
        </p>
       </li>
+<li class="listitem">
+       <p>
+         Two new update policy rule types have been added
+         <span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
+         which allow machines with Kerberos principals to update
+         the name space at or below the machine names identified
+         in the respective principals.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The new configure option <span class="command"><strong>--enable-fips-mode</strong></span>
+         can be used to make BIND enable and enforce FIPS mode in the
+         OpenSSL library.  When compiled with such option the BIND will
+         refuse to run if FIPS mode can't be enabled, thus this option
+         must be only enabled for the systems where FIPS mode is available.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         Two new configuration options <span class="command"><strong>min-cache-ttl</strong></span> and
+         <span class="command"><strong>min-ncache-ttl</strong></span> has been added to allow the BIND 9
+         administrator to override the minimum TTL in the received DNS records
+         (positive caching) and for storing the information about non-existent
+         records (negative caching).  The configured minimum TTL for both
+         configuration options cannot exceed 90 seconds.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -415,6 +452,11 @@
          usually long after their end-of-life date and they are
          neither developed nor supported by their respective vendors.
        </p>
+       <p>
+         Support for DSA and DSA-NSEC3-SHA1 algorithms has been
+         removed from BIND as the DSA key length is limited to 1024
+         bits and this is not considered secure enough.
+       </p>
       </li>
 </ul></div>
   </div>
@@ -474,13 +516,6 @@
          that have timed out, in addition to those that respond. [GL #64]
        </p>
       </li>
-<li class="listitem">
-       <p>
-         <span class="command"><strong>dig +noidnin</strong></span> can be used to disable IDN
-         processing on the input domain name, when BIND is compiled
-         with IDN support.
-       </p>
-      </li>
 <li class="listitem">
        <p>
          Up to 64 <span class="command"><strong>response-policy</strong></span> zones are now
@@ -509,6 +544,50 @@
          instead of using the <span class="command"><strong>resolver</strong></span> category.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
+         between views of the same name but different class; this
+         has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
+         option. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         <span class="command"><strong>allow-recursion-on</strong></span> and
+         <span class="command"><strong>allow-query-cache-on</strong></span> each now default to
+         the other if only one of them is set, in order to be consistent
+         with the way <span class="command"><strong>allow-recursion</strong></span> and
+         <span class="command"><strong>allow-query-cache</strong></span> work. [GL #319]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         When compiled with IDN support, the <span class="command"><strong>dig</strong></span> and
+         <span class="command"><strong>nslookup</strong></span> commands now disable IDN processing
+         when the standard output is not a TTY (i.e., when the output
+         is not being read by a human). When running from a shell
+         script, the command line options <span class="command"><strong>+idnin</strong></span> and
+         <span class="command"><strong>+idnout</strong></span> may be used to enable IDN
+         processing of input and output domain names, respectively.
+         When running on a TTY, the <span class="command"><strong>+noidnin</strong></span> and
+         <span class="command"><strong>+noidnout</strong></span> options may be used to disable
+         IDN processing of input and output domain names.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The configuration option <span class="command"><strong>max-ncache-ttl</strong></span> cannot
+         exceed seven days. Previously, larger values than this were silently
+         lowered; now, they trigger a configuration error.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The new <span class="command"><strong>dig -r</strong></span> command line option
+         disables reading of the file <code class="filename">$HOME/.digrc</code>.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -543,6 +622,22 @@
           to be non-resolvable. [GL #390]
         </p>
       </li>
+<li class="listitem">
+       <p>
+         When a negative trust anchor was added to multiple views
+         using <span class="command"><strong>rndc nta</strong></span>, the text returned via
+         <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
+         first line, making it appear that only one NTA had been
+         added. This has been fixed. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The view name is now included in the output of
+         <span class="command"><strong>rndc nta -dump</strong></span>, for consistency with
+         other options. [GL !816]
+       </p>
+      </li>
 <li class="listitem">
        <p>
          <span class="command"><strong>named</strong></span> now rejects excessively large
@@ -626,6 +721,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 3d95eaef5f4469cfe50f59a6faa678c485fd21aa..ce4b5dc1604a5dbc056a4d718ac6454578d03fba 100644 (file)
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html
index 59976597f54bf8d98aa31a34f7866ba3e684f2cc..ba4396ef60f600aa043f554b9b463c6ccdd7ade5 100644 (file)
--- a/doc/arm/Bv9ARM.ch10.html
+++ b/doc/arm/Bv9ARM.ch10.html
@@ -914,6 +914,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch11.html b/doc/arm/Bv9ARM.ch11.html
index 2822f81c6e52003aa2a21080e5391dc36f5cc236..e070183e4079b2cf2f2bdd4e34d0bfad6e012235 100644 (file)
--- a/doc/arm/Bv9ARM.ch11.html
+++ b/doc/arm/Bv9ARM.ch11.html
@@ -533,6 +533,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html
index 17fac42819c052b46a54c7ff406b31b43a28f177..414512bd88b523bb942d439cce69b016cc2f1dc0 100644 (file)
--- a/doc/arm/Bv9ARM.ch12.html
+++ b/doc/arm/Bv9ARM.ch12.html
@@ -206,6 +206,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index 6b386b10260f0d40fb80d78def89cad1380b0ba9..d7f49eb41d0aee098ab4a73f60e8c80ac197e35d 100644 (file)
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.13.3</p></div>
+<div><p class="releaseinfo">BIND Version 9.13.4</p></div>
 <div><p class="copyright">Copyright © 2000-2018 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -99,7 +99,7 @@
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_keys">Generating Keys</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_signing">Signing the Zone</a></span></dt>
-<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_config">Configuring Servers</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec_config">Configuring Servers for DNSSEC</a></span></dt>
 </dl></dd>
 <dt><span class="section"><a href="Bv9ARM.ch04.html#dnssec.dynamic.zones">DNSSEC, Dynamic Zones, and Automatic Signing</a></span></dt>
 <dd><dl>
@@ -237,7 +237,7 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.3</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.13.4</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_versions">Note on Version Numbering</a></span></dt>
@@ -432,6 +432,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf
index 5f24a8aa2a8e281dd8fa3622a9c1bc74e9cf19f6..e509567f443d7fb7cde418855ce76fab55662440 100644 (file)
Binary files a/doc/arm/Bv9ARM.pdf and b/doc/arm/Bv9ARM.pdf differ

diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html
index fff8af775e1242c5772ba42907bc1f333600f878..ce34bb17667c8d1f718caf78c1a96f3d159099a2 100644 (file)
--- a/doc/arm/man.arpaname.html
+++ b/doc/arm/man.arpaname.html
@@ -90,6 +90,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html
index c1b359b9026e93e8620e6f5a7df0617ee7aed69d..50a1638f57ad88c9c672ed160f1120038b616058 100644 (file)
--- a/doc/arm/man.ddns-confgen.html
+++ b/doc/arm/man.ddns-confgen.html
@@ -220,6 +220,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html
index 7084d6c05ec57d7040c8610da964e3883252f1f5..659749ea4e2b24c56af6c4fe1a1a9634c73d1742 100644 (file)
--- a/doc/arm/man.delv.html
+++ b/doc/arm/man.delv.html
@@ -625,6 +625,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 60517e47544fd895357cfac8b71871b168e27b71..5d64a52b4221f6f2c15a080c2135b72ab4c41025 100644 (file)
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -124,9 +124,10 @@
 
     <p>
       It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <code class="option">-r</code> option disables this feature, for
+      scripts that need predictable behaviour.
     </p>
 
     <p>
@@ -245,14 +246,6 @@
            <span class="command"><strong>dig</strong></span> using the command-line interface.
          </p>
        </dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-         <p>
-           Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
-           domain, which is no longer in use. Obsolete bit string
-           label queries (RFC 2874) are not attempted.
-         </p>
-       </dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
 <dd>
          <p>
@@ -292,6 +285,13 @@
            the <em class="parameter"><code>name</code></em> from other arguments.
          </p>
        </dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+         <p>
+           Do not read options from <code class="filename">${HOME}/.digrc</code>.
+           This is useful for scripts that need predictable behaviour.
+         </p>
+       </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
          <p>
@@ -342,8 +342,7 @@
            <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
            query type and class to PTR and IN respectively. IPv6
            addresses are looked up using nibble format under the
-           IP6.ARPA domain (but see also the <code class="option">-i</code>
-           option).
+           IP6.ARPA domain.
          </p>
        </dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
@@ -649,7 +648,13 @@
            <p>
              Process [do not process] IDN domain names on input.
              This requires IDN SUPPORT to have been enabled at
-             compile time.  The default is to process IDN input.
+             compile time.
+           </p>
+           <p>
+             The default is to process IDN input when standard output
+             is a tty.  The IDN processing on input is disabled when
+             dig output is redirected to files, pipes, and other
+             non-tty file descriptors.
            </p>
          </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -657,7 +662,13 @@
            <p>
              Convert [do not convert] puny code on output.
              This requires IDN SUPPORT to have been enabled at
-             compile time.  The default is to convert output.
+             compile time.
+           </p>
+           <p>
+             The default is to process puny code on output when
+             standard output is a tty.  The puny code processing on
+             output is disabled when dig output is redirected to
+             files, pipes, and other non-tty file descriptors.
            </p>
          </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -1079,7 +1090,9 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
       reply from the server.
       If you'd like to turn off the IDN support for some reason, use
       parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em>.
+      <em class="parameter"><code>+noidnout</code></em> or define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+
     </p>
   </div>
 
@@ -1138,6 +1151,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-cds.html b/doc/arm/man.dnssec-cds.html
index daf0a7c31962dadaba8a18e2595e2366003c4c80..198685efa3f8accdd61d5cb2e4e993cfacbd6d3c 100644 (file)
--- a/doc/arm/man.dnssec-cds.html
+++ b/doc/arm/man.dnssec-cds.html
@@ -376,6 +376,6 @@ nsupdate -l
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html
index e9c8cc0c6140de9acb1ed12f7a128966573a1568..b210715189cf321733d5101dcad54aa736407e86 100644 (file)
--- a/doc/arm/man.dnssec-checkds.html
+++ b/doc/arm/man.dnssec-checkds.html
@@ -150,6 +150,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html
index 56e01e3e25a969dfba7e541f90cd2921c04769f6..4fc3f4aa6eccc4b05760a467d4902e203b55f9d6 100644 (file)
--- a/doc/arm/man.dnssec-coverage.html
+++ b/doc/arm/man.dnssec-coverage.html
@@ -270,6 +270,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html
index 640ab38cc05f83814ff4c3b119445dd560a521fd..70c06f87b868e956b2fba175439d006386c05f53 100644 (file)
--- a/doc/arm/man.dnssec-dsfromkey.html
+++ b/doc/arm/man.dnssec-dsfromkey.html
@@ -289,6 +289,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html
index e51bd62db3120c1d0a57caaf2d45c56589deb303..59282e73b801c5ef533b8e78e1c406cd1d0f20da 100644 (file)
--- a/doc/arm/man.dnssec-importkey.html
+++ b/doc/arm/man.dnssec-importkey.html
@@ -250,6 +250,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html
index 0a889bcf536786d3d35984ebf53f1fb83de24530..592a303d690c409cba2a78059a4fe06ec6ba363d 100644 (file)
--- a/doc/arm/man.dnssec-keyfromlabel.html
+++ b/doc/arm/man.dnssec-keyfromlabel.html
@@ -108,7 +108,7 @@
          <p>
            Selects the cryptographic algorithm.  The value of
            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-           DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+           NSEC3RSASHA1, RSASHA256, RSASHA512,
            ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.
          </p>
          <p>
@@ -121,9 +121,9 @@
          <p>
            These values are case insensitive. In some cases, abbreviations
            are supported, such as ECDSA256 for ECDSAP256SHA256 and
-           ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+           ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
            along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-           or NSEC3DSA will be used instead.
+           will be used instead.
          </p>
          <p>
            As of BIND 9.12.0, this option is mandatory except when using
@@ -498,6 +498,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html
index 56e267e7b5be5aba58487ceb049dc0e91ca6166a..1c42a1a82e690656df15f4e99fc83ae88672f472 100644 (file)
--- a/doc/arm/man.dnssec-keygen.html
+++ b/doc/arm/man.dnssec-keygen.html
@@ -118,7 +118,7 @@
          <p>
            Selects the cryptographic algorithm.  For DNSSEC keys, the value
            of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
-           DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512,
+           NSEC3RSASHA1, RSASHA256, RSASHA512,
            ECDSAP256SHA256, ECDSAP384SHA384, ED25519 or ED448.  For
            TKEY, the value must be DH (Diffie Hellman); specifying
            his value will automatically set the <code class="option">-T KEY</code>
@@ -127,9 +127,9 @@
          <p>
            These values are case insensitive. In some cases, abbreviations
            are supported, such as ECDSA256 for ECDSAP256SHA256 and
-           ECDSA384 for ECDSAP384SHA384. If RSASHA1 or DSA is specified
+           ECDSA384 for ECDSAP384SHA384. If RSASHA1 is specified
            along with the <code class="option">-3</code> option, then NSEC3RSASHA1
-           or NSEC3DSA will be used instead.
+           will be used instead.
          </p>
          <p>
            This parameter <span class="emphasis"><em>must</em></span> be specified except
@@ -568,6 +568,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-keymgr.html b/doc/arm/man.dnssec-keymgr.html
index f29c4cf0d1d14a3eb48a9498b31593c470813301..7500a695cabb44038cdb6510b5d84746625a69ba 100644 (file)
--- a/doc/arm/man.dnssec-keymgr.html
+++ b/doc/arm/man.dnssec-keymgr.html
@@ -276,8 +276,7 @@
            Takes two arguments: keytype (eihter "zsk" or "ksk") and size.
            A default value for this option can be set in algorithm policies
            as well as in policy classes or zone policies. If no policy is
-           configured, the default is 1024 bits for DSA keys and 2048 for
-           RSA.
+           configured, the default is 2048 bits for RSA keys.
          </p>
        </dd>
 <dt><span class="term"><span class="command"><strong>keyttl</strong></span></span></dt>
@@ -388,6 +387,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html
index 07e174a8a1670f7b78b95d78f2c70e2fb1b9a7fa..4a881774f2cbc850076f4625c6c517e67c9d2b4c 100644 (file)
--- a/doc/arm/man.dnssec-revoke.html
+++ b/doc/arm/man.dnssec-revoke.html
@@ -171,6 +171,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html
index cb05759d5ba68263d029c1814abccf47eb4fbcca..a5bcb5e319fa22914345776735c45ade62dbae5c 100644 (file)
--- a/doc/arm/man.dnssec-settime.html
+++ b/doc/arm/man.dnssec-settime.html
@@ -349,6 +349,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index 30e545e8bf81f6ab010566c67358914c2111d7bf..044311ab27cf1742295a908d7faf7442e3853622 100644 (file)
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -700,6 +700,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html
index 7a2c7298e049ef04aa17c19ae593ac93582e4cab..84265e24c6632f810a33533d33db7390972e6a35 100644 (file)
--- a/doc/arm/man.dnssec-verify.html
+++ b/doc/arm/man.dnssec-verify.html
@@ -202,6 +202,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html
index a339ed4cf5a66c17049343dea7cd9c867e5d74dd..e1ec0a05acbe5c4e383281d992ab00d14e171b48 100644 (file)
--- a/doc/arm/man.dnstap-read.html
+++ b/doc/arm/man.dnstap-read.html
@@ -142,6 +142,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html
index 11bc12d5d787a85da5bb68876d7369faf4b3e090..275a4069d2c9b1ecd2e88bba59849fd32ed76610 100644 (file)
--- a/doc/arm/man.host.html
+++ b/doc/arm/man.host.html
@@ -156,15 +156,6 @@
            Equivalent to the <code class="option">-v</code> verbose option.
          </p>
        </dd>
-<dt><span class="term">-i</span></dt>
-<dd>
-         <p>
-           Obsolete.
-           Use the IP6.INT domain for reverse lookups of IPv6
-           addresses as defined in RFC1886 and deprecated in RFC4159.
-           The default is to use IP6.ARPA as specified in RFC3596.
-         </p>
-       </dd>
 <dt><span class="term">-l</span></dt>
 <dd>
          <p>
@@ -329,7 +320,7 @@
       <span class="command"><strong>host</strong></span> appropriately converts character encoding of
       domain name before sending a request to DNS server or displaying a
       reply from the server.
-      If you'd like to turn off the IDN support for some reason, defines
+      If you'd like to turn off the IDN support for some reason, define
       the <code class="envar">IDN_DISABLE</code> environment variable.
       The IDN support is disabled if the variable is set when
       <span class="command"><strong>host</strong></span> runs.
@@ -375,6 +366,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html
index a44ddc9dcc507edd3bfb889fcd855b6fb590309f..8f10e56513c4033c5d79d7fe27d1718dc0856888 100644 (file)
--- a/doc/arm/man.mdig.html
+++ b/doc/arm/man.mdig.html
@@ -375,11 +375,6 @@
       a reverse lookup with the "PTR" query type.
     </p>
 
-    <p>
-      The <code class="option">-i</code> option sets the reverse domain for
-      IPv6 addresses to IP6.INT.
-    </p>
-
     <p>
       Reverse lookups &#8212; mapping addresses to names &#8212; are
       simplified by the <code class="option">-x</code> option.
@@ -389,8 +384,7 @@
       query name like <code class="literal">11.12.13.10.in-addr.arpa</code> and
       sets the query type and class to PTR and IN respectively.
       By default, IPv6 addresses are looked up using nibble format
-      under the IP6.ARPA domain.  To use the older RFC1886 method
-      using the IP6.INT domain specify the <code class="option">-i</code> option.
+      under the IP6.ARPA domain.
     </p>
 
     <p>
@@ -610,6 +604,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index 4552dd1ab88f1f4bc4a5fbc83fc91f01b6a77e4b..03bc81d5b9a2e552baebd1ee38e7fb4e0e5fa20c 100644 (file)
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html
index ebee65ae464254e7098b3a0a9df5a721adcc1a9c..2df53bf97a39f350797620094ef9c26292320148 100644 (file)
--- a/doc/arm/man.named-checkzone.html
+++ b/doc/arm/man.named-checkzone.html
@@ -463,6 +463,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html
index fb4254d9ae9a53c4959e336d0c3297b1bf6ab7b4..24f427c601d56a5e4855aff9e007ea0d02ae0063 100644 (file)
--- a/doc/arm/man.named-journalprint.html
+++ b/doc/arm/man.named-journalprint.html
@@ -117,6 +117,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html
index 3dedbba85ffd51c4f611b458db0c0bb547943c10..ac198d6d6434ad6bcf678eabcecf89bc18130f15 100644 (file)
--- a/doc/arm/man.named-nzd2nzf.html
+++ b/doc/arm/man.named-nzd2nzf.html
@@ -119,6 +119,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html
index 6d68a92bbb9c100d2ae8397641b0cd15816cc918..0bc1f2a72cfbf81f0f0bf8a70aa0a6dfc6b368c1 100644 (file)
--- a/doc/arm/man.named-rrchecker.html
+++ b/doc/arm/man.named-rrchecker.html
@@ -121,6 +121,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 4a9411be55b10a2a41bb3dd8e7182f11affcf104..e8d126d176a3b81c734aa374a9b8cf1a5a3855aa 100644 (file)
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -198,6 +198,7 @@ options
            ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
        alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
            * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
+       answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
        attach-cache <em class="replaceable"><code>string</code></em>;<br>
        auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
        auto-dnssec ( allow | maintain | off );<br>
@@ -263,8 +264,8 @@ options
        dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
        dnssec-update-mode ( maintain | no-resign );<br>
        dnssec-validation ( yes | no | auto );<br>
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-           response ) ]; ... };<br>
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+           ( query | response ) ]; ... };<br>
        dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
        dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
            <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
@@ -342,6 +343,8 @@ options
        memstatistics <em class="replaceable"><code>boolean</code></em>;<br>
        memstatistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
        message-compression <em class="replaceable"><code>boolean</code></em>;<br>
+       min-cache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
+       min-ncache-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
        min-refresh-time <em class="replaceable"><code>integer</code></em>;<br>
        min-retry-time <em class="replaceable"><code>integer</code></em>;<br>
        minimal-any <em class="replaceable"><code>boolean</code></em>;<br>
@@ -619,8 +622,8 @@ view
        dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
        dnssec-update-mode ( maintain | no-resign );<br>
        dnssec-validation ( yes | no | auto );<br>
-       dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
-           response ) ]; ... };<br>
+       dnstap { ( all | auth | client | forwarder | resolver | update ) [<br>
+           ( query | response ) ]; ... };<br>
        dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
            <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
            <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -901,10 +904,10 @@ view
                    static-stub | stub );<br>
                update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
                update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-                   6to4-self | external | krb5-self | krb5-subdomain |<br>
-                   ms-self | ms-subdomain | name | self | selfsub |<br>
-                   selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
-                   [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+                   6to4-self | external | krb5-self | krb5-selfsub |<br>
+                   krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
+                   name | self | selfsub | selfwild | subdomain | tcp-self<br>
+                   | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
                use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
                zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
                zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -1004,9 +1007,10 @@ zone
            stub );<br>
        update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
        update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-           external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
-           | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
-           wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+           external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
+           | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
+           | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
+           <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
        use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
        zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
        zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -1063,6 +1067,6 @@ zone
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html
index 8af85c2f44947eff8633c3527a0cb25fcb590149..fd1944603b4c51c7048335940f45c25e67e7e0ad 100644 (file)
--- a/doc/arm/man.named.html
+++ b/doc/arm/man.named.html
@@ -492,6 +492,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index dc1df73ce95693bc09073712a6d251ed91667c5c..4ce78ed1aabbfab15e3143a71b412728450f8edd 100644 (file)
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -155,6 +155,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html
index 275ce6b2116e82ef868d731a8c048a7fe866a6a7..7ce0d9630952a79bd5d0baddcd1389fcba3feb19 100644 (file)
--- a/doc/arm/man.nslookup.html
+++ b/doc/arm/man.nslookup.html
@@ -380,14 +380,31 @@ nslookup -query=hinfo  -timeout=10
   </div>
 
   <div class="refsection">
-<a name="id-1.13.29.11"></a><h2>FILES</h2>
+<a name="id-1.13.29.11"></a><h2>IDN SUPPORT</h2>
+
+    <p>
+      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
+      domain name) support, it can accept and display non-ASCII domain names.
+      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
+      domain name before sending a request to DNS server or displaying a
+      reply from the server.
+      If you'd like to turn off the IDN support for some reason, define
+      the <code class="envar">IDN_DISABLE</code> environment variable.
+      The IDN support is disabled if the variable is set when
+      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
+      a tty.
+    </p>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.13.29.12"></a><h2>FILES</h2>
 
     <p><code class="filename">/etc/resolv.conf</code>
     </p>
   </div>
 
   <div class="refsection">
-<a name="id-1.13.29.12"></a><h2>SEE ALSO</h2>
+<a name="id-1.13.29.13"></a><h2>SEE ALSO</h2>
 
     <p><span class="citerefentry">
         <span class="refentrytitle">dig</span>(1)
@@ -420,6 +437,6 @@ nslookup -query=hinfo  -timeout=10
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html
index 432a12f0e58aaa56054e6b813166cf6de0a92d26..a9a245d08f2fea2ab17fcf398243809ed29c5568 100644 (file)
--- a/doc/arm/man.nsupdate.html
+++ b/doc/arm/man.nsupdate.html
@@ -818,6 +818,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html
index 1d305a81ef074f846c386f7c3abaef6392dcf6b0..fe849a5196718f52068a0159acce18cda24cfb75 100644 (file)
--- a/doc/arm/man.pkcs11-destroy.html
+++ b/doc/arm/man.pkcs11-destroy.html
@@ -162,6 +162,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html
index 4b4ee7ab23342aea7f367ab9b265e6634471fff5..cd7a49579966afc9f74e9d33e670ab25863bcd03 100644 (file)
--- a/doc/arm/man.pkcs11-keygen.html
+++ b/doc/arm/man.pkcs11-keygen.html
@@ -200,6 +200,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html
index 8f94bf9775cfab2cc772947d42d3859c65c1e782..925bf08e87cf047b52caa7b85528b6f861d7916e 100644 (file)
--- a/doc/arm/man.pkcs11-list.html
+++ b/doc/arm/man.pkcs11-list.html
@@ -158,6 +158,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html
index 797e46944cbab18c68b41543a6745283b0c0af6a..ca68ff3a09008bc0376b43f12de99b3565b1ea26 100644 (file)
--- a/doc/arm/man.pkcs11-tokens.html
+++ b/doc/arm/man.pkcs11-tokens.html
@@ -123,6 +123,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index 6ca604b8b5447cd83153a69f30caf4bee8317e10..d31a23cb4c666b447f2c4fb039f14af603bbf301 100644 (file)
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -260,6 +260,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index aedf5cabf726b64cddfb2448c69c29cda08efcae..43b399fc2c8c6d966ed6ea9ec5df620528d759b4 100644 (file)
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -268,6 +268,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 4456ffdf35e3ad48b5a9d41259be9ca0119f00e1..10bcd13aef2e4ceb80c60aa27d55997d9c7d8b7d 100644 (file)
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -500,7 +500,7 @@
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>nta
-       [<span class="optional">( -d | -f | -r | -l <em class="replaceable"><code>duration</code></em>)</span>]
+           [<span class="optional">( -class <em class="replaceable"><code>class</code></em> | -dump | -force | -remove | -lifetime <em class="replaceable"><code>duration</code></em>)</span>]
        <em class="replaceable"><code>domain</code></em>
        [<span class="optional"><em class="replaceable"><code>view</code></em></span>]
        </code></strong></span></dt>
@@ -548,7 +548,7 @@
            is equivalent to <code class="option">-remove</code>.
          </p>
          <p>
-           If <code class="option">-dump</code> is used, any other arguments
+           If the <code class="option">-dump</code> is used, any other arguments
            are ignored, and a list of existing NTAs is printed
            (note that this may include NTAs that are expired but
            have not yet been cleaned up).
@@ -565,10 +565,21 @@
            lifetime, regardless of whether data could be
            validated if the NTA were not present.
          </p>
+         <p>
+           The view class can be specified with <code class="option">-class</code>.
+           The default is class <strong class="userinput"><code>IN</code></strong>, which is
+           the only class for which DNSSEC is currently supported.
+         </p>
          <p>
            All of these options can be shortened, i.e., to
            <code class="option">-l</code>, <code class="option">-r</code>, <code class="option">-d</code>,
-           and <code class="option">-f</code>.
+           <code class="option">-f</code>, and <code class="option">-c</code>.
+         </p>
+         <p>
+           Unrecognized options are treated as errors. To reference
+           a domain or view name that begins with a hyphen,
+           use a double-hyphen on the command line to indicate the
+           end of options.
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional"> on | off </span>] </span></dt>
@@ -918,11 +929,14 @@
 <dd>
          <p>
            Enable, disable, or check the current status of
-           DNSSEC validation.
-           Note <span class="command"><strong>dnssec-enable</strong></span> also needs to be
-           set to <strong class="userinput"><code>yes</code></strong> or
-           <strong class="userinput"><code>auto</code></strong> to be effective.
-           It defaults to enabled.
+           DNSSEC validation.  By default, validation is enabled.
+           (Note that <span class="command"><strong>dnssec-enable</strong></span> must also be
+           <strong class="userinput"><code>yes</code></strong> (the default value) for signatures
+           to be returned along with validated data. If validation is
+           enabled while <span class="command"><strong>dnssec-enable</strong></span> is set to
+           <strong class="userinput"><code>no</code></strong>, the server will validate internally,
+           but will not supply clients with the necessary records to allow
+           validity to be confirmed.)
          </p>
        </dd>
 <dt><span class="term"><strong class="userinput"><code>zonestatus <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
@@ -1010,6 +1024,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.3 (Development Release)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.13.4 (Development Release)</p>
 </body>
 </html>

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 625518dbc00b2e2ea9139ee9c8ab524ba50f988c..7ec783af6c8674dd1b1fd15e370fc1d40a30f2f9 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -15,7 +15,7 @@
 
   <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.2"></a>Release Notes for BIND Version 9.13.3</h2></div></div></div>
+<a name="id-1.2"></a>Release Notes for BIND Version 9.13.4</h2></div></div></div>
   
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
@@ -141,6 +141,15 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_features"></a>New Features</h3></div></div></div>
     <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         Task manager and socket code have been substantially modified.
+         The manager uses per-cpu queues for tasks and network stack runs
+         multiple event loops in CPU-affinitive threads. This greatly
+         improves performance on large systems, especially when using
+         multi-queue NICs.
+       </p>
+      </li>
 <li class="listitem">
        <p>
          A new secondary zone option, <span class="command"><strong>mirror</strong></span>,
@@ -208,6 +217,34 @@
          them. [GL #237]
        </p>
       </li>
+<li class="listitem">
+       <p>
+         Two new update policy rule types have been added
+         <span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
+         which allow machines with Kerberos principals to update
+         the name space at or below the machine names identified
+         in the respective principals.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The new configure option <span class="command"><strong>--enable-fips-mode</strong></span>
+         can be used to make BIND enable and enforce FIPS mode in the
+         OpenSSL library.  When compiled with such option the BIND will
+         refuse to run if FIPS mode can't be enabled, thus this option
+         must be only enabled for the systems where FIPS mode is available.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         Two new configuration options <span class="command"><strong>min-cache-ttl</strong></span> and
+         <span class="command"><strong>min-ncache-ttl</strong></span> has been added to allow the BIND 9
+         administrator to override the minimum TTL in the received DNS records
+         (positive caching) and for storing the information about non-existent
+         records (negative caching).  The configured minimum TTL for both
+         configuration options cannot exceed 90 seconds.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -375,6 +412,11 @@
          usually long after their end-of-life date and they are
          neither developed nor supported by their respective vendors.
        </p>
+       <p>
+         Support for DSA and DSA-NSEC3-SHA1 algorithms has been
+         removed from BIND as the DSA key length is limited to 1024
+         bits and this is not considered secure enough.
+       </p>
       </li>
 </ul></div>
   </div>
@@ -434,13 +476,6 @@
          that have timed out, in addition to those that respond. [GL #64]
        </p>
       </li>
-<li class="listitem">
-       <p>
-         <span class="command"><strong>dig +noidnin</strong></span> can be used to disable IDN
-         processing on the input domain name, when BIND is compiled
-         with IDN support.
-       </p>
-      </li>
 <li class="listitem">
        <p>
          Up to 64 <span class="command"><strong>response-policy</strong></span> zones are now
@@ -469,6 +504,50 @@
          instead of using the <span class="command"><strong>resolver</strong></span> category.
        </p>
       </li>
+<li class="listitem">
+       <p>
+         The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
+         between views of the same name but different class; this
+         has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
+         option. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         <span class="command"><strong>allow-recursion-on</strong></span> and
+         <span class="command"><strong>allow-query-cache-on</strong></span> each now default to
+         the other if only one of them is set, in order to be consistent
+         with the way <span class="command"><strong>allow-recursion</strong></span> and
+         <span class="command"><strong>allow-query-cache</strong></span> work. [GL #319]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         When compiled with IDN support, the <span class="command"><strong>dig</strong></span> and
+         <span class="command"><strong>nslookup</strong></span> commands now disable IDN processing
+         when the standard output is not a TTY (i.e., when the output
+         is not being read by a human). When running from a shell
+         script, the command line options <span class="command"><strong>+idnin</strong></span> and
+         <span class="command"><strong>+idnout</strong></span> may be used to enable IDN
+         processing of input and output domain names, respectively.
+         When running on a TTY, the <span class="command"><strong>+noidnin</strong></span> and
+         <span class="command"><strong>+noidnout</strong></span> options may be used to disable
+         IDN processing of input and output domain names.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The configuration option <span class="command"><strong>max-ncache-ttl</strong></span> cannot
+         exceed seven days. Previously, larger values than this were silently
+         lowered; now, they trigger a configuration error.
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The new <span class="command"><strong>dig -r</strong></span> command line option
+         disables reading of the file <code class="filename">$HOME/.digrc</code>.
+       </p>
+      </li>
 </ul></div>
   </div>
 
@@ -503,6 +582,22 @@
           to be non-resolvable. [GL #390]
         </p>
       </li>
+<li class="listitem">
+       <p>
+         When a negative trust anchor was added to multiple views
+         using <span class="command"><strong>rndc nta</strong></span>, the text returned via
+         <span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
+         first line, making it appear that only one NTA had been
+         added. This has been fixed. [GL #105]
+       </p>
+      </li>
+<li class="listitem">
+       <p>
+         The view name is now included in the output of
+         <span class="command"><strong>rndc nta -dump</strong></span>, for consistency with
+         other options. [GL !816]
+       </p>
+      </li>
 <li class="listitem">
        <p>
          <span class="command"><strong>named</strong></span> now rejects excessively large

diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf
index 6fada99ebb7e96cd0d815786f3e45cb100faddfd..66580c66e1a693b8cf618418a3a65e10d3d5a13d 100644 (file)
Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ

diff --git a/doc/arm/notes.txt b/doc/arm/notes.txt
index 2aa434faad8ec0d32e7fdb7529275188bb1487b4..f09441c8193bd740dd4dc412ffd4195064e9a3b3 100644 (file)
--- a/doc/arm/notes.txt
+++ b/doc/arm/notes.txt
@@ -1,4 +1,4 @@
-Release Notes for BIND Version 9.13.3
+Release Notes for BIND Version 9.13.4
 
 Introduction
 
@@ -81,6 +81,11 @@ Security Fixes
 
 New Features
 
+  * Task manager and socket code have been substantially modified. The
+    manager uses per-cpu queues for tasks and network stack runs multiple
+    event loops in CPU-affinitive threads. This greatly improves
+    performance on large systems, especially when using multi-queue NICs.
+
   * A new secondary zone option, mirror, enables named to serve a
     transferred copy of a zone's contents without acting as an authority
     for the zone. A zone must be fully validated against an active trust
@@ -120,6 +125,24 @@ New Features
     DNSSEC validation should not be performed, regardless of whether a
     trust anchor has been configured above them. [GL #237]
 
+  * Two new update policy rule types have been added krb5-selfsub and
+    ms-selfsub which allow machines with Kerberos principals to update the
+    name space at or below the machine names identified in the respective
+    principals.
+
+  * The new configure option --enable-fips-mode can be used to make BIND
+    enable and enforce FIPS mode in the OpenSSL library. When compiled
+    with such option the BIND will refuse to run if FIPS mode can't be
+    enabled, thus this option must be only enabled for the systems where
+    FIPS mode is available.
+
+  * Two new configuration options min-cache-ttl and min-ncache-ttl has
+    been added to allow the BIND 9 administrator to override the minimum
+    TTL in the received DNS records (positive caching) and for storing the
+    information about non-existent records (negative caching). The
+    configured minimum TTL for both configuration options cannot exceed 90
+    seconds.
+
 Removed Features
 
   * Workarounds for servers that misbehave when queried with EDNS have
@@ -223,6 +246,10 @@ Removed Features
     and they are neither developed nor supported by their respective
     vendors.
 
+    Support for DSA and DSA-NSEC3-SHA1 algorithms has been removed from
+    BIND as the DSA key length is limited to 1024 bits and this is not
+    considered secure enough.
+
 Feature Changes
 
   * BIND will now always use the best CSPRNG (cryptographically-secure
@@ -251,9 +278,6 @@ Feature Changes
   * dig +nssearch will now list name servers that have timed out, in
     addition to those that respond. [GL #64]
 
-  * dig +noidnin can be used to disable IDN processing on the input domain
-    name, when BIND is compiled with IDN support.
-
   * Up to 64 response-policy zones are now supported by default;
     previously the limit was 32. [GL #123]
 
@@ -266,6 +290,30 @@ Feature Changes
   * NSID logging (enabled by the request-nsid option) now has its own nsid
     category, instead of using the resolver category.
 
+  * The rndc nta command could not differentiate between views of the same
+    name but different class; this has been corrected with the addition of
+    a -class option. [GL #105]
+
+  * allow-recursion-on and allow-query-cache-on each now default to the
+    other if only one of them is set, in order to be consistent with the
+    way allow-recursion and allow-query-cache work. [GL #319]
+
+  * When compiled with IDN support, the dig and nslookup commands now
+    disable IDN processing when the standard output is not a TTY (i.e.,
+    when the output is not being read by a human). When running from a
+    shell script, the command line options +idnin and +idnout may be used
+    to enable IDN processing of input and output domain names,
+    respectively. When running on a TTY, the +noidnin and +noidnout
+    options may be used to disable IDN processing of input and output
+    domain names.
+
+  * The configuration option max-ncache-ttl cannot exceed seven days.
+    Previously, larger values than this were silently lowered; now, they
+    trigger a configuration error.
+
+  * The new dig -r command line option disables reading of the file $HOME
+    /.digrc.
+
 Bug Fixes
 
   * Running rndc reconfig could cause inline-signing zones to stop
@@ -281,6 +329,14 @@ Bug Fixes
     treated as an error; this caused certain domains to be non-resolvable.
     [GL #390]
 
+  * When a negative trust anchor was added to multiple views using rndc
+    nta, the text returned via rndc was incorrectly truncated after the
+    first line, making it appear that only one NTA had been added. This
+    has been fixed. [GL #105]
+
+  * The view name is now included in the output of rndc nta -dump, for
+    consistency with other options. [GL !816]
+
   * named now rejects excessively large incremental (IXFR) zone transfers
     in order to prevent possible corruption of journal files which could
     cause named to abort when loading zones. [GL #339]

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index d3a0750246e3e89f86c126ee578c4774ce0447cc..1b46a0a85260bc443cfb10ef06427ca8037170e8 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -235,12 +235,6 @@
          configuration options cannot exceed 90 seconds.
        </para>
       </listitem>
-      <listitem>
-       <para>
-         The configuration option <command>max-ncache-ttl</command> was
-         silently capped to 7 days, and the upper limit is now enforced.
-       </para>
-      </listitem>
     </itemizedlist>
   </section>
 
@@ -469,13 +463,6 @@
          that have timed out, in addition to those that respond. [GL #64]
        </para>
       </listitem>
-      <listitem>
-       <para>
-         <command>dig +noidnin</command> can be used to disable IDN
-         processing on the input domain name, when BIND is compiled
-         with IDN support.
-       </para>
-      </listitem>
       <listitem>
        <para>
          Up to 64 <command>response-policy</command> zones are now
@@ -523,12 +510,29 @@
       </listitem>
       <listitem>
        <para>
-         When compiled with IDN support, the <command>dig</command> and the
-         <command>nslookup</command> commands now disable IDN processing when
-         the standard output is not a tty (e.g. not used by human).  The command
-         line options +idnin and +idnout need to be used to enable IDN
-         processing when <command>dig</command> or <command>nslookup</command>
-         is used from the shell scripts.
+         When compiled with IDN support, the <command>dig</command> and
+         <command>nslookup</command> commands now disable IDN processing
+         when the standard output is not a TTY (i.e., when the output
+         is not being read by a human). When running from a shell
+         script, the command line options <command>+idnin</command> and
+         <command>+idnout</command> may be used to enable IDN
+         processing of input and output domain names, respectively.
+         When running on a TTY, the <command>+noidnin</command> and
+         <command>+noidnout</command> options may be used to disable
+         IDN processing of input and output domain names.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+         The configuration option <command>max-ncache-ttl</command> cannot
+         exceed seven days. Previously, larger values than this were silently
+         lowered; now, they trigger a configuration error.
+       </para>
+      </listitem>
+      <listitem>
+       <para>
+         The new <command>dig -r</command> command line option
+         disables reading of the file <filename>$HOME/.digrc</filename>.
        </para>
       </listitem>
     </itemizedlist>

diff --git a/doc/misc/options b/doc/misc/options
index 02d05afdb527effdc3d076c1abad407e609ca5ba..371ae556647e345c8e4f7d89dab3f45d06aca9a7 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -146,13 +146,16 @@ options {
         dnssec-secure-to-insecure <boolean>;
         dnssec-update-mode ( maintain | no-resign );
         dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
-        dnstap-identity ( <quoted_string> | none | hostname );
-        dnstap-output ( file | unix ) <quoted_string> [ size ( unlimited |
-            <size> ) ] [ versions ( unlimited | <integer> ) ] [ suffix (
-            increment | timestamp ) ];
-        dnstap-version ( <quoted_string> | none );
+        dnstap { ( all | auth | client | forwarder |
+            resolver | update ) [ ( query | response ) ];
+            ... }; // not configured
+        dnstap-identity ( <quoted_string> | none |
+            hostname ); // not configured
+        dnstap-output ( file | unix ) <quoted_string> [
+            size ( unlimited | <size> ) ] [ versions (
+            unlimited | <integer> ) ] [ suffix ( increment
+            | timestamp ) ]; // not configured
+        dnstap-version ( <quoted_string> | none ); // not configured
         dscp <integer>;
         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
             <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
@@ -176,13 +179,13 @@ options {
         forward ( first | only );
         forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
             | <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
-        fstrm-set-buffer-hint <integer>;
-        fstrm-set-flush-timeout <integer>;
-        fstrm-set-input-queue-size <integer>;
-        fstrm-set-output-notify-threshold <integer>;
-        fstrm-set-output-queue-model ( mpsc | spsc );
-        fstrm-set-output-queue-size <integer>;
-        fstrm-set-reopen-interval <ttlval>;
+        fstrm-set-buffer-hint <integer>; // not configured
+        fstrm-set-flush-timeout <integer>; // not configured
+        fstrm-set-input-queue-size <integer>; // not configured
+        fstrm-set-output-notify-threshold <integer>; // not configured
+        fstrm-set-output-queue-model ( mpsc | spsc ); // not configured
+        fstrm-set-output-queue-size <integer>; // not configured
+        fstrm-set-reopen-interval <ttlval>; // not configured
         geoip-directory ( <quoted_string> | none ); // not configured
         geoip-use-ecs <boolean>; // obsolete
         glue-cache <boolean>;
@@ -204,7 +207,7 @@ options {
         listen-on-v6 [ port <integer> ] [ dscp
             <integer> ] {
             <address_match_element>; ... }; // may occur multiple times
-        lmdb-mapsize <sizeval>;
+        lmdb-mapsize <sizeval>; // non-operational
         lock-file ( <quoted_string> | none );
         maintain-ixfr-base <boolean>; // obsolete
         managed-keys-directory <quoted_string>;
@@ -513,8 +516,9 @@ view <string> [ <class> ] {
         dnssec-secure-to-insecure <boolean>;
         dnssec-update-mode ( maintain | no-resign );
         dnssec-validation ( yes | no | auto );
-        dnstap { ( all | auth | client | forwarder | resolver | update ) [
-            ( query | response ) ]; ... };
+        dnstap { ( all | auth | client | forwarder |
+            resolver | update ) [ ( query | response ) ];
+            ... }; // not configured
         dual-stack-servers [ port <integer> ] { ( <quoted_string> [ port
             <integer> ] [ dscp <integer> ] | <ipv4_address> [ port
             <integer> ] [ dscp <integer> ] | <ipv6_address> [ port
@@ -545,7 +549,7 @@ view <string> [ <class> ] {
         }; // may occur multiple times
         key-directory <quoted_string>;
         lame-ttl <ttlval>;
-        lmdb-mapsize <sizeval>;
+        lmdb-mapsize <sizeval>; // non-operational
         maintain-ixfr-base <boolean>; // obsolete
         managed-keys { <string> <string>
             <integer> <integer> <integer>

diff --git a/lib/bind9/api b/lib/bind9/api
index 2e3dc0c30eb070e2a5bd43407a1187372ccb1f5a..f76669b2744ac9bc36c50d051f6b6d14a9f34f06 100644 (file)
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -10,5 +10,5 @@
 # 9.12: 1200-1299
 # 9.13: 1300-1399
 LIBINTERFACE = 1301
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0

diff --git a/lib/dns/api b/lib/dns/api
index e2cd846d2621817e1a7b1c180fd0200bc5831e55..9e9718c95028647251a0928117efd3717cc4f0ad 100644 (file)
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -9,6 +9,6 @@
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
 # 9.13: 1300-1399
-LIBINTERFACE = 1303
+LIBINTERFACE = 1304
 LIBREVISION = 0
 LIBAGE = 0

diff --git a/lib/irs/api b/lib/irs/api
index 2e3dc0c30eb070e2a5bd43407a1187372ccb1f5a..f76669b2744ac9bc36c50d051f6b6d14a9f34f06 100644 (file)
--- a/lib/irs/api
+++ b/lib/irs/api
@@ -10,5 +10,5 @@
 # 9.12: 1200-1299
 # 9.13: 1300-1399
 LIBINTERFACE = 1301
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0

diff --git a/lib/isc/api b/lib/isc/api
index e2cd846d2621817e1a7b1c180fd0200bc5831e55..9e9718c95028647251a0928117efd3717cc4f0ad 100644 (file)
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -9,6 +9,6 @@
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
 # 9.13: 1300-1399
-LIBINTERFACE = 1303
+LIBINTERFACE = 1304
 LIBREVISION = 0
 LIBAGE = 0

diff --git a/lib/isccc/api b/lib/isccc/api
index 2e3dc0c30eb070e2a5bd43407a1187372ccb1f5a..f76669b2744ac9bc36c50d051f6b6d14a9f34f06 100644 (file)
--- a/lib/isccc/api
+++ b/lib/isccc/api
@@ -10,5 +10,5 @@
 # 9.12: 1200-1299
 # 9.13: 1300-1399
 LIBINTERFACE = 1301
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0

diff --git a/lib/ns/api b/lib/ns/api
index 8fff36996f76abe293271aefc71322c3fdd106a3..ba136ce1bee12cff31ba94e58b94eba99b1e18c6 100644 (file)
--- a/lib/ns/api
+++ b/lib/ns/api
@@ -10,5 +10,5 @@
 # 9.12: 1200-1299
 # 9.13: 1300-1399
 LIBINTERFACE = 1303
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 0

diff --git a/version b/version
index 30967a859363f621eaba9e58c985e7b88d8b1db7..41503d276d936cd522b93eb36c91001f0afc3aee 100644 (file)
--- a/version
+++ b/version
@@ -5,7 +5,7 @@ PRODUCT=BIND
 DESCRIPTION="(Development Release)"
 MAJORVER=9
 MINORVER=13
-PATCHVER=3
+PATCHVER=4
 RELEASETYPE=
 RELEASEVER=
 EXTENSIONS=