From: Tinderbox User <tbox@isc.org>
Date: Thu, 14 Sep 2017 01:12:10 +0000 (+0000)
Subject: regen master
X-Git-Tag: v9.12.0b1~208
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e3bd90ee1b9fbe017a53a5de063d1c2c0943a701;p=thirdparty%2Fbind9.git

regen master
---

diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8
index f0807dec733..e95043ce034 100644
--- a/bin/dnssec/dnssec-signzone.8
+++ b/bin/dnssec/dnssec-signzone.8
@@ -376,7 +376,7 @@ Sets the debugging level\&.
 .PP
 \-x
 .RS 4
-Only sign the DNSKEY RRset with key\-signing keys, and omit signatures from zone\-signing keys\&. (This is similar to the
+Only sign the DNSKEY, CDNSKEY, and CDS RRsets with key\-signing keys, and omit signatures from zone\-signing keys\&. (This is similar to the
 \fBdnssec\-dnskey\-kskonly yes;\fR
 zone option in
 \fBnamed\fR\&.)
diff --git a/bin/dnssec/dnssec-signzone.html b/bin/dnssec/dnssec-signzone.html
index 9232ee43359..45d84c12db2 100644
--- a/bin/dnssec/dnssec-signzone.html
+++ b/bin/dnssec/dnssec-signzone.html
@@ -563,8 +563,9 @@
 <dt><span class="term">-x</span></dt>
 <dd>
           <p>
-            Only sign the DNSKEY RRset with key-signing keys, and omit
-            signatures from zone-signing keys.  (This is similar to the
+            Only sign the DNSKEY, CDNSKEY, and CDS RRsets with
+            key-signing keys, and omit signatures from zone-signing
+            keys. (This is similar to the
             <span class="command"><strong>dnssec-dnskey-kskonly yes;</strong></span> zone option in
             <span class="command"><strong>named</strong></span>.)
           </p>
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index 9a0b59fb9e5..d83a0beec7f 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -4911,9 +4911,9 @@ options {
                   When this option and <span class="command"><strong>update-check-ksk</strong></span>
                   are both set to <code class="literal">yes</code>, only key-signing
                   keys (that is, keys with the KSK bit set) will be used
-                  to sign the DNSKEY RRset at the zone apex.  Zone-signing
-                  keys (keys without the KSK bit set) will be used to sign
-                  the remainder of the zone, but not the DNSKEY RRset.
+                  to sign the DNSKEY, CDNSKEY, and CDS RRsets at the zone apex.
+                  Zone-signing keys (keys without the KSK bit set) will be used
+                  to sign the remainder of the zone, but not the DNSKEY RRset.
                   This is similar to the
                   <span class="command"><strong>dnssec-signzone -x</strong></span> command line option.
                 </p>
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 8ea62690d35..a160d5a9850 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -528,6 +528,22 @@
 	  matching <span class="command"><strong>cookie-secret</strong></span>.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track prefetch
+	  queries. [RT #45847]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
+	  <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
+	  <span class="command"><strong>named.conf</strong></span>, which suppress the use of
+	  the ZSK when signing DNSKEY records, now also apply to
+	  CDNSKEY and CDS records. Thanks to Tony Finch for the
+	  contribution. [RT #45689]
+	</p>
+      </li>
 </ul></div>
   </div>
 
diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html
index 5d167c9dd08..0924d32331f 100644
--- a/doc/arm/man.dnssec-signzone.html
+++ b/doc/arm/man.dnssec-signzone.html
@@ -581,8 +581,9 @@
 <dt><span class="term">-x</span></dt>
 <dd>
           <p>
-            Only sign the DNSKEY RRset with key-signing keys, and omit
-            signatures from zone-signing keys.  (This is similar to the
+            Only sign the DNSKEY, CDNSKEY, and CDS RRsets with
+            key-signing keys, and omit signatures from zone-signing
+            keys. (This is similar to the
             <span class="command"><strong>dnssec-dnskey-kskonly yes;</strong></span> zone option in
             <span class="command"><strong>named</strong></span>.)
           </p>
diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index a8d76cd54ed..aca91d44d36 100644
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -489,6 +489,22 @@
 	  matching <span class="command"><strong>cookie-secret</strong></span>.
 	</p>
       </li>
+<li class="listitem">
+	<p>
+	  A new statistics counter has been added to track prefetch
+	  queries. [RT #45847]
+	</p>
+      </li>
+<li class="listitem">
+	<p>
+	  The <span class="command"><strong>dnssec-signzone -x</strong></span> flag and the
+	  <span class="command"><strong>dnssec-dnskey-kskonly</strong></span> option in
+	  <span class="command"><strong>named.conf</strong></span>, which suppress the use of
+	  the ZSK when signing DNSKEY records, now also apply to
+	  CDNSKEY and CDS records. Thanks to Tony Finch for the
+	  contribution. [RT #45689]
+	</p>
+      </li>
 </ul></div>
   </div>