358. [cleanup] Rename the intermediate files used by the dnssec

                        programs.

diff --git a/CHANGES b/CHANGES
index 40e9b322fd54d0bb4e00a09ea8b900479214d78f..e90688879c05b3ad17eeb14f1c0b3c82d1cbaf4d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+ 358.  [cleanup]       Rename the intermediate files used by the dnssec
+                       programs.
+
  357.  [bug]           The zone file parser crashed when seeing a quoted
                        $INCLUDE.
 

diff --git a/bin/dnssec/dnssec-makekeyset.8 b/bin/dnssec/dnssec-makekeyset.8
index 293d151129d19f138d98d009d66318527cb5a4b9..8e48995fe4ea5e1903bac7f39b8eb6a3598d1763 100644 (file)
--- a/bin/dnssec/dnssec-makekeyset.8
+++ b/bin/dnssec/dnssec-makekeyset.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-makekeyset.8,v 1.5 2000/07/27 09:42:33 tale Exp $
+.\" $Id: dnssec-makekeyset.8,v 1.6 2000/07/31 15:28:19 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-MAKEKEYSET 8
@@ -147,14 +147,14 @@ to print a short summary of its options and arguments.
 If
 .Nm dnssec-makekeyset
 is successful, it creates a file name of the form
-.Ar nnnn.keyset .
+.Ar keyset-nnnn. .
 This file contains the KEY and SIG records for domain
 .Dv nnnn ,
 the domain name part from the key file identifier produced when
 .Nm dnssec-keygen
 created the domain's public and private keys.
 The
-.Ar .keyset
+.Ar keyset
 file can then be transferred to the DNS administrator of the parent
 zone for them to sign the contents with
 .Xr dnssec-signkey 8 .
@@ -174,7 +174,7 @@ the command line when running
 .Pp
 .Nm dnssec-makekeyset
 will create a file called
-.Pa example.com.keyset
+.Pa keyset-example.com.
 containing a SIG and KEY record for
 .Dv example.com.
 These records will have a TTL of 86400 seconds (1 day).
@@ -184,7 +184,7 @@ The SIG record becomes valid at noon UTC on July 1st 2000 and expires
 The DNS administrator for
 .Dv example.com
 could then send
-.Pa example.com.keyset
+.Pa keyset-example.com.
 to the DNS administrator for
 .Dv .com
 so that they could sign the resource records in the file.

diff --git a/bin/dnssec/dnssec-makekeyset.c b/bin/dnssec/dnssec-makekeyset.c
index 523a93b32a6a469c06f64a52ee1f534dbde31b51..c12d06b9549319e901800c2f711b5a44d7082d1f 100644 (file)
--- a/bin/dnssec/dnssec-makekeyset.c
+++ b/bin/dnssec/dnssec-makekeyset.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-makekeyset.c,v 1.29 2000/07/30 20:53:49 bwelling Exp $ */
+/* $Id: dnssec-makekeyset.c,v 1.30 2000/07/31 15:28:12 bwelling Exp $ */
 
 #include <config.h>
 
@@ -103,6 +103,8 @@ usage(void) {
        fprintf(stderr, "\t\tSIG end time  - "
                             "absolute|from start|from now (now + 30 days)\n");
        fprintf(stderr, "\t-t ttl\n");
+       fprintf(stderr, "\t-p\n");
+       fprintf(stderr, "\t\tuse pseudorandom data (faster but less secure)\n");
        fprintf(stderr, "\t-r randomdev:\n");
        fprintf(stderr, "\t\ta file containing random data\n");
        fprintf(stderr, "\t-v level:\n");
@@ -138,6 +140,8 @@ main(int argc, char *argv[]) {
        isc_log_t *log = NULL;
        keynode_t *keynode;
        dns_name_t *savedname = NULL;
+       unsigned int eflags;
+       isc_boolean_t pseudorandom = ISC_FALSE;
 
        result = isc_mem_create(0, 0, &mctx);
        if (result != ISC_R_SUCCESS)
@@ -146,7 +150,7 @@ main(int argc, char *argv[]) {
 
        dns_result_register();
 
-       while ((ch = isc_commandline_parse(argc, argv, "s:e:t:r:v:h")) != -1)
+       while ((ch = isc_commandline_parse(argc, argv, "s:e:t:r:v:ph")) != -1)
        {
                switch (ch) {
                case 's':
@@ -184,6 +188,10 @@ main(int argc, char *argv[]) {
                                fatal("verbose level must be numeric");
                        break;
 
+               case 'p':
+                       pseudorandom = ISC_TRUE;
+                       break;
+
                case 'h':
                default:
                        usage();
@@ -200,8 +208,10 @@ main(int argc, char *argv[]) {
        setup_entropy(mctx, randomfile, &ectx);
        if (randomfile != NULL)
                isc_mem_free(mctx, randomfile);
-       result = dst_lib_init(mctx, ectx,
-                             ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+       eflags = ISC_ENTROPY_BLOCKING;
+       if (!pseudorandom)
+               eflags |= ISC_ENTROPY_GOODONLY;
+       result = dst_lib_init(mctx, ectx, eflags);
        if (result != ISC_R_SUCCESS)
                fatal("could not initialize dst");
 
@@ -266,12 +276,12 @@ main(int argc, char *argv[]) {
                }
                if (output == NULL) {
                        output = isc_mem_allocate(mctx,
-                                                 strlen(namestr) +
-                                                 strlen("keyset") + 1);
+                                                 strlen("keyset-") +
+                                                 strlen(namestr) + 1);
                        if (output == NULL)
                                fatal("out of memory");
-                       strcpy(output, namestr);
-                       strcat(output, "keyset");
+                       strcpy(output, "keyset-");
+                       strcat(output, namestr);
                }
                if (domain == NULL) {
                        dns_fixedname_init(&fdomain);

diff --git a/bin/dnssec/dnssec-signkey.8 b/bin/dnssec/dnssec-signkey.8
index a7dc4f89b9a5f12d2833b6174d6e0139c84a2578..b454fae706833f0a6e10dcdc4f6d0688fb7b6ea7 100644 (file)
--- a/bin/dnssec/dnssec-signkey.8
+++ b/bin/dnssec/dnssec-signkey.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-signkey.8,v 1.6 2000/07/27 09:42:34 tale Exp $
+.\" $Id: dnssec-signkey.8,v 1.7 2000/07/31 15:28:20 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-SIGNKEY 8
@@ -34,7 +34,7 @@
 .Nm dnssec-signkey
 is used to sign a key set for a child zone.
 Typically this would be provided by a 
-.Ar .keyset
+.Ar keyset
 file generated by
 .Xr dnssec-makekeyset 8 .
 This provides a mechanism for a DNSSEC-aware zone to sign the keys of
@@ -43,7 +43,7 @@ The child zone's key set gets signed with the zone keys for its parent
 zone.
 .Ar keyset
 will be the pathname of the child zone's
-.Ar .keyset
+.Ar keyset
 file.
 Each
 .Ar keyfile
@@ -102,7 +102,7 @@ The default level is zero.
 When
 .Nm dnssec-signkey
 completes successfully, it generates a file called
-.Ar nnnn.signedkey
+.Ar signedkey-nnnn.
 containing the signed keys for child zone
 .Ar nnnn .
 The keys from the
@@ -125,13 +125,13 @@ The DNS administrator for a DNSSEC-aware
 zone would use the following command to make
 .Nm dnssec-signkey
 sign the
-.Ar .keyset
+.Ar keyset
 file for
 .Dv example.com
 created in the example shown in the man page for
 .Xr dnssec-makekeyset 8 :
 .Pp
-.Dl # dnssec-signkey example.com.keyset Kcom.+003+51944
+.Dl # dnssec-signkey keyset-example.com. Kcom.+003+51944
 .Pp
 where
 .Dv Kcom.+003+51944
@@ -143,7 +143,7 @@ zone.
 .Pp
 .Nm dnssec-signkey
 will produce a file called
-.Dv example.com.signedkey
+.Dv signedkey-example.com.
 which has the keys for
 .Dv example.com
 signed by the

diff --git a/bin/dnssec/dnssec-signkey.c b/bin/dnssec/dnssec-signkey.c
index 5bb56eae0c7bda60858ad25995f566534042006c..5ab9c6a7eef95f0cf1194c098b8eb3a80a3f0756 100644 (file)
--- a/bin/dnssec/dnssec-signkey.c
+++ b/bin/dnssec/dnssec-signkey.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signkey.c,v 1.28 2000/06/22 21:49:03 tale Exp $ */
+/* $Id: dnssec-signkey.c,v 1.29 2000/07/31 15:28:13 bwelling Exp $ */
 
 #include <config.h>
 
@@ -212,14 +212,14 @@ main(int argc, char *argv[]) {
 
        setup_logging(verbose, mctx, &log);
 
-       if (strlen(argv[0]) < 8 ||
-           strcmp(argv[0] + strlen(argv[0]) - 7, ".keyset") != 0)
-               fatal("keyset file must end in .keyset");
+       if (strlen(argv[0]) < 8 || strncmp(argv[0], "keyset-", 7) != 0)
+               fatal("keyset file '%s' must start with keyset-", argv[0]);
 
        dns_fixedname_init(&fdomain);
        domain = dns_fixedname_name(&fdomain);
-       isc_buffer_init(&b, argv[0], strlen(argv[0]) - 7);
-       isc_buffer_add(&b, strlen(argv[0]) - 7);
+       isc_buffer_init(&b, argv[0] + strlen("keyset-"),
+                       strlen(argv[0]) - strlen("keyset-"));
+       isc_buffer_add(&b, strlen(argv[0]) - strlen("keyset-"));
        result = dns_name_fromtext(domain, &b, dns_rootname, ISC_FALSE, NULL);
        if (result != ISC_R_SUCCESS)
                fatal("'%s' does not contain a valid domain name", argv[0]);
@@ -230,11 +230,11 @@ main(int argc, char *argv[]) {
        tdomain[r.length] = 0;
 
        output = isc_mem_allocate(mctx,
-                                 strlen(tdomain) + strlen("signedkey") + 1);
+                                 strlen("signedkey-") + strlen(tdomain) + 1);
        if (output == NULL)
                fatal("out of memory");
-       strcpy(output, tdomain);
-       strcat(output, "signedkey");
+       strcpy(output, "signedkey-");
+       strcat(output, tdomain);
 
        db = NULL;
        result = dns_db_create(mctx, "rbt", domain, dns_dbtype_zone,

diff --git a/bin/dnssec/dnssec-signzone.8 b/bin/dnssec/dnssec-signzone.8
index 549ba4585722316fb3b86d181a3644583944135c..29f4ca3744bb6ae3e9e9747adf0968e3d476bb66 100644 (file)
--- a/bin/dnssec/dnssec-signzone.8
+++ b/bin/dnssec/dnssec-signzone.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-signzone.8,v 1.8 2000/07/27 09:42:35 tale Exp $
+.\" $Id: dnssec-signzone.8,v 1.9 2000/07/31 15:28:21 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-SIGNZONE 8
@@ -40,7 +40,7 @@
 .Nm dnssec-signzone
 is used to sign a zone.
 Any
-.Ar .signedkey
+.Ar signedkey
 files for the zone to be signed should be present in the current
 directory, along with the keys that will be used to sign the zone.
 If no
@@ -57,7 +57,7 @@ Each
 argument would be an identification string for a key created with
 .Xr dnssec-keygen 8 .
 If the zone to be signed has any secure subzones, the
-.Ar .signedkey
+.Ar signedkey
 files for those subzones need to be available in the
 current working directory used by
 .Nm dnssec-signzone .
@@ -222,18 +222,14 @@ The zone file for this zone is
 which is the same as the origin, so there is no need to use the
 .Fl o
 option to set the origin.
-This zone file contains the keyset for
-.Dv example.com
-that was created by
-.Xr dnssec-makekeyset 8 .
 The zone's keys were either appended to the zone file or
 incorporated using a 
 .Dv $INCLUDE 
 statement.
 If there was a
-.Ar .signedkey
+.Ar signedkey
 file from the parent zone - i.e. 
-.Dv example.com.signedkey 
+.Dv signedkey-example.com.
 - it should be present in the current directory.
 This allows the parent zone's signature to be included in the signed
 version of the
@@ -258,5 +254,4 @@ so that it can be loaded by the name server.
 .Sh SEE ALSO
 .Xr RFC2535,
 .Xr dnssec-keygen 8 ,
-.Xr dnssec-makekeyset 8 ,
 .Xr dnssec-signkey 8 .

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index cf056783ea6b0e68feb19191fe58815023b7b064..3c3c6e43990c72901f91ce460812601e17e1cd7c 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.81 2000/06/22 21:49:04 tale Exp $ */
+/* $Id: dnssec-signzone.c,v 1.82 2000/07/31 15:28:14 bwelling Exp $ */
 
 #include <config.h>
 
@@ -512,18 +512,19 @@ importparentsig(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 {
        unsigned char filename[256];
        isc_buffer_t b;
-       isc_region_t r;
        dns_db_t *newdb = NULL;
        dns_dbnode_t *newnode = NULL;
        dns_rdataset_t newset, sigset;
        dns_rdata_t rdata, newrdata;
        isc_result_t result;
 
-       isc_buffer_init(&b, filename, sizeof(filename) - 10);
+       isc_buffer_init(&b, filename, sizeof(filename));
+       isc_buffer_putstr(&b, "signedkey-");
        result = dns_name_totext(name, ISC_FALSE, &b);
        check_result(result, "dns_name_totext()");
-       isc_buffer_usedregion(&b, &r);
-       strcpy((char *)r.base + r.length, "signedkey");
+       if (isc_buffer_availablelength(&b) == 0)
+               fatal("name '%s' is too long", nametostr(name));
+       isc_buffer_putmem(&b, "", 1);
        result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
                               dns_db_class(db), 0, NULL, &newdb);
        check_result(result, "dns_db_create()");
@@ -588,7 +589,6 @@ static isc_boolean_t
 haschildkey(dns_db_t *db, dns_name_t *name) {
        unsigned char filename[256];
        isc_buffer_t b;
-       isc_region_t r;
        dns_db_t *newdb = NULL;
        dns_dbnode_t *newnode = NULL;
        dns_rdataset_t set, sigset;
@@ -601,11 +601,13 @@ haschildkey(dns_db_t *db, dns_name_t *name) {
        dns_rdataset_init(&set);
        dns_rdataset_init(&sigset);
 
-       isc_buffer_init(&b, filename, sizeof(filename) - 10);
+       isc_buffer_init(&b, filename, sizeof(filename));
+       isc_buffer_putstr(&b, "signedkey-");
        result = dns_name_totext(name, ISC_FALSE, &b);
        check_result(result, "dns_name_totext()");
-       isc_buffer_usedregion(&b, &r);
-       strcpy((char *)r.base + r.length, "signedkey");
+       if (isc_buffer_availablelength(&b) == 0)
+               fatal("name '%s' is too long", nametostr(name));
+       isc_buffer_putmem(&b, "", 1);
        result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
                              dns_db_class(db), 0, NULL, &newdb);
        check_result(result, "dns_db_create()");
@@ -839,6 +841,10 @@ signname(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
                                signset(db, version, node, name, &keyset);
  alreadyhavenullkey:
                                dns_rdataset_disassociate(&keyset);
+                       } else if (isdelegation) {
+                               vbprintf(2, "child key for %s found\n",
+                                        nametostr(name));
+
                        }
 #endif
                }

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index 3570d8068a6056980694cb9b49dc5ce10136c18a..f5fc0148b1ef8d1d84927fb2778604fa007c8517 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -15,9 +15,9 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: clean.sh,v 1.6 2000/07/27 09:39:19 tale Exp $
+# $Id: clean.sh,v 1.7 2000/07/31 15:28:15 bwelling Exp $
 
-rm -f */K* */.keyset */*.keyset */*.signedkey */*.signed */trusted.conf
+rm -f */K* */keyset-* */signedkey-* */*.signed */trusted.conf
 rm -f ns1/root.db ns2/example.db ns3/secure.example.db
 rm -f ns3/unsecure.example.db ns3/bogus.example.db
 rm -f dig.out.* 

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index d8209f0abbb1f7eac3001e31b50e21ec3e55fe5f..6de7032df58b6961c1ba06eacd738a272a5c36f5 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -15,7 +15,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.8 2000/07/27 09:39:24 tale Exp $
+# $Id: sign.sh,v 1.9 2000/07/31 15:28:16 bwelling Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -30,11 +30,11 @@ keyname=`$KEYGEN -a RSA -b 768 -n zone -r $RANDFILE $zone`
 
 (cd ../ns2 && sh sign.sh )
 
-cp ../ns2/example.keyset .
+cp ../ns2/keyset-example. .
 
-$KEYSIGNER -r $RANDFILE example.keyset $keyname
+$KEYSIGNER -r $RANDFILE keyset-example. $keyname
 
-cat example.signedkey >> ../ns2/example.db.signed
+cat signedkey-example. >> ../ns2/example.db.signed
 
 $KEYSETTOOL -r $RANDFILE -t 3600 $keyname
 

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index bbbed42fa5d62d09c41fab97eb4725c88326e975..2d219fae0d24b15c1008985e1ff7552556a747ff 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -15,7 +15,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.11 2000/07/27 09:39:31 tale Exp $
+# $Id: sign.sh,v 1.12 2000/07/31 15:28:18 bwelling Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -33,21 +33,21 @@ keyname=`$KEYGEN -r $RANDFILE -a RSA -b 768 -n zone $zone`
 
 ( cd ../ns3 && sh sign.sh )
 
-cp ../ns3/secure.example.keyset .
+cp ../ns3/keyset-secure.example. .
 
-$KEYSIGNER -r $RANDFILE secure.example.keyset $keyname
+$KEYSIGNER -r $RANDFILE keyset-secure.example. $keyname
 
 # This will leave two copies of the child's zone key in the signed db file;
 # that shouldn't cause any problems.
-cat secure.example.signedkey >>../ns3/secure.example.db.signed
+cat signedkey-secure.example. >>../ns3/secure.example.db.signed
 
-cp ../ns3/bogus.example.keyset .
+cp ../ns3/keyset-bogus.example. .
 
-$KEYSIGNER -r $RANDFILE bogus.example.keyset $keyname
+$KEYSIGNER -r $RANDFILE keyset-bogus.example. $keyname
 
 # This will leave two copies of the child's zone key in the signed db file;
 # that shouldn't cause any problems.
-cat bogus.example.signedkey >>../ns3/bogus.example.db.signed
+cat signedkey-bogus.example. >>../ns3/bogus.example.db.signed
 
 $KEYSETTOOL -r $RANDFILE -t 3600 $keyname
 

diff --git a/doc/man/dnssec/dnssec-makekeyset.8 b/doc/man/dnssec/dnssec-makekeyset.8
index 293d151129d19f138d98d009d66318527cb5a4b9..8e48995fe4ea5e1903bac7f39b8eb6a3598d1763 100644 (file)
--- a/doc/man/dnssec/dnssec-makekeyset.8
+++ b/doc/man/dnssec/dnssec-makekeyset.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-makekeyset.8,v 1.5 2000/07/27 09:42:33 tale Exp $
+.\" $Id: dnssec-makekeyset.8,v 1.6 2000/07/31 15:28:19 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-MAKEKEYSET 8
@@ -147,14 +147,14 @@ to print a short summary of its options and arguments.
 If
 .Nm dnssec-makekeyset
 is successful, it creates a file name of the form
-.Ar nnnn.keyset .
+.Ar keyset-nnnn. .
 This file contains the KEY and SIG records for domain
 .Dv nnnn ,
 the domain name part from the key file identifier produced when
 .Nm dnssec-keygen
 created the domain's public and private keys.
 The
-.Ar .keyset
+.Ar keyset
 file can then be transferred to the DNS administrator of the parent
 zone for them to sign the contents with
 .Xr dnssec-signkey 8 .
@@ -174,7 +174,7 @@ the command line when running
 .Pp
 .Nm dnssec-makekeyset
 will create a file called
-.Pa example.com.keyset
+.Pa keyset-example.com.
 containing a SIG and KEY record for
 .Dv example.com.
 These records will have a TTL of 86400 seconds (1 day).
@@ -184,7 +184,7 @@ The SIG record becomes valid at noon UTC on July 1st 2000 and expires
 The DNS administrator for
 .Dv example.com
 could then send
-.Pa example.com.keyset
+.Pa keyset-example.com.
 to the DNS administrator for
 .Dv .com
 so that they could sign the resource records in the file.

diff --git a/doc/man/dnssec/dnssec-signkey.8 b/doc/man/dnssec/dnssec-signkey.8
index a7dc4f89b9a5f12d2833b6174d6e0139c84a2578..b454fae706833f0a6e10dcdc4f6d0688fb7b6ea7 100644 (file)
--- a/doc/man/dnssec/dnssec-signkey.8
+++ b/doc/man/dnssec/dnssec-signkey.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-signkey.8,v 1.6 2000/07/27 09:42:34 tale Exp $
+.\" $Id: dnssec-signkey.8,v 1.7 2000/07/31 15:28:20 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-SIGNKEY 8
@@ -34,7 +34,7 @@
 .Nm dnssec-signkey
 is used to sign a key set for a child zone.
 Typically this would be provided by a 
-.Ar .keyset
+.Ar keyset
 file generated by
 .Xr dnssec-makekeyset 8 .
 This provides a mechanism for a DNSSEC-aware zone to sign the keys of
@@ -43,7 +43,7 @@ The child zone's key set gets signed with the zone keys for its parent
 zone.
 .Ar keyset
 will be the pathname of the child zone's
-.Ar .keyset
+.Ar keyset
 file.
 Each
 .Ar keyfile
@@ -102,7 +102,7 @@ The default level is zero.
 When
 .Nm dnssec-signkey
 completes successfully, it generates a file called
-.Ar nnnn.signedkey
+.Ar signedkey-nnnn.
 containing the signed keys for child zone
 .Ar nnnn .
 The keys from the
@@ -125,13 +125,13 @@ The DNS administrator for a DNSSEC-aware
 zone would use the following command to make
 .Nm dnssec-signkey
 sign the
-.Ar .keyset
+.Ar keyset
 file for
 .Dv example.com
 created in the example shown in the man page for
 .Xr dnssec-makekeyset 8 :
 .Pp
-.Dl # dnssec-signkey example.com.keyset Kcom.+003+51944
+.Dl # dnssec-signkey keyset-example.com. Kcom.+003+51944
 .Pp
 where
 .Dv Kcom.+003+51944
@@ -143,7 +143,7 @@ zone.
 .Pp
 .Nm dnssec-signkey
 will produce a file called
-.Dv example.com.signedkey
+.Dv signedkey-example.com.
 which has the keys for
 .Dv example.com
 signed by the

diff --git a/doc/man/dnssec/dnssec-signzone.8 b/doc/man/dnssec/dnssec-signzone.8
index 549ba4585722316fb3b86d181a3644583944135c..29f4ca3744bb6ae3e9e9747adf0968e3d476bb66 100644 (file)
--- a/doc/man/dnssec/dnssec-signzone.8
+++ b/doc/man/dnssec/dnssec-signzone.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\" 
-.\" $Id: dnssec-signzone.8,v 1.8 2000/07/27 09:42:35 tale Exp $
+.\" $Id: dnssec-signzone.8,v 1.9 2000/07/31 15:28:21 bwelling Exp $
 .\" 
 .Dd Jun 30, 2000
 .Dt DNSSEC-SIGNZONE 8
@@ -40,7 +40,7 @@
 .Nm dnssec-signzone
 is used to sign a zone.
 Any
-.Ar .signedkey
+.Ar signedkey
 files for the zone to be signed should be present in the current
 directory, along with the keys that will be used to sign the zone.
 If no
@@ -57,7 +57,7 @@ Each
 argument would be an identification string for a key created with
 .Xr dnssec-keygen 8 .
 If the zone to be signed has any secure subzones, the
-.Ar .signedkey
+.Ar signedkey
 files for those subzones need to be available in the
 current working directory used by
 .Nm dnssec-signzone .
@@ -222,18 +222,14 @@ The zone file for this zone is
 which is the same as the origin, so there is no need to use the
 .Fl o
 option to set the origin.
-This zone file contains the keyset for
-.Dv example.com
-that was created by
-.Xr dnssec-makekeyset 8 .
 The zone's keys were either appended to the zone file or
 incorporated using a 
 .Dv $INCLUDE 
 statement.
 If there was a
-.Ar .signedkey
+.Ar signedkey
 file from the parent zone - i.e. 
-.Dv example.com.signedkey 
+.Dv signedkey-example.com.
 - it should be present in the current directory.
 This allows the parent zone's signature to be included in the signed
 version of the
@@ -258,5 +254,4 @@ so that it can be loaded by the name server.
 .Sh SEE ALSO
 .Xr RFC2535,
 .Xr dnssec-keygen 8 ,
-.Xr dnssec-makekeyset 8 ,
 .Xr dnssec-signkey 8 .