regen master

diff --git a/bin/check/named-checkconf.8 b/bin/check/named-checkconf.8
index 68755b35aa68b8d0fb4d9d1c55963872cf14e63d..03f2b9c7cc709b23cc2dc3bee2de395d34bb8bcc 100644 (file)
--- a/bin/check/named-checkconf.8
+++ b/bin/check/named-checkconf.8
@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -74,6 +74,11 @@ Print the usage summary and exit\&.
 When loading a zonefile read the journal if it exists\&.
 .RE
 .PP
+\-l
+.RS 4
+List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
+.RE
+.PP
 \-p
 .RS 4
 Print out the

diff --git a/bin/check/named-checkconf.html b/bin/check/named-checkconf.html
index 3b41974ef4dd49669b4be49b7fd7a558de850ed7..a73ae29724bd988c279d429a56ebd7b21d772b4b 100644 (file)
--- a/bin/check/named-checkconf.html
+++ b/bin/check/named-checkconf.html
@@ -20,7 +20,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjvz</code>] [<code class="option">-p</code>
+<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjlvz</code>] [<code class="option">-p</code>
         [<code class="option">-x</code>
       ]] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename}</p></div>
 </div>
@@ -55,6 +55,12 @@
 <dd><p>
             When loading a zonefile read the journal if it exists.
           </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+            List all the configured zones. Each line of output
+            contains the zone name, class (e.g. IN), view, and type
+            (e.g. master or slave).
+          </p></dd>
 <dt><span class="term">-p</span></dt>
 <dd><p>
            Print out the <code class="filename">named.conf</code> and included files

diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5
index 7d0a0a1dacfc23d81be0c8d1ac3348d6f091dee3..9f548cc63ca1a926b372c08fc7a98ad792cd6470 100644 (file)
--- a/bin/named/named.conf.5
+++ b/bin/named/named.conf.5
@@ -369,6 +369,7 @@ options {
                ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
        };
        max\-journal\-size \fIsize_no_default\fR;
+       max\-records \fIinteger\fR;
        max\-transfer\-time\-in \fIinteger\fR;
        max\-transfer\-time\-out \fIinteger\fR;
        max\-transfer\-idle\-in \fIinteger\fR;
@@ -556,6 +557,7 @@ view \fIstring\fR \fIoptional_class\fR {
                ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
        };
        max\-journal\-size \fIsize_no_default\fR;
+       max\-records \fIinteger\fR;
        max\-transfer\-time\-in \fIinteger\fR;
        max\-transfer\-time\-out \fIinteger\fR;
        max\-transfer\-idle\-in \fIinteger\fR;
@@ -650,6 +652,7 @@ zone \fIstring\fR \fIoptional_class\fR {
                ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
        };
        max\-journal\-size \fIsize_no_default\fR;
+       max\-records \fIinteger\fR;
        max\-transfer\-time\-in \fIinteger\fR;
        max\-transfer\-time\-out \fIinteger\fR;
        max\-transfer\-idle\-in \fIinteger\fR;

diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html
index 42655e4e7aa4099d200fb1119b20daa072bcdf48..f22501a677ad1891dd7143ae8697f60b7430afb6 100644 (file)
--- a/bin/named/named.conf.html
+++ b/bin/named/named.conf.html
@@ -320,6 +320,7 @@ options
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -523,6 +524,7 @@ view
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -623,6 +625,7 @@ zone
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index ad6c528023e320b36c4f39bf6f7330100716af6d..360e82fe4ed3e8627a4b359abc312c48981f79c8 100644 (file)
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -2402,6 +2402,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
     [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
+    [<span class="optional"> max-records <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
@@ -5594,6 +5595,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   means 2 gigabytes.
                   This may also be set on a per-zone basis.
                 </p></dd>
+<dt><span class="term"><span class="command"><strong>max-records</strong></span></span></dt>
+<dd><p>
+                  The maximum number of records permitted in a zone.
+                  The default is zero which means unlimited.
+                </p></dd>
 <dt><span class="term"><span class="command"><strong>host-statistics-max</strong></span></span></dt>
 <dd><p>
                   In BIND 8, specifies the maximum number of host statistics
@@ -9171,6 +9177,11 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
                     See the description of
                     <span class="command"><strong>max-journal-size</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called &#8220;Server  Resource Limits&#8221;</a>.
                   </p></dd>
+<dt><span class="term"><span class="command"><strong>max-records</strong></span></span></dt>
+<dd><p>
+                    See the description of
+                    <span class="command"><strong>max-records</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called &#8220;Server  Resource Limits&#8221;</a>.
+                  </p></dd>
 <dt><span class="term"><span class="command"><strong>max-transfer-time-in</strong></span></span></dt>
 <dd><p>
                     See the description of

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 51e72f70c1f5d450e19f2d0e954644c344624c06..3f677d2bcde3971511951f9635e1a4d30c5e3b2a 100644 (file)
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -108,6 +108,13 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+         Added the ability to specify the maximum number of records
+         permitted in a zone (max-records #;).  This provides a mechanism
+         to block overly large zone transfers, which is a potential risk
+         with slave zones from other parties, as described in CVE-2016-6170.
+         [RT #42143]
+       </p></li>
 <li class="listitem"><p>
          It was possible to trigger a assertion when rendering a
          message using a specially crafted request. This flaw is

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html
index f60aa5ff4a472499dae337312ba8227875915a78..ba3d27b55205ccf48bf77598c9fa8785a5043566 100644 (file)
--- a/doc/arm/man.named-checkconf.html
+++ b/doc/arm/man.named-checkconf.html
@@ -38,7 +38,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjvz</code>] [<code class="option">-p</code>
+<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjlvz</code>] [<code class="option">-p</code>
         [<code class="option">-x</code>
       ]] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename}</p></div>
 </div>
@@ -73,6 +73,12 @@
 <dd><p>
             When loading a zonefile read the journal if it exists.
           </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+            List all the configured zones. Each line of output
+            contains the zone name, class (e.g. IN), view, and type
+            (e.g. master or slave).
+          </p></dd>
 <dt><span class="term">-p</span></dt>
 <dd><p>
            Print out the <code class="filename">named.conf</code> and included files

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html
index 824ae9cb7fb5bf1033c14d456912488b2e04dfcf..2e6ad1023c2c21ee6cd0c834de68da44994d1769 100644 (file)
--- a/doc/arm/man.named.conf.html
+++ b/doc/arm/man.named.conf.html
@@ -338,6 +338,7 @@ options
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -541,6 +542,7 @@ view
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -641,6 +643,7 @@ zone
        };<br>
 <br>
        max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+       max-records <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
        max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 2639a469ad35eabc7b5fbba5c759b4dffa9c2694..63dfa108b4106ba148a420fa706d47be30481606 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -69,6 +69,13 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+         Added the ability to specify the maximum number of records
+         permitted in a zone (max-records #;).  This provides a mechanism
+         to block overly large zone transfers, which is a potential risk
+         with slave zones from other parties, as described in CVE-2016-6170.
+         [RT #42143]
+       </p></li>
 <li class="listitem"><p>
          It was possible to trigger a assertion when rendering a
          message using a specially crafted request. This flaw is

diff --git a/doc/misc/options b/doc/misc/options
index 1f7bc3604c66d88152831b73cdaaecb30ca63675..16b1b47f0df1c2f24490f06509966f8cce81fe9d 100644 (file)
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -217,6 +217,7 @@ options {
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
         max-ncache-ttl <integer>;
+        max-records <integer>;
         max-recursion-depth <integer>;
         max-recursion-queries <integer>;
         max-refresh-time <integer>;
@@ -521,6 +522,7 @@ view <string> [ <class> ] {
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
         max-ncache-ttl <integer>;
+        max-records <integer>;
         max-recursion-depth <integer>;
         max-recursion-queries <integer>;
         max-refresh-time <integer>;
@@ -703,6 +705,7 @@ view <string> [ <class> ] {
                 max-ixfr-log-size ( unlimited | default |
                     <sizeval> ); // obsolete
                 max-journal-size ( unlimited | <sizeval> );
+                max-records <integer>;
                 max-refresh-time <integer>;
                 max-retry-time <integer>;
                 max-transfer-idle-in <integer>;
@@ -806,6 +809,7 @@ zone <string> [ <class> ] {
             <integer> ] ) [ key <string> ]; ... };
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
+        max-records <integer>;
         max-refresh-time <integer>;
         max-retry-time <integer>;
         max-transfer-idle-in <integer>;