.PP
\-A \fIalgorithm\fR
.RS 4
-Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5\&.
+Specifies the algorithm to use for the TSIG key\&. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512\&. The default is hmac\-md5 or if MD5 was disabled hmac\-sha256\&.
.RE
.PP
\-b \fIkeysize\fR
<dd><p>
Specifies the algorithm to use for the TSIG key. Available
choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
- hmac-sha384 and hmac-sha512. The default is hmac-md5.
+ hmac-sha384 and hmac-sha512. The default is hmac-md5 or
+ if MD5 was disabled hmac-sha256.
</p></dd>
<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
<dd><p>
hmac\-sha512\&. If
\fIhmac\fR
is not specified, the default is
-hmac\-md5\&.
+hmac\-md5
+or if MD5 was disabled
+hmac\-sha256\&.
.sp
NOTE: You should use the
\fB\-k\fR
<code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
<code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
<code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
- is not specified, the default is <code class="literal">hmac-md5</code>.
+ is not specified, the default is <code class="literal">hmac-md5</code>
+ or if MD5 was disabled <code class="literal">hmac-sha256</code>.
</p>
<p>
NOTE: You should use the <code class="option">-k</code> option and
coresize \fIsize\fR;
datasize \fIsize\fR;
directory \fIquoted_string\fR;
+ dnstap { \fImessage_type\fR; \&.\&.\&. };
+ dnstap\-output ( file | unix ) \fIpath_name\fR;
+ dnstap\-identity ( \fIstring\fR | hostname | none );
+ dnstap\-version ( \fIstring\fR | none );
dump\-file \fIquoted_string\fR;
files \fIsize\fR;
+ fstrm\-set\-buffer\-hint \fInumber\fR;
+ fstrm\-set\-flush\-timeout \fInumber\fR;
+ fstrm\-set\-input\-queue\-size \fInumber\fR;
+ fstrm\-set\-output\-notify\-threshold \fInumber\fR;
+ fstrm\-set\-output\-queue\-model ( \fImpsc\fR | \fIspsc\fR ) ;
+ fstrm\-set\-output\-queue\-size \fInumber\fR;
+ fstrm\-set\-reopen\-interval \fInumber\fR;
heartbeat\-interval \fIinteger\fR;
host\-statistics \fIboolean\fR; // not implemented
host\-statistics\-max \fInumber\fR; // not implemented
coresize <em class="replaceable"><code>size</code></em>;<br>
datasize <em class="replaceable"><code>size</code></em>;<br>
directory <em class="replaceable"><code>quoted_string</code></em>;<br>
+ dnstap { <em class="replaceable"><code>message_type</code></em>; ... };<br>
+ dnstap-output ( <code class="literal">file</code> | <code class="literal">unix</code> ) <em class="replaceable"><code>path_name</code></em>;<br>
+ dnstap-identity ( <em class="replaceable"><code>string</code></em> | <code class="literal">hostname</code> | <code class="literal">none</code> );<br>
+ dnstap-version ( <em class="replaceable"><code>string</code></em> | <code class="literal">none</code> );<br>
dump-file <em class="replaceable"><code>quoted_string</code></em>;<br>
files <em class="replaceable"><code>size</code></em>;<br>
+ fstrm-set-buffer-hint <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-flush-timeout <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-input-queue-size <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-output-notify-threshold <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-output-queue-model ( <em class="replaceable"><code>mpsc</code></em> | <em class="replaceable"><code>spsc</code></em> ) ;<br>
+ fstrm-set-output-queue-size <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-reopen-interval <em class="replaceable"><code>number</code></em>;<br>
heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
host-statistics <em class="replaceable"><code>boolean</code></em>; // not implemented<br>
host-statistics-max <em class="replaceable"><code>number</code></em>; // not implemented<br>
hmac\-sha512\&. If
\fIhmac\fR
is not specified, the default is
-hmac\-md5\&.
+hmac\-md5
+or if MD5 was disabled
+hmac\-sha256\&.
.sp
NOTE: Use of the
\fB\-y\fR
pair\&. If
\fIhmac\fR
is specified, then it sets the signing algorithm in use; the default is
-hmac\-md5\&. The
+hmac\-md5
+or if MD5 was disabled
+hmac\-sha256\&. The
\fBkey\fR
command overrides any key specified on the command line via
\fB\-y\fR
<code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
<code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
<code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
- is not specified, the default is <code class="literal">hmac-md5</code>.
+ is not specified, the default is <code class="literal">hmac-md5</code>
+ or if MD5 was disabled <code class="literal">hmac-sha256</code>.
</p>
<p>
NOTE: Use of the <code class="option">-y</code> option is discouraged because the
<em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
signing algorithm in use; the default is
- <code class="literal">hmac-md5</code>. The <span class="command"><strong>key</strong></span>
+ <code class="literal">hmac-md5</code> or if MD5 was disabled
+ <code class="literal">hmac-sha256</code>. The <span class="command"><strong>key</strong></span>
command overrides any key specified on the command line via
<code class="option">-y</code> or <code class="option">-k</code>.
</p></dd>
Specify the PKCS#11 provider module\&. This must be the full path to a shared library object implementing the PKCS#11 API for the device\&.
.RE
.PP
-\-e
+\-v
.RS 4
Make the PKCS#11 libisc initialization verbose\&.
.RE
<!--
- Copyright (C) 2014-2016 Internet Systems Consortium, Inc. ("ISC")
-
- - Permission to use, copy, modify, and/or distribute this software for any
- - purpose with or without fee is hereby granted, provided that the above
- - copyright notice and this permission notice appear in all copies.
- -
- - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- - PERFORMANCE OF THIS SOFTWARE.
+ - This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/.
-->
<html>
<head>
path to a shared library object implementing the PKCS#11 API
for the device.
</p></dd>
-<dt><span class="term">-e</span></dt>
+<dt><span class="term">-v</span></dt>
<dd><p>
Make the PKCS#11 libisc initialization verbose.
</p></dd>
[<span class="optional"> dnstap-output ( <code class="literal">file</code> | <code class="literal">unix</code> ) <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> dnstap-identity ( <em class="replaceable"><code>string</code></em> | <code class="literal">hostname</code> | <code class="literal">none</code> ); </span>]
[<span class="optional"> dnstap-version ( <em class="replaceable"><code>string</code></em> | <code class="literal">none</code> ); </span>]
+ [<span class="optional"> fstrm-set-buffer-hint <em class="replaceable"><code>number</code></em> ; </span>]
+ [<span class="optional"> fstrm-set-flush-timeout <em class="replaceable"><code>number</code></em> ; </span>]
+ [<span class="optional"> fstrm-set-input-queue-size <em class="replaceable"><code>number</code></em> ; </span>]
+ [<span class="optional"> fstrm-set-output-notify-threshold <em class="replaceable"><code>number</code></em> ; </span>]
+ [<span class="optional"> fstrm-set-output-queue-model ( <em class="replaceable"><code>mpsc</code></em> |
+ <em class="replaceable"><code>spsc</code></em> ) ; </span>]
+ [<span class="optional"> fstrm-set-output-queue-size <em class="replaceable"><code>number</code></em> ; </span>]
+ [<span class="optional"> fstrm-set-reopen-interval <em class="replaceable"><code>number</code></em> ; </span>]
[<span class="optional"> geoip-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> key-directory <em class="replaceable"><code>path_name</code></em>; </span>]
[<span class="optional"> managed-keys-directory <em class="replaceable"><code>path_name</code></em>; </span>]
For more information on <span class="command"><strong>dnstap</strong></span>, see
<a class="link" href="http://dnstap.info" target="_top">http://dnstap.info</a>.
</p>
+<p>
+ The fstrm library has a number of tunables that are exposed
+ in <code class="filename">named.conf</code>, and can be modified
+ if necessary to improve performance or prevent loss of data.
+ These are:
+ </p>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-buffer-hint</strong></span>: The
+ threshold number of bytes to accumulate in the output
+ buffer before forcing a buffer flush. The minimum is
+ 1K, the maximum is 64K, and the default is 8K.
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-flush-timeout</strong></span>: The number
+ of seconds to allow unflushed data to remain in the
+ output buffer. The minimum is 1 second, the maximum is
+ 600 seconds (10 minutes), and the default is 1 second.
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-output-notify-threshold</strong></span>:
+ The number of outstanding queue entries to allow on
+ an input queue before waking the I/O thread.
+ The minimum is 1 and the default is 32.
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-output-queue-model</strong></span>:
+ Controls the queuing semantics to use for queue
+ objects. The default is <code class="literal">mpsc</code>
+ (multiple producer, single consumer); the other
+ option is <code class="literal">spsc</code> (single producer,
+ single consumer).
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-input-queue-size</strong></span>: The
+ number of queue entries to allocate for each
+ input queue. The minimum is 2, the maximum is 16384,
+ and the default is 512.
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-output-queue-size</strong></span>:
+ The number of queue entries to allocate for each
+ output queue. The minimum is 2, the maximum is
+ system-dependent and based on <code class="option">IOV_MAX</code>,
+ and the default is 64.
+ </li>
+<li class="listitem">
+ <span class="command"><strong>fstrm-set-reopen-interval</strong></span>:
+ The number of seconds to wait between attempts to
+ reopen a closed output stream. The minimum is 1 second,
+ the maximum is 600 seconds (10 minutes), and the default
+ is 5 seconds.
+ </li>
+</ul></div>
+<p>
+ Note that all of the above minimum, maximum, and default
+ values are set by the <span class="command"><strong>libfstrm</strong></span> library,
+ and may be subject to change in future versions of the
+ library. See the <span class="command"><strong>libfstrm</strong></span> documentation
+ for more information.
+ </p>
</dd>
<dt><span class="term"><span class="command"><strong>dnstap-output</strong></span></span></dt>
<dd>
<code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
<code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
<code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
- is not specified, the default is <code class="literal">hmac-md5</code>.
+ is not specified, the default is <code class="literal">hmac-md5</code>
+ or if MD5 was disabled <code class="literal">hmac-sha256</code>.
</p>
<p>
NOTE: You should use the <code class="option">-k</code> option and
coresize <em class="replaceable"><code>size</code></em>;<br>
datasize <em class="replaceable"><code>size</code></em>;<br>
directory <em class="replaceable"><code>quoted_string</code></em>;<br>
+ dnstap { <em class="replaceable"><code>message_type</code></em>; ... };<br>
+ dnstap-output ( <code class="literal">file</code> | <code class="literal">unix</code> ) <em class="replaceable"><code>path_name</code></em>;<br>
+ dnstap-identity ( <em class="replaceable"><code>string</code></em> | <code class="literal">hostname</code> | <code class="literal">none</code> );<br>
+ dnstap-version ( <em class="replaceable"><code>string</code></em> | <code class="literal">none</code> );<br>
dump-file <em class="replaceable"><code>quoted_string</code></em>;<br>
files <em class="replaceable"><code>size</code></em>;<br>
+ fstrm-set-buffer-hint <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-flush-timeout <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-input-queue-size <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-output-notify-threshold <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-output-queue-model ( <em class="replaceable"><code>mpsc</code></em> | <em class="replaceable"><code>spsc</code></em> ) ;<br>
+ fstrm-set-output-queue-size <em class="replaceable"><code>number</code></em>;<br>
+ fstrm-set-reopen-interval <em class="replaceable"><code>number</code></em>;<br>
heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
host-statistics <em class="replaceable"><code>boolean</code></em>; // not implemented<br>
host-statistics-max <em class="replaceable"><code>number</code></em>; // not implemented<br>
<code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
<code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
<code class="literal">hmac-sha512</code>. If <em class="parameter"><code>hmac</code></em>
- is not specified, the default is <code class="literal">hmac-md5</code>.
+ is not specified, the default is <code class="literal">hmac-md5</code>
+ or if MD5 was disabled <code class="literal">hmac-sha256</code>.
</p>
<p>
NOTE: Use of the <code class="option">-y</code> option is discouraged because the
<em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
signing algorithm in use; the default is
- <code class="literal">hmac-md5</code>. The <span class="command"><strong>key</strong></span>
+ <code class="literal">hmac-md5</code> or if MD5 was disabled
+ <code class="literal">hmac-sha256</code>. The <span class="command"><strong>key</strong></span>
command overrides any key specified on the command line via
<code class="option">-y</code> or <code class="option">-k</code>.
</p></dd>
</div>
<div class="refsynopsisdiv">
<h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">pkcs11-tokens</code> [<code class="option">-m <em class="replaceable"><code>module</code></em></code>]</p></div>
+<div class="cmdsynopsis"><p><code class="command">pkcs11-tokens</code> [<code class="option">-m <em class="replaceable"><code>module</code></em></code>] [<code class="option">-v</code>]</p></div>
</div>
<div class="refsection">
<a name="id-1.14.37.7"></a><h2>DESCRIPTION</h2>
path to a shared library object implementing the PKCS#11 API
for the device.
</p></dd>
+<dt><span class="term">-v</span></dt>
+<dd><p>
+ Make the PKCS#11 libisc initialization verbose.
+ </p></dd>
</dl></div>
</div>
<div class="refsection">
<dd><p>
Specifies the algorithm to use for the TSIG key. Available
choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
- hmac-sha384 and hmac-sha512. The default is hmac-md5.
+ hmac-sha384 and hmac-sha512. The default is hmac-md5 or
+ if MD5 was disabled hmac-sha256.
</p></dd>
<dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
<dd><p>
forward ( first | only );
forwarders [ port <integer> ] [ dscp <integer> ] { ( <ipv4_address>
| <ipv6_address> ) [ port <integer> ] [ dscp <integer> ]; ... };
+ fstrm-set-buffer-hint <integer>; // not configured
+ fstrm-set-flush-timeout <integer>; // not configured
+ fstrm-set-input-queue-size <integer>; // not configured
+ fstrm-set-output-notify-threshold <integer>; // not configured
+ fstrm-set-output-queue-model ( spsc | mpsc ); // not configured
+ fstrm-set-output-queue-size <integer>; // not configured
+ fstrm-set-reopen-interval <integer>; // not configured
geoip-directory ( <quoted_string> | none ); // not configured
geoip-use-ecs ( <quoted_string> | none ); // not configured
has-old-clients <boolean>; // obsolete