2007. [func] It is now possible to explicitly enable DNSSEC

                        validation.  default dnssec-validation no; to
                        be changed to yes in 9.5.0.  [RT #15674]

diff --git a/CHANGES b/CHANGES
index 6dfae786e85eea23776320bd05c497fc33d1ddd1..294b8cf2b11552c9b724e635cf1057fa76aea6e3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2007.  [func]          It is now possible to explicitly enable DNSSEC
+                       validation.  default dnssec-validation no; to
+                       be changed to yes in 9.5.0.  [RT #15674]
+
 2006.  [security]      Allow-query-cache and allow-recursion now default
                        to the builtin acls "localnets" and "localhost".
 

diff --git a/bin/named/config.c b/bin/named/config.c
index c20e6019a18d5635841723c523081d0013bb387b..198322b79410bf2920ba1058f4a77eba531ad899 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.72 2006/03/09 03:30:18 marka Exp $ */
+/* $Id: config.c,v 1.73 2006/03/09 23:21:53 marka Exp $ */
 
 /*! \file */
 
@@ -135,7 +135,8 @@ options {\n\
        use-additional-cache true;\n\
        acache-cleaning-interval 60;\n\
        max-acache-size 0;\n\
-       dnssec-enable no; /* Make yes for 9.4. */ \n\
+       dnssec-enable yes;\n\
+       dnssec-validation no; /* Make yes for 9.5. */ \n\
        dnssec-accept-expired no;\n\
        clients-per-query 10;\n\
        max-clients-per-query 100;\n\

diff --git a/bin/named/named.conf.docbook b/bin/named/named.conf.docbook
index 3bc7561627254c64874c8f62f12268c9cd8a2077..1ba25acf881074fbe4f28dcea9467525a68629f9 100644 (file)
--- a/bin/named/named.conf.docbook
+++ b/bin/named/named.conf.docbook
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.conf.docbook,v 1.20 2006/03/06 01:27:51 marka Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.21 2006/03/09 23:21:53 marka Exp $ -->
 <refentry>
   <refentryinfo>
     <date>Aug 13, 2004</date>
@@ -263,6 +263,7 @@ options {
        root-delegation-only <optional> exclude { <replaceable>quoted_string</replaceable>; ... } </optional>;
        disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
        dnssec-enable <replaceable>boolean</replaceable>;
+       dnssec-validation <replaceable>boolean</replaceable>;
        dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
        dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
        dnssec-accept-expired <replaceable>boolean</replaceable>;
@@ -410,6 +411,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
        root-delegation-only <optional> exclude { <replaceable>quoted_string</replaceable>; ... } </optional>;
        disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
        dnssec-enable <replaceable>boolean</replaceable>;
+       dnssec-validation <replaceable>boolean</replaceable>;
        dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
        dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
        dnssec-accept-expired <replaceable>boolean</replaceable>;

diff --git a/bin/named/query.c b/bin/named/query.c
index 6981cd4e524b4cf9dfccfc5f4b4806528998544f..e8d3ca7f745c93d904bc0df4f01c8e45f9c121a8 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.282 2006/03/03 00:43:34 marka Exp $ */
+/* $Id: query.c,v 1.283 2006/03/09 23:21:53 marka Exp $ */
 
 /*! \file */
 
@@ -4527,13 +4527,17 @@ ns_query_start(ns_client_t *client) {
         * If the client has requested that DNSSEC checking be disabled,
         * allow lookups to return pending data and instruct the resolver
         * to return data before validation has completed.
+        *
+        * We don't need to set DNS_DBFIND_PENDINGOK when validation is
+        * disabled as there will be no pending data.
         */
        if (message->flags & DNS_MESSAGEFLAG_CD ||
            qtype == dns_rdatatype_rrsig)
        {
                client->query.dboptions |= DNS_DBFIND_PENDINGOK;
                client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
-       }
+       } else if (!client->view->enablevalidation)
+               client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
 
        /*
         * Allow glue NS records to be added to the authority section

diff --git a/bin/named/server.c b/bin/named/server.c
index 7fdbdaf5fff0a8c6e390dbd460cff1889ae7d6ef..8b5dbe2a2b0ff0a94e872076d815e561feaa70d3 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.460 2006/03/09 03:30:18 marka Exp $ */
+/* $Id: server.c,v 1.461 2006/03/09 23:21:53 marka Exp $ */
 
 /*! \file */
 
@@ -1493,6 +1493,11 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
        INSIST(result == ISC_R_SUCCESS);
        view->acceptexpired = cfg_obj_asboolean(obj);
 
+       obj = NULL;
+       result = ns_config_get(maps, "dnssec-validation", &obj);
+       INSIST(result == ISC_R_SUCCESS);
+       view->enablevalidation = cfg_obj_asboolean(obj);
+
        obj = NULL;
        result = ns_config_get(maps, "dnssec-lookaside", &obj);
        if (result == ISC_R_SUCCESS) {

diff --git a/bin/tests/system/dlv/ns5/named.conf b/bin/tests/system/dlv/ns5/named.conf
index ebe0cb426a0c8d8d9eb2b89ca987819b0cb6574f..3cdf71493a4e082754da6804751cd9f418591ac1 100644 (file)
--- a/bin/tests/system/dlv/ns5/named.conf
+++ b/bin/tests/system/dlv/ns5/named.conf
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.3 2004/06/04 02:31:41 marka Exp $ */
+/* $Id: named.conf,v 1.4 2006/03/09 23:21:53 marka Exp $ */
 
 /*
  * Choose a keyname that is unlikely to clash with any real key names.
@@ -58,6 +58,7 @@ options {
        recursion yes;
        notify yes;
        dnssec-enable yes;
+       dnssec-validation yes;
        dnssec-lookaside "." trust-anchor "dlv.utld";
 };
 

diff --git a/bin/tests/system/dnssec/ns1/named.conf b/bin/tests/system/dnssec/ns1/named.conf
index 833e9375d73c3c81c7798be76df22e780005379c..f27ebaf39f648198f0bca5fb4edf585b3725c0af 100644 (file)
--- a/bin/tests/system/dnssec/ns1/named.conf
+++ b/bin/tests/system/dnssec/ns1/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.20 2004/03/10 02:19:53 marka Exp $ */
+/* $Id: named.conf,v 1.21 2006/03/09 23:21:53 marka Exp $ */
 
 // NS1
 
@@ -32,6 +32,7 @@ options {
        recursion no;
        notify yes;
        dnssec-enable yes;
+       dnssec-validation yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf
index 66f33bf692891ccaece3da83ced8c8f2e8cdca13..abb3b20d63cf213293f7d765b174337c7fae38ad 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.24 2004/05/05 01:32:57 marka Exp $ */
+/* $Id: named.conf,v 1.25 2006/03/09 23:21:53 marka Exp $ */
 
 // NS2
 
@@ -32,6 +32,7 @@ options {
        recursion no;
        notify yes;
        dnssec-enable yes;
+       dnssec-validation yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf
index 71e88928e81f455d0c6003d7adb8f776c612e432..6455101b32714e95ea000008ed284106a5a58f08 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf
+++ b/bin/tests/system/dnssec/ns3/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.27 2004/05/05 01:32:57 marka Exp $ */
+/* $Id: named.conf,v 1.28 2006/03/09 23:21:53 marka Exp $ */
 
 // NS3
 
@@ -32,6 +32,7 @@ options {
        recursion no;
        notify yes;
        dnssec-enable yes;
+       dnssec-validation yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns4/named.conf b/bin/tests/system/dnssec/ns4/named.conf
index 040e481e4c4595a66f55e7cd70c058d5bd0cae25..25b4138d8e355a8d43cc482988a226c7eeaff221 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named.conf
+++ b/bin/tests/system/dnssec/ns4/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.23 2004/04/15 23:40:23 marka Exp $ */
+/* $Id: named.conf,v 1.24 2006/03/09 23:21:53 marka Exp $ */
 
 // NS4
 
@@ -31,6 +31,7 @@ options {
        listen-on-v6 { none; };
        recursion yes;
        dnssec-enable yes;
+       dnssec-validation yes;
        dnssec-must-be-secure mustbesecure.example yes;
 };
 

diff --git a/bin/tests/system/dnssec/ns5/named.conf b/bin/tests/system/dnssec/ns5/named.conf
index 29191295a3e6e61d2e51e9b0a9c39ad4e773b285..09237206be9012f1fe114278d208a91e72b4d87c 100644 (file)
--- a/bin/tests/system/dnssec/ns5/named.conf
+++ b/bin/tests/system/dnssec/ns5/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.20 2004/03/10 02:19:54 marka Exp $ */
+/* $Id: named.conf,v 1.21 2006/03/09 23:21:53 marka Exp $ */
 
 // NS5
 
@@ -31,6 +31,7 @@ options {
        listen-on-v6 { none; };
        recursion yes;
        dnssec-enable yes;
+       dnssec-validation yes;
 };
 
 zone "." {

diff --git a/bin/tests/system/dnssec/ns6/named.conf b/bin/tests/system/dnssec/ns6/named.conf
index 4fcd5894b4e7399c648442195ec75856e65866fd..ed6413196c4d9d0bbf5e6cf71bd49720854c8f8d 100644 (file)
--- a/bin/tests/system/dnssec/ns6/named.conf
+++ b/bin/tests/system/dnssec/ns6/named.conf
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.7 2004/06/04 02:31:41 marka Exp $ */
+/* $Id: named.conf,v 1.8 2006/03/09 23:21:53 marka Exp $ */
 
 // NS6
 
@@ -32,6 +32,7 @@ options {
        notify yes;
        disable-algorithms . { DSA; };
        dnssec-enable yes;
+       dnssec-validation yes;
        dnssec-lookaside . trust-anchor dlv;
 };
 

diff --git a/bin/tests/system/lwresd/ns1/named.conf b/bin/tests/system/lwresd/ns1/named.conf
index f04aa97c4fd0d9a9c12f180fe1cd500e2ad38a13..6dbfef307ad0083261207d26e62b474de483f68b 100644 (file)
--- a/bin/tests/system/lwresd/ns1/named.conf
+++ b/bin/tests/system/lwresd/ns1/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.15 2004/03/10 02:19:54 marka Exp $ */
+/* $Id: named.conf,v 1.16 2006/03/09 23:21:54 marka Exp $ */
 
 controls { /* empty */ };
 
@@ -30,6 +30,7 @@ options {
        recursion no;
        notify no;
        dnssec-enable yes;
+       dnssec-validation yes;
 };
 
 zone "." {

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c3d888ea46afa2c400a8edbde85b7a808b97ca7f..55285f1db0736a4f3ddc6dff3dd16c01e87e735a 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.298 2006/03/09 03:30:18 marka Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.299 2006/03/09 23:21:54 marka Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -4393,6 +4393,7 @@ category notify { null; };
     <optional> use-id-pool <replaceable>yes_or_no</replaceable>; </optional>
     <optional> maintain-ixfr-base <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-enable <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> dnssec-validation <replaceable>yes_or_no</replaceable>; </optional>
     <optional> dnssec-lookaside <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable>; </optional>
     <optional> dnssec-must-be-secure <replaceable>domain yes_or_no</replaceable>; </optional>
     <optional> dnssec-accept-expired <replaceable>yes_or_no</replaceable>; </optional>
@@ -5484,6 +5485,18 @@ options {
                 <para>
                   Enable DNSSEC support in named.  Unless set to <userinput>yes</userinput>
                   named behaves as if it does not support DNSSEC.
+                  The default is <userinput>yes</userinput>.
+                </para>
+              </listitem>
+            </varlistentry>
+
+            <varlistentry>
+              <term><command>dnssec-validation</command></term>
+              <listitem>
+                <para>
+                  Enable DNSSEC validation in named.
+                 Note <command>dnssec-enable</command> also needs to be
+                 set to <userinput>yes</userinput> to be effective.
                   The default is <userinput>no</userinput>.
                 </para>
               </listitem>

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index cef648a6eba7d3fa6fcd0838c198c13768b85269..5e2e3ef760f17c2006b1f92b0726603808d04b7c 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.72 2006/03/06 01:27:52 marka Exp $ */
+/* $Id: check.c,v 1.73 2006/03/09 23:21:54 marka Exp $ */
 
 /*! \file */
 
@@ -1394,6 +1394,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
        isc_result_t result = ISC_R_SUCCESS;
        isc_result_t tresult = ISC_R_SUCCESS;
        cfg_aclconfctx_t actx;
+       cfg_obj_t *obj;
+       isc_boolean_t enablednssec, enablevalidation;
 
        /*
         * Check that all zone statements are syntactically correct and
@@ -1499,6 +1501,33 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
                        result = ISC_R_FAILURE;
        }
 
+       /*
+        * Check that dnssec-enable/dnssec-validation are sensible.
+        */
+       obj = NULL;
+       if (voptions != NULL)
+               (void)cfg_map_get(voptions, "dnssec-enable", &obj);
+       if (obj == NULL)
+               (void)cfg_map_get(config, "dnssec-enable", &obj);
+       if (obj == NULL)
+               enablednssec = ISC_TRUE;
+       else
+               enablednssec = cfg_obj_asboolean(obj);
+
+       obj = NULL;
+       if (voptions != NULL)
+               (void)cfg_map_get(voptions, "dnssec-validation", &obj);
+       if (obj == NULL)
+               (void)cfg_map_get(config, "dnssec-validation", &obj);
+       if (obj == NULL)
+               enablevalidation = ISC_FALSE;   /* XXXMPA Change for 9.5. */
+       else
+               enablevalidation = cfg_obj_asboolean(obj);
+
+       if (enablevalidation && !enablednssec)
+               cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+                           "'dnssec-validation yes;' and 'dnssec-enable no;'");
+
        if (voptions != NULL)
                tresult = check_options(voptions, logctx, mctx);
        else

diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index fa00fa96bd4f089bc71be4f3af149890fd2c72a7..debe893a1cb2cef620eee442e19595491f7eaafe 100644 (file)
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.h,v 1.100 2006/01/05 00:01:46 marka Exp $ */
+/* $Id: view.h,v 1.101 2006/03/09 23:21:54 marka Exp $ */
 
 #ifndef DNS_VIEW_H
 #define DNS_VIEW_H 1
@@ -112,6 +112,7 @@ struct dns_view {
        isc_boolean_t                   additionalfromauth;
        isc_boolean_t                   minimalresponses;
        isc_boolean_t                   enablednssec;
+       isc_boolean_t                   enablevalidation;
        isc_boolean_t                   acceptexpired;
        dns_transfer_format_t           transfer_format;
        dns_acl_t *                     queryacl;

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 14c895befa00697740b8bbe4f9401121c19b92f9..191552b4f26f866373f6fdb6363b0c79cea150c7 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.329 2006/02/17 00:24:21 marka Exp $ */
+/* $Id: resolver.c,v 1.330 2006/03/09 23:21:54 marka Exp $ */
 
 /*! \file */
 
@@ -3536,14 +3536,16 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
        /*
         * Is DNSSEC validation required for this name?
         */
-       result = dns_keytable_issecuredomain(res->view->secroots, name,
-                                            &secure_domain);
-       if (result != ISC_R_SUCCESS)
-               return (result);
+       if (res->view->enablevalidation) {
+               result = dns_keytable_issecuredomain(res->view->secroots, name,
+                                                    &secure_domain);
+               if (result != ISC_R_SUCCESS)
+                       return (result);
 
-       if (!secure_domain && res->view->dlv != NULL) {
-               valoptions = DNS_VALIDATOR_DLV;
-               secure_domain = ISC_TRUE;
+               if (!secure_domain && res->view->dlv != NULL) {
+                       valoptions = DNS_VALIDATOR_DLV;
+                       secure_domain = ISC_TRUE;
+               }
        }
 
        if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
@@ -3955,14 +3957,16 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
        /*
         * Is DNSSEC validation required for this name?
         */
-       result = dns_keytable_issecuredomain(res->view->secroots, name,
-                                            &secure_domain);
-       if (result != ISC_R_SUCCESS)
-               return (result);
+       if (fctx->res->view->enablevalidation) {
+               result = dns_keytable_issecuredomain(res->view->secroots, name,
+                                                    &secure_domain);
+               if (result != ISC_R_SUCCESS)
+                       return (result);
 
-       if (!secure_domain && res->view->dlv != NULL) {
-               valoptions = DNS_VALIDATOR_DLV;
-               secure_domain = ISC_TRUE;
+               if (!secure_domain && res->view->dlv != NULL) {
+                       valoptions = DNS_VALIDATOR_DLV;
+                       secure_domain = ISC_TRUE;
+               }
        }
 
        if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)

diff --git a/lib/dns/view.c b/lib/dns/view.c
index 9dc53a702a5c891514f635bd7175442e979594e0..cddcb7a1141cccc00e5c94215228dcad361b3559 100644 (file)
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.136 2006/01/05 00:01:46 marka Exp $ */
+/* $Id: view.c,v 1.137 2006/03/09 23:21:54 marka Exp $ */
 
 /*! \file */
 
@@ -160,6 +160,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
        view->additionalfromcache = ISC_TRUE;
        view->additionalfromauth = ISC_TRUE;
        view->enablednssec = ISC_TRUE;
+       view->enablevalidation = ISC_TRUE;
        view->acceptexpired = ISC_FALSE;
        view->minimalresponses = ISC_FALSE;
        view->transfer_format = dns_one_answer;

diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 84fb1e0b141aec184b0ebe07e3f6edb9c8747e4e..a37285d703fddad448ba5994ab1deaaee99ed032 100644 (file)
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.67 2006/03/06 01:27:52 marka Exp $ */
+/* $Id: namedconf.c,v 1.68 2006/03/09 23:21:54 marka Exp $ */
 
 /*! \file */
 
@@ -768,6 +768,7 @@ view_clauses[] = {
        { "disable-algorithms", &cfg_type_disablealgorithm,
          CFG_CLAUSEFLAG_MULTI },
        { "dnssec-enable", &cfg_type_boolean, 0 },
+       { "dnssec-validation", &cfg_type_boolean, 0 },
        { "dnssec-lookaside", &cfg_type_lookaside, CFG_CLAUSEFLAG_MULTI },
        { "dnssec-must-be-secure",  &cfg_type_mustbesecure,
           CFG_CLAUSEFLAG_MULTI },