From: Tinderbox User Date: Fri, 27 May 2016 01:05:21 +0000 (+0000) Subject: regen master X-Git-Tag: v9.11.0a3~36 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=260e8e04b0dc24cb884c789b5d9eb046457f264e;p=thirdparty%2Fbind9.git regen master --- diff --git a/bin/dig/host.1 b/bin/dig/host.1 index d6baf9236f3..4fd60cde53f 100644 --- a/bin/dig/host.1 +++ b/bin/dig/host.1 @@ -86,14 +86,14 @@ option\&. "All"\&. The \fB\-a\fR option is normally equivalent to -\fB\-v\fR\fB\-t\fRANY\&. It also affects the behaviour of the +\fB\-v \-t \fR\fBANY\fR\&. It also affects the behaviour of the \fB\-l\fR list zone option\&. .RE .PP \-c \fIclass\fR .RS 4 -Query class: This can be used to lookup Hesiod or Chaosnet class resource records\&. The default class is IN (Internet)\&. +Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet) class resource records\&. The default class is IN (Internet)\&. .RE .PP \-C @@ -121,12 +121,12 @@ Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as de .RS 4 List zone: The \fBhost\fR -performs a zone transfer of zone +command performs a zone transfer of zone \fIname\fR and prints out the NS, PTR and address records (A/AAAA)\&. .sp Together, the -\fB\-l\fR\fB\-a\fR +\fB\-l \-a\fR options print all records in the zone\&. .RE .PP @@ -145,9 +145,7 @@ directive in .PP \-r .RS 4 -Non\-recursive query: Setting this option clears the -\fBRD\fR -\(em recursion desired \(em bit in the query\&. This should mean that the name server receiving the query will not attempt to resolve +Non\-recursive query: Setting this option clears the RD (recursion desired) bit in the query\&. This should mean that the name server receiving the query will not attempt to resolve \fIname\fR\&. The \fB\-r\fR option enables @@ -174,7 +172,7 @@ send the query to the next nameserver if any server responds with a SERVFAIL res .PP \-t \fItype\fR .RS 4 -Query type: the +Query type: The \fItype\fR argument can be any recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc\&. .sp @@ -188,8 +186,8 @@ is a dotted\-decimal IPv4 address or colon\-delimited IPv6 address, \fBhost\fR will query for PTR records\&. .sp -If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e\&.g\&. -\fB\-t\fRIXFR=12345678)\&. +If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (like +\fB\-t \fR\fBIXFR=12345678\fR)\&. .RE .PP \-T @@ -217,7 +215,8 @@ Verbose output\&. Equivalent to the \fB\-d\fR debug option\&. Verbose output can also be enabled by setting the \fIdebug\fR -option in/etc/resolv\&.conf\&. +option in +/etc/resolv\&.conf\&. .RE .PP \-V @@ -227,14 +226,14 @@ Print the version number and exit\&. .PP \-w .RS 4 -Wait forever: the query timeout is set to the maximum possible\&. See also the +Wait forever: The query timeout is set to the maximum possible\&. See also the \fB\-W\fR option\&. .RE .PP \-W \fIwait\fR .RS 4 -Timeout: wait for up to +Timeout: Wait for up to \fIwait\fR seconds for a reply\&. If \fIwait\fR diff --git a/bin/dig/host.html b/bin/dig/host.html index 98ede811b39..fb2e9a549b1 100644 --- a/bin/dig/host.html +++ b/bin/dig/host.html @@ -68,14 +68,14 @@
-a

"All". The -a option is normally equivalent - to -v -t ANY. + to -v -t ANY. It also affects the behaviour of the -l list zone option.

-c class

- Query class: This can be used to lookup Hesiod or Chaosnet - class resource records. The default class is IN + Query class: This can be used to lookup HS (Hesiod) or CH + (Chaosnet) class resource records. The default class is IN (Internet).

-C
@@ -102,12 +102,12 @@

List zone: - The host performs a zone transfer of + The host command performs a zone transfer of zone name and prints out the NS, PTR and address records (A/AAAA).

- Together, the -l -a + Together, the -l -a options print all records in the zone.

@@ -126,10 +126,10 @@
-r

Non-recursive query: - Setting this option clears the RD — - recursion desired — bit in the query. This should - mean that the name server receiving the query will not - attempt to resolve name. + Setting this option clears the RD (recursion desired) bit + in the query. This should mean that the name server + receiving the query will not attempt to + resolve name. The -r option enables host to mimic the behavior of a name server by making non-recursive queries and expecting @@ -155,7 +155,7 @@

Query type: - the type argument can be any + The type argument can be any recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

@@ -173,7 +173,7 @@ If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number - (e.g. -t IXFR=12345678). + (like -t IXFR=12345678).

-T
@@ -199,7 +199,7 @@ Equivalent to the -d debug option. Verbose output can also be enabled by setting the debug option - in/etc/resolv.conf. + in /etc/resolv.conf.

-V

@@ -207,13 +207,13 @@

-w

- Wait forever: the query timeout is set to the maximum possible. + Wait forever: The query timeout is set to the maximum possible. See also the -W option.

-W wait

- Timeout: wait for up to wait + Timeout: Wait for up to wait seconds for a reply. If wait is less than one, the wait interval is set to one second.

diff --git a/bin/named/named.conf.5 b/bin/named/named.conf.5 index 22c27c0bd4d..76a8f508d51 100644 --- a/bin/named/named.conf.5 +++ b/bin/named/named.conf.5 @@ -264,6 +264,7 @@ options { sortlist { \fIaddress_match_element\fR; \&.\&.\&. }; topology { \fIaddress_match_element\fR; \&.\&.\&. }; // not implemented auth\-nxdomain \fIboolean\fR; // default changed + minimal\-any \fIboolean\fR; minimal\-responses \fIboolean\fR; recursion \fIboolean\fR; rrset\-order { @@ -298,6 +299,16 @@ options { check\-mx\-cname ( fail | warn | ignore ); check\-srv\-cname ( fail | warn | ignore ); cache\-file \fIquoted_string\fR; // test option + catalog\-zones { + zone \fIquoted_string\fR + [ default\-masters + [port \fIip_port\fR] + [dscp \fIip_dscp\fR] + { ( \fImasters_list\fR | \fIip_addr\fR [port \fIip_port\fR] [key \fIkey\fR] ) ; [\&.\&.\&.] }] + [in\-memory \fIyes_or_no\fR] + [min\-update\-interval \fIinterval\fR] + ; \&.\&.\&. }; + ; suppress\-initial\-notify \fIboolean\fR; // not yet implemented preferred\-glue \fIstring\fR; dual\-stack\-servers [ port \fIinteger\fR ] { @@ -446,6 +457,7 @@ view \fIstring\fR \fIoptional_class\fR { sortlist { \fIaddress_match_element\fR; \&.\&.\&. }; topology { \fIaddress_match_element\fR; \&.\&.\&. }; // not implemented auth\-nxdomain \fIboolean\fR; // default changed + minimal\-any \fIboolean\fR; minimal\-responses \fIboolean\fR; recursion \fIboolean\fR; rrset\-order { diff --git a/bin/named/named.conf.html b/bin/named/named.conf.html index b2092c15a4e..e5c796e95cf 100644 --- a/bin/named/named.conf.html +++ b/bin/named/named.conf.html @@ -207,6 +207,7 @@ options sortlist { address_match_element; ... };
topology { address_match_element; ... }; // not implemented
auth-nxdomain boolean; // default changed
+ minimal-any boolean;
minimal-responses boolean;
recursion boolean;
rrset-order {
@@ -241,6 +242,16 @@ options check-mx-cname ( fail | warn | ignore );
check-srv-cname ( fail | warn | ignore );
cache-file quoted_string; // test option
+ catalog-zones {
+     zone quoted_string
+ [ default-masters
+ [port ip_port]
+ [dscp ip_dscp]
+ { ( masters_list | ip_addr [port ip_port] [key key] ) ; [...] }]
+     [in-memory yes_or_no]
+     [min-update-interval interval]
+     ; ... };
+ ;
suppress-initial-notify boolean; // not yet implemented
preferred-glue string;
dual-stack-servers [ port integer ] {
@@ -404,6 +415,7 @@ view sortlist { address_match_element; ... };
topology { address_match_element; ... }; // not implemented
auth-nxdomain boolean; // default changed
+ minimal-any boolean;
minimal-responses boolean;
recursion boolean;
rrset-order {
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 4ac4527bd8d..66666d27a41 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -107,10 +107,16 @@
Configuring DynDB
Sample DynDB Module
+
Catalog Zones
+
+
Principle of Operation
+
Configuring Catalog Zones
+
Catalog Zone format
+
IPv6 Support in BIND 9
-
Address Lookups Using AAAA Records
-
Address to Name Lookups Using Nibble Format
+
Address Lookups Using AAAA Records
+
Address to Name Lookups Using Nibble Format
@@ -2328,6 +2334,222 @@ $ dnssec-signzone -E '' -S example.net

+Catalog Zones

+

+ A "catalog zone" is a special DNS zone that contains a list of + other zones to be served, along with their configuration parameters. + Zones listed in a catalog zone are called "member zones". + When a catalog zone is loaded or transferred to a slave server + which supports this functionality, the slave server will create + the member zones automatically. When the catalog zone is updated + is updated (for example, to add or delete member zones, or change + their configuration aprameters) those changes are immediately put + into effect. Because the catalog zone is a normal DNS zone, these + configuration changes can be propagated using the standard AXFR/IXFR + zone transfer mechanism. +

+

+ Catalog zones' format and behavior are specified as an internet draft + for interoperability among DNS implementations. As of this release, the + latest revision of the DNS catalog zones draft can be found here: + https://datatracker.ietf.org/doc/draft-muks-dnsop-dns-catalog-zones/ +

+
+

+Principle of Operation

+

+ Normally, if a zone is to be served by a slave server, the + named.conf file on the server must list the + zone, or the zone must be added using rndc addzone. + In environments with a large number of slave servers and/or where + the zones being served are changing frequently, the overhead involved + in maintaining consistent zone configuration on all the slave + servers can be significant. +

+

+ A catalog zone is a way to ease this administrative burden. It is a + DNS zone that lists member zones that should be served by slave servers. + When a slave server receives an update to the catalog zone, it adds, + removes, or reconfigures member zones based on the data received. +

+

+ To use a catalog zone, it must first be set up as a normal zone on + the master and the on slave servers that will be configured to use + it. It must also be added to a catalog-zones list + in the options or view statement + in named.conf. (This is comparable to the way + a policy zone is configured as a normal zone and also listed in + a response-policy statement.) +

+

+ To use the catalog zone feature to serve a new member zone: +

+
    +

  • + Set up the the member zone to be served on the master as normal. + This could be done by editing named.conf, + or by running rndc addzone. +

    • +

  • + Add an entry to the catalog zone for the new member zone. + This could be done by editing the catalog zone's master file + and running rndc reload, or by updating + the zone using nsupdate. +

    • +
+

+ The change to the catalog zone will be propagated from the master to all + slaves using the normal AXFR/IXFR mechanism. When the slave receives the + update to the catalog zone, it will detect the entry for the new member + zone, create an instance of of that zone on the slave server, and point + that instance to the masters specified in the catalog + zone data. The newly created member zone is a normal slave zone, so + BIND will immediately initiate a transfer of zone contents from the + master. Once complete, the slave will start serving the member zone. +

+

+ Removing a member zone from a slave server requires nothing more than + deleting the member zone's entry in the catalog zone. The change to the + catalog cone is propagated to the slave server using the normal AXFR/IXFR + transfer mechanism. The slave server, on processing the update, will + notice that the member zone has been removed. It will stop serving the + zone and remove it froms its list of configured zones. (Removing the + member zone from the master server has to be done in the normal way, + by editing the configuration file or running + rndc delzone.) +

+
+
+

+Configuring Catalog Zones

+

+ Catalog zones are configured with a catalog-zones + statement in the options or view + section of named.conf. For example, +

+
+catalog-zones {
+    zone "catalog.example" default-masters { 10.53.0.1; } in-memory true min-update-interval 10;
+};
+
+

+ This statement specifies that the zone + catalog.example is a catalog zone. This zone must be + properly configured in the same view. In most configurations, it would + be a slave zone. +

+

+ The default-masters option defines the default masters + for member zones listed in a catalog zone. This can be overriden by + options within a catalog zone. If no such options are included, then + member zones will transfer their contents from the servers listed in + this option. +

+

+ The in-memory option, if set to yes, + causes member zones to be stored only in memory. This is functionally + equivalent to configuring a slave zone without a file. + option. The default is no; member zones' content + will be stored locally in a file whose name is automatically generated + from the view name, catalog zone name, and member zone name. +

+

+ The min-update-interval option sets the minimum + interval between processing of updates to catalog zones, in seconds. + If an update to a catalog zone (for example, via IXFR) happens less + than min-update-interval seconds after the most + recent update, then the changes will not be carried out until this + interval has elapsed. The default is 5 seconds. +

+

+ Catalog zones are defined on a per-view basis. Configuring a non-empty + catalog-zones statement in a view will automatically + turn on allow-new-zones for that view. (Note: this + means rndc addzone and rndc delzone + will also work in any view that supports catalog zones.) +

+
+
+

+Catalog Zone format

+

+ A catalog zone is a regular DNS zone; therefore, it has to have a + single SOA and at least one NS + record. +

+

+ A record stating the version of the catalog zone format is + also required. If the version number listed is not supported by + the server, then a catalog zone may not be used by that server. +

+
+catalog.example.    IN SOA . . 2016022901 900 600 86400 1
+catalog.example.    IN NS nsexample.
+version.catalog.example.    IN TXT "1"
+
+

+ Note that this record must have the domain name + version.catalog-zone-name. This illustrates + how the meaning of data stored in a catalog zone is indicated by the + the domain name label immediately before the catalog zone domain. +

+

+ Catalog zones can contain a set of global options that are applied to + all member zones, overriding the settings for the catalog zone + in the configuration file. Currently only the "masters" option + is supported: + +

+
+masters.catalog.example    IN A 192.0.2.1
+masters.catalog.example    IN AAAA 2001:db8::1
+
+

+ (Note that if more than one server is defined, the order in which + they are used is undefined. The above example could correspond to + a zone configured with + masters { 192.0.2.1; 2001:db8::1; }; + or with + masters { 2001:db8::1; 192.0.2.1; };. + There is currently no way to force a particular ordering.) +

+

+ A member zone is added by including a PTR + resource record in the zones sub-domain of the + catalog zone. The record label is a SHA-1 hash + of the member zone name in wire format. The target of the PTR + record is the member zone name. For example, to add the member + zone domain.example: +

+
+5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example IN PTR domain.example.
+
+

+ The hash is necessary to identify options for a specific member + zone. The member zone-specific options are defined the same way as + global options, but in the member zone subdomain: +

+
+masters.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example IN A 192.0.2.2
+masters.5960775ba382e7a4e09263fc06e7c00569b6a05c.zones.catalog.example IN AAAA 2001:db8::2
+
+

+ As would be expected, options defined for a specific zone override + the global options defined in the catalog zone. These in turn override + the global options defined in the catalog-zones + statement in the configuration file. +

+

+ (Note that none of the global records an option will be inherited if + any records are defined for that option for the specific zone. For + example, if the zone had a masters record of type + A but not AAAA, then it would not inherit the + type AAAA record from the global option.) +

+
+
+
+

IPv6 Support in BIND 9

BIND 9 fully supports all currently @@ -2366,7 +2588,7 @@ $ dnssec-signzone -E '' -S example.net

-Address Lookups Using AAAA Records

+Address Lookups Using AAAA Records

The IPv6 AAAA record is a parallel to the IPv4 A record, and, unlike the deprecated A6 record, specifies the entire @@ -2385,7 +2607,7 @@ host 3600 IN AAAA 2001:db8::1

-Address to Name Lookups Using Nibble Format

+Address to Name Lookups Using Nibble Format

When looking up an address in nibble format, the address components are simply reversed, just as in IPv4, and diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 1e2a7731bcb..fd151bcaaea 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -2317,6 +2317,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ has-old-clients yes_or_no; ] [ host-statistics yes_or_no; ] [ host-statistics-max number; ] + [ minimal-any yes_or_no; ] [ minimal-responses yes_or_no; ] [ multiple-cnames yes_or_no; ] [ notify yes_or_no | explicit | master-only; ] @@ -2552,6 +2553,16 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ qname-wait-recurse yes_or_no ] [ automatic-interface-scan yes_or_no ] ; ] + [ catalog-zones { + zone quoted_string + [ default-masters + [port ip_port] + [dscp ip_dscp] + { ( masters_list | ip_addr [port ip_port] [key key] ) ; [...] }] + [in-memory yes_or_no] + [min-update-interval interval] + ; [...] }; + ; ] [v6-bias number ; ] }; @@ -3810,6 +3821,25 @@ options { performance of the server. The default is no.

+
minimal-any
+

+ If set to yes, then when + generating a positive response to a query of type + ANY over UDP, the server will reply with only one + of the RRsets for the query name, and its covering + RRSIGs if any, instead of replying with all known + RRsets for the name. Similarly, a query for type + RRSIG will be answered with the RRSIG records covering + only one type. This can reduce the impact of some kinds + of attack traffic, without harming legitimate + clients. (Note, however, that the RRset returned is the + first one found in the database; it is not necessarily + the smallest available RRset.) + Additionally, minimal-responses is + turned on for these queries, so no unnecessary records + will be added to the authority or additional sections. + The default is no. +

multiple-cnames

This option was used in BIND 8 to allow diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index dfc309f7639..851ee7d3797 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -94,6 +94,35 @@

New Features

    +
  • +

    + A new method of provisioning secondary servers called + "Catalog Zones" has been added. This is an implementation of + + draft-muks-dnsop-dns-catalog-zones/ + . +

    +

    + A catalog zone is a regular DNS zone which contains a list + of "member zones", along with the configuration options for + each of those zones. When a server is configured to use a + catalog zone, all the zones listed in the catalog zone are + added to the local server as slave zones. When the catalog + zone is updated (e.g., by adding or removing zones, or + changing configuration options for existing zones) those + changes will be put into effect. Since the catalog zone is + itself a DNS zone, this means configuration changes can be + propagated to slaves using the standard AXFR/IXFR update + mechanism. +

    +

    + This feature should be considered experimental. It currently + supports only basic features; more advanced features such as + ACLs and TSIG keys are not yet supported. Example catalog + zone configurations can be found in the Chapter 9 of the + BIND Administrator Reference Manual. +

    +

  • Added rndc python module.

    • @@ -448,6 +477,14 @@ and if so, it will regenerate the RRSIG immediately. This helps when a system's clock needs to be reset backwards.

    +

  • + The new minimal-any option reduces the size + of answers to UDP queries for type ANY by implementing one of + the strategies in "draft-ietf-dnsop-refuse-any": returning + a single arbitrarily-selected RRset that matches the query + name rather than returning all of the matching RRsets. + Thanks to Tony Finch for the contribution. [RT #41615] +

@@ -637,13 +674,21 @@

Bug Fixes

    +

  • + Fixed a crash when calling rndc stats on some + Windows builds: some Visual Studio compilers generate code that + crashes when the "%z" printf() format specifier is used. [RT #42380] +

  • Windows installs were failing due to triggering UAC without the installation binary being signed.

  • - A race condition in rbt/rbtdb was leading to INSISTs being - triggered. + A change in the internal binary representation of the RBT database + node structure enabled a race condition to occur (especially when + BIND was built with certain compilers or optimizer settings), + leading to inconsistent database state which caused random + assertion failures. [RT #42380]

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index f14ecb4ef09..b758a6ea41b 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -151,10 +151,16 @@
Configuring DynDB
Sample DynDB Module
+
Catalog Zones
+
+
Principle of Operation
+
Configuring Catalog Zones
+
Catalog Zone format
+
IPv6 Support in BIND 9
-
Address Lookups Using AAAA Records
-
Address to Name Lookups Using Nibble Format
+
Address Lookups Using AAAA Records
+
Address to Name Lookups Using Nibble Format
5. The BIND 9 Lightweight Resolver
diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 71fcbcacd96..0aa8c9d2477 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -86,14 +86,14 @@
-a

"All". The -a option is normally equivalent - to -v -t ANY. + to -v -t ANY. It also affects the behaviour of the -l list zone option.

-c class

- Query class: This can be used to lookup Hesiod or Chaosnet - class resource records. The default class is IN + Query class: This can be used to lookup HS (Hesiod) or CH + (Chaosnet) class resource records. The default class is IN (Internet).

-C
@@ -120,12 +120,12 @@

List zone: - The host performs a zone transfer of + The host command performs a zone transfer of zone name and prints out the NS, PTR and address records (A/AAAA).

- Together, the -l -a + Together, the -l -a options print all records in the zone.

@@ -144,10 +144,10 @@
-r

Non-recursive query: - Setting this option clears the RD — - recursion desired — bit in the query. This should - mean that the name server receiving the query will not - attempt to resolve name. + Setting this option clears the RD (recursion desired) bit + in the query. This should mean that the name server + receiving the query will not attempt to + resolve name. The -r option enables host to mimic the behavior of a name server by making non-recursive queries and expecting @@ -173,7 +173,7 @@

Query type: - the type argument can be any + The type argument can be any recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

@@ -191,7 +191,7 @@ If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number - (e.g. -t IXFR=12345678). + (like -t IXFR=12345678).

-T
@@ -217,7 +217,7 @@ Equivalent to the -d debug option. Verbose output can also be enabled by setting the debug option - in/etc/resolv.conf. + in /etc/resolv.conf.

-V

@@ -225,13 +225,13 @@

-w

- Wait forever: the query timeout is set to the maximum possible. + Wait forever: The query timeout is set to the maximum possible. See also the -W option.

-W wait

- Timeout: wait for up to wait + Timeout: Wait for up to wait seconds for a reply. If wait is less than one, the wait interval is set to one second.

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index e93be41b5b7..cea15e460fb 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -226,6 +226,7 @@ options sortlist { address_match_element; ... };
topology { address_match_element; ... }; // not implemented
auth-nxdomain boolean; // default changed
+ minimal-any boolean;
minimal-responses boolean;
recursion boolean;
rrset-order {
@@ -260,6 +261,16 @@ options check-mx-cname ( fail | warn | ignore );
check-srv-cname ( fail | warn | ignore );
cache-file quoted_string; // test option
+ catalog-zones {
+     zone quoted_string
+ [ default-masters
+ [port ip_port]
+ [dscp ip_dscp]
+ { ( masters_list | ip_addr [port ip_port] [key key] ) ; [...] }]
+     [in-memory yes_or_no]
+     [min-update-interval interval]
+     ; ... };
+ ;
suppress-initial-notify boolean; // not yet implemented
preferred-glue string;
dual-stack-servers [ port integer ] {
@@ -423,6 +434,7 @@ view sortlist { address_match_element; ... };
topology { address_match_element; ... }; // not implemented
auth-nxdomain boolean; // default changed
+ minimal-any boolean;
minimal-responses boolean;
recursion boolean;
rrset-order {
diff --git a/doc/arm/notes.html b/doc/arm/notes.html index 12a249b2440..10ebd1a9bd8 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -55,6 +55,35 @@

New Features

    +
  • +

    + A new method of provisioning secondary servers called + "Catalog Zones" has been added. This is an implementation of + + draft-muks-dnsop-dns-catalog-zones/ + . +

    +

    + A catalog zone is a regular DNS zone which contains a list + of "member zones", along with the configuration options for + each of those zones. When a server is configured to use a + catalog zone, all the zones listed in the catalog zone are + added to the local server as slave zones. When the catalog + zone is updated (e.g., by adding or removing zones, or + changing configuration options for existing zones) those + changes will be put into effect. Since the catalog zone is + itself a DNS zone, this means configuration changes can be + propagated to slaves using the standard AXFR/IXFR update + mechanism. +

    +

    + This feature should be considered experimental. It currently + supports only basic features; more advanced features such as + ACLs and TSIG keys are not yet supported. Example catalog + zone configurations can be found in the Chapter 9 of the + BIND Administrator Reference Manual. +

    +

  • Added rndc python module.

    • @@ -409,6 +438,14 @@ and if so, it will regenerate the RRSIG immediately. This helps when a system's clock needs to be reset backwards.

    +

  • + The new minimal-any option reduces the size + of answers to UDP queries for type ANY by implementing one of + the strategies in "draft-ietf-dnsop-refuse-any": returning + a single arbitrarily-selected RRset that matches the query + name rather than returning all of the matching RRsets. + Thanks to Tony Finch for the contribution. [RT #41615] +

@@ -598,13 +635,21 @@

Bug Fixes

    +

  • + Fixed a crash when calling rndc stats on some + Windows builds: some Visual Studio compilers generate code that + crashes when the "%z" printf() format specifier is used. [RT #42380] +

  • Windows installs were failing due to triggering UAC without the installation binary being signed.

  • - A race condition in rbt/rbtdb was leading to INSISTs being - triggered. + A change in the internal binary representation of the RBT database + node structure enabled a race condition to occur (especially when + BIND was built with certain compilers or optimizer settings), + leading to inconsistent database state which caused random + assertion failures. [RT #42380]

diff --git a/doc/misc/options b/doc/misc/options index f6aa2254407..31c03552d66 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -90,6 +90,11 @@ options { bindkeys-file ; blackhole { ; ... }; cache-file ; + catalog-zones { zone [ default-masters [ port + ] [ dscp ] { ( | [ + port ] | [ port ] ) [ key + ]; ... } ] [ in-memory ] [ + min-update-interval ]; ... }; check-dup-records ( fail | warn | ignore ); check-integrity ; check-mx ( fail | warn | ignore ); @@ -210,6 +215,7 @@ options { min-refresh-time ; min-retry-time ; min-roots ; // not implemented + minimal-any ; minimal-responses ; multi-master ; multiple-cnames ; // obsolete @@ -395,6 +401,11 @@ view [ ] { auth-nxdomain ; // default changed auto-dnssec ( allow | maintain | off ); cache-file ; + catalog-zones { zone [ default-masters [ port + ] [ dscp ] { ( | [ + port ] | [ port ] ) [ key + ]; ... } ] [ in-memory ] [ + min-update-interval ]; ... }; check-dup-records ( fail | warn | ignore ); check-integrity ; check-mx ( fail | warn | ignore ); @@ -495,6 +506,7 @@ view [ ] { min-refresh-time ; min-retry-time ; min-roots ; // not implemented + minimal-any ; minimal-responses ; multi-master ; no-case-compress { ; ... };