From: Tinderbox User Date: Thu, 5 Jan 2017 01:05:07 +0000 (+0000) Subject: regen master X-Git-Tag: v9.12.0a1~553 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=37ae13794214eee7d12ae03c4da78f5ea8f085d1;p=thirdparty%2Fbind9.git regen master --- diff --git a/bin/dig/dig.1 b/bin/dig/dig.1 index 42246d8e295..6e333f30676 100644 --- a/bin/dig/dig.1 +++ b/bin/dig/dig.1 @@ -523,6 +523,15 @@ Print only one (starting) SOA record when performing an AXFR\&. The default is t Set [restore] the DNS message opcode to the specified value\&. The default value is QUERY (0)\&. .RE .PP +\fB+padding=value\fR +.RS 4 +Pad the size of the query packet using the EDNS Padding option to blocks of +\fIvalue\fR +bytes\&. For example, +\fB+padding=32\fR +would cause a 48\-byte query to be padded to 64 bytes\&. The default block size is 0, which disables padding\&. The maximum is 512\&. Values are ordinarily expected to be powers of two, such as 128; however, this is not mandatory\&. Responses to padded queries may also be padded, but only if the query uses TCP or DNS COOKIE\&. +.RE +.PP \fB+[no]qr\fR .RS 4 Print [do not print] the query as it is sent\&. By default, the query is not printed\&. diff --git a/bin/dig/dig.docbook b/bin/dig/dig.docbook index 7d2e41c81c0..5f500e449d6 100644 --- a/bin/dig/dig.docbook +++ b/bin/dig/dig.docbook @@ -1,7 +1,7 @@ ]> @@ -8882,7 +8883,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; The timeout value (in units of 100 milliseconds) the server will send in respones containing the EDNS TCP - keepalive option. This informs a client of the + keepalive option. This informs a client of the amount of time it may keep the session open. The default is 300 (30 seconds), the maximum is 1200 (two minutes), and the minimum is 0, which diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index ff5254cb6b0..2dc6c65769c 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -2565,6 +2565,10 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ serial-query-rate number ; ] [ serial-queries number ; ] [ tcp-listen-queue number ; ] + [ tcp-initial-timeout number; ] + [ tcp-idle-timeout number; ] + [ tcp-keepalive-timeout number; ] + [ tcp-advertised-timeout number; ] [ transfer-format ( one-answer | many-answers ) ; ] [ transfer-message-size number ; ] [ transfers-in number ; ] @@ -2647,6 +2651,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ preferred-glue ( A | AAAA | none ); ] [ edns-udp-size number ; ] [ max-udp-size number ; ] + [ response-padding { address_match_list } block-size number ; ] [ max-rsa-exponent-size number ; ] [ root-delegation-only [ exclude { namelist } ] ; ] [ querylog yes_or_no ; ] @@ -4343,6 +4348,45 @@ options { 256 bits for SHA256.

+
response-padding
+
+

+ The EDNS Padding option is intended to improve + confidentiality when DNS queries are sent over an + encrypted channel by reducing the variability in + packet sizes. If a query: +

+
    +
  1. + contains an EDNS Padding option, +
    2. +
  2. + includes a valid server cookie or uses TCP, +
    3. +
  3. + is not signed using TSIG or + SIG(0), and +
    4. +
  4. + is from a client whose address matches the specified ACL, +
    5. +
+

+ then the response is padded with an EDNS Padding option + to a multiple of block-size bytes. + If these conditions are not met, the response is not + padded. +

+

+ If block-size is 0 or the ACL is + none;, then this feature is + disabled and no padding will occur; this is the + default. If block-size is greater + than 512, a warning is logged and the value is truncated + to 512. Block sizes are ordinarily expected to be powers + of two (for instance, 128), but this is not mandatory. +

+
rfc2308-type1

@@ -6341,6 +6385,72 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; length to a system-defined default value.

+
tcp-initial-timeout
+
+

+ The amount of time (in units of 100 milliseconds) the + server waits on a new TCP connection for the first message + from the client. The default is 300 (30 seconds), + the minimum is 25 (2.5 seconds), and the maximum is + 1200 (two minutes). Values above the maximum or below + the minimum will be adjusted with a logged warning. + (Note: This value must be greater than the expected + round trip delay time; otherwise no client will ever + have enough time to submit a message.) + This value can be updated at runtime by using + rndc tcp-timeouts. +

+
+
tcp-idle-timeout
+
+

+ The amount of time (in units of 100 milliseconds) the + server waits on an idle TCP conenction before closing + it when the client is not using the EDNS TCP keepalive + option. The default is 300 (30 seconds), the maximum + is 1200 (two minutes), and the minimum is 1 (one tenth + of a second). Values above the maximum or below the minimum + will be adjusted with a logged warning. + See tcp-keepalive-timeout + for clients using the EDNS TCP keepalive option. + This value can be updated at runtime by using + rndc tcp-timeouts. +

+
+
tcp-keepalive-timeout
+
+

+ The amount of time (in units of 100 milliseconds) the + server waits on an idle TCP conenction before closing + it when the client is using the EDNS TCP keepalive + option. The default is 300 (30 seconds), the maximum + is 1200 (two minutes), and the minimum is 1 (one tenth + of a second). Values above the maximum or below the minimum + will be adjusted with a logged warning. + This value may be greater than + tcp-idle-timeout, because + clients using the EDNS TCP keepalive option are expected + to use TCP connections for more than one message. + This value can be updated at runtime by using + rndc tcp-timeouts. +

+
+
tcp-advertised-timeout
+
+

+ The timeout value (in units of 100 milliseconds) the + server will send in respones containing the EDNS TCP + keepalive option. This informs a client of the + amount of time it may keep the session open. + The default is 300 (30 seconds), the maximum is + 1200 (two minutes), and the minimum is 0, which + signals that the clients must close TCP connections + immediately. Ordinarily this should be set to the + same value as tcp-keepalive-timeout. + This value can be updated at runtime by using + rndc tcp-timeouts. +

+
@@ -8383,7 +8493,9 @@ example.com CNAME rpz-tcp-only. [ edns-udp-size number ; ] [ edns-version number ; ] [ max-udp-size number ; ] + [ padding number ; ] [ tcp-only yes_or_no ; ] + [ tcp-keepalive yes_or_no ; ] [ transfers number ; ] [ transfer-format ( one-answer | many-answers ) ; ] [ keys { key_id } ; ] @@ -8551,6 +8663,19 @@ example.com CNAME rpz-tcp-only. that is blocking large replies from named.

+

+ The padding option adds EDNS Padding + options to outgoing messages, increasing the packet size to + a multiple of the specified block size. Valid block sizes + range from 0 (the default, which disables the use of + EDNS Padding) to 512 bytes. Larger values will be reduced + to 512, with a logged warning. + Note: This option is not currently compatible with no TSIG + or SIG(0), as the EDNS OPT record containing the padding + would have to be added to the packet after it had already + been signed. +

+

The tcp-only option sets the transport protocol to TCP. The default is to use the UDP transport @@ -8558,6 +8683,12 @@ example.com CNAME rpz-tcp-only. is received.

+

+ The tcp-keepalive option adds EDNS + TCP keepalive to messages sent over TCP. Note currently + idle timeouts in responses are ignored. +

+

The server supports two zone transfer methods. The first, one-answer, uses one DNS message per resource record transferred. many-answers packs diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index badd4b333a4..5d999be2d51 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -167,6 +167,21 @@

New Features

    +
  • +

    + Added support for the EDNS TCP Keepalive option (RFC 7828); + this allows negotiation of longer-lived TCP sessions + to reduce the overhead of setting up TCP for individual + queries. [RT #42126] +

    +
    • +
  • +

    + Added support for the EDNS Padding option (RFC 7830), + which obfuscates packet size analysis when DNS queries + are sent over an encrypted channel. [RT #42094] +

    +

  • The print-time option in the diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index 9fa226949f9..9a0181476b6 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -715,6 +715,20 @@ value. The default value is QUERY (0).

    +
    +padding=value
    +
    +

    + Pad the size of the query packet using the EDNS Padding option + to blocks of value bytes. For example, + +padding=32 would cause a 48-byte query to + be padded to 64 bytes. The default block size is 0, which + disables padding. The maximum is 512. Values are + ordinarily expected to be powers of two, such as 128; + however, this is not mandatory. Responses to + padded queries may also be padded, but only if the query + uses TCP or DNS COOKIE. +

    +
    +[no]qr

    @@ -831,13 +845,13 @@ specified IP address or network prefix.

    - dig +subnet=0.0.0.0/0, or simply - dig +subnet=0 for short, sends an EDNS - CLIENT-SUBNET option with an empty address and a source - prefix-length of zero, which signals a resolver that - the client's address information must - not be used when resolving - this query. + dig +subnet=0.0.0.0/0, or simply + dig +subnet=0 for short, sends an EDNS + CLIENT-SUBNET option with an empty address and a source + prefix-length of zero, which signals a resolver that + the client's address information must + not be used when resolving + this query.

    +[no]tcp
    diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index d5c1867243c..2b9279c4d98 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -115,7 +115,9 @@ server edns boolean;
    edns-udp-size integer;
    max-udp-size integer;
    + padding integer;
    tcp-only boolean;
    + tcp-keepalive boolean;
    provide-ixfr boolean;
    request-ixfr boolean;
    keys server_key;
    @@ -416,6 +418,10 @@ options require-server-cookie boolean;
    send-cookie boolean;
    nocookie-udp-size integer;
    +
    + response-padding {
    + address_match_list
    + } block-size integer;

    deny-answer-addresses {
    address_match_list
    diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index 649b4508c86..60fb4eb5b76 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -755,6 +755,21 @@ no zone is specified, then all zones are synced.

    +
    tcp-timeouts [initial idle keepalive advertised]
    +
    +

    + When called without arguments, display the current + values of the tcp-initial-timeout, + tcp-idle-timeout, + tcp-keepalive-timeout and + tcp-advertised-timeout options. + When called with arguments, update these values. This + allows an administrator to make rapid adjustments when + under a denial of service attack. See the descriptions of + these options in the BIND 9 Administrator Reference Manual + for details of their use. +

    +
    thaw [zone [class [view]]]

    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index 6c1c70838d1..a4b46615f7b 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -130,6 +130,21 @@

    New Features

      +
    • +

      + Added support for the EDNS TCP Keepalive option (RFC 7828); + this allows negotiation of longer-lived TCP sessions + to reduce the overhead of setting up TCP for individual + queries. [RT #42126] +

      +
      • +
    • +

      + Added support for the EDNS Padding option (RFC 7830), + which obfuscates packet size analysis when DNS queries + are sent over an encrypted channel. [RT #42094] +

      +

    • The print-time option in the diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 84e056331d9..4b89e7badb4 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -5,7 +5,7 @@ ]>