From: Tinderbox User Date: Fri, 6 May 2016 01:05:45 +0000 (+0000) Subject: regen master X-Git-Tag: v9.11.0a2~37 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=f33abec8a62ab6f2b867d7189dfffa72592c027b;p=thirdparty%2Fbind9.git regen master --- diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 0bac4dc786d..d22ca4d2839 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -2548,6 +2548,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] [ max-policy-ttl number ] [ break-dnssec yes_or_no ] [ min-ns-dots number ] + [ nsip-wait-recurse yes_or_no ] [ qname-wait-recurse yes_or_no ] [ automatic-interface-scan yes_or_no ] ; ] @@ -6986,14 +6987,36 @@ deny-answer-aliases { "example.net"; }; policy records.

RPZ-NSIP
-

- NSIP triggers are encoded like IP triggers except as +

+

+ NSIP triggers match the IP addresses of authoritative + servers. They are enncoded like IP triggers, except as subdomains of rpz-nsip. NSDNAME and NSIP triggers are checked only for names with at least min-ns-dots dots. - The default value of min-ns-dots is 1 to - exclude top level domains. -

+ The default value of min-ns-dots is + 1, to exclude top level domains. +

+

+ If a name server's IP address is not yet known, + named will recursively look up + the IP address before applying an RPZ-NSIP rule. + This can cause a processing delay. To speed up + processing at the cost of precision, the + nsip-wait-recurse option + can be used: when set to no, + RPZ-NSIP rules will only be applied when a name + servers's IP address has already been looked up and + cached. If a server's IP address is not in the + cache, then the RPZ-NSIP rule will be ignored, + but the address will be looked up in the + background, and the rule will be applied + to subsequent queries. The default is + yes, meaning RPZ-NSIP + rules should always be applied even if an + address needs to be looked up first. +

+

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 1b6b95cdc71..99a0c6947aa 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -580,6 +580,18 @@ Retrieving the local port range from net.ipv4.ip_local_port_range on Linux is now supported.

+

  • + A new nsip-wait-recurse directive has been + added to RPZ, specifying whether to look up unknown name server + IP addresses and wait for a response before applying RPZ-NSIP rules. + The default is yes. If set to + no, named will only + apply RPZ-NSIP rules to servers whose addresses are already cached. + The addresses will be looked up in the background so the rule can + be applied on subsequent queries. This improves performance when + the cache is cold, at the cost of temporary imprecision in applying + policy directives. [RT #35009] +

  • Within the response-policy option, it is now possible to configure RPZ rewrite logging on a per-zone basis @@ -598,10 +610,17 @@ Zone transfers now use smaller message sizes to improve message compression. This results in reduced network usage.

    • -

  • +

  • +

    Added support for the AVC resource record type (Application Visibility and Control). -

    • +

    +

    + Changed rndc reconfig behaviour so that newly + added zones are loaded asynchronously and the loading does not + block the server. +

    +
    diff --git a/doc/arm/notes.html b/doc/arm/notes.html index 76e4e5ad66a..c0e803285b6 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -541,6 +541,18 @@ Retrieving the local port range from net.ipv4.ip_local_port_range on Linux is now supported.

    +

  • + A new nsip-wait-recurse directive has been + added to RPZ, specifying whether to look up unknown name server + IP addresses and wait for a response before applying RPZ-NSIP rules. + The default is yes. If set to + no, named will only + apply RPZ-NSIP rules to servers whose addresses are already cached. + The addresses will be looked up in the background so the rule can + be applied on subsequent queries. This improves performance when + the cache is cold, at the cost of temporary imprecision in applying + policy directives. [RT #35009] +

  • Within the response-policy option, it is now possible to configure RPZ rewrite logging on a per-zone basis @@ -559,10 +571,17 @@ Zone transfers now use smaller message sizes to improve message compression. This results in reduced network usage.

    • -

  • +

  • +

    Added support for the AVC resource record type (Application Visibility and Control). -

    • +

    +

    + Changed rndc reconfig behaviour so that newly + added zones are loaded asynchronously and the loading does not + block the server. +

    +
    diff --git a/doc/misc/options b/doc/misc/options index 8be73a42b0b..f6aa2254407 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -156,15 +156,15 @@ options { fetches-per-server [ ( drop | fail ) ]; fetches-per-zone [ ( drop | fail ) ]; files ( unlimited | default | ); - filter-aaaa { ; ... }; - filter-aaaa-on-v4 ( break-dnssec | ); - filter-aaaa-on-v6 ( break-dnssec | ); + filter-aaaa { ; ... }; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured + filter-aaaa-on-v6 ( break-dnssec | ); // not configured flush-zones-on-shutdown ; forward ( first | only ); forwarders [ port ] [ dscp ] { ( | ) [ port ] [ dscp ]; ... }; - geoip-directory ( | none ); - geoip-use-ecs ; + geoip-directory ( | none ); // not configured + geoip-use-ecs ( | none ); // not configured has-old-clients ; // obsolete heartbeat-interval ; host-statistics ; // not implemented @@ -452,9 +452,9 @@ view [ ] { fetch-quota-params ; fetches-per-server [ ( drop | fail ) ]; fetches-per-zone [ ( drop | fail ) ]; - filter-aaaa { ; ... }; - filter-aaaa-on-v4 ( break-dnssec | ); - filter-aaaa-on-v6 ( break-dnssec | ); + filter-aaaa { ; ... }; // not configured + filter-aaaa-on-v4 ( break-dnssec | ); // not configured + filter-aaaa-on-v6 ( break-dnssec | ); // not configured forward ( first | only ); forwarders [ port ] [ dscp ] { ( | ) [ port ] [ dscp ]; ... };