diff options
| author | des <des@FreeBSD.org> | 2004-09-24 19:48:50 +0000 |
|---|---|---|
| committer | des <des@FreeBSD.org> | 2004-09-24 19:48:50 +0000 |
| commit | bd20f820eed84d93e9324f7de3865ce58a0c7731 (patch) | |
| tree | bb3edb8dcc07615d426eb359f46c1741e4c22575 /contrib/bind/doc | |
| parent | 3fe60073ff63db1d6dc640928a53105d35a80da4 (diff) | |
| download | FreeBSD-src-bd20f820eed84d93e9324f7de3865ce58a0c7731.zip FreeBSD-src-bd20f820eed84d93e9324f7de3865ce58a0c7731.tar.gz | |
Retire the BIND 8 sources.
Diffstat (limited to 'contrib/bind/doc')
47 files changed, 0 insertions, 15708 deletions
diff --git a/contrib/bind/doc/html/acl.html b/contrib/bind/doc/html/acl.html deleted file mode 100644 index 57cf869..0000000 --- a/contrib/bind/doc/html/acl.html +++ /dev/null @@ -1,63 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND acl Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>acl</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -acl <VAR>name</VAR> { - <VAR><A HREF="address_list.html">address_match_list</A></VAR> -}; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The <CODE>acl</CODE> statement creates a named address match list. -It gets its name from a primary use of address match lists: Access -Control Lists (ACLs).</P> - -<P>Note that an address match list's name must be defined with -<CODE>acl</CODE> before it can be used elsewhere; no forward -references are allowed.</P> - -The following ACLs are built-in: - -<DL> -<DT><CODE>any</CODE> -<DD> -Allows all hosts. - -<DT><CODE>none</CODE> -<DD> -Denies all hosts. - -<DT><CODE>localhost</CODE> -<DD> -Allows the IP addresses of all interfaces on the system. - -<DT><CODE>localnets</CODE> -<DD> -Allows any host on a network for which the system has an interface. -</DL> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: acl.html,v 1.5 1999/09/15 20:28:00 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/address_list.html b/contrib/bind/doc/html/address_list.html deleted file mode 100644 index c2b2fe7..0000000 --- a/contrib/bind/doc/html/address_list.html +++ /dev/null @@ -1,100 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Address Match Lists</TITLE> -</HEAD> -<BODY> - -<H2>BIND Configuration File Guide--Address Match Lists</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -<VAR>address_match_list</VAR> = <VAR>address_match_element</VAR> [ <VAR>address_match_element</VAR> ... ] - -<VAR>address_match_element</VAR> = [ "!" ] ( <VAR><A HREF="docdef.html">ip_address</A></VAR> / <VAR><A HREF="docdef.html">ip_prefix</A></VAR> / <VAR><A HREF="acl.html">acl_name</A></VAR> / <VAR><A HREF="docdef.html">"key" key_id</A></VAR> / { <VAR>address_match_list</VAR> } ) ; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>Address match lists are primarily used to determine access control for -various server operations. They are also used to define priorities -for querying other nameservers and to set the addresses on which -<CODE>named</CODE> will listen for queries. -The elements which constitute an address match list can be any -of the following:</P> - -<UL> -<LI>an IP address (in dotted-decimal notation),</LI> - -<LI>an IP prefix (in the '/'-notation),</LI> - -<LI>a key ID, as defined by the -<A HREF="key.html"><CODE>key</CODE></A> statement, or - -<LI>the name of an address match list previously defined with -the <A HREF="acl.html"><CODE>acl</CODE></A> statment, or</LI> - -<LI>another <VAR>address_match_list</VAR></LI> -</UL> - -<P>Elements can be negated with a leading exclamation mark ("!"), and -the match list names "any", "none", "localhost" and "localnets" are -predefined. More information on those names can be found in the -description of the <A HREF="acl.html"><CODE>acl</CODE></A> statement. - -<P>The addition of the <CODE>key</CODE> -clause made the name of this syntactic element something of a -misnomer, since security keys can be used to validate access without -regard to a host or network address. Nonetheless, the term "address -match list" is still used throughout the documentation.</P> - -<P>When a given IP address or prefix is compared to an address match -list, the list is traversed in order until an element matches. The -interpretation of a match depends on whether the list is being used -for access control, defining <CODE>listen-on</CODE> ports, or as a -topology, and whether the element was negated.</P> - -<P>When used as an access control list, a non-negated match allows -access and a negated match denies access. If there is no match, -access is denied. The clauses <CODE>allow-query</CODE>, -<CODE>allow-transfer</CODE>, <CODE>allow-update</CODE> and -<CODE>blackhole</CODE> all use address match lists like this. -Similarly, the <CODE>listen-on</CODE> -option will cause the server to not accept queries on any of the -machine's addresses which do not match the list. - -<P>When used with the <CODE>topology</CODE> clause, a non-negated -match returns a distance based on its position on the list (the closer -the match is to the start of the list, the shorter the distance is -between it and the server). A negated match will be assigned the -maximum distance from the server. If there is no match, the address -will get a distance which is further than any non-negated list -element, and closer than any negated element.</P> - -<P>Because of the first-match aspect of the algorithm, an element that -defines a subset of another element in the list should come before the -broader element, regardless of whether either is negated. For -example, in <CODE>1.2.3/24; ! 1.2.3.13;</CODE> the 1.2.3.13 -element is completely useless, because the algorithm will match -any lookup for 1.2.3.13 to the 1.2.3/24 element. Using -<CODE>! 1.2.3.13; 1.2.3/24</CODE> fixes that problem by -having 1.2.3.13 blocked by the negation but all other 1.2.3.* hosts -fall through. - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: address_list.html,v 1.9 1999/12/03 02:20:42 gson Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/comments.html b/contrib/bind/doc/html/comments.html deleted file mode 100644 index a064c1c..0000000 --- a/contrib/bind/doc/html/comments.html +++ /dev/null @@ -1,84 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Comment Syntax</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--Comment Syntax</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -/* This is a BIND comment as in C */ - -// This is a BIND comment as in C++ - -# This is a BIND comment as in common Unix shells and perl -</PRE> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>Comments may appear anywhere that whitespace may appear in a BIND -configuration file.</P> - -<P>C-style comments start with the two characters <CODE>/*</CODE> -(slash, star) and end with <CODE>*/</CODE> (star, slash). Because -they are completely delimited with these characters, they can be used -to comment only a portion of a line or to span multiple lines.</P> - -<P>C-style comments cannot be nested. For example, the following is -not valid because the entire comment ends with the first -<CODE>*/</CODE>: - -<PRE> -/* This is the start of a comment. - This is still part of the comment. -/* This is an incorrect attempt at nesting a comment. */ - This is no longer in any comment. */ -</PRE> - - -<P>C++-style comments start with the two characters <CODE>//</CODE> -(slash, slash) and continue to the end of the physical line. They -cannot be continued across multiple physical lines; to have one -logical comment span multiple lines, each line must use the -<CODE>//</CODE> pair. For example: - -<PRE> -// This is the start of a comment. The next line -// is a new comment, even though it is logically -// part of the previous comment. -</PRE> - -<P>Shell-style (or perl-style, if you prefer) comments start with the -character <CODE>#</CODE> (hash or pound or number or octothorpe or -whatever) and continue to the end of the physical line, like C++ -comments.</P> For example: - -<PRE> -# This is the start of a comment. The next line -# is a new comment, even though it is logically -# part of the previous comment. -</PRE> - -<P><STRONG>WARNING:</STRONG> you cannot use the <CODE>;</CODE> -(semicolon) character to start a comment such as you would in a zone -file. The semicolon indicates the end of a configuration statement, -so whatever follows it will be interpreted as the start of the next -statement.</P> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: comments.html,v 1.5 1999/09/15 20:28:00 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/config.html b/contrib/bind/doc/html/config.html deleted file mode 100644 index b139ef2..0000000 --- a/contrib/bind/doc/html/config.html +++ /dev/null @@ -1,97 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Configuration File Guide</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide</H2> - -<HR> - -<H3>Overview</H3> - -<P>BIND 8 is much more configurable than previous releases of BIND. -There are entirely new areas of configuration, such as access control lists -and categorized logging. Many options that previously applied to all zones -can now be used selectively. These features, plus a consideration of future -configuration needs led to the creation of a new configuration file format. - -<H3>The Configuration File</H3> - -<H4><A HREF="example.html">Example Configuration</A></H4> - -<H4>Statements</H4> - -<P>A BIND 8 configuration consists of statements and comments. -Statements end with a semicolon. Many statements contain a block of -substatements, which are also terminated with a semicolon.</P> - -<P>The following statements are supported: -<DL> -<DT><CODE><A HREF="acl.html">acl</A></CODE> -<DD> -defines a named IP address matching list, for access control and other uses - -<DT><CODE><A HREF="include.html">include</A></CODE> -<DD> -includes a file - -<DT><CODE><A HREF="key.html">key</A></CODE> -<DD> -specifies key information for use in authentication and authorization - -<DT><CODE><A HREF="logging.html">logging</A></CODE> -<DD> -specifies what the server logs, and where the log messages are sent - -<DT><CODE><A HREF="options.html">options</A></CODE> -<DD> -controls global server configuration options and sets defaults for other -statements - -<DT><CODE><A HREF="controls.html">controls</A></CODE> -<DD> -declares control channels to be used by the <VAR>ndc</VAR> utility - -<DT><CODE><A HREF="server.html">server</A></CODE> -<DD> -sets certain configuration options on a per-server basis - -<DT><CODE><A HREF="trusted-keys.html">trusted-keys</A></CODE> -<DD> -defines DNSSEC keys that are preconfigured into the server and implicitly -trusted - -<DT><CODE><A HREF="zone.html">zone</A></CODE> -<DD> -defines a zone -</DL> - -<P>The <CODE>logging</CODE> and <CODE>options</CODE> statements may only -occur once per configuration. - -<H4>Comments</H4> - -The BIND 8 <A HREF="comments.html">comment syntax</A> allows for -comments to appear anywhere that whitespace may appear in a BIND -configuration file. To appeal to programmers of all kinds, they can -be written in C, C++, or shell/perl constructs. - -<H3>Converting from BIND 4.9.x</H3> - -<p>BIND 4.9.x configuration files can be converted to the new format by -using <code>src/bin/named/named-bootconf</code>, a shell script that is part of -the BIND 8.2.x source kits. - -<HR> - -<CENTER><P>[ <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: config.html,v 1.11 2000/11/28 20:03:48 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/controls.html b/contrib/bind/doc/html/controls.html deleted file mode 100644 index 0789901..0000000 --- a/contrib/bind/doc/html/controls.html +++ /dev/null @@ -1,75 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND controls Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>controls</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -controls { - [ inet <VAR><A HREF="docdef.html">ip_addr</A></VAR> - port <VAR><A HREF="docdef.html">ip_port</A></VAR> - allow { <VAR><A HREF="address_list.html">address_match_list</A></VAR>; }; ] - [ unix <VAR><A HREF="docdef.html">path_name</A></VAR> - perm <VAR><A HREF="docdef.html">number</A></VAR> - owner <VAR><A HREF="docdef.html">number</A></VAR> - group <VAR><A HREF="docdef.html">number</A></VAR>; ] -}; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The <CODE>controls</CODE> statement declares control channels -to be used by system -administrators to affect the operation of the local name server. These -control channels are used by the <CODE>ndc</CODE> utility to send commands -to and retrieve non-DNS results from a name server.</P> - -<P>A <CODE>unix</CODE> control channel is a FIFO in the file system, -and access to it is -controlled by normal file system permissions. -It is created by <CODE>named</CODE> with the specified file mode bits (see -the <CODE>chmod</CODE>(1) manual page), user and group owner. -Note that, unlike <CODE>chmod</CODE>, the mode bits specified for -<CODE>perm</CODE> will normally have a leading 0 so the number -is interpreted as octal. Also note that the user and group -ownership specified as <CODE>owner</CODE> and <CODE>group</CODE> -must be given as numbers, not names. -It is recommended that the -permissions be restricted to administrative personnel only, or else any -user on the system might be able to manage the local name server.</P> - -<P>On Solaris and SunOS machines the permissions and ownerships are applied -to the containing directory. -This is done because these operating systems -do not honour the permission on the UNIX domain socket. - -<P>An <CODE>inet</CODE> control channel is a TCP/IP socket accessible -to the Internet, created at the specified <VAR>ip_port</VAR> on the -specified <VAR>ip_addr</VAR>. -Modern <VAR>telnet</VAR> clients are capable of speaking directly to these -sockets, and the control protocol is ARPAnet-style text. It is recommended -that 127.0.0.1 be the only <VAR>ip_addr</VAR> used, and this only if you -trust all non-privileged users on the local host to manage your name -server.</P> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: controls.html,v 1.5 2001/02/01 04:27:11 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/docdef.html b/contrib/bind/doc/html/docdef.html deleted file mode 100644 index 077f969..0000000 --- a/contrib/bind/doc/html/docdef.html +++ /dev/null @@ -1,118 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Documentation Definitions</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--Documentation Definitions</H2> - -<HR> - -<H3>Syntactic Miscellany</H3> - -<P>Described below are elements used throughout the BIND configuration -file documentation. Elements which are only associated with one -statement are described only in the section describing that statement. - -<DL> -<DT><VAR>acl_name</VAR> -<DD> -The name of an <A HREF="address_list.html">address match list</A>, -as defined by the <A HREF="acl.html">acl</A> statement. - -<DT><VAR>address_match_list</VAR> -<DD> -A list of one or more <VAR>ip_address</VAR>, <VAR>ip_prefix</VAR> -<VAR>key_id</VAR> or <VAR>acl_name</VAR> elements, as described in the -<A HREF="address_list.html">Address Match Lists</A> section. - -<DT><VAR>dotted-decimal</VAR> -<DD> -One or more integers valued 0 through 255 separated only by dots -("."), such as <CODE>123</CODE> or <CODE>45.67</CODE> or -<CODE>89.123.45.67</CODE>. - -<DT><VAR>domain_name</VAR> -<DD> -A quoted string which will be used as a DNS name, for example -<CODE>"my.test.domain"</CODE>. - -<DT><VAR>path_name</VAR> -<DD> -A quoted string which will be used as a pathname, such as -<CODE>"zones/master/my.test.domain"</CODE>. - -<DT><VAR>ip_addr</VAR> -<DD> -An IP address with exactly four elements in -<VAR>dotted-decimal</VAR> notation. - -<DT><VAR>ip_port</VAR> -<DD> -An IP port <VAR>number</VAR>. <VAR>number</VAR> is limited to 0 -through 65535, with values below 1024 typically restricted to -root-owned processes. In some cases an asterisk (``*'') character -can be used as a placeholder to select a random high-numbered port. - -<DT><VAR>ip_prefix</VAR> -<DD> -An IP network specified in <VAR>dotted-decimal</VAR> form, followed by "/" -and then the number of bits in the netmask. E.g. <CODE>127/8</CODE> is -the network <CODE>127.0.0.0</CODE> with netmask <CODE>255.0.0.0</CODE>. -<CODE>1.2.3.0/24</CODE> is network <CODE>1.2.3.0</CODE> with netmask -<CODE>255.255.255.0</CODE>. - -<DT><VAR>key_id</VAR> -<DD> -A string representing the name of a shared key, to be used for transaction -security. - -<DT><VAR>number</VAR> -<DD> -A non-negative integer with an entire range limited by the range of a -C language signed integer (2,147,483,647 on a machine with 32 bit -integers). Its acceptable value might further be limited by the -context in which it is used. - -<DT><VAR>size_spec</VAR> -<DD> -A <VAR>number</VAR>, the word <CODE>unlimited</CODE>, or the word -<CODE>default</CODE>. - -<P>The maximum value of <VAR>size_spec</VAR> is that of unsigned long -integers on the machine. <CODE>unlimited</CODE> requests unlimited use, or -the maximum available amount. <CODE>default</CODE> uses the limit that -was in force when the server was started.</P> - -<P>A <VAR>number</VAR> can optionally be followed by a scaling factor: -<CODE>K</CODE> or <CODE>k</CODE> for kilobytes, <CODE>M</CODE> or -<CODE>m</CODE> for megabytes, and <CODE>G</CODE> or <CODE>g</CODE> for -gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 -respectively. - -<P>Integer storage overflow is currently silently ignored during -conversion of scaled values, resulting in values less than intended, -possibly even negative. Using <CODE>unlimited</CODE> is the best way -to safely set a really large number.</P> - -<DT><VAR>yes_or_no</VAR> -<DD> -Either <CODE>yes</CODE> or <CODE>no</CODE>. The words -<CODE>true</CODE> and <CODE>false</CODE> are also accepted, as are the -numbers <CODE>1</CODE> and <CODE>0</CODE>. - -</DL> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: docdef.html,v 1.9 2002/04/02 00:57:47 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/example.html b/contrib/bind/doc/html/example.html deleted file mode 100644 index a147828..0000000 --- a/contrib/bind/doc/html/example.html +++ /dev/null @@ -1,65 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Configuration File Guide -- Example Config File</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide -- Example Config File</H2> - -<HR> - -<PRE> - -/* - * A simple BIND 8 configuration - */ - -logging { - category lame-servers { null; }; - category cname { null; }; -}; - -options { - directory "/var/named"; -}; - -controls { - inet * port 52 allow { localnets; }; // a BAD idea - unix "/var/run/ndc" perm 0600 owner 0 group 0; // the default -}; - -zone "isc.org" in { - type master; - file "master/isc.org"; -}; - -zone "vix.com" in { - type slave; - file "slave/vix.com"; - masters { 10.0.0.53; }; -}; - -zone "." in { - type hint; - file "named.cache"; -}; - -zone "0.0.127.in-addr.arpa" in { - type master; - notify no; - file "master/127.0.0"; -}; -</PRE> - -<HR> - -<CENTER><P>[ <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: example.html,v 1.5 1999/09/15 20:28:01 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/include.html b/contrib/bind/doc/html/include.html deleted file mode 100644 index 421d97b..0000000 --- a/contrib/bind/doc/html/include.html +++ /dev/null @@ -1,57 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND include Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>include</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -include <VAR><A HREF="docdef.html">path_name</A></VAR>; -</PRE> - -<HR> - -<A Name="#Usage"><H3>Definition and Usage</H3></A> - -<P>The <CODE>include</CODE> statement inserts the specified file at -the point that the <CODE>include</CODE> statement is encountered. It -cannot be used within another statement, though, so a line such as -<PRE> -acl internal_hosts { include "internal_hosts.acl"; }; -</PRE> -is not allowed.</P> - -<P>Use <CODE>include</CODE> to break the configuration up into -easily-managed chunks. For example: - -<PRE> -include "/etc/security/keys.bind"; -include "/etc/acls.bind"; -</PRE> - -<P>could be used at the top of a BIND configuration file in order to -include any ACL or key information.</P> - -<P>Be careful not to type -"<CODE>#include</CODE>", like you would in a C -program, because "<CODE>#</CODE>" is used to start a -comment.</P> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: include.html,v 1.7 1999/09/15 20:28:01 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/index.html b/contrib/bind/doc/html/index.html deleted file mode 100644 index d78a8aa..0000000 --- a/contrib/bind/doc/html/index.html +++ /dev/null @@ -1,65 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND Version 8 Online Documentation</TITLE> -</HEAD> - -<BODY> -<H2>BIND Version 8 Online Documentation</H2> - -<H3>BIND 8 Highlights</H3> - -<UL> -<LI>DNS Dynamic Updates -(<A HREF=http://www.ietf.org/rfc/rfc2136.txt>RFC 2136</A>)</LI> -<LI>DNS Change Notification -(<A HREF=http://www.ietf.org/rfc/rfc1996.txt>RFC 1996</A>)</LI> -<LI>Completely new configuration syntax</LI> -<LI>Flexible, categorized logging system</LI> -<LI>IP-address-based access control for queries, zone transfers, and -updates that may be specified on a zone-by-zone basis</LI> -<LI>More efficient zone transfers</LI> -<LI>Improved performance for servers with thousands of zones</LI> -<LI>The server no longer forks for outbound zone transfers</LI> -<LI>Many bug fixes</LI> -</UL> - -<H3><A HREF="config.html">Configuration File Guide</A></H3> - -<H3><A HREF="master.html">Master File Format</A></H3> - -<H3>Kits</H3> -<UL> -<LI><A HREF="ftp://ftp.isc.org/isc/bind/src/cur"> -The latest production release</A></LI> -<LI><A HREF="ftp://ftp.isc.org/isc/bind/src/testing"> -The latest public test release</A></LI> -</UL> - -<H3>Bug Reports and Comments</H3> -<P>Send bug reports to -<A HREF="mailto:bind-bugs@isc.org">bind-bugs@isc.org</A>. - -<H3>DNS Related Newsgroups</H3> -<UL> -<LI><A HREF="news:comp.protocols.dns.bind">Using BIND</A></LI> -<LI><A HREF="news:comp.protocols.dns.ops">DNS Operations</A></LI> -<LI><A HREF="news:comp.protocols.dns.std">DNS Standards</A></LI> -</UL> - -<H3><A HREF="http://www.isc.org/">The Internet Software Consortium</A></H3> - -BIND is supported by the Internet Software Consortium, and -although it is free for use and redistribution and incorporation into -vendor products and export and anything else you can think of, it -costs money to produce. That money comes from ISPs, hardware and -software vendors, companies who make extensive use of the software, -and generally kind hearted folk such as yourself. - -<HR> -<ADDRESS> -Last Updated: $Id: index.html,v 1.6 1999/12/28 10:03:40 cyarnell Exp $ -</ADDRESS> - -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/key.html b/contrib/bind/doc/html/key.html deleted file mode 100644 index bf2e3d1..0000000 --- a/contrib/bind/doc/html/key.html +++ /dev/null @@ -1,57 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND key Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>key</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -key <VAR>key_id</VAR> { - algorithm <VAR>algorithm_id</VAR>; - secret <VAR>secret_string</VAR>; -}; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The <CODE>key</CODE> statement defines a key ID which can be used -in a <A HREF="server.html"><CODE>server</CODE></A> statement to -associate an authentication method with a particular name server. - -<P>A key ID must be created with the <CODE>key</CODE> -statement before it can be used in a <CODE>server</CODE> -definition or an address match list.</P> - -<P>The <VAR>algorithm_id</VAR> is a string that specifies a -security/authentication algorithm. The only supported -algorithm is "hmac-md5". - -<P><VAR>secret_string</VAR> is the secret to be used by the algorithm, -and is treated as a base-64 encoded string. This may be generated -using dnskeygen or another utility or created manually. - -<P>The <CODE>key</CODE> statement is intended for use in transaction -security. Unless included in a <A HREF="server.html"><CODE>server</CODE></A> -statement, it is not used to sign any requests. It is used to verify -requests matching the <VAR>key_id</VAR> and <VAR>algorithm_id</VAR>, -and sign replies to those requests. -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: key.html,v 1.10 1999/09/15 20:28:02 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/logging.html b/contrib/bind/doc/html/logging.html deleted file mode 100644 index 73b4016..0000000 --- a/contrib/bind/doc/html/logging.html +++ /dev/null @@ -1,373 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND logging Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide -- <CODE>logging</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -logging { - [ channel <VAR>channel_name</VAR> { - ( file <VAR><A HREF="docdef.html">path_name</A></VAR> - [ versions ( <VAR>number</VAR> | unlimited ) ] - [ size <VAR><A HREF="docdef.html">size_spec</A></VAR> ] - | syslog ( kern | user | mail | daemon | auth | syslog | lpr | - news | uucp | cron | authpriv | ftp | - local0 | local1 | local2 | local3 | - local4 | local5 | local6 | local7 ) - | null ); - - [ severity ( critical | error | warning | notice | - info | debug [ <VAR>level</VAR> ] | dynamic ); ] - [ print-category <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ print-severity <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ print-time <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - }; ] - - [ category <VAR>category_name</VAR> { - <VAR>channel_name</VAR>; [ <VAR>channel_name</VAR>; ... ] - }; ] - ... -}; -</PRE> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The <CODE>logging</CODE> statement configures a wide variety of -logging options for the nameserver. Its <CODE>channel</CODE> phrase -associates output methods, format options and severity levels with -a name that can then be used with the <CODE>category</CODE> phrase to -select how various classes of messages are logged.</P> - -<P>Only one <CODE>logging</CODE> statement is used to define as many -channels and categories as are wanted. If there are multiple logging -statements in a configuration, the first defined determines the logging, -and warnings are issued for the others. If there is no logging statement, -the logging configuration will be:</P> - -<PRE> - logging { - category default { default_syslog; default_debug; }; - category panic { default_syslog; default_stderr; }; - category packet { default_debug; }; - category eventlib { default_debug; }; - }; -</PRE> - -The logging configuration is established as soon as the -<CODE>logging</CODE> statement is parsed. If you want to redirect -messages about processing of the entire configuration file, the -<CODE>logging</CODE>statement must appear first. Even if you do not -redirect configuration file parsing messages, we recommend -always putting the <CODE>logging</CODE> statement first so that this -rule need not be consciously recalled if you ever do want the -parser's messages relocated. - -<H4>The <CODE>channel</CODE> phrase</H4> - -<P>All log output goes to one or more "channels"; you can make as many -of them as you want.</P> - -<P>Every channel definition must include a clause that says whether -messages selected for the channel go to a file, to a particular syslog -facility, or are discarded. It can optionally also limit the message -severity level that will be accepted by the channel (default is -"info"), and whether to include a <CODE>named</CODE>-generated time -stamp, the category name and/or severity level (default is not to -include any).</P> - -<P>The word <CODE>null</CODE> as the destination option for the -channel will cause all messages sent to it to be discarded; other -options for the channel are meaningless.</P> - -<P>The <CODE>file</CODE> clause can include limitations both on how -large the file is allowed to become, and how many versions of the file -will be saved each time the file is opened. - -<P>The <CODE>size</CODE> option for files is simply a hard ceiling on -log growth. If the file ever exceeds the size, -<CODE>named</CODE> will just not write anything more to it until the -file is reopened; exceeding the size does not automatically trigger a -reopen. The default behavior is to not limit the size of the file.</P> - -<P>If you use the <CODE>version</CODE> logfile option, -<CODE>named</CODE> will retain that many backup versions of the file -by renaming them when opening. For example, if you choose to keep 3 -old versions of the file "lamers.log" then just before it is opened -lamers.log.1 is renamed to lames.log.2, lamers.log.0 is renamed to -lamers.log.1, and lamers.log is renamed to lamers.log.0. No rolled -versions are kept by default; any existing log file is simply -appended. The <CODE>unlimited</CODE> keyword is synonymous with -<CODE>99</CODE> in current BIND releases.</P> - -<P>Example usage of the size and versions options: - -<PRE> - channel an_example_level { - file "lamers.log" versions 3 size 20m; - print-time yes; - print-category yes; - }; -</PRE> - -<P>The argument for the <CODE>syslog</CODE> clause is a syslog -facility as described in the <CODE>syslog</CODE> manual page. How -<CODE>syslogd</CODE> will handle messages sent to this facility is -described in the <CODE>syslog.conf</CODE> manual page. If you have a -system which uses a very old version of <CODE>syslog</CODE> that only -uses two arguments to the <CODE>openlog()</CODE> function, this -clause is silently ignored.</P> - -<P>The <CODE>severity</CODE> clause works like <CODE>syslog</CODE>'s -"priorities", except that they can also be used if you are writing -straight to a file rather than using <CODE>syslog</CODE>. Messages -which are not at least of the severity level given will not be -selected for the channel; messages of higher severity levels will be -accepted.</P> - -<P>If you are using <CODE>syslog</CODE>, the -<CODE>syslog.conf</CODE> priorities will also determine what -eventually passes through. For example, defining a channel facility -and severity as <CODE>daemon</CODE> and <CODE>debug</CODE> but only -logging <CODE>daemon.warning</CODE> via <CODE>syslog.conf</CODE> will -cause messages of severity <CODE>info</CODE> and <CODE>notice</CODE> -to be dropped. If the situation were reversed, with -<CODE>named</CODE> writing messages of only <CODE>warning</CODE> or -higher, <CODE>syslogd</CODE> would print all messages it received -from the channel.</P> - -<P>The server can supply extensive debugging information when it is in -debugging mode. If the server's global debug level is greater than -zero, debugging mode will be active. The global debug level is -set either by starting the <CODE>named</CODE> server with the "-d" -flag followed by a positive integer, or by sending the running server the -SIGUSR1 signal (for example, by using "ndc trace"). The global debug -level can be set to zero, and debugging mode turned off, by sending -the server the SIGUSR2 signal ("ndc notrace"). All debugging messages -in the server have a debug level, and higher debug levels give more -more detailed output. -Channels that specify a specific debug severity, e.g. - -<PRE> - channel specific_debug_level { - file "foo"; - severity debug 3; - }; -</PRE> - -<P>will get debugging output of level 3 or less any time the -server is in debugging mode, regardless of the global debugging level. -Channels with <code>dynamic</code> severity use the server's global -level to determine what messages to print. - -<P>If <CODE>print-time</CODE> has been turned on, the date and -time will be logged. <CODE>print-time</CODE> may be specified for a -syslog channel, but is usually pointless since syslog also prints the -date and time. If <CODE>print-category</CODE> is requested, -then the category of the message will be logged as well. Finally, if -<CODE>print-severity</CODE> is on, the severity level of the -message will be logged. The <CODE>print-</CODE> options may be used -in any combination, and will always be printed in the following order: -time, category, severity. Here is an example where all three -<CODE>print-</CODE> options are on: - -<PRE> - 28-Apr-1997 15:05:32.863 default: notice: Ready to answer queries. -</PRE> - -<P>There are four predefined channels that are used for -default logging as follows. How they are used -used is described in the next section, The <CODE>category</CODE> phrase. - -<PRE> - channel default_syslog { - syslog daemon; # send to syslog's daemon facility - severity info; # only send priority info and higher - }; - - channel default_debug { - file "named.run"; # write to named.run in the working directory - # Note: stderr is used instead of "named.run" - # if the server is started with the "-f" option. - severity dynamic; # log at the server's current debug level - }; - - channel default_stderr { # writes to stderr - file "<stderr>"; # this is illustrative only; there's currently - # no way of specifying an internal file - # descriptor in the configuration language. - severity info; # only send priority info and higher - }; - - channel null { - null; # toss anything sent to this channel - }; -</PRE> - -<P>Once a channel is defined, it cannot be redefined. Thus you cannot -alter the built-in channels directly, but you can modify the default -logging by pointing categories at channels you have defined.</P> - -<H4>The <CODE>category</CODE> phrase</H4> - -<P>There are many categories, so you can send the logs you want to see -wherever you want, without seeing logs you don't want. If you don't specify -a list of channels for a category, log messages in that category will -be sent to the <CODE>default</CODE> category instead. If you don't specify -a default category, the following "default default" is used: - -<PRE> - category default { default_syslog; default_debug; }; -</PRE> - -<P>As an example, let's say you want to log security events to a file, -but you also want keep the default logging behavior. You'd specify the -following: - -<PRE> - channel my_security_channel { - file "my_security_file"; - severity info; - }; - category security { my_security_channel; default_syslog; default_debug; }; -</PRE> - -<P>To discard all messages in a category, specify the -<CODE>null</CODE> channel: - -<PRE> - category lame-servers { null; }; - category cname { null; }; -</PRE> - -<P>The following -categories are available:</P> - -<DL> -<DT><CODE>default</CODE> -<DD> -The catch-all. Many things still aren't classified into categories, -and they all end up here. Also, if you don't specify any channels for -a category, the default category is used instead. If you do not -define the default category, the following definition is used: -<CODE>category default { default_syslog; default_debug; };</CODE> - -<DT><CODE>config</CODE> -<DD> -High-level configuration file processing. - -<DT><CODE>parser</CODE> -<DD> -Low-level configuration file processing. - -<DT><CODE>queries</CODE> -<DD> -A short log message is generated for every query the server receives. - -<DT><CODE>lame-servers</CODE> -<DD> -Messages like "Lame server on ..." - -<DT><CODE>statistics</CODE> -<DD> -Statistics. - -<DT><CODE>panic</CODE> -<DD> -If the server has to shut itself down due to an internal problem, it -will log the problem in this category as well as in the problem's native -category. If you do not define the panic category, the following definition -is used: <CODE>category panic { default_syslog; default_stderr; };</CODE> - -<DT><CODE>update</CODE> -<DD> -Dynamic updates. - -<DT><CODE>update-security</CODE> -<DD> -Denied dynamic updates due to access controls. - -<DT><CODE>ncache</CODE> -<DD> -Negative caching. - -<DT><CODE>xfer-in</CODE> -<DD> -Zone transfers the server is receiving. - -<DT><CODE>xfer-out</CODE> -<DD> -Zone transfers the server is sending. - -<DT><CODE>db</CODE> -<DD> -All database operations. - -<DT><CODE>eventlib</CODE> -<DD> -Debugging info from the event system. Only one channel may be specified for -this category, and it must be a file channel. If you do not define the -eventlib category, the following definition is used: <CODE>category eventlib -{ default_debug; };</CODE> - -<DT><CODE>packet</CODE> -<DD> -Dumps of packets received and sent. Only one channel may be specified for -this category, and it must be a file channel. If you do not define the -packet category, the following definition is used: <CODE>category packet -{ default_debug; };</CODE> - -<DT><CODE>notify</CODE> -<DD> -The NOTIFY protocol. - -<DT><CODE>cname</CODE> -<DD> -Messages like "... points to a CNAME". - -<DT><CODE>security</CODE> -<DD> -Approved/unapproved requests. - -<DT><CODE>os</CODE> -<DD> -Operating system problems. - -<DT><CODE>insist</CODE> -<DD> -Internal consistency check failures. - -<DT><CODE>maintenance</CODE> -<DD> -Periodic maintenance events. - -<DT><CODE>load</CODE> -<DD> -Zone loading messages. - -<DT><CODE>response-checks</CODE> -<DD> -Messages arising from response checking, such as -"Malformed response ...", "wrong ans. name ...", -"unrelated additional info ...", "invalid RR type ...", and "bad referral ...". - -</DL> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: logging.html,v 1.14 2002/07/19 22:44:05 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/master.html b/contrib/bind/doc/html/master.html deleted file mode 100644 index 33487de..0000000 --- a/contrib/bind/doc/html/master.html +++ /dev/null @@ -1,166 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>Master File Format</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration Guide -- Master File Format</H2> - -<HR> - -<P> -The Master File Format was initially defined in -<A HREF=http://www.ietf.org/rfc/rfc1035.txt>RFC 1035</A> -and has subsequently been extended. -<P> -While the Master File Format is class independent all records in a -Master File must be of the same class. - -<H3>Master File Directives</H3> -<H4>$ORIGIN</H4> -Syntax: <CODE>$ORIGIN <domain-name> [<comment>]</CODE> -<P> -<CODE>$ORIGIN</CODE> set the domain name that will be appended to any -unqualified records. -When a zone is first read in there is an implict <CODE>$ORIGIN</CODE> -<zone-name>. -The current <CODE>$ORIGIN</CODE> is appended to the domain specified in the -<CODE>$ORIGIN</CODE> argument if it is not absolute. - -<PRE> -$ORIGIN EXAMPLE. -$ORIGIN MYZONE -WWW CNAME MAIN-SERVER -</PRE> -is equivlent to -<PRE> -WWW.MYZONE.EXAMPLE. CNAME MAIN-SERVER.MYZONE.EXAMPLE. -</PRE> - -<H4>$INCLUDE</H4> -Syntax: <CODE>$INCLUDE <filename> [<origin>] [<comment>]</CODE> -<P> -Read and process the file filename as if it was included into the file at this -point. If origin is specified the file is processed with <CODE>$ORIGIN</CODE> -set to that value otherwise the current <CODE>$ORIGIN</CODE> is used. -<I>NOTE: The behaviour when <origin> is specified differs from that -described in -<A HREF=http://www.ietf.org/rfc/rfc1035.txt>RFC 1035</A>.</I> -<P> -The origin and current domain revert to the values they were prior to the -<CODE>$INCLUDE</CODE> once the file has been read. -<H4>$TTL</H4> -Syntax: <CODE>$TTL <default-ttl> [<comment>]</CODE> -<P> -Set the default Time To Live (TTL) for subsequent records with undefined -TTL's. Valid TTL's are of the range 0-2147483647. -<P> -<CODE>$TTL</CODE> is defined in -<A HREF=http://www.ietf.org/rfc/rfc2308.txt>RFC 2308</A>. -<H3>BIND Master File Extentions</H3> -<H4>$GENERATE</H4> -Syntax: <CODE>$GENERATE <range> <lhs> <type> <rhs> -[<comment>]</CODE> -<P> -<CODE>$GENERATE</CODE> is used to create a series of resource records -that only differ from each other by an iterator. <CODE>$GENERATE</CODE> -can be used to easily generate the sets of records required to support -sub /24 reverse delegations described in -<A HREF=http://www.ietf.org/rfc/rfc2317.txt>RFC 2317: Classless IN-ADDR.ARPA delegation</A>. - -<PRE> -$ORIGIN 0.0.192.IN-ADDR.ARPA. -$GENERATE 1-2 0 NS SERVER$.EXAMPLE. -$GENERATE 1-127 $ CNAME $.0 -</PRE> -is equivalent to -<PRE> -0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE. -0.0.0.192.IN-ADDR.ARPA NS SERVER2.EXAMPLE. -1.0.0.192.IN-ADDR.ARPA CNAME 1.0.0.0.192.IN-ADDR.ARPA. -2.0.0.192.IN-ADDR.ARPA CNAME 2.0.0.0.192.IN-ADDR.ARPA. -... -127.0.0.192.IN-ADDR.ARPA CNAME 127.0.0.0.192.IN-ADDR.ARPA. -</PRE> -<DL> -<DT>range</DT> -<DD> -This can be one of two forms: -<I>start</I>-<I>stop</I> -or -<I>start</I>-<I>stop</I>/<I>step</I>. If the first form is -used then step is set to 1. All of start, stop and step must be positive. -<DT>lhs</DT> -<DD> -Lhs describes the owner name of the resource records to be created. -Any single $ symbols within the LHS side are replaced by the iterator value. -To get a $ in the output use \$. If the lhs is not absolute -the current $ORIGIN is appended to the name, when appropriate. -You can also apply an offset to the iterator by using ${offset} where -offset is a decimal value to add to the iterator. -And you can also change the format of the iterator by using a printf -like string. The format is ${offset,width,radix} where offset is as before -(use 0 for no change), width is the minimum field width (always zero padded) -radix is one of d, o, x, or X to change the radix to decimal, octal, hex, or hex -with capital letters. -The default is ${0,1,d}. -For example: ${16,3} will add 16 to the iterator and be replaced by -a 3 digit decimal representation. ${0,2,x} will be replaced by a 2 digit -hex representation. To get a { character inserted into the text -immediately after the iterator, use $\{. -<DT>type</DT> -<DD> -At present the only supported types are A, AAAA, PTR, CNAME and NS. -<DT>rhs</DT> -<DD> -Rhs is the data. It is processed similarly to the lhs. -<DD> -</DL> -<H2>Resource Records</H2> -Syntax: <CODE>{<domain>|@|<blank>} -[<ttl>] [<class>] <type> <rdata> -[<comment>]</CODE> -<P> -All resource records have the same basic syntax. -<DL> -<DT><CODE>domain</CODE></DT> -<DD> -Specify the domain name for this record. If it is not absolute the -current <CODE>$ORIGIN</CODE> is appended. -<DT><CODE>@</CODE></DT> -<DD> -Use the current <CODE>$ORIGIN</CODE> for the domain name for this record. -<DT><CODE>blank</CODE></DT> -<DD> -Use the last specified domainname. -<DT><CODE>ttl</CODE></DT> -<DD> -This specifies how long this record will be cached by caching servers. -The valid range is 0-2147483647. -<DT><CODE>class</CODE></DT> -<DD> -Specify the class of this record. This is usually redundent as the -class of a zone is specfied in the configuration file prior to reading -the zone file. -<DT><CODE>type</CODE></DT> -<DD> -Specify the type of this record. This describes the contents of the rdata -section. -<DT><CODE>rdata</CODE></DT> -<DD> -This is the value of the resource record. -</DL> -<H2>Time Values: Alternate Specification format (BIND Enhancement)</H2> -<P> -Many time values within the MASTER file may be specified in multiples -of weeks, days, hours, minutes and seconds rather than just seconds. -<P> -The format for this is <CODE>#w#d#h#m#s</CODE>. To specify 1 week you would -use <CODE>1w</CODE> or two weeks and 1 hour <CODE>2w1h</CODE>. -<P> -This format applies to TTL values, and SOA REFRESH, RETRY, EXPIRE and MINIMUM -values. -</P> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/options.html b/contrib/bind/doc/html/options.html deleted file mode 100644 index 9e3c0da..0000000 --- a/contrib/bind/doc/html/options.html +++ /dev/null @@ -1,864 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND options Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide -- <CODE>options</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -options { - [ hostname <VAR>hostname_string</VAR>; ] - [ version <VAR>version_string</VAR>; ] - [ directory <VAR>path_name</VAR>; ] - [ named-xfer <VAR>path_name</VAR>; ] - [ dump-file <VAR>path_name</VAR>; ] - [ memstatistics-file <VAR>path_name</VAR>; ] - [ pid-file <VAR>path_name</VAR>; ] - [ statistics-file <VAR>path_name</VAR>; ] - [ auth-nxdomain <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ deallocate-on-exit <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ dialup <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ fake-iquery <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ fetch-glue <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ has-old-clients <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ host-statistics <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ host-statistics-max <VAR>number</VAR>; ] - [ multiple-cnames <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ notify ( <VAR><A HREF="docdef.html">yes_or_no</A></VAR> | explicit ) <; ] - [ suppress-initial-notify <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ recursion <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ rfc2308-type1 <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ use-id-pool <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ treat-cr-as-space <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ also-notify { <VAR><A HREF="docdef.html">ip_addr</A></VAR>; [ <VAR><A HREF="docdef.html">ip_addr</A></VAR>; ... ] }; ] - [ forward ( only | first ); ] - [ forwarders { [ <VAR><A HREF="docdef.html">in_addr</A></VAR> ; [ <VAR><A HREF="docdef.html">in_addr</A></VAR> ; ... ] ] }; ] - [ check-names ( master | slave | response ) ( warn | fail | ignore); ] - [ allow-query { <VAR>address_match_list</VAR> }; ] - [ allow-transfer { <VAR>address_match_list</VAR> }; ] - [ allow-recursion { <VAR>address_match_list</VAR> }; ] - [ blackhole { <VAR>address_match_list</VAR> }; ] - [ listen-on [ port <VAR><A HREF="docdef.html">ip_port</A></VAR> ] { <VAR>address_match_list</VAR> }; ] - [ query-source [ address ( <VAR><A HREF="docdef.html">ip_addr</A></VAR> | * ) ] [ port ( <VAR><A HREF="docdef.html">ip_port</A></VAR> | * ) ] ; ] - [ lame-ttl <VAR>number</VAR>; ] - [ max-transfer-time-in <VAR>number</VAR>; ] - [ max-ncache-ttl <VAR>number</VAR>; ] - [ min-roots <VAR>number</VAR>; ] - [ serial-queries <VAR>number</VAR>; ] - [ transfer-format ( one-answer | many-answers ); ] - [ transfers-in <VAR>number</VAR>; ] - [ transfers-out <VAR>number</VAR>; ] - [ transfers-per-ns <VAR>number</VAR>; ] - [ transfer-source <VAR><A HREF="docdef.html">ip_addr</A></VAR>; ] - [ maintain-ixfr-base <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ max-ixfr-log-size <VAR>number</VAR>; ] - [ coresize <VAR><A HREF="docdef.html">size_spec</A></VAR> ; ] - [ datasize <VAR><A HREF="docdef.html">size_spec</A></VAR> ; ] - [ files <VAR><A HREF="docdef.html">size_spec</A></VAR> ; ] - [ stacksize <VAR><A HREF="docdef.html">size_spec</A></VAR> ; ] - [ cleaning-interval <VAR>number</VAR>; ] - [ heartbeat-interval <VAR>number</VAR>; ] - [ interface-interval <VAR>number</VAR>; ] - [ statistics-interval <VAR>number</VAR>; ] - [ <A HREF="#topology">topology</A> { <VAR>address_match_list</VAR> }; ] - [ <A HREF="#sortlist">sortlist</A> { <VAR>address_match_list</VAR> }; ] - [ rrset-order { <VAR>order_spec</VAR> ; [ <VAR>order_spec</VAR> ; ... ] }; ] - [ preferred-glue ( A | AAAA ); ] - [ edns-udp-size <VAR>number</VAR>; ] -}; -</PRE> -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The options statement sets up global options to be used by -BIND. This statement may appear at only once in a -configuration file; if more than one occurrence is found, the -first occurrence determines the actual options used, -and a warning will be generated. If there is no options statement, -an options block with each option set to its default will be used.</P> - -<H4>Server Information</H4> - -<DL> -<DT><CODE>hostname</CODE> -<DD> -This defaults to the hostname of the machine hosting the nameserver -as found by gethostname(). -Its prime purpose is to be able to identify which of a number of anycast -servers is actually answering your queries by sending a <I>txt</I> -query for <CODE>hostname.bind</CODE> in class <I>chaos</I> to the anycast -server and getting back a unique name. -Setting the hostname to a empty string ("") will disable processing of -the queries. - -<DT><CODE>version</CODE> -<DD> -The version the server should report via the <VAR>ndc</VAR> command -or via a query of name <CODE>version.bind</CODE> in class <I>chaos</I>. -The default is the real version number of the server, but some server -operators prefer the string <CODE>"surely you must be joking"</CODE>. -Changing the value of this string will not prevent people from identifying -what version you are running. -</DL> - -<H4>Pathnames</H4> - -<DL> -<DT><CODE>directory</CODE> -<DD> -The working directory of the server. Any non-absolute -pathnames in the configuration file will be taken as relative to this -directory. The default location for most server output files -(e.g. "named.run") is this directory. If a directory is not -specified, the working directory defaults to ".", the directory from which the -server was started. The directory specified should be an absolute path. - -<DT><CODE>named-xfer</CODE> -<DD> -The pathname to the named-xfer program that the server uses for -inbound zone transfers. If not specified, the default is -system dependent (e.g. "/usr/sbin/named-xfer"). - -<DT><CODE>dump-file</CODE> -<DD> -The pathname of the file the server dumps the database to when it -receives <CODE>SIGINT</CODE> signal (<CODE>ndc dumpdb</CODE>). If not -specified, the default is "named_dump.db". - -<DT><CODE>memstatistics-file</CODE> -<DD> -The pathname of the file the server writes memory usage statistics to, on exit, -if <CODE>deallocate-on-exit</CODE> is <CODE>yes</CODE>. If not -specified, the default is "named.memstats". - -<DT><CODE>pid-file</CODE> -<DD> -The pathname of the file the server writes its process ID in. If not -specified, the default is operating system dependent, but is usually -"/var/run/named.pid" or "/etc/named.pid". The pid-file is used by -programs like "ndc" that want to send signals to the running -nameserver. - -<DT><CODE>statistics-file</CODE> -<DD> -The pathname of the file the server appends statistics to when it -receives <CODE>SIGILL</CODE> signal (<CODE>ndc stats</CODE>). If not -specified, the default is "named.stats". -</DL> - -<A name="BooleanOptions"><H4>Boolean Options</H4></A> - -<DL> -<DT><CODE>auth-nxdomain</CODE> -<DD> -If <CODE>yes</CODE>, the <CODE>AA</CODE> bit is always set on -NXDOMAIN responses, even if the server is not actually authoritative. -The default is <CODE>no</CODE>. Turning <CODE>auth-nxdomain</CODE> will -allow older clients that require <CODE>AA</CODE> to be set to accept -NXDOMAIN responses to work. - -<DT><CODE>deallocate-on-exit</CODE> -<DD> -If <CODE>yes</CODE>, the server will painstakingly deallocate every object it -it allocated, when it exits, and then write a memory usage report to -the <CODE>memstatistics-file</CODE>. The default is <CODE>no</CODE>, because -it is faster to let the operating system clean up. -<CODE>deallocate-on-exit</CODE> is handy for detecting memory leaks. - -<DT><CODE>dialup</CODE> -<DD> -If <CODE>yes</CODE>, the server treats all zones as if they are -doing zone transfers across a dial on demand dialup link, which can -be brought up by traffic originating from this server. This has -different effects according to zone type and concentrates the zone -maintenance so that it all happens in a short interval, once every -<CODE>heartbeat-interval</CODE> and hopefully during the one call. -It also suppresses some of the normal zone maintainance traffic. -The default is <CODE>no</CODE>. The <CODE>dialup</CODE> -option may also be specified in the <CODE>zone</CODE> statement, in which -case it overrides the <CODE>options dialup</CODE> statement. - -<P> -If the zone is a <CODE>master</CODE> zone, the server will send out -NOTIFY request to all the slaves. This will trigger the "zone up to -date checking" in the slave (providing it supports NOTIFY), allowing -the <CODE>slave</CODE> to verify the zone while the call us up. - -<P> -If the zone is a <CODE>slave</CODE> or <CODE>stub</CODE> zone, the server -will suppress the regular "zone up to date" queries and only perform -them when the <CODE>heartbeat-interval</CODE> expires. - -<DT><CODE>fake-iquery</CODE> -<DD> -If <CODE>yes</CODE>, the server will simulate the obsolete DNS query type -IQUERY. The default is <CODE>no</CODE>. - -<DT><CODE>fetch-glue</CODE> -<DD> -If <CODE>yes</CODE> (the default), the server will fetch "glue" resource -records it doesn't have when constructing the additional data section of -a response. <CODE>fetch-glue no</CODE> can be used in conjunction with -<CODE>recursion no</CODE> to prevent the server's cache from growing or -becoming corrupted (at the cost of requiring more work from the client). - -<DT><CODE>has-old-clients</CODE> -<DD> -Setting the option to <CODE>yes</CODE> is equivalent to setting the following -options: <CODE>auth-nxdomain yes;</CODE> and <CODE>rfc2308-type1 no;</CODE>. -The use of <CODE>has-old-clients</CODE> with <CODE>auth-nxdomain</CODE> -and <CODE>rfc2308-type1</CODE> is order dependent. - -<DT><CODE>host-statistics</CODE> -<DD> -If <CODE>yes</CODE>, statistics are kept for every host that the -the nameserver interacts with. The default is <CODE>no</CODE>. <I>Note:</I> -turning on <CODE>host-statistics</CODE> can consume huge amounts of memory. - -<DT><CODE>host-statistics-max</CODE> -<DD> -The maximum number of host records that will be kept. When this limit is -reached no new hosts will be added to the host statistics. If the set -to zero then there is no limit set. The default value is zero. - -<DT><CODE>maintain-ixfr-base</CODE> -<DD> -If <CODE>yes</CODE>, a transaction log is kept for -Incremental Zone Transfer. The default is <CODE>no</CODE>. - -<DT><CODE>multiple-cnames</CODE> -<DD> -If <CODE>yes</CODE>, multiple CNAME resource records will be -allowed for a domain name. The default is <CODE>no</CODE>. Allowing -multiple CNAME records is against standards and is not recommended. -Multiple CNAME support is available because previous versions of BIND -allowed multiple CNAME records, and these records have been used for load -balancing by a number of sites. - -<DT><CODE>notify</CODE> -<DD> -If <CODE>yes</CODE> (the default), DNS NOTIFY messages are sent when a -zone the server is authoritative for changes. The use of NOTIFY -speeds convergence between the master and its slaves. Slave servers -that receive a NOTIFY message, and understand it, will contact the -master server for the zone to see if they need to do a zone transfer. If -they do, they will initiate it immediately. If <CODE>explicit</CODE>, -the NOTIFY messages will only be sent to the addresses in the -<CODE>also-notify</CODE> list. The <CODE>notify</CODE> -option may also be specified in the <CODE>zone</CODE> statement, in which -case it overrides the <CODE>options notify</CODE> statement. - -<DT><CODE>suppress-initial-notify</CODE> -<DD> -If <CODE>yes</CODE>, suppress the initial notify messages when the server -first loads. The default is <CODE>no</CODE>. - -<DT><CODE>recursion</CODE> -<DD> -If <CODE>yes</CODE>, and a DNS query requests recursion, the -server will attempt to do all the work required to answer the query. -If recursion is not on, the server will return a referral to the -client if it doesn't know the answer. The default is <CODE>yes</CODE>. -See also <CODE>fetch-glue</CODE> above. - -<DT><CODE>rfc2308-type1</CODE> -<DD> -If <CODE>yes</CODE>, the server will send NS records along with the SOA -record for negative answers from the cache. -You need to set this to <CODE>no</CODE> if you have an old BIND -server using you as a forwarder that does not understand negative answers -which contain both SOA and NS records or you have an old version of sendmail. -The correct fix is to upgrade the broken server or sendmail. -The default is <CODE>no</CODE>. - -<DT><CODE>use-id-pool</CODE> -<DD> -If <CODE>yes</CODE>, the server will keep track of its own outstanding -query ID's to avoid duplication and increase randomness. This will result -in 128KB more memory being consumed by the server. -The default is <CODE>no</CODE>. - -<DT><CODE>treat-cr-as-space</CODE> -<DD> -If <CODE>yes</CODE>, the server will treat '\r' characters the same way it -treats a ' ' or '\t'. This may be necessary when loading zone files on a -UNIX system that were generated on an NT or DOS machine. The default is <CODE>no</CODE>. - -</DL> - -<A NAME="Also-notify"><H4>Also-Notify</H4></A> - -<DT><CODE>also-notify</CODE> -<P> -Defines a global list of IP addresses that also get sent NOTIFY messages -whenever a fresh copy of the zone is loaded. This helps to ensure that -copies of the zones will quickly converge on ``stealth'' servers. -If an <CODE>also-notify</CODE> list is given in a <CODE>zone</CODE> -statement, it will override the <CODE>options also-notify</CODE> statement. -When a <CODE>zone notify</CODE> statement is set to <CODE>no</CODE>, -the IP addresses in the global <CODE>also-notify</CODE> list will not get -sent NOTIFY messages for that zone. -The default is the empty list (no global notification list). - -<A NAME="Forwarding"><H4>Forwarding</H4></A> - -<P>The forwarding facility can be used to create a large site-wide -cache on a few servers, reducing traffic over links to external -nameservers. It can also be used to allow queries by servers that do -not have direct access to the Internet, but wish to look up exterior -names anyway. Forwarding occurs only on those queries for which the -server is not authoritative and does not have the answer in its cache. - -<DL> -<DT><CODE>forward</CODE> -<DD> -This option is only meaningful if the <CODE>forwarders</CODE> list is -not empty. A value of <CODE>first</CODE>, the default, causes the -server to query the forwarders first, and if that doesn't answer the -question the server will then look for the answer itself. If -<CODE>only</CODE> is specified, the server will only query the -forwarders. - -<DT><CODE>forwarders</CODE> -<DD> -Specifies the IP addresses to be used for forwarding. The default is the -empty list (no forwarding). -</DL> - -<P>Forwarding can also be configured on a per-zone basis, allowing for -the global forwarding options to be overridden in a variety of ways. -You can set particular zones to use different forwarders, or have -different <CODE>forward only/first</CODE> behavior, or to not forward -at all. See the <A HREF="zone.html"><CODE>zone</CODE></A> statement -for more information. - -<P>Future versions of BIND 8 will provide a more powerful forwarding -system. The syntax described above will continue to be supported. - -<a name="NameChecking"><H4>Name Checking</H4></a> - -<P>The server can check domain names based upon their expected client contexts. -For example, a domain name used as a hostname can be checked for compliance -with the RFCs defining valid hostnames. - -<P>Three checking methods are available: - -<DL> -<DT><CODE>ignore</CODE> -<DD> -No checking is done. - -<DT><CODE>warn</CODE> -<DD> -Names are checked against their expected client contexts. Invalid names are -logged, but processing continues normally. - -<DT><CODE>fail</CODE> -<DD> -Names are checked against their expected client contexts. Invalid names are -logged, and the offending data is rejected. -</DL> - -<P>The server can check names three areas: master zone files, slave -zone files, and in responses to queries the server has initiated. If -<CODE>check-names response fail</CODE> has been specified, and -answering the client's question would require sending an invalid name -to the client, the server will send a REFUSED response code to the -client. - -<P>The defaults are: - -<PRE> - check-names master fail; - check-names slave warn; - check-names response ignore; -</PRE> - -<P><CODE>check-names</CODE> may also be specified in the -<A HREF="zone.html"><CODE>zone</CODE></A> -statement, in which case it overrides the <CODE>options check-names</CODE> -statement. When used in a <CODE>zone</CODE> statement, the area is not -specified (because it can be deduced from the zone type). - -<A name="AccessControl"><H4>Access Control</H4></A> - -<P>Access to the server can be restricted based on the IP address of the -requesting system. See -<VAR><A HREF="address_list.html">address_match_list</A></VAR> for details -on how to specify IP address lists. - -<DL> -<DT><CODE>allow-query</CODE> -<DD> -Specifies which hosts are allowed to ask ordinary questions. -<CODE>allow-query</CODE> may also be specified in the -<CODE>zone</CODE> statement, in which case it overrides the -<CODE>options allow-query</CODE> statement. If not specified, the default is -to allow queries from all hosts. - -<DT><CODE>allow-transfer</CODE> -<DD> -Specifies which hosts are allowed to receive zone transfers from the -server. <CODE>allow-transfer</CODE> may also be specified in the -<CODE>zone</CODE> statement, in which case it overrides the -<CODE>options allow-transfer</CODE> statement. If not specified, the default -is to allow transfers from all hosts. - -<DT><CODE>allow-recursion</CODE> -<DD> -Specifies which hosts are allowed to make recursive queries through this -server. If not specified, the default is to allow recursive queries from -all hosts. - -<DT><CODE>blackhole</CODE> -<DD> -Specifies a list of addresses that the server will not accept queries from -or use to resolve a query. Queries from these addresses will not be -responded to. -</DL> - -<H4>Interfaces</H4> - -<P>The interfaces and ports that the server will answer queries from may -be specified using the <CODE>listen-on</CODE> option. <CODE>listen-on</CODE> -takes an optional port, and an -<VAR><A HREF="address_list.html">address_match_list</A></VAR>. The server will -listen on all interfaces allowed by the address match list. If a port is -not specified, port 53 will be used. - -<P>Multiple <CODE>listen-on</CODE> statements are allowed. For example, - -<PRE> - listen-on { 5.6.7.8; }; - listen-on port 1234 { !1.2.3.4; 1.2/16; }; -</PRE> - -will enable the nameserver on port 53 for the IP address 5.6.7.8, and -on port 1234 of an address on the machine in net 1.2 that is not -1.2.3.4. - -<P>If no <CODE>listen-on</CODE> is specified, the server will listen on port -53 on all interfaces. - -<H4>Query Address</H4> - -<P>If the server doesn't know the answer to a question, it will query -other nameservers. <CODE>query-source</CODE> specifies the address -and port used for such queries. If <CODE>address</CODE> is -<CODE>*</CODE> or is omitted, a wildcard IP address -(<CODE>INADDR_ANY</CODE>) will be used. If <CODE>port</CODE> is -<CODE>*</CODE> or is omitted, a random unprivileged port will be used. -The default is - -<PRE> - query-source address * port *; -</PRE> - -<P>Note: <CODE>query-source port</CODE> applies only to UDP queries, -TCP queries always use a random unprivileged port. - -<A name="ZoneTransfers"><H4>Zone Transfers</H4></A> - -<DL> -<DT><CODE>max-transfer-time-in</CODE> -<DD> -Inbound zone transfers (<CODE>named-xfer</CODE> processes) running -longer than this many minutes will be terminated. The default is 120 -minutes (2 hours). - -<DT><CODE>transfer-format</CODE> -<DD> -The server supports two zone transfer methods. -<CODE>one-answer</CODE> uses one DNS message per resource record -transferred. <CODE>many-answers</CODE> packs as many resource records -as possible into a message. <CODE>many-answers</CODE> is more -efficient, but is only known to be understood by BIND 8.1+ and patched -versions of BIND 4.9.5. The default is <CODE>one-answer</CODE>. -<CODE>transfer-format</CODE> may be -overridden on a per-server basis by using the <CODE>server</CODE> statement. - -<DT><CODE>transfers-in</CODE> -<DD> -The maximum number of inbound zone transfers that can be running -concurrently. The default value is 10. Increasing -<CODE>transfers-in</CODE> may speed up the convergence of slave zones, -but it also may increase the load on the local system. - -<DT><CODE>transfers-out</CODE> -<DD> -This option will be used in the future to limit the number of -concurrent outbound zone transfers. It is checked for syntax, but is -otherwise ignored. - -<DT><CODE>transfers-per-ns</CODE> -<DD> -The maximum number of inbound zone transfers (<CODE>named-xfer</CODE> -processes) that can be concurrently transferring from a given remote -nameserver. The default value is 2. Increasing -<CODE>transfers-per-ns</CODE> may speed up the convergence of slave -zones, but it also may increase the load on the remote nameserver. -<CODE>transfers-per-ns</CODE> may be overridden on a per-server basis -by using the <CODE>transfers</CODE> phrase of the <CODE>server</CODE> -statement. - -<DT><CODE>transfer-source</CODE> -<DD> -<CODE>transfer-source</CODE> determines which local address will be bound -to the TCP connection used to fetch all zones transferred inbound by the -server. If not set, it defaults to a system controlled value which will -usually be the address of the interface ``closest to'' the remote end. -This address must appear in the remote end's <CODE>allow-transfer</CODE> -option for the zone being transferred, if one is specified. This statement -sets the <CODE>transfer-source</CODE> for all zones, but can be overridden -on a per-zone basis by including a <CODE>transfer-source</CODE> statement -within the zone block in the configuration file. - -<DT><CODE>serial-queries</CODE> -<DD> -Slave servers will periodically query master servers to find out if zone -serial numbers have changed. Each such query uses a minute amount of the -slave server's network bandwidth, but more importantly each query uses a -small amount of <I>memory</I> in the slave server while waiting for the -master server to respond. The <CODE>serial-queries</CODE> option sets the -maximum number of concurrent serial-number queries allowed to be outstanding -at any given time. The default is four (4). -<B>Note:</B> -If a server loads a large (tens or hundreds of thousands) number of slave -zones, this limit should be raised to the high hundreds or low -thousands -- otherwise the slave server may never actually become aware of -zone changes in the master servers. Beware, though, that setting this limit -arbitrarily high can spend a considerable amount of your slave server's -network, CPU, and memory resources. As with all tunable limits, this one -should be changed gently and monitored for its effects. -</DL> - -<H4>Resource Limits</H4> - -<P>The server's usage of many system resources can be limited. Some -operating systems don't support some of the limits. On such systems, -a warning will be issued if the unsupported limit is used. Some -operating systems don't support limiting resources, and on these systems -a <CODE>cannot set resource limits on this system</CODE> message will -be logged. - -<P>Scaled values are allowed when specifying resource limits. For -example, <CODE>1G</CODE> can be used instead of -<CODE>1073741824</CODE> to specify a limit of one gigabyte. -<CODE>unlimited</CODE> requests unlimited use, or the maximum -available amount. <CODE>default</CODE> uses the limit that was in -force when the server was started. See -<VAR><A HREF="docdef.html">size_spec</A></VAR> for more details. - -<DL> -<DT><CODE>coresize</CODE> -<DD> -The maximum size of a core dump. The default is <CODE>default</CODE>. - -<DT><CODE>datasize</CODE> -<DD> -The maximum amount of data memory the server may use. The default is -<CODE>default</CODE>. - -<DT><CODE>files</CODE> -<DD> -The maximum number of files the server may have open concurrently. -The default is <CODE>unlimited</CODE>. <I>Note:</I> on some operating -systems the server cannot set an unlimited value and cannot determine -the maximum number of open files the kernel can support. On such -systems, choosing <CODE>unlimited</CODE> will cause the server to use -the larger of the <CODE>rlim_max</CODE> for <CODE>RLIMIT_NOFILE</CODE> -and the value returned by <CODE>sysconf(_SC_OPEN_MAX)</CODE>. If the -actual kernel limit is larger than this value, use <CODE>limit -files</CODE> to specify the limit explicitly. - -<DT><CODE>max-ixfr-log-size</CODE> -<DD> -Limit the size of the transaction log kept for Incremental Zone Transfer. -Default 0 (unlimited). - -<DT><CODE>stacksize</CODE> -<DD> -The maximum amount of stack memory the server may use. The default is -<CODE>default</CODE>. -</DL> - -<H4>Periodic Task Intervals</H4> - -<DL> -<DT><CODE>cleaning-interval</CODE> -<DD> -The server will remove expired resource records from the cache every -<CODE>cleaning-interval</CODE> minutes. The default is 60 minutes. If set -to 0, no periodic cleaning will occur. - -<DT><CODE>heartbeat-interval</CODE> -<DD> -The server will perform zone maintenance tasks for all zones marked -<CODE>dialup yes</CODE> whenever this interval expires. -The default is 60 minutes. Reasonable values are up to 1 day (1440 minutes). -If set to 0, no zone maintenance for these zones will occur. -<DT><CODE>interface-interval</CODE> -<DD> -The server will scan the network interface list every -<CODE>interface-interval</CODE> minutes. The default is 60 minutes. -If set to 0, interface scanning will only occur when the configuration -file is loaded. After the scan, listeners will be started on any new -interfaces (provided they are allowed by the <CODE>listen-on</CODE> -configuration). Listeners on interfaces that have gone away will be -cleaned up. - -<DT><CODE>statistics-interval</CODE> -<DD> -Nameserver statistics will be logged every <CODE>statistics-interval</CODE> -minutes. The default is 60. If set to 0, no statistics will be logged. -</DL> - -<H4><A NAME="topology">Topology</A></H4> - -<P>All other things being equal, when the server chooses a nameserver -to query from a list of nameservers, it prefers the one that is -topologically closest to itself. The <CODE>topology</CODE> statement -takes an <VAR><A HREF="address_list.html">address_match_list</A></VAR> -and interprets it in a special way. Each top-level list element is -assigned a distance. Non-negated elements get a distance based on -their position in the list, where the closer the match is to the start -of the list, the shorter the distance is between it and the server. A -negated match will be assigned the maximum distance from the server. -If there is no match, the address will get a distance which is further -than any non-negated list element, and closer than any negated -element. For example, - -<PRE> - topology { - 10/8; - !1.2.3/24; - { 1.2/16; 3/8; }; - }; -</PRE> - -<P>will prefer servers on network 10 the most, followed by hosts on -network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the exception -of hosts on network 1.2.3 (netmask 255.255.255.0), which is preferred least -of all. - -<P>The default topology is - -<PRE> - topology { localhost; localnets; }; -</PRE> - -<H4><A NAME="sortlist">Resource Record sorting</A></H4> - -<P> -When returning multiple RRs, -the nameserver will normally return them in -<B>Round Robin</B>, -i.e. after each request, the first RR is put to the end of the list. -As the order of RRs is not defined, this should not cause any problems. -</P> -<P> -The client resolver code should re-arrange the RRs as appropriate, -i.e. using any addresses on the local net in preference to other addresses. -However, not all resolvers can do this, or are not correctly configured. -</P> -<P> -When a client is using a local server, the sorting can be performed in the -server, based on the client's address. -This only requires configuring the nameservers, not all the clients. -</P> -<P> -The sortlist statement takes an address match list and interprets it even -more specially than the <A HREF="#topology">topology</A> statement does. -</P> -<P> -Each top level statement in the sortlist must itself be an explicit -address match list with one or two elements. The first element -(which may be an IP address, an IP prefix, an ACL name or nested -address match list) of each top level list is checked against the -source address of the query until a match is found. -</P> -<P> -Once the source address of the query has been matched, if the top level -statement contains only one element, the actual primitive element that -matched the source address is used to select the address in the response -to move to the beginning of the response. If the statement is a list -of two elements, the second element is treated like the address -match list in a topology statement. Each top level element is assigned -a distance and the address in the response with the minimum distance is -moved to the beginning of the response. -</P> -<P> -In the following example, any queries received from any of the addresses -of the host itself will get responses preferring addresses on any of -the locally connected networks. Next most preferred are addresses on -the 192.168.1/24 network, and after that either the 192.168.2/24 or -192.168.3/24 network with no preference shown between these two networks. -Queries received from a host on the 192.168.1/24 network will prefer -other addresses on that network to the 192.168.2/24 and 192.168.3/24 -networks. Queries received from a host on the 192.168.4/24 or the -192.168.5/24 network will only prefer other addresses on their -directly connected networks. -<PRE> -sortlist { - { localhost; // IF the local host - { localnets; // THEN first fit on the - 192.168.1/24; // following nets - { 192,168.2/24; 192.168.3/24; }; }; }; - { 192.168.1/24; // IF on class C 192.168.1 - { 192.168.1/24; // THEN use .1, or .2 or .3 - { 192.168.2/24; 192.168.3/24; }; }; }; - { 192.168.2/24; // IF on class C 192.168.2 - { 192.168.2/24; // THEN use .2, or .1 or .3 - { 192.168.1/24; 192.168.3/24; }; }; }; - { 192.168.3/24; // IF on class C 192.168.3 - { 192.168.3/24; // THEN use .3, or .1 or .2 - { 192.168.1/24; 192.168.2/24; }; }; }; - { { 192.168.4/24; 192.168.5/24; }; // if .4 or .5, prefer that net - }; -}; -</PRE> -The following example will give reasonable behaviour for the local host -and hosts on directly connected networks. It is similar to the behavior -of the address sort in BIND 4.9.x. Responses sent to queries from the -local host will favor any of the directly connected networks. Responses -sent to queries from any other hosts on a directly connected network will -prefer addresses on that same network. Responses to other queries will -not be sorted. -<PRE> -sortlist { - { localhost; localnets; }; - { localnets; }; -}; -</PRE> -<!-- - * XXX - it would be nice to have an ACL called "source" that matched the - * source address of a query so that a host could be configured to - * automatically prefer itself, and an ACL called "sourcenet", that - * would return the primitive IP match element that matched the source - * address so that you could do: - * { localnets; { sourcenet; { other stuff ...}; }; - * and automatically get similar behaviour to what you get with: - * { localnets; }; ---> -</P> - -<a name="RrsetOrder"> -<H4>RRset Ordering</H4> - -<P>When multiple records are returned in an answer it may be useful to -configure the order the records are placed into the response. For example the -records for a zone might be configured to always be returned in the order they -are defined in the zone file. Or perhaps a <i>random</i> shuffle of the -records as they are returned is wanted. The <var>rrset-order</var> statement -permits configuration of the ordering made of the records in a multiple record -response. The default, if no ordering is defined, is a cyclic ordering (round -robin). - -<P>An <var>order_spec</var> is defined as follows: - -<PRE> - [ <var>class</var> class_name ][ <var>type</var> type_name ][ <var>name</var> "FQDN" ] <var>order</var> ordering -</PRE> - -<P>If no <var>class</var> is specified, the default is <code>ANY</code>. If no -<var>type</var> is specified, the default is <code>ANY</code>. If no -<var>name</var> is specified, the default is <code>"*"</code>. - -<P>The legal values for <code>ordering</code> are: - -<DL> -<DT><code>fixed</code> -<DD>Records are returned in the order they are defined in the zone file. - -<DT><code>random</code> -<DD>Records are returned in some random order. - -<DT><code>cyclic</code> -<DD>Records are returned in a round-robin order. - -</DL> - - -<P>For example: - -<PRE> - rrset-order { - class IN type A name "rc.vix.com" order random; - order cyclic; - }; -</PRE> - -<P>will cause any responses for type <VAR>A</VAR> records in class -<VAR>IN</VAR> that have "rc.vix.com" as a suffix, to always be returned in -random order. All other records are returned in cyclic order. - -<P>If multiple <code>rrset-order</code> statements appear, they are not -combined--the last one applies. - -<P>If no <code>rrset-order</code> statement is specified, a default one -of: - -<pre> - rrset-order { class ANY type ANY name "*" order cyclic ; }; -</pre> - -<P>is used. - -<H4>Glue Ordering</H4> - -When running a root nameserver it is sometimes necessary to ensure that -other nameservers that are priming are successful. This requires -that glue A records for at least of the nameservers are returned in -the answer to a priming query. This can be achieved by setting -<CODE>preferred-glue A;</CODE> which will add A records before other types -in the additional section. - -<H4>EDNS</H4> - -Some firewalls fail to pass EDNS/UDP messages that are larger than -certain size, 512 or the UDP reassembly buffer. To allow EDNS to -work across such firewalls it is necessary to advertise a EDNS -buffer size that is small enough to not trigger failures. -<CODE>edns-udp-size</CODE> can be use to adjust the advertised size. -Values less than 512 will be increased to 512 and values greater than -4096 will be truncated to 4096. - -<H4>Tuning</H4> - -<DL> -<DT><CODE>lame-ttl</CODE> -<DD> -Sets the number of seconds to cache a lame server indication. -0 disables caching. Default is 600 (10 minutes). Maximum value is 1800 (30 minutes). -<DT><CODE>max-ncache-ttl</CODE> -<DD> -To reduce network traffic and increase performance the server stores negative -answers. <CODE>max-ncache-ttl</CODE> is used to set a maximum retention time -for these answers in the server is seconds. The default <CODE>max-ncache-ttl</CODE> is -10800 seconds (3 hours). <CODE>max-ncache-ttl</CODE> cannot exceed the -maximum retention time for ordinary (positive) answers (7 days) and will be -silently truncated to 7 days if set to a value which is greater that 7 days. -<DT><CODE>min-roots</CODE> -<DD> -The minimum number of root servers that is required for a -request for the root servers to be accepted. Default 2. -</DL> -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: options.html,v 1.49.6.1 2003/06/02 09:56:33 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/server.html b/contrib/bind/doc/html/server.html deleted file mode 100644 index 5dea794..0000000 --- a/contrib/bind/doc/html/server.html +++ /dev/null @@ -1,80 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND server Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>server</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -server <VAR><A HREF="docdef.html">ip_addr</A></VAR> { - [ edns <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ bogus <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ support-ixfr <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ transfers <VAR><A HREF="docdef.html">number</A></VAR>; ] - [ transfer-format ( one-answer | many-answers ); ] - [ keys { <VAR><A HREF="key.html">key_id</A></VAR> [<VAR>key_id</VAR> ... ] }; ] -}; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<P>The server statement defines the characteristics to be -associated with a remote name server.</P> - -<P>If you discover that a server does not support EDNS you can prevent -named making EDNS queries to it by specifying <CODE>edns no;</CODE>. -The default value of <CODE>edns</CODE> is <CODE>yes</CODE>. - -<P>If you discover that a server is giving out bad data, marking it as -<CODE>bogus</CODE> will prevent further queries to it. The default value of -<CODE>bogus</CODE> is <CODE>no</CODE>. Marking a server as <CODE>bogus</CODE> -will mark all other addresses for that server as <CODE>bogus</CODE> when -a match is made when looking up a server's address by name. - -<P>If the server supports IXFR you can tell named to attempt to perform a -IXFR style zone transfer by specifing <CODE>support-ixfr yes</CODE>. -The default value of <CODE>support-ixfr</CODE> is <CODE>no</CODE>. - -<P>The server supports two zone transfer methods. The first, -<CODE>one-answer</CODE>, uses one DNS message per resource record -transferred. <CODE>many-answers</CODE> packs as many resource records -as possible into a message. <CODE>many-answers</CODE> is more -efficient, but is only known to be understood by BIND 8.1 and patched -versions of BIND 4.9.5. You can specify which method to use for a -server with the <CODE>transfer-format</CODE> option. If -<CODE>transfer-format</CODE> is not specified, the <CODE>transfer-format</CODE> -specified by the <CODE>options</CODE> statement will be used. - -<P>The <CODE>transfers</CODE> will be used in a future release of the server -to limit the number of concurrent in-bound zone transfers from the specified -server. It is checked for syntax but is otherwise ignored. - -<P>The <CODE>keys</CODE> clause is used to identify a -<VAR>key_id</VAR> defined by the <CODE>key</CODE> statement, to be -used for transaction security when talking to the remote server. -The <CODE>key</CODE> statememnt must come before the <CODE>server</CODE> -statement that references it. When a request is sent to the remote server, -a request signature will be generated using the key specified here and -appended to the message. A request originating from the remote server is not -required to be signed by this key. - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: server.html,v 1.13 2002/05/24 03:04:51 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/trusted-keys.html b/contrib/bind/doc/html/trusted-keys.html deleted file mode 100644 index acf2bed..0000000 --- a/contrib/bind/doc/html/trusted-keys.html +++ /dev/null @@ -1,58 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND trusted-keys Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>trusted-keys</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -trusted-keys { - [ <VAR><A HREF="docdef.html">domain_name</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR>string</VAR>; ] -}; - -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -The <CODE>trusted-keys</CODE> -statement is for use with DNSSEC-style security, originally specified -in RFC 2065. DNSSEC is meant to -provide three distinct services: key distribution, data origin -authentication, and transaction and request authentication. A -complete description of DNSSEC and its use is beyond the scope of this -document, and readers interested in more information should start with -<A HREF="http://info.internet.isi.edu/in-notes/rfc/files/rfc2065.txt"> -RFC 2065</A> and then continue with the -<A HREF="http://www.ietf.org/ids.by.wg/dnssec.html"> -Internet Drafts</A>.</P> - -<P>Each trusted key is associated with a domain name. Its attributes are -the non-negative integral <VAR>flags</VAR>, <VAR>protocol</VAR>, and -<VAR>algorithm</VAR>, as well as a base-64 encoded string representing -the key.</P> - -A trusted key is added when a public key for a non-authoritative zone is -known, but cannot be securely obtained through DNS. This occurs when -a signed zone is a child of an unsigned zone. Adding the trusted -key here allows data signed by that zone to be considered secure.</P> - -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: trusted-keys.html,v 1.4 1999/09/15 20:28:02 cyarnell Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/html/zone.html b/contrib/bind/doc/html/zone.html deleted file mode 100644 index d7b5604..0000000 --- a/contrib/bind/doc/html/zone.html +++ /dev/null @@ -1,244 +0,0 @@ -<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> -<HTML> -<HEAD> - <TITLE>BIND zone Statement</TITLE> -</HEAD> - -<BODY> -<H2>BIND Configuration File Guide--<CODE>zone</CODE> Statement</H2> - -<HR> - -<A NAME="Syntax"><H3>Syntax</H3></A> - -<PRE> -zone <VAR><A HREF="docdef.html">domain_name</A></VAR> [ ( in | hs | hesiod | chaos ) ] { - type master; - file <VAR><A HREF="docdef.html">path_name</A></VAR>; - [ forward ( only | first ); ] - [ forwarders { [ <VAR><A HREF="docdef.html">ip_addr</A></VAR> ; [ <VAR>ip_addr</VAR> ; ... ] ] }; ] - [ check-names ( warn | fail | ignore ); ] - [ allow-update { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ allow-query { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ allow-transfer { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ dialup <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ notify (<VAR><A HREF="docdef.html">yes_or_no</A></VAR> | explicit ); ] - [ also-notify { <VAR><A HREF="docdef.html">ip_addr</A></VAR>; [ <VAR>ip_addr</VAR>; ... ] }; ] - [ ixfr-base <VAR><A HREF="docdef.html">path_name</A></VAR>; ] - [ pubkey <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR>string</VAR>; ] -}; - -zone <VAR><A HREF="docdef.html">domain_name</A></VAR> [ ( in | hs | hesiod | chaos ) ] { - type ( slave | stub ); - [ file <VAR><A HREF="docdef.html">path_name</A></VAR>; ] - [ ixfr-base <VAR><A HREF="docdef.html">path_name</A></VAR>; ] - masters [ port <VAR><A HREF="docdef.html">ip_port</A></VAR> ] { <VAR><A HREF="docdef.html">ip_addr</A></VAR> [key <VAR><A HREF="key.html">key_id</A></VAR>]; [ ... ] }; - [ forward ( only | first ); ] - [ forwarders { [ <VAR><A HREF="docdef.html">ip_addr</A></VAR> ; [ <VAR>ip_addr</VAR> ; ... ] ] }; ] - [ check-names ( warn | fail | ignore ); ] - [ allow-update { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ allow-query { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ allow-transfer { <VAR><A HREF="address_list.html">address_match_list</A></VAR> }; ] - [ transfer-source <VAR><A HREF="docdef.html">ip_addr</A></VAR>; ] - [ dialup <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ max-transfer-time-in <VAR>number</VAR>; ] - [ notify <VAR><A HREF="docdef.html">yes_or_no</A></VAR>; ] - [ also-notify { <VAR><A HREF="docdef.html">ip_addr</A></VAR>; [ <VAR>ip_addr</VAR>; ... ] }; ] - [ pubkey <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR><A HREF="docdef.html">number</A></VAR> <VAR>string</VAR>; ] -}; - -zone <VAR><A HREF="docdef.html">domain_name</A></VAR> [ ( in | hs | hesiod | chaos ) ] { - type forward; - [ forward ( only | first ); ] - [ forwarders { [ <VAR><A HREF="docdef.html">ip_addr</A></VAR> ; [ <VAR>ip_addr</VAR> ; ... ] ] }; ] - [ check-names ( warn | fail | ignore ); ] -}; - -zone "." [ ( in | hs | hesiod | chaos ) ] { - type hint; - file <VAR><A HREF="docdef.html">path_name</A></VAR>; - [ check-names ( warn | fail | ignore ); ] -}; -</PRE> - -<HR> - -<A NAME="Usage"><H3>Definition and Usage</H3></A> - -<H4>Zone Types</H4> - -<DL> -<DT><CODE>master</CODE> -<DD> -The server has a master copy of the data for the zone and will be able -to provide authoritative answers for it. - - -<DT><CODE>slave</CODE> -<DD> -A <CODE>slave</CODE> zone is a replica of a master zone. The -<CODE>masters</CODE> list specifies one or more IP addresses that the -slave contacts to update its copy of the zone. If a <CODE>port</CODE> -is specified then checks to see if the zone is current and zone transfers -will be done to the port given. If <CODE>file</CODE> -is specified, the replica will be written to this file whenever -the zone is changed, and reloaded from this file on a server restart. -Use of -<CODE>file</CODE> is recommended, since it often speeds server startup -and eliminates a needless waste of bandwidth. Note that for large numbers -(in the tens or hundreds of thousands) of zones per server, it is best to -use a two level naming scheme for zone file names. For example, a slave -server for the zone <CODE>vix.com</CODE> might place the zone contents into -a file called <CODE>"vi/vix.com"</CODE> where <CODE>vi/</CODE> is just the -first two letters of the zone name. (Most operating systems behave very -slowly if you put 100K files into a single directory.) - -<DT><CODE>stub</CODE> -<DD> -A <CODE>stub</CODE> zone is like a slave zone, except that it replicates -only the NS records of a master zone instead of the entire zone. - -<DT><CODE>forward</CODE> -<DD> -A <CODE>forward</CODE> zone is used to <A HREF="options.html#Forwarding"> -direct all queries</A> in it to other servers. The specification of -options in such a zone will override any global options -declared in the <A HREF="options.html#Forwarding">options</A> statement. - -<P>If either no <CODE>forwarders</CODE> statement is present in the -zone or an empty list for <CODE>forwarders</CODE> is given, no -forwarding will be done for the zone, cancelling the effects of any -<CODE>forwarders</CODE> in the <CODE>options</CODE> statement. -Thus if you want to use this -type of zone to change the behavior of the global <CODE>forward</CODE> -option, and not the servers used, you also need to respecify the -global forwarders. - -<DT><CODE>hint</CODE> -<DD> -The initial set of root nameservers is specified using a -<CODE>hint</CODE> zone. When the server starts up, it uses the root hints -to find a root nameserver and get the most recent list of root nameservers. -</DL> - -<P>Note: previous releases of BIND used the term <EM>primary</EM> for a -master zone, <EM>secondary</EM> for a slave zone, and <EM>cache</EM> for -a hint zone.</P> - -<H4>Class</H4> - -<P>The zone's name may optionally be followed by a class. If a class -is not specified, class <CODE>in</CODE> (for "internet"), is assumed. -This is correct for the vast majority of cases. - -<P>The <CODE>hesiod</CODE> class is for an information service from MIT's -Project Athena. It is used to share information about various systems -databases, such as users, groups, printers and so on. More -information can be found at -<A HREF="ftp://athena-dist.mit.edu/pub/ATHENA/usenix/athena_changes.PS">MIT</A>. -The keyword <CODE>hs</CODE> is a synonym for <CODE>hesiod</CODE>.</P> - -<P>Another MIT development was CHAOSnet, a LAN protocol created in the -mid-1970s. It is still sometimes seen on LISP stations and other -hardware in the AI community, and zone data for it can be specified -with the -<CODE>chaos</CODE> class.</P> - -<H4>Options</H4> - -<DL> -<DT><CODE>check-names</CODE> -<DD> -See <A HREF="options.html#NameChecking">Name Checking</A>. - -<DT><CODE>allow-query</CODE> -<DD> -See the description of <CODE>allow-query</CODE> in the -<A HREF="options.html#AccessControl">Access Control</A> section. Note that -this should in general be <I>more restrictive</I> than the similar global -option of the same name; otherwise, confusing and nonworthwhile delegations -will be returned. - -<DT><CODE>allow-update</CODE> -<DD> -Specifies which hosts are allowed to submit Dynamic DNS updates to the -server. The default is to deny updates from all hosts. - -<DT><CODE>allow-transfer</CODE> -<DD> -See the description of <CODE>allow-transfer</CODE> in -the <A HREF="options.html#AccessControl">Access Control</A> section. - -<DT><CODE>transfer-source</CODE> -<DD> -<CODE>transfer-source</CODE> determines which local address will be bound to -the TCP connection used to fetch this zone. If not set, it defaults to a -system controlled value which will usually be the address of the interface -``closest to'' the remote end. This address must appear in the remote end's -<CODE>allow-transfer</CODE> option for this zone if one is specified. - -<DT><CODE>ixfr-base</CODE> -<DD> -<CODE>ixfr-base</CODE> -specifies the file name used for IXFR transaction log file. - -<DT><CODE>max-transfer-time-in</CODE> -<DD> -See the description of <CODE>max-transfer-time-in</CODE> in -the <A HREF="options.html#ZoneTransfers">Zone Transfers</A> section. - -<DT><CODE>dialup</CODE> -<DD> -See the description of <CODE>dialup</CODE> in -the <A HREF="options.html#BooleanOptions">Boolean Options</A> section. - -<DT><CODE>notify</CODE> -<DD> -See the description of <CODE>notify</CODE> in -the <A HREF="options.html#BooleanOptions">Boolean Options</A> section. - -<DT><CODE>also-notify</CODE> -<DD> -<CODE>also-notify</CODE> is only meaningful if <CODE>notify</CODE> is -active for this zone. The set of machines that will receive a DNS -NOTIFY message for this zone is made up of all the listed nameservers -for the zone (other than the primary master) plus any IP addresses -specified with <CODE>also-notify</CODE>. <CODE>also-notify</CODE> is not -meaningful for <CODE>stub</CODE> zones. The default is the empty list. - -<DT><CODE>forward</CODE> -<DD> -<CODE>forward</CODE> is only meaningful if the zone has a -<CODE>forwarders</CODE> list. The <CODE>only</CODE> value causes the -lookup to fail after trying the <CODE>forwarders</CODE> and getting no -answer, while <CODE>first</CODE> would allow a normal lookup to be tried. - -<DT><CODE>forwarders</CODE> -<DD> -The <CODE>forwarders</CODE> option in a zone is used to override the -list of global forwarders. If it is not specified in a zone of type -<CODE>forward</CODE>, <STRONG>no</STRONG> forwarding is done for the -zone; the global options are not used. - -<DT><CODE>pubkey</CODE> -<DD> -A pubkey represents a public key for this zone. It is needed when this is the -top level authoritative zone served by this server and there is no chain of -trust to a <A HREF="trusted-keys.html">trusted key</A>. It is considered -secure, so that data that it signs will be considered secure. The DNSSEC -flags, protocol, and algorithm are specified, as well as a base-64 encoded -string representing the key. - -</DL> -<HR> - -<CENTER><P>[ <A HREF="config.html">BIND Config. File</A> -| <A HREF="http://www.isc.org/products/BIND/">BIND Home</A> -| <A HREF="http://www.isc.org/">ISC</A> ]</P></CENTER> - -<HR> -<ADDRESS> -Last Updated: $Id: zone.html,v 1.26 2002/04/25 05:27:02 marka Exp $ -</ADDRESS> -</BODY> -</HTML> diff --git a/contrib/bind/doc/man/Makefile b/contrib/bind/doc/man/Makefile deleted file mode 100644 index 604c293..0000000 --- a/contrib/bind/doc/man/Makefile +++ /dev/null @@ -1,423 +0,0 @@ -## Portions Copyright (c) 1993 by Digital Equipment Corporation. -## -## Permission to use, copy, modify, and distribute this software for any -## purpose with or without fee is hereby granted, provided that the above -## copyright notice and this permission notice appear in all copies, and that -## the name of Digital Equipment Corporation not be used in advertising or -## publicity pertaining to distribution of the document or software without -## specific, written prior permission. -## -## THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -## WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -## OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -## CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -## DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -## PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -## ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -## SOFTWARE. - -## Portions Copyright (c) 1996,1999 by Internet Software Consortium -## -## Permission to use, copy, modify, and distribute this software for any -## purpose with or without fee is hereby granted, provided that the above -## copyright notice and this permission notice appear in all copies. -## -## THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -## ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -## OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -## CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -## DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -## PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -## ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -## SOFTWARE. - -# -# Makefile to install the BIND manual entries. -# -# Default Configuration: -# There are a set of default assignments immediately following this -# note. These defaults are for BSD4.4, BSD/386, other net2-alikes, -# and will install manual entries with following characteristics: -# o They will be catable (i.e., passed through nroff) -# o They will be installed in the directories -# /usr/share/man/catN, where N is 1, 3, 5, 7, 8 -# o They will have an extension of `.0' -# -# Don't change these defaults. Instead, following the default configuration -# are sets of commented values for particular systems that can be used -# to override the default values. -# - -# -# Target directory for the manual directory tree. Eg., may be used to -# specify the path of an NFS-mounted directory for common files. -# -DESTDIR= - -# -# Default location for manual section directories. -# -DESTMAN= /usr/share/man - -# -# Install manuals in ${MANDIR}N. For systems that generate catable manual -# entries on the fly, use -# MANDIR = man -# -MANDIR = cat - -# -# Default extension for manual entries. To install the manual entries under -# their `real' extensions use -# CATEXT = $$N -# -CATEXT = 0 - -# -# Command to install manual entries -# -INSTALL= install - -# -# `install' options to set Owner and Group for manual entries. Eg. for -# BSD `install' use -# MAN_OWNER = -o bin -# MAN_GROUP = -g bin -# -MAN_OWNER = -MAN_GROUP = - -SHELL= /bin/sh - -INDOT= -XFER_INDOT= -# -# Uppercase versions of the above variables (`INDOT_U' and `XFER_INDOT_U') -# are defined for use in `.TH' lines. -# - -# -# Command used to generate a manual entry. By default this produces catable -# manual entries. -# -# For systems that store manuals in MDOC form (eg modern BSD systems) and -# can generate catable manual entries on the fly the following assignment -# can be used. -# MANROFF = cat -# -MANROFF = ( tbl | nroff -mandoc ) - -# -# Default extensions for installed manual entries. The following variables -# have been defined to allow BIND's manual entries to be installed in the -# right place for a given platform. -# -# CMD_EXT = extension for user commands (eg, dig) -# LIB_NETWORK_EXT = extension for network library routines (eg, -# gethostbyname) -# FORMAT_EXT = extension for files describing file formats -# (eg, resolver) -# DESC_EXT = extension for descriptive files (eg, mailaddr) -# SYS_OPS_EXT = extension system operation and maintenance commands -# and applications. (eg, named, named-xfer, syslog) -# -# Associated with each variable is an additional variable with the suffix -# `_DIR' that specifies the suffix to ${MANDIR}. It's needed because on -# some systems, eg., Ultrix, multiple subsections (eg 3x, 3m 3n) are -# stored in generic manual section directories (eg., man3). -# -# Associated with each variable is an additional variable with the suffix -# `_U' which gives the upper case form of the variable for use in `.TH' -# commands. Useful for platforms (such as Solaris 2) that include letters -# in manual sections. -# -CMD_EXT = 1 -CMD_EXT_DIR = ${CMD_EXT} -LIB_NETWORK_EXT = 3 -LIB_NETWORK_EXT_DIR = ${LIB_NETWORK_EXT} -FORMAT_EXT = 5 -FORMAT_EXT_DIR = ${FORMAT_EXT} -DESC_EXT = 7 -DESC_EXT_DIR = ${DESC_EXT} -SYS_OPS_EXT = 8 -SYS_OPS_EXT_DIR = ${SYS_OPS_EXT} - -# -# Additional variables are defined for cross-references within manual -# entries: -# SYSCALL_EXT = extension for system calls -# BSD_SYSCALL_EXT = extension for BSD-specifc system calls. On some -# systems (eg Ultrix) these appear in section 2. -# On other system (eg SunOS 5) these are implemented -# via a BSD-compatibility library and appear in -# section 3. -# LIB_C_EXT = extension for C library routines (eg, signal) -# -SYSCALL_EXT = 2 -SYSCALL_EXT_DIR = ${SYSCALL_EXT} -BSD_SYSCALL_EXT = 2 -BSD_SYSCALL_EXT_DIR = ${BSD_SYSCALL_EXT} -LIB_C_EXT = 3 -LIB_C_EXT_DIR = ${LIB_C_EXT} - -###################################################################### -# -# No user changes needed past this point. -# -###################################################################### -# -# This sed command is used to update the manual entries so they refer to -# the appropriate section of the manual for a given platform. -# -EXT_SED_CMD = INDOT_U=`echo "${INDOT}"|tr "[a-z]" "[A-Z]"`; \ - export INDOT_U; \ - XFER_INDOT_U=`echo "${XFER_INDOT}"|tr "[a-z]" "[A-Z]"`; \ - export XFER_INDOT_U; \ - CMD_EXT_U=`echo "${CMD_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export CMD_EXT_U; \ - SYS_OPS_EXT_U=`echo "${SYS_OPS_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export SYS_OPS_EXT_U; \ - LIB_NETWORK_EXT_U=`echo "${LIB_NETWORK_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export LIB_NETWORK_EXT_U; \ - FORMAT_EXT_U=`echo "${FORMAT_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export FORMAT_EXT_U; \ - DESC_EXT_U=`echo "${DESC_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export DESC_EXT_U; \ - SYSCALL_EXT_U=`echo "${SYSCALL_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export SYSCALL_EXT_U; \ - BSD_SYSCALL_EXT_U=`echo "${BSD_SYSCALL_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export BSD_SYSCALL_EXT_U; \ - LIB_C_EXT_U=`echo "${LIB_C_EXT}"|tr "[a-z]" "[A-Z]"`; \ - export LIB_C_EXT_U; \ - sed -e "s/@INDOT@/${INDOT}/g" \ - -e "s/@INDOT_U@/$${INDOT_U}/g" \ - -e "s/@XFER_INDOT@/${XFER_INDOT}/g" \ - -e "s/@XFER_INDOT_U@/$${XFER_INDOT_U}/g" \ - -e "s/@CMD_EXT@/${CMD_EXT}/g" \ - -e "s/@CMD_EXT_U@/$${CMD_EXT_U}/g" \ - -e "s/@LIB_NETWORK_EXT@/${LIB_NETWORK_EXT}/g" \ - -e "s/@LIB_NETWORK_EXT_U@/$${LIB_NETWORK_EXT_U}/g" \ - -e "s/@FORMAT_EXT@/${FORMAT_EXT}/g" \ - -e "s/@FORMAT_EXT_U@/$${FORMAT_EXT_U}/g" \ - -e "s/@DESC_EXT@/${DESC_EXT}/g" \ - -e "s/@DESC_EXT_U@/$${DESC_EXT_U}/g" \ - -e "s/@SYS_OPS_EXT@/${SYS_OPS_EXT}/g" \ - -e "s/@SYS_OPS_EXT_U@/$${SYS_OPS_EXT_U}/g" \ - -e "s/@SYSCALL_EXT@/${SYSCALL_EXT}/g" \ - -e "s/@SYSCALL_EXT_U@/$${SYSCALL_EXT_U}/g" \ - -e "s/@BSD_SYSCALL_EXT@/${BSD_SYSCALL_EXT}/g" \ - -e "s/@BSD_SYSCALL_EXT_U@/$${BSD_SYSCALL_EXT_U}/g" \ - -e "s/@LIB_C_EXT@/${LIB_C_EXT}/g" \ - -e "s/@LIB_C_EXT_U@/$${LIB_C_EXT_U}/g" - -# -# Command used to produce manual entries -# -MK_MANFILE = ( ${EXT_SED_CMD} | ${MANROFF} ) - -# -# Extensions for the generated manual entries -# -OUT_EXT = lst -CMD_OUT_EXT = ${OUT_EXT}${CMD_EXT} -LIB_NETWORK_OUT_EXT = ${OUT_EXT}${LIB_NETWORK_EXT} -FORMAT_OUT_EXT = ${OUT_EXT}${FORMAT_EXT} -DESC_OUT_EXT = ${OUT_EXT}${DESC_EXT} -SYS_OPS_OUT_EXT = ${OUT_EXT}${SYS_OPS_EXT} - -# -# User command manual entries -# -CMD_BASE = dig host dnsquery dnskeygen -CMD_SRC_EXT = 1 -CMD_SRC = dig.${CMD_SRC_EXT} \ - host.${CMD_SRC_EXT} \ - dnsquery.${CMD_SRC_EXT} \ - dnskeygen.${CMD_SRC_EXT} -CMD_OUT = dig.${CMD_OUT_EXT} \ - host.${CMD_OUT_EXT} \ - dnsquery.${CMD_OUT_EXT} \ - dnskeygen.${CMD_OUT_EXT} - -# -# named manual entries -# -NAMED_BASE = named ndc -SYS_OPS_SRC_EXT = 8 -NAMED_SRC = named.${SYS_OPS_SRC_EXT} ndc.${SYS_OPS_SRC_EXT} -NAMED_OUT = named.${SYS_OPS_OUT_EXT} ndc.${SYS_OPS_OUT_EXT} - -# -# named-xfer manual entry -# -NAMED_XFER_BASE = named-xfer -NAMED_XFER_SRC = named-xfer.${SYS_OPS_SRC_EXT} -NAMED_XFER_OUT = named-xfer.${SYS_OPS_OUT_EXT} - -# -# named-bootconf manual entry -# -NAMED_BOOTCONF_BASE = named-bootconf -NAMED_BOOTCONF_SRC = named-bootconf.${SYS_OPS_SRC_EXT} -NAMED_BOOTCONF_OUT = named-bootconf.${SYS_OPS_OUT_EXT} - -# -# nslookup manual entry -# -NSLOOKUP_BASE = nslookup -NSLOOKUP_SRC = nslookup.${SYS_OPS_SRC_EXT} -NSLOOKUP_OUT = nslookup.${SYS_OPS_OUT_EXT} - -# -# nsupdate manual entry -# -NSUPDATE_BASE = nsupdate -NSUPDATE_SRC = nsupdate.${SYS_OPS_SRC_EXT} -NSUPDATE_OUT = nsupdate.${SYS_OPS_OUT_EXT} - -# -# Network library routines manual entries -# -LIB_NETWORK_BASE = gethostbyname inet_cidr resolver hesiod getnetent \ - tsig getaddrinfo getnameinfo getipnodebyname -LIB_NETWORK_SRC_EXT = 3 -LIB_NETWORK_SRC = gethostbyname.${LIB_NETWORK_SRC_EXT} \ - inet_cidr.${LIB_NETWORK_SRC_EXT} \ - resolver.${LIB_NETWORK_SRC_EXT} \ - hesiod.${LIB_NETWORK_SRC_EXT} \ - getnetent.${LIB_NETWORK_SRC_EXT} \ - tsig.${LIB_NETWORK_SRC_EXT} \ - getaddrinfo.${LIB_NETWORK_SRC_EXT} \ - getnameinfo.${LIB_NETWORK_SRC_EXT} \ - getipnodebyname.${LIB_NETWORK_SRC_EXT} -LIB_NETWORK_OUT = gethostbyname.${LIB_NETWORK_OUT_EXT} \ - inet_cidr.${LIB_NETWORK_OUT_EXT} \ - resolver.${LIB_NETWORK_OUT_EXT} \ - hesiod.${LIB_NETWORK_OUT_EXT} \ - getnetent.${LIB_NETWORK_OUT_EXT} \ - tsig.${LIB_NETWORK_OUT_EXT} \ - getaddrinfo.${LIB_NETWORK_OUT_EXT} \ - getnameinfo.${LIB_NETWORK_OUT_EXT} \ - getipnodebyname.${LIB_NETWORK_OUT_EXT} - -# -# File format manual entries -# -FORMAT_BASE = resolver irs.conf named.conf -FORMAT_SRC_EXT = 5 -FORMAT_SRC = resolver.${FORMAT_SRC_EXT} \ - irs.conf.${FORMAT_SRC_EXT} \ - named.conf.${FORMAT_SRC_EXT} -FORMAT_OUT = resolver.${FORMAT_OUT_EXT} \ - irs.conf.${FORMAT_OUT_EXT} \ - named.conf.${FORMAT_OUT_EXT} - -# -# Feature Description manual entries -# -DESC_BASE = hostname mailaddr -DESC_SRC_EXT = 7 -DESC_SRC = hostname.${DESC_SRC_EXT} mailaddr.${DESC_SRC_EXT} -DESC_OUT = hostname.${DESC_OUT_EXT} mailaddr.${DESC_OUT_EXT} - -.SUFFIXES: .${CMD_SRC_EXT} .${CMD_OUT_EXT} \ - .${SYS_OPS_SRC_EXT} .${SYS_OPS_OUT_EXT} \ - .${LIB_NETWORK_SRC_EXT} .${LIB_NETWORK_OUT_EXT} \ - .${FORMAT_SRC_EXT} .${FORMAT_OUT_EXT} \ - .${DESC_SRC_EXT} .${DESC_OUT_EXT} - -.${CMD_SRC_EXT}.${CMD_OUT_EXT}: - @echo "$*.${CMD_SRC_EXT} -> $*.${CMD_OUT_EXT}" - @${MK_MANFILE} <$*.${CMD_SRC_EXT} >$*.${CMD_OUT_EXT} - -.${SYS_OPS_SRC_EXT}.${SYS_OPS_OUT_EXT}: - @echo "$*.${SYS_OPS_SRC_EXT} -> $*.${SYS_OPS_OUT_EXT}" - @${MK_MANFILE} <$*.${SYS_OPS_SRC_EXT} >$*.${SYS_OPS_OUT_EXT} - -.${LIB_NETWORK_SRC_EXT}.${LIB_NETWORK_OUT_EXT}: - @echo "$*.${LIB_NETWORK_SRC_EXT} -> $*.${LIB_NETWORK_OUT_EXT}" - @${MK_MANFILE} <$*.${LIB_NETWORK_SRC_EXT} >$*.${LIB_NETWORK_OUT_EXT} - -.${FORMAT_SRC_EXT}.${FORMAT_OUT_EXT}: - @echo "$*.${FORMAT_SRC_EXT} -> $*.${FORMAT_OUT_EXT}" - @${MK_MANFILE} <$*.${FORMAT_SRC_EXT} >$*.${FORMAT_OUT_EXT} - -.${DESC_SRC_EXT}.${DESC_OUT_EXT}: - @echo "$*.${DESC_SRC_EXT} -> $*.${DESC_OUT_EXT}" - @${MK_MANFILE} <$*.${DESC_SRC_EXT} >$*.${DESC_OUT_EXT} - -OUTFILES = ${CMD_OUT} ${NAMED_OUT} ${NAMED_XFER_OUT} ${NSLOOKUP_OUT} \ - ${NSUPDATE_OUT} ${LIB_NETWORK_OUT} ${FORMAT_OUT} ${DESC_OUT} \ - ${NAMED_BOOTCONF_OUT} - -all: ${OUTFILES} - -install: ${OUTFILES} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${CMD_EXT_DIR} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${LIB_NETWORK_EXT_DIR} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${FORMAT_EXT_DIR} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${DESC_EXT_DIR} - @set -x; N=${CMD_EXT}; for f in ${CMD_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${CMD_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${CMD_EXT_DIR}/$${f}.${CATEXT}; \ - done - @set -x; N=${SYS_OPS_EXT}; for f in ${NAMED_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${SYS_OPS_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR}/${INDOT}$${f}.${CATEXT}; \ - done - @set -x; N=${SYS_OPS_EXT}; for f in ${NAMED_XFER_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${SYS_OPS_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR}/${XFER_INDOT}$${f}.${CATEXT}; \ - done - @set -x; N=${SYS_OPS_EXT}; for f in ${NAMED_BOOTCONF_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${SYS_OPS_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR}/${XFER_INDOT}$${f}.${CATEXT}; \ - done - @set -x; N=${SYS_OPS_EXT}; for f in ${NSLOOKUP_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${SYS_OPS_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR}/$${f}.${CATEXT}; \ - done - @set -x; N=${SYS_OPS_EXT}; for f in ${NSUPDATE_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${SYS_OPS_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR}/$${f}.${CATEXT}; \ - done - @set -x; N=${LIB_NETWORK_EXT}; for f in ${LIB_NETWORK_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${LIB_NETWORK_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${LIB_NETWORK_EXT_DIR}/$${f}.${CATEXT}; \ - done - @set -x; N=${FORMAT_EXT}; for f in ${FORMAT_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${FORMAT_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${FORMAT_EXT_DIR}/$${f}.${CATEXT}; \ - done - @set -x; N=${DESC_EXT}; for f in ${DESC_BASE}; do \ - ${INSTALL} -c -m 444 ${MAN_OWNER} ${MAN_GROUP} \ - $${f}.${DESC_OUT_EXT} \ - ${DESTDIR}${DESTMAN}/${MANDIR}${DESC_EXT_DIR}/$${f}.${CATEXT}; \ - done - -${DESTDIR}${DESTMAN}/${MANDIR}${CMD_EXT_DIR} \ -${DESTDIR}${DESTMAN}/${MANDIR}${SYS_OPS_EXT_DIR} \ -${DESTDIR}${DESTMAN}/${MANDIR}${LIB_NETWORK_EXT_DIR} \ -${DESTDIR}${DESTMAN}/${MANDIR}${FORMAT_EXT_DIR} \ -${DESTDIR}${DESTMAN}/${MANDIR}${DESC_EXT_DIR}: - mkdir $@ - -links: FRC - @set -ex; ln -s SRC/*.[0-9] . - -depend: - -clean: - rm -f *~ *.BAK *.CKP *.orig - rm -f ${OUTFILES} - -FRC: diff --git a/contrib/bind/doc/man/dig.1 b/contrib/bind/doc/man/dig.1 deleted file mode 100644 index 829a585..0000000 --- a/contrib/bind/doc/man/dig.1 +++ /dev/null @@ -1,705 +0,0 @@ -.\" $FreeBSD$ -.\" $Id: dig.1,v 8.11 2003/04/03 05:52:34 marka Exp $ -.\" -.\" ++Copyright++ 1993 -.\" - -.\" Copyright (c) 1993 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" - -.\" Portions Copyright (c) 1993 by Digital Equipment Corporation. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Digital Equipment Corporation not be used in advertising or -.\" publicity pertaining to distribution of the document or software without -.\" specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" - -.\" --Copyright-- -.\" -.\" Distributed with 'dig' version 2.0 from University of Southern -.\" California Information Sciences Institute (USC-ISI). -.\" -.\" dig.1 2.0 (USC-ISI) 8/30/90 -.\" -.Dd August 30, 1990 -.Dt DIG @CMD_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm dig -.Nd send domain name query packets to name servers -.Sh SYNOPSIS -.Nm dig -.Op Ic @ Ns Ar server -.Ar domain -.Op Aq Ar query-type -.Op Aq Ar query-class -.Op Ic + Ns Aq Ar query-option -.Op Fl Aq Ar dig-option -.Op Ar %comment -.Sh DESCRIPTION -.Ic Dig -(domain information groper) is a flexible command line tool -which can be used to gather information from the Domain -Name System servers. -.Ic Dig -has two modes: simple interactive mode -for a single query, and batch mode which executes a query for -each in a list of several query lines. All query options are -accessible from the command line. -.Pp -The usual simple use of -.Ic dig -will take the form: -.Pp -.Bd -ragged -offset indent-two -.Ic dig @ Ns Ar server domain query-type query-class -.Ed -.Pp -where: -.Bl -tag -width Fl -.It Ar server -may be either a domain name or a raw (IPv4 / IPv6) -Internet address. If this optional field is omitted, -.Ic dig -will attempt to use the default name server for your machine. -.Pp -.Em Note : -If a domain name is specified, this will be resolved -using the domain name system resolver (i.e., BIND). If your -system does not support DNS, you may -.Em have -to specify a -dot-notation address. Alternatively, if there is a server -at your disposal somewhere, all that is required is that -.Pa /etc/resolv.conf -be present and indicate where the default -name servers reside, so that -.Ar server -itself can be resolved. See -.Xr resolver @FORMAT_EXT@ -for information on -.Pa /etc/resolv.conf . -.Sy WARNING : -Changing -.Pa /etc/resolv.conf -will affect both the standard resolver library and -.Pq potentially -several programs which use it. -As an option, the user may set the -environment variable -.Ev LOCALRES -to name a file which is to -be used instead of -.Pa /etc/resolv.conf -.Ns Ev (LOCALRES -is specific to the -.Ic dig -resolver and is not referenced by the standard resolver). -If the -.Ev LOCALRES -variable is not set or the specified file -is not readable, then -.Pa /etc/resolv.conf -will be used. -.It Ar domain -is the domain name for which you are requesting information. -See the -.Fl x -option (documented in the -.Sx OTHER OPTIONS -subsection of this section) for convenient way to specify reverse address -query. -.It Ar query-type -is the type of information (DNS query type) that -you are requesting. If omitted, the default is -.Dq Ar a -.Pq Dv T_A = Ar address . -The following types are recognized: -.Pp -.Bl -hang -width "hinfo T_HINFO " -compact -.It Ar a\ \ \ \ \ \ Dv T_A -network address -.It Ar any\ \ \ \ Dv T_ANY -all/any information about specified domain -.It Ar mx\ \ \ \ \ Dv T_MX -mail exchanger for the domain -.It Ar ns\ \ \ \ \ Dv T_NS -name servers -.It Ar soa\ \ \ \ Dv T_SOA -zone of authority record -.It Ar hinfo\ \ Dv T_HINFO -host information -.It Ar axfr\ \ \ Dv T_AXFR -zone transfer (must ask an authoritative server) -.It Ar txt\ \ \ \ Dv T_TXT -arbitrary number of strings -.El -.Pp -(See RFC 1035 for the complete list.) -.It Ar query-class -is the network class requested in the query. If -omitted, the default is -.Dq Ar in -.Pq Dv C_IN = Ar Internet . -The following classes are recognized: -.Pp -.Bl -tag -width "hinfo T_HINFO " -compact -.It Ar in\ \ \ \ \ Dv C_IN -Internet class domain -.It Ar any\ \ \ \ Dv C_ANY -all/any class information -.El -.Pp -(See RFC 1035 for the complete list.) -.Pp -.Em Note : -.Dq Ar Any -can be used to specify a -.Em class -and/or a -.Em type -of query. -.Ic Dig -will parse the first occurrence of -.Dq Ar any -to mean -.Ar query-type = Dv T_ANY . -To specify -.Ar query-class = Dv C_ANY , -you must either specify -.Dq any -twice, or set -.Ar query-class -using the -.Fl c -option (see below). -.El -.Ss OTHER OPTIONS -.Bl -tag -width Fl -.It % Ns Ar ignored-comment -.Dq % -is used to included an argument that is simply not -parsed. This may be useful if running -.Ic dig -in batch -mode. Instead of resolving every -.Ar @server-domain-name -in a list of queries, you can avoid the overhead of doing -so, and still have the domain name on the command line -as a reference. Example: -.Pp -.Bd -ragged -offset indent-two -.Ic dig @128.9.0.32 %venera.isi.edu mx isi.edu -.Ed -.Pp -.It Fl Aq Ar dig option -.Dq Fl -is used to specify an option which affects the operation of -.Ic dig . -The following options are currently -available (although not guaranteed to be useful): -.Bl -tag -width Fl -.It Fl x Ar dot-notation-address -Convenient form to specify inverse address mapping. -Instead of -.Dq Ic dig 32.0.9.28.in-addr.arpa , -one can simply -.Dq Ic dig -x 28.9.0.32 . -.It Fl x Ar IPv6-address -Convenient form to specify inverse address mapping. -Instead of -.Dq Ic dig 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa , -one can simply -.Dq Ic dig -x ::1 . -.It Fl f Ar file -File for -.Ic dig -batch mode. The file contains a list -of query specifications -( -.Ns Ic dig -command lines) which are to be executed successively. Lines beginning with -.Sq \&; , -.Sq # , -or -.Sq \en -are ignored. Other options -may still appear on command line, and will be in -effect for each batch query. -.It Fl T Ar time -Time in seconds between start of successive -queries when running in batch mode. Can be used -to keep two or more batch -.Ic dig -commands running -roughly in sync. Default is zero. -.It Fl p Ar port -Port number. Query a name server listening to a -non-standard port number. Default is 53. -.It Fl P Ns Bq Ar ping-string -After query returns, execute a -.Xr ping @SYS_OPS_EXT@ -command for response time comparison. This rather -unelegantly makes a call to the shell. The last -three lines of statistics is printed for the -command: -.Pp -.Bd -ragged -offset indent-two -.Ic ping Fl s server_name 56 3 -.Ed -.Pp -If the optional -.Dq Ar ping_string -is present, it -replaces -.Dq Ic ping Fl s -in the shell command. -.It Fl t Ar query-type -Specify type of query. May specify either an -integer value to be included in the type field -or use the abbreviated mnemonic as discussed -above (i.e., -.Ar mx = Dv T_MX ) . -.It Fl c Ar query-class -Specify class of query. May specify either an -integer value to be included in the class field -or use the abbreviated mnemonic as discussed -above (i.e., in = C_IN). -.It Fl k Ar keydir:keyname -Sign the query with the TSIG key named keyname -that is in the directory keydir. -.It Fl envsav -This flag specifies that the -.Ic dig -environment -(defaults, print options, etc.), after -all of the arguments are parsed, should be saved -to a file to become the default environment. -This is useful if you do not like the standard set of -defaults and do not desire to include a -large number of options each time -.Ic dig -is used. The environment consists of resolver state -variable flags, timeout, and retries as well as the flags detailing -.Ic dig -output (see below). -If the shell environment variable -.Ev LOCALDEF -is set to the name of a file, this is where the default -.Ic dig -environment is saved. If not, the file -.Dq Pa DiG.env -is created in the current working directory. -.Pp -.Em Note : -.Ev LOCALDEF -is specific to the -.Ic dig -resolver, -and will not affect operation of the standard -resolver library. -.Pp -Each time -.Ic dig -is executed, it looks for -.Dq Pa ./DiG.env -or the file specified by the shell environment variable -.Ev LOCALDEF . -If such file exists and is readable, then the -environment is restored from this file before any arguments are parsed. -.It Fl envset -This flag only affects batch query runs. When -.Dq Fl envset -is specified on a line in a -.Ic dig -batch file, the -.Ic dig -environment after the arguments are parsed -becomes the default environment for the duration of -the batch file, or until the next line which specifies -.Dq Fl envset . -.It Xo -.Fl Op Cm no -.Ns Cm stick -.Xc -This flag only affects batch query runs. -It specifies that the -.Ic dig -environment (as read initially -or set by -.Dq Fl envset -switch) is to be restored before each query (line) in a -.Ic dig -batch file. -The default -.Dq Fl nostick -means that the -.Ic dig -environment does not stick, hence options specified on a single line -in a -.Ic dig -batch file will remain in effect for -subsequent lines (i.e. they are not restored to the -.Dq sticky -default). -.El -.It Ic + Ns Aq Ar query-option -.Dq + -is used to specify an option to be changed in the query packet or to change -.Ic dig -output specifics. Many of these are the same parameters accepted by -.Xr nslookup @SYS_OPS_EXT@ . -If an option requires a parameter, the form is as follows: -.Pp -.Bd -ragged -offset indent-two -.Ic + -.Ns Ar keyword -.Ns Op = Ns Ar value -.Ed -.Pp -Most keywords can be abbreviated. Parsing of the -.Dq + -options is very simplistic \(em a value must not be -separated from its keyword by white space. The following -keywords are currently available: -.Pp -Keyword Abbrev. Meaning [default] -.Pp -.Bl -tag -width "[no]primary (ret) " -compact -.It Xo -.Op Cm no -.Ns Cm debug\ \ \ \ -.Pq Cm deb -.Xc -turn on/off debugging mode -.Bq Cm deb -.It Xo -.Op Cm no -.Ns Cm d2\ \ \ \ \ \ \ \ \ \ -.Xc -turn on/off extra debugging mode -.Bq Cm nod2 -.It Xo -.Op Cm no -.Ns Cm recurse\ \ -.Pq Cm rec -.Xc -use/don't use recursive lookup -.Bq Cm rec -.It Xo -.Cm retry= Ns Ar # -.Cm \ \ \ \ \ -.Pq Cm ret -.Xc -set number of retries to # -.Bq 4 -.It Xo -.Cm time= Ns Ar # -.Cm \ \ \ \ \ \ -.Pq Cm ti -.Xc -set timeout length to # seconds -.Bq 4 -.It Xo -.Op Cm no -.Ns Cm ko -.Xc -keep open option (implies vc) -.Bq Cm noko -.It Xo -.Op Cm no -.Ns Cm vc -.Xc -use/don't use virtual circuit -.Bq Cm novc -.It Xo -.Op Cm no -.Ns Cm defname\ \ -.Pq Cm def -.Xc -use/don't use default domain name -.Bq Cm def -.It Xo -.Op Cm no -.Ns Cm search\ \ \ -.Pq Cm sea -.Xc -use/don't use domain search list -.Bq Cm sea -.It Xo -.Cm domain= Ns Ar NAME\ \ -.Pq Cm do -.Xc -set default domain name to -.Ar NAME -.It Xo -.Op Cm no -.Ns Cm ignore\ \ \ -.Pq Cm i -.Xc -ignore/don't ignore trunc. errors -.Bq Cm noi -.It Xo -.Op Cm no -.Ns Cm primary\ \ -.Pq Cm pr -.Xc -use/don't use primary server -.Bq Cm nopr -.It Xo -.Op Cm no -.Ns Cm aaonly\ \ \ -.Pq Cm aa -.Xc -authoritative query only flag -.Bq Cm noaa -.It Xo -.Op Cm no -.Ns Cm cmd -.Xc -echo parsed arguments -.Bq Cm cmd -.It Xo -.Op Cm no -.Ns Cm stats\ \ \ \ -.Pq Cm st -.Xc -print query statistics -.Bq Cm st -.It Xo -.Op Cm no -.Ns Cm Header\ \ \ -.Pq Cm H -.Xc -print basic header -.Bq Cm H -.It Xo -.Op Cm no -.Ns Cm header\ \ \ -.Pq Cm he -.Xc -print header flags -.Bq Cm he -.It Xo -.Op Cm no -.Ns Cm ttlid\ \ \ \ -.Pq Cm tt -.Xc -print TTLs -.Bq Cm tt -.It Xo -.Op Cm no -.Ns Cm trunc\ \ \ \ -.Pq Cm tr -.Xc -truncate origin from names -.Bq Cm tr -.It Xo -.Op Cm no -.Ns Cm cl -.Xc -print class info -.Bq Cm nocl -.It Xo -.Op Cm no -.Ns Cm qr -.Xc -print outgoing query -.Bq Cm noqr -.It Xo -.Op Cm no -.Ns Cm reply\ \ \ \ -.Pq Cm rep -.Xc -print reply -.Bq Cm rep -.It Xo -.Op Cm no -.Ns Cm ques\ \ \ \ \ -.Pq Cm qu -.Xc -print question section -.Bq Cm qu -.It Xo -.Op Cm no -.Ns Cm answer\ \ \ -.Pq Cm an -.Xc -print answer section -.Bq Cm an -.It Xo -.Op Cm no -.Ns Cm author\ \ \ -.Pq Cm au -.Xc -print authoritative section -.Bq Cm au -.It Xo -.Op Cm no -.Ns Cm addit\ \ \ \ -.Pq Cm ad -.Xc -print additional section -.Bq Cm ad -.It Xo -.Op Cm no -.Ns Cm dnssec\ \ \ -.Pq Cm \ddn -.Xc -set the DNSSEC OK bit in the OPT pseudo record -.Bq Cm nodn -.It Cm pfdef -set to default print flags -.It Cm pfmin -set to minimal default print flags -.It Cm pfset= Ns Ar # -set print flags to # -(# can be hex/octal/decimal) -.It Cm pfand= Ns Ar # -bitwise and print flags with # -.It Cm pfor= Ns Ar # -bitwise or print flags with # -.El -.Pp -The -.Cm retry -and -.Cm time -options affect the retransmission strategy used by the resolver -library when sending datagram queries. The algorithm is as follows: -.Pp -.Bd -literal -offset indent -for i = 0 to retry - 1 - for j = 1 to num_servers - send_query - wait((time * (2**i)) / num_servers) - end -end -.Ed -.Pp -(Note: -.Ic dig -always uses a value of 1 for -.Dq Li num_servers . ) -.El -.Ss DETAILS -.Ic Dig -once required a slightly modified version of the BIND -.Xr resolver @LIB_NETWORK_EXT@ -library. As of BIND 4.9, BIND's resolver has been augmented to work -properly with -.Ic dig . -Essentially, -.Ic dig -is a straight-forward -(albeit not pretty) effort of parsing arguments and setting appropriate -parameters. -.Ic Dig -uses -.Xr resolver @LIB_NETWORK_EXT@ -routines -.Fn res_init , -.Fn res_mkquery , -.Fn res_send -as well as accessing the -.Ft _res -structure. -.Sh ENVIRONMENT -.Bl -tag -width "LOCALRES " -compact -.It Ev LOCALRES -file to use in place of -.Pa /etc/resolv.conf -.It Ev LOCALDEF -default environment file -.El -.Pp -See also the explanation of the -.Fl envsav , -.Fl envset , -and -.Xo -.Fl Op Cm no -.Ns Cm stick -.Xc -options, above. -.Sh FILES -.Bl -tag -width "/etc/resolv.conf " -compact -.It Pa /etc/resolv.conf -initial domain name and name server addresses -.It Pa \./DiG.env -default save file for default options -.El -.Sh SEE ALSO -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ , -.Xr nslookup @SYS_OPS_EXT@ . -.Sh STANDARDS -RFC 1035. -.Sh AUTHOR -Steve Hotz -hotz@isi.edu -.Sh ACKNOWLEDGMENTS -.Ic Dig -uses functions from -.Xr nslookup @SYS_OPS_EXT@ -authored by Andrew Cherenson. -.Sh BUGS -.Ic Dig -has a serious case of "creeping featurism" -- the result of -considering several potential uses during its development. It would -probably benefit from a rigorous diet. Similarly, the print flags -and granularity of the items they specify make evident their -rather ad hoc genesis. -.Pp -.Ic Dig -does not consistently exit nicely (with appropriate status) -when a problem occurs somewhere in the resolver -.Po -.Sy NOTE : -most of the common exit cases are handled -.Pc . -This is particularly annoying when running in -batch mode. If it exits abnormally (and is not caught), the entire -batch aborts; when such an event is trapped, -.Ic dig -simply -continues with the next query. diff --git a/contrib/bind/doc/man/dnskeygen.1 b/contrib/bind/doc/man/dnskeygen.1 deleted file mode 100644 index 7080f95..0000000 --- a/contrib/bind/doc/man/dnskeygen.1 +++ /dev/null @@ -1,132 +0,0 @@ -.\" Copyright (c) 1996,1999 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" -.\" $Id: dnskeygen.1,v 8.8 2002/04/22 04:27:19 marka Exp $ -.\" -.Dd December 2, 1998 -.Dt DNSKEYGEN @CMD_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm dnskeygen -.Nd "generate public, private, and shared secret keys for DNS Security" -.Sh SYNOPSIS -.Nm dnskeygen -.Oo -.Fl Op Cm DHR -.Ar size -.Oc -.Op Fl F -.Op Fl Cm zhu -.Op Fl Cm a -.Op Fl Cm c -.Op Fl Cm p Ar num -.Op Fl Cm s Ar num -.Fl n Ar name -.Sh DESCRIPTION -.Ic Dnskeygen -(DNS Key Generator) is a tool to generate and maintain keys for DNS Security -within the DNS (Domain Name System). -.Nm Dnskeygen -can generate public and private keys to authenticate zone data, and shared -secret keys to be used for Request/Transaction signatures. -.Bl -tag -width Fl -.It Fl D -Dnskeygen will generate a -.Ic DSA/DSS -key. -.Dq size -must be one of [512, 576, 640, 704, 768, 832, 896, 960, 1024]. -.It Fl H -Dnskeygen will generate an -.Ic HMAC-MD5 -key. -.Dq size -must be between 128 and 504. -.It Fl R -Dnskeygen will generate an -.Ic RSA -key. -.Dq size -must be between 512 and 4096. -.It Fl F -.Ic ( RSA only ) -Use a large exponent for key generation. -.It Fl z Fl h Fl u -These flags define the type of key being generated: Zone (DNS validation) key, -Host (host or service) key or User (e.g. email) key, respectively. -Each key is only allowed to be one of these. -.It Fl a -Indicates that the key -.Ic CANNOT -be used for authentication. -.It Fl c -Indicates that the key -.Ic CANNOT -be used for encryption. -.It Fl p Ar num -Sets the key's protocol field to -.Ar num ; -the default is -.Ic 3 -(DNSSEC) if -.Dq Fl z -or -.Dq Fl h -is specified and -.Ic 2 -(EMAIL) otherwise. Other accepted values are -.Ic 1 -(TLS), -.Ic 4 -(IPSEC), and -.Ic 255 -(ANY). -.It Fl s Ar num -Sets the key's strength field to -.Ar num ; -the default is -.Sy 0 . -.It Fl n Ar name -Sets the key's name to -.Ar name . -.El -.Ss DETAILS -.Ic Dnskeygen -stores each key in two files: -.Pa K<name>+<alg>+<footprint>.private -and -.Pa K<name>+<alg>+<footprint>.key -The file -.Pa K<name>+<alg>+<footprint>.private -contains the private key in a portable format. The file -.Pa K<name>+<alg>+<footprint>.key -contains the public key in the DNS zone file format: -.Pp -.D1 Ar <name> IN KEY <flags> <algorithm> <protocol> <exponent|modulus> -.Pp -.Sh ENVIRONMENT -No environmental variables are used. -.Sh SEE ALSO -.Em RFC 2065 -on secure DNS and the -.Em TSIG -Internet Draft. -.Sh AUTHOR -Olafur Gudmundsson (ogud@tis.com). -.Sh ACKNOWLEDGMENTS -The underlying cryptographic math is done by the DNSSAFE and/or Foundation -Toolkit libraries. -.Sh BUGS -None are known at this time diff --git a/contrib/bind/doc/man/dnsquery.1 b/contrib/bind/doc/man/dnsquery.1 deleted file mode 100644 index b6588c6..0000000 --- a/contrib/bind/doc/man/dnsquery.1 +++ /dev/null @@ -1,180 +0,0 @@ -.\" $Id: dnsquery.1,v 8.5 2002/06/18 02:04:54 marka Exp $ -.\" -.\"Copyright (c) 1995,1996,1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.\" -.Dd March 10, 1990 -.Dt DNSQUERY @CMD_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm dnsquery -.Nd query domain name servers using resolver -.Sh SYNOPSIS -.Nm dnsquery -.Op Fl n Ar nameserver -.Op Fl t Ar type -.Op Fl c Ar class -.Op Fl r Ar retry -.Op Fl p Ar period -.Op Fl d -.Op Fl s -.Op Fl v -.Ar host -.Sh DESCRIPTION -The -.Ic dnsquery -program is a general interface to nameservers via -BIND resolver library calls. The program supports -queries to the nameserver with an opcode of QUERY. -This program is intended to be a replacement or -supplement to programs like nstest, nsquery and -nslookup. All arguments except for -.Ar host -and -.Ar nameserver -are treated without case-sensitivity. -.Sh OPTIONS -.Bl -tag -width Fl -.It Fl n Ar nameserver -The nameserver to be used in the query. Nameservers can appear as either -Internet addresses of the form -.Ar ( w.x.y.z -or -.Ar xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx ) -or can appear as domain names. -(Default: as specified in -.Pa /etc/resolv.conf . ) -.It Fl t Ar type -The type of resource record of interest. Types include: -.Bl -tag -width "AFSDB " -compact -offset indent -.It Ar A -address -.It Ar NS -nameserver -.It Ar CNAME -canonical name -.It Ar PTR -domain name pointer -.It Ar SOA -start of authority -.It Ar WKS -well-known service -.It Ar HINFO -host information -.It Ar MINFO -mailbox information -.It Ar MX -mail exchange -.It Ar RP -responsible person -.It Ar MG -mail group member -.It Ar AFSDB -DCE or AFS server -.It Ar ANY -wildcard -.El -.Pp -Note that any case may be used. (Default: -.Ar ANY . ) -.It Fl c Ar class -The class of resource records of interest. -Classes include: -.Bl -tag -width "CHAOS " -compact -offset indent -.It Ar IN -Internet -.It Ar HS -Hesiod -.It Ar CHAOS -Chaos -.It Ar ANY -wildcard -.El -.Pp -Note that any case may be used. (Default: -.Ar IN . ) -.It Fl r Ar retry -The number of times to retry if the nameserver is -not responding. (Default: 4.) -.It Fl p Ar period -Period to wait before timing out. (Default: -.Dv RES_TIMEOUT . ) -.It Fl d -Turn on debugging. This sets the -.Dv RES_DEBUG -bit of the resolver's -.Ft options -field. (Default: no debugging.) -.It Fl s -Use a -.Em stream -rather than a packet. This uses a TCP stream connection with -the nameserver rather than a UDP datagram. This sets the -.Dv RES_USEVC -bit of the resolver's -.Ft options -field. (Default: UDP datagram.) -.It Fl v -Synonym for the -.Dq Fl s -flag. -.It Ar host -The name of the host (or domain) of interest. -.El -.Sh FILES -.Bl -tag -width "<arpa/nameser.h> " -compact -.It Pa /etc/resolv.conf -to get the default ns and search lists -.It Pa <arpa/nameser.h> -list of usable RR types and classes -.It Pa <resolv.h> -list of resolver flags -.El -.Sh DIAGNOSTICS -If the resolver fails to answer the query and debugging has not been -turned on, -.Ic dnsquery -will simply print a message like: -.Dl Query failed (rc = 1) : Unknown host -.Pp -The value of the return code is supplied by -.Ft h_errno . -.Sh SEE ALSO -.Xr nslookup @SYS_OPS_EXT@ , -.Xr nstest @CMD_EXT@ , -.Xr nsquery @CMD_EXT@ , -.Xr named @SYS_OPS_EXT@ , -.Xr resolver @FORMAT_EXT@ . -.Sh AUTHOR -Bryan Beecher -.Sh BUGS -Queries of a class other than -.Ar IN -can have interesting results -since ordinarily a nameserver only has a list of root nameservers -for class -.Ar IN -resource records. -.Pp -.Ic Dnsquery -uses a call to -.Fn inet_addr -to determine if the argument -for the -.Dq Fl n -option is a valid Internet address. Unfortunately, -.Fn inet_addr -seems to cause a segmentation fault with some (bad) -IP addresses (e.g., 1.2.3.4.5). diff --git a/contrib/bind/doc/man/getaddrinfo.3 b/contrib/bind/doc/man/getaddrinfo.3 deleted file mode 100644 index a18d3d0..0000000 --- a/contrib/bind/doc/man/getaddrinfo.3 +++ /dev/null @@ -1,360 +0,0 @@ -.\" Copyright (c) 1983, 1987, 1991, 1993 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" -.\" From: @(#)gethostbyname.3 8.4 (Berkeley) 5/25/95 -.\" $Id: getaddrinfo.3,v 8.3 2001/12/28 04:24:15 marka Exp $ -.\" -.Dd May 25, 1995 -.Dt GETADDRINFO @LIB_NETWORK_EXT@ -.Os KAME -.Sh NAME -.Nm getaddrinfo -.Nm freeaddrinfo , -.Nm gai_strerror -.Nd nodename-to-address translation in protocol-independent manner -.Sh SYNOPSIS -.Fd #include <sys/socket.h> -.Fd #include <netdb.h> -.Ft int -.Fn getaddrinfo "const char *nodename" "const char *servname" \ -"const struct addrinfo *hints" "struct addrinfo **res" -.Ft void -.Fn freeaddrinfo "struct addrinfo *ai" -.Ft "char *" -.Fn gai_strerror "int ecode" -.Sh DESCRIPTION -The -.Fn getaddrinfo -function is defined for protocol-independent nodename-to-address translation. -It performs functionality of -.Xr gethostbyname @LIB_NETWORK_EXT@ -and -.Xr getservbyname @LIB_NETWORK_EXT@ , -in more sophisticated manner. -.Pp -The addrinfo structure is defined as a result of including the -.Li <netdb.h> -header: -.Bd -literal -offset -struct addrinfo { * - int ai_flags; /* AI_PASSIVE, AI_CANONNAME, AI_NUMERICHOST */ - int ai_family; /* PF_xxx */ - int ai_socktype; /* SOCK_xxx */ - int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */ - size_t ai_addrlen; /* length of ai_addr */ - char *ai_canonname; /* canonical name for nodename */ - struct sockaddr *ai_addr; /* binary address */ - struct addrinfo *ai_next; /* next structure in linked list */ -}; -.Ed -.Pp -The -.Fa nodename -and -.Fa servname -arguments are pointers to null-terminated strings or -.Dv NULL . -One or both of these two arguments must be a -.Pf non Dv -NULL -pointer. -In the normal client scenario, both the -.Fa nodename -and -.Fa servname -are specified. -In the normal server scenario, only the -.Fa servname -is specified. -A -.Pf non Dv -NULL -.Fa nodename -string can be either a node name or a numeric host address string -(i.e., a dotted-decimal IPv4 address or an IPv6 hex address). -A -.Pf non Dv -NULL -.Fa servname -string can be either a service name or a decimal port number. -.Pp -The caller can optionally pass an -.Li addrinfo -structure, pointed to by the third argument, -to provide hints concerning the type of socket that the caller supports. -In this -.Fa hints -structure all members other than -.Fa ai_flags , -.Fa ai_family , -.Fa ai_socktype , -and -.Fa ai_protocol -must be zero or a -.Dv NULL -pointer. -A value of -.Dv PF_UNSPEC -for -.Fa ai_family -means the caller will accept any protocol family. -A value of 0 for -.Fa ai_socktype -means the caller will accept any socket type. -A value of 0 for -.Fa ai_protocol -means the caller will accept any protocol. -For example, if the caller handles only TCP and not UDP, then the -.Fa ai_socktype -member of the hints structure should be set to -.Dv SOCK_STREAM -when -.Fn getaddrinfo -is called. -If the caller handles only IPv4 and not IPv6, then the -.Fa ai_family -member of the -.Fa hints -structure should be set to -.Dv PF_INET -when -.Fn getaddrinfo -is called. -If the third argument to -.Fn getaddrinfo -is a -.Dv NULL -pointer, this is the same as if the caller had filled in an -.Li addrinfo -structure initialized to zero with -.Fa ai_family -set to PF_UNSPEC. -.Pp -Upon successful return a pointer to a linked list of one or more -.Li addrinfo -structures is returned through the final argument. -The caller can process each -.Li addrinfo -structure in this list by following the -.Fa ai_next -pointer, until a -.Dv NULL -pointer is encountered. -In each returned -.Li addrinfo -structure the three members -.Fa ai_family , -.Fa ai_socktype , -and -.Fa ai_protocol -are the corresponding arguments for a call to the -.Fn socket -function. -In each -.Li addrinfo -structure the -.Fa ai_addr -member points to a filled-in socket address structure whose length is -specified by the -.Fa ai_addrlen -member. -.Pp -If the -.Dv AI_PASSIVE -bit is set in the -.Fa ai_flags -member of the -.Fa hints -structure, then the caller plans to use the returned socket address -structure in a call to -.Fn bind . -In this case, if the -.Fa nodename -argument is a -.Dv NULL -pointer, then the IP address portion of the socket -address structure will be set to -.Dv INADDR_ANY -for an IPv4 address or -.Dv IN6ADDR_ANY_INIT -for an IPv6 address. -.Pp -If the -.Dv AI_PASSIVE -bit is not set in the -.Fa ai_flags -member of the -.Fa hints -structure, then the returned socket address structure will be ready for a -call to -.Fn connect -.Pq for a connection-oriented protocol -or either -.Fn connect , -.Fn sendto , -or -.Fn sendmsg -.Pq for a connectionless protocol . -In this case, if the -.Fa nodename -argument is a -.Dv NULL -pointer, then the IP address portion of the -socket address structure will be set to the loopback address. -.Pp -If the -.Dv AI_CANONNAME -bit is set in the -.Fa ai_flags -member of the -.Fa hints -structure, then upon successful return the -.Fa ai_canonname -member of the first -.Li addrinfo -structure in the linked list will point to a null-terminated string -containing the canonical name of the specified -.Fa nodename . -.Pp -If the -.Dv AI_NUMERICHOST -bit is set in the -.Fa ai_flags -member of the -.Fa hints -structure, then a -.Pf non Dv -NULL -.Fa nodename -string must be a numeric host address string. -Otherwise an error of -.Dv EAI_NONAME -is returned. -This flag prevents any type of name resolution service (e.g., the DNS) -from being called. -.Pp -All of the information returned by -.Fn getaddrinfo -is dynamically allocated: -the -.Li addrinfo -structures, and the socket address structures and canonical node name -strings pointed to by the addrinfo structures. -To return this information to the system the function -Fn freeaddrinfo -is called. -The -.Fa addrinfo -structure pointed to by the -.Fa ai argument -is freed, along with any dynamic storage pointed to by the structure. -This operation is repeated until a -.Dv NULL -.Fa ai_next -pointer is encountered. -.Pp -To aid applications in printing error messages based on the -.Dv EAI_xxx -codes returned by -.Fn getaddrinfo , -.Fn gai_strerror -is defined. -The argument is one of the -.Dv EAI_xxx -values defined earlier and the return value points to a string describing -the error. -If the argument is not one of the -.Dv EAI_xxx -values, the function still returns a pointer to a string whose contents -indicate an unknown error. -.Sh FILES -.Bl -tag -width /etc/resolv.conf -compact -.It Pa /etc/hosts -.It Pa /etc/host.conf -.It Pa /etc/resolv.conf -.El -.Sh DIAGNOSTICS -Error return status from -.Fn getaddrinfo -is zero on success and non-zero on errors. -Non-zero error codes are defined in -.Li <netdb.h> , -and as follows: -.Pp -.Bl -tag -width EAI_ADDRFAMILY -compact -.It Dv EAI_ADDRFAMILY -address family for nodename not supported -.It Dv EAI_AGAIN -temporary failure in name resolution -.It Dv EAI_BADFLAGS -invalid value for ai_flags -.It Dv EAI_FAIL -non-recoverable failure in name resolution -.It Dv EAI_FAMILY -ai_family not supported -.It Dv EAI_MEMORY -memory allocation failure -.It Dv EAI_NODATA -no address associated with nodename -.It Dv EAI_NONAME -nodename nor servname provided, or not known -.It Dv EAI_SERVICE -servname not supported for ai_socktype -.It Dv EAI_SOCKTYPE -ai_socktype not supported -.It Dv EAI_SYSTEM -system error returned in errno -.El -.Pp -If called with proper argument, -.Fn gai_strerror -returns a pointer to a string describing the given error code. -If the argument is not one of the -.Dv EAI_xxx -values, the function still returns a pointer to a string whose contents -indicate an unknown error. -.Sh SEE ALSO -.Xr getnameinfo @LIB_NETWORK_EXT@ , -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr getservbyname @LIB_NETWORK_EXT@ , -.Xr hosts @FORMAT_EXT@ , -.Xr services @FORMAT_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr named @SYS_OPS_EXT@ -.Pp -R. Gilligan, S. Thomson, J. Bound, and W. Stevens, -``Basic Socket Interface Extensions for IPv6,'' RFC2133, April 1997. -.Sh HISTORY -The implementation first appeared in WIDE Hydrangea IPv6 protocol stack kit. -.Sh STANDARDS -The -.Fn getaddrinfo -function is defined IEEE POSIX 1003.1g draft specification, -and documented in ``Basic Socket Interface Extensions for IPv6'' -(RFC2133). -.Sh BUGS -The text was shamelessly copied from RFC2133. diff --git a/contrib/bind/doc/man/gethostbyname.3 b/contrib/bind/doc/man/gethostbyname.3 deleted file mode 100644 index e23d51e..0000000 --- a/contrib/bind/doc/man/gethostbyname.3 +++ /dev/null @@ -1,242 +0,0 @@ -.\" Copyright (c) 1983, 1987 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted provided -.\" that: (1) source distributions retain this entire copyright notice and -.\" comment, and (2) distributions including binaries display the following -.\" acknowledgement: ``This product includes software developed by the -.\" University of California, Berkeley and its contributors'' in the -.\" documentation or other materials provided with the distribution and in -.\" all advertising materials mentioning features or use of this software. -.\" Neither the name of the University nor the names of its contributors may -.\" be used to endorse or promote products derived from this software without -.\" specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED -.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF -.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)gethostbyname.3 6.12 (Berkeley) 6/23/90 -.\" -.Dd June 23, 1990 -.Dt GETHOSTBYNAME @LIB_NETWORK_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm gethostbyname , -.Nm gethostbyaddr , -.Nm gethostent , -.Nm sethostent , -.Nm endhostent , -.Nm herror -.Nd get network host entry -.Sh SYNOPSIS -.Fd #include <netdb.h> -.Ft extern int -.Fa h_errno ; -.Pp -.Ft struct hostent * -.Fn gethostbyname "char *name" -.Ft struct hostent * -.Fn gethostbyname2 "char *name" "int af" -.Ft struct hostent * -.Fn gethostbyaddr "char *addr" "int len, type" -.Ft struct hostent * -.Fn gethostent -.Fn sethostent "int stayopen" -.Fn endhostent -.Fn herror "char *string" -.Sh DESCRIPTION -.Fn Gethostbyname , -.Fn gethostbyname2 , -and -.Fn gethostbyaddr -each return a pointer to a -.Ft hostent -structure (see below) describing an internet host -referenced by name or by address, as the function names indicate. -This structure contains either the information obtained from the name server, -.Xr @INDOT@named @SYS_OPS_EXT@ , -or broken-out fields from a line in -.Pa /etc/hosts . -If the local name server is not running, these routines do a lookup in -.Pa /etc/hosts . -.Bd -literal -offset indent -struct hostent { - char *h_name; /* official name of host */ - char **h_aliases; /* alias list */ - int h_addrtype; /* host address type */ - int h_length; /* length of address */ - char **h_addr_list; /* list of addresses from name server */ -}; - -#define h_addr h_addr_list[0] /* address, for backward compatibility */ -.Ed -.Pp -The members of this structure are: -.Bl -tag -width "h_addr_list" -.It h_name -Official name of the host. -.It h_aliases -A zero-terminated array of alternate names for the host. -.It h_addrtype -The type of address being returned; usually -.Dv AF_INET . -.It h_length -The length, in bytes, of the address. -.It h_addr_list -A zero-terminated array of network addresses for the host. -Host addresses are returned in network byte order. -.It h_addr -The first address in -.Li h_addr_list ; -this is for backward compatibility. -.El -.Pp -When using the nameserver, -.Fn gethostbyname -will search for the named host in each parent domain given in the -.Dq Li search -directive of -.Xr resolv.conf @FORMAT_EXT@ -unless the name contains a dot -.Pq Dq \&. . -If the name contains no dot, and if the environment variable -.Ev HOSTALIASES -contains the name of an alias file, the alias file will first be searched -for an alias matching the input name. -See -.Xr hostname @DESC_EXT@ -for the domain search procedure and the alias file format. -.Pp -.Fn Gethostbyname2 -is an evolution of -.Fn gethostbyname -intended to allow lookups in address families other than -.Dv AF_INET , -for example, -.Dv AF_INET6 . -Currently, the -.Fa af -argument must be specified as -.Dv AF_INET -else the function will return -.Dv NULL -after having set -.Ft h_errno -to -.Dv NETDB_INTERNAL . -.Pp -.Fn Sethostent -may be used to request the use of a connected TCP socket for queries. -If the -.Fa stayopen -flag is non-zero, -this sets the option to send all queries to the name server using TCP -and to retain the connection after each call to -.Fn gethostbyname -or -.Fn gethostbyaddr . -Otherwise, queries are performed using UDP datagrams. -.Pp -.Fn Endhostent -closes the TCP connection. -.Sh ENVIRONMENT -.Bl -tag -width "HOSTALIASES " -compact -.It Ev HOSTALIASES -Name of file containing -.Pq Ar host alias , full hostname -pairs. -.El -.Sh FILES -.Bl -tag -width "HOSTALIASES " -compact -.It Pa /etc/hosts -See -.Xr hosts @FORMAT_EXT@ . -.El -.Sh DIAGNOSTICS -.Pp -Error return status from -.Fn gethostbyname -and -.Fn gethostbyaddr -is indicated by return of a null pointer. -The external integer -.Ft h_errno -may then be checked to see whether this is a temporary failure -or an invalid or unknown host. -The routine -.Fn herror -can be used to print an error message describing the failure. -If its argument -.Fa string -is non-NULL, it is printed, followed by a colon and a space. -The error message is printed with a trailing newline. -.Pp -.Ft h_errno -can have the following values: -.Bl -tag -width "HOST_NOT_FOUND " -offset indent -.It Dv NETDB_INTERNAL -This indicates an internal error in the library, unrelated to the network -or name service. -.Ft errno -will be valid in this case; see -.Xr perror @SYSCALL_EXT@ . -.It Dv HOST_NOT_FOUND -No such host is known. -.It Dv TRY_AGAIN -This is usually a temporary error -and means that the local server did not receive -a response from an authoritative server. -A retry at some later time may succeed. -.It Dv NO_RECOVERY -Some unexpected server failure was encountered. -This is a non-recoverable error, as one might expect. -.It Dv NO_DATA -The requested name is valid but does not have an IP address; -this is not a temporary error. -This means that the name is known to the name server but there is no address -associated with this name. -Another type of request to the name server using this domain name -will result in an answer; -for example, a mail-forwarder may be registered for this domain. -.El -.Sh SEE ALSO -.Xr hosts @FORMAT_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ . -.Sh CAVEAT -.Pp -.Fn Gethostent -is defined, and -.Fn sethostent -and -.Fn endhostent -are redefined, -when -.Pa libc -is built to use only the routines to lookup in -.Pa /etc/hosts -and not the name server: -.Bd -ragged -offset indent -.Pp -.Fn Gethostent -reads the next line of -.Pa /etc/hosts , -opening the file if necessary. -.Pp -.Fn Sethostent -is redefined to open and rewind the file. If the -.Fa stayopen -argument is non-zero, -the hosts data base will not be closed after each call to -.Fn gethostbyname -or -.Fn gethostbyaddr . -.Pp -.Fn Endhostent -is redefined to close the file. -.Ed -.Sh BUGS -All information is contained in a static area so it must be copied if it is -to be saved. Only the Internet address format is currently understood. diff --git a/contrib/bind/doc/man/getipnodebyname.3 b/contrib/bind/doc/man/getipnodebyname.3 deleted file mode 100644 index 95ca428..0000000 --- a/contrib/bind/doc/man/getipnodebyname.3 +++ /dev/null @@ -1,227 +0,0 @@ -.\" Copyright (c) 1996,1999 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" -.\" Copyright (c) 1983, 1987 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted provided -.\" that: (1) source distributions retain this entire copyright notice and -.\" comment, and (2) distributions including binaries display the following -.\" acknowledgement: ``This product includes software developed by the -.\" University of California, Berkeley and its contributors'' in the -.\" documentation or other materials provided with the distribution and in -.\" all advertising materials mentioning features or use of this software. -.\" Neither the name of the University nor the names of its contributors may -.\" be used to endorse or promote products derived from this software without -.\" specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED -.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF -.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.Dd September 17, 1999 -.Dt GETIPNODEBYNAME @LIB_NETWORK_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm getipnodebyname , -.Nm getipnodebyaddr -.Nd get network host entry -.br -.Nm freehostent -.Nd free network host entry -.Sh SYNOPSIS -.Fd #include <netdb.h> -.Pp -.Ft struct hostent * -.Fn getipnodebyname "const char *name" "int af" "int flags" "int *error" -.Ft struct hostent * -.Fn getipnodebyaddr "const void *addr" "size_t len" "int af" "int *error" -.Ft void -.Fn freehostent "struct hostent *he" -.Sh DESCRIPTION -.Fn Getipnodebyname , -and -.Fn getipnodebyaddr -each return a pointer to a -.Ft hostent -structure (see below) describing an internet host -referenced by name or by address, as the function names indicate. -This structure contains either the information obtained from the name server, -.Xr @INDOT@named @SYS_OPS_EXT@ , -or broken-out fields from a line in -.Pa /etc/hosts . -If the local name server is not running, these routines do a lookup in -.Pa /etc/hosts . -.Bd -literal -offset indent -struct hostent { - char *h_name; /* official name of host */ - char **h_aliases; /* alias list */ - int h_addrtype; /* host address type */ - int h_length; /* length of address */ - char **h_addr_list; /* list of addresses from name server */ -}; - -#define h_addr h_addr_list[0] /* address, for backward compatibility */ -.Ed -.Pp -The members of this structure are: -.Bl -tag -width "h_addr_list" -.It h_name -Official name of the host. -.It h_aliases -A zero-terminated array of alternate names for the host. -.It h_addrtype -The type of address being returned. -.It h_length -The length, in bytes, of the address. -.It h_addr_list -A zero-terminated array of network addresses for the host. -Host addresses are returned in network byte order. -.It h_addr -The first address in -.Li h_addr_list ; -this is for backward compatibility. -.El -.Pp -This structure should be freed after use by calling -.Fn freehostent . -.Pp -When using the nameserver, -.Fn getiphostbyaddr -will search for the named host in each parent domain given in the -.Dq Li search -directive of -.Xr resolv.conf @FORMAT_EXT@ -unless the name contains a dot -.Pq Dq \&. . -If the name contains no dot, and if the environment variable -.Ev HOSTALIASES -contains the name of an alias file, the alias file will first be searched -for an alias matching the input name. -See -.Xr hostname @DESC_EXT@ -for the domain search procedure and the alias file format. -.Pp -.Fn Getiphostbyaddr -can be told to look for IPv4 addresses, IPv6 addresses or both IPv4 and IPv6. -If IPv4 addresses only are to be looked up then -.Fa af -should be set to -.Dv AF_INET , -otherwise it should be set to -.Dv AF_INET6 . -.Pp -There are three flags that can be set -.Bl -tag -width "AI_ADDRCONFIG" -.It Dv AI_V4MAPPED -Return IPv4 addresses if no IPv6 addresses are found. -This flag is ignored unless -.Fa af -is -.Dv AF_INET6 . -.It Dv AI_ALL -Return IPv4 addresses as well IPv6 addresses if -.Dv AI_V4MAPPED -is set. -This flag is ignored unless -.Fa af -is -.Dv AF_INET6 . -.It Dv AI_ADDRCONFIG -Only return addresses of a given type if the system has an active interface -with that type. -.El -.Pp -Also -.Dv AI_DEFAULT -is defined to be -.Dv (AI_V4MAPPED|AI_ADDRCONFIG) . -.Pp -.Fn Getipnodebyaddr -will lookup IPv4 mapped and compatible addresses in the IPv4 name -space and IPv6 name space -.Pp -.Fn Freehostent -frees the hostent structure allocated be -.Fn getipnodebyname -and -.Fn getipnodebyaddr . -The structures returned by -.Fn gethostbyname , -.Fn gethostbyname2 , -.Fn gethostbyaddr -and -.Fn gethostent -should not be passed to -.Fn freehostent -as they are pointers to static areas. -.Sh ENVIRONMENT -.Bl -tag -width "HOSTALIASES " -compact -.It Ev HOSTALIASES -Name of file containing -.Pq Ar host alias , full hostname -pairs. -.El -.Sh FILES -.Bl -tag -width "HOSTALIASES " -compact -.It Pa /etc/hosts -See -.Xr hosts @FORMAT_EXT@ . -.El -.Sh DIAGNOSTICS -.Pp -Error return status from -.Fn getipnodebyname -and -.Fn getipnodebyaddr -is indicated by return of a null pointer. -In this case -.Ft error -may then be checked to see whether this is a temporary failure -or an invalid or unknown host. -.Ft errno -can have the following values: -.Bl -tag -width "HOST_NOT_FOUND " -offset indent -.It Dv NETDB_INTERNAL -This indicates an internal error in the library, unrelated to the network -or name service. -.Ft errno -will be valid in this case; see -.Xr perror @SYSCALL_EXT@ . -.It Dv HOST_NOT_FOUND -No such host is known. -.It Dv TRY_AGAIN -This is usually a temporary error -and means that the local server did not receive -a response from an authoritative server. -A retry at some later time may succeed. -.It Dv NO_RECOVERY -Some unexpected server failure was encountered. -This is a non-recoverable error, as one might expect. -.It Dv NO_ADDRESS -The requested name is valid but does not have an IP address; -this is not a temporary error. -This means that the name is known to the name server but there is no address -associated with this name. -Another type of request to the name server using this domain name -will result in an answer; -for example, a mail-forwarder may be registered for this domain. -.El -.Sh SEE ALSO -.Xr hosts @FORMAT_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ , -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr RFC2553 . diff --git a/contrib/bind/doc/man/getnameinfo.3 b/contrib/bind/doc/man/getnameinfo.3 deleted file mode 100644 index e80dc36..0000000 --- a/contrib/bind/doc/man/getnameinfo.3 +++ /dev/null @@ -1,103 +0,0 @@ -.\" $Id: getnameinfo.3,v 8.2 2001/12/28 04:24:16 marka Exp $ -.\" -.\"Copyright (c) 1998,1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.\" -.Dd January 11, 1999 -.Dt GETRNAMEINFO @LIB_NETWORK_EXT@ -.Sh NAME -.Nm getnameinfo -.Nd address-to-name translation in protocol-independent manner -.Sh SYNOPSIS -.Fd #include <sys/socket.h> -.Fd #include <netdb.h> -.Ft int -.Fn getnameinfo "const struct sockaddr *sa" "socklen_t salen" \ -"char *host" "size_t hostlen" "char *serv" "size_t servlen" "int flags" -.Sh DESCRIPTION -The -.Fn getnameinfo -function is defined for protocol-independent address-to-nodename translation. -It performs functionality of -.Xr gethostbyaddr @LIB_NETWORK_EXT@ -and -.Xr getservbyport @LIB_NETWORK_EXT@ -in more sophisticated manner. -.Pp -The -.Fa sa -arguement is a pointer to a generic socket address structure of size -.Fa salen . -The arguements -.Fa host -and -.Fa serv -are pointers to buffers to hold the return values. -Their sizes are specified by -.Fa hostlen -and -.Fa servlen -repectively. -Either -.Fa host -or -.Fa serv -may be -.Dv NULL -if the hostname or service name is not required. -.Pp -The -.Fa flags -arguement modifies the behaviour of -.Fn getnameinfo -as follows: -.Pp -If -.Dv NI_NOFQDN -is set only the unqualified hostname is returned for local fully -qualified names. -.Pp -If -.Dv NI_NUMERICHOST -is set then the numeric form of the hostname is returned. -.Pp -If -.Dv NI_NAMEREQD -is set, then a error is returned if the hostname cannot be looked up. -.Pp -If -.Dv NI_NUMERICSERV -is set then the service is returned in numeric form. -.Pp -If -.Dv NI_DGRAM -is set then the service is UDP based rather than TCP based. -.Sh SEE ALSO -.Xr getaddrinfo @LIB_NETWORK_EXT@ , -.Xr gethostbyaddr @LIB_NETWORK_EXT@ , -.Xr getservbyport @LIB_NETWORK_EXT@ , -.Xr hosts @FORMAT_EXT@ , -.Xr services @FORMAT_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr named @SYS_OPS_EXT@ -.Pp -R. Gilligan, S. Thomson, J. Bound, and W. Stevens, -``Basic Socket Interface Extensions for IPv6,'' RFC2133, April 1997. -.Sh STANDARDS -The -.Fn getaddrinfo -function is defined IEEE POSIX 1003.1g draft specification, -and documented in ``Basic Socket Interface Extensions for IPv6'' -(RFC2133). diff --git a/contrib/bind/doc/man/getnetent.3 b/contrib/bind/doc/man/getnetent.3 deleted file mode 100644 index 0475256..0000000 --- a/contrib/bind/doc/man/getnetent.3 +++ /dev/null @@ -1,154 +0,0 @@ -.\" $Id: getnetent.3,v 8.6 2001/12/28 04:24:17 marka Exp $ -.\" -.\"Copyright (c) 1995,1996,1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.\" -.Dd May 20, 1996 -.Dt GETNETENT @LIB_NETWORK_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm getnetent , -.Nm getnetbyaddr , -.Nm getnetbyname , -.Nm setnetent , -.Nm endnetent -.Nd get networks entry -.Sh SYNOPSIS -.Fd #include <netdb.h> -.Ft struct netent * -.Fn getnetent -.Ft struct netent * -.Fn getnetbyname "char name" -.Ft struct netent * -.Fn getnetbyaddr "unsigned long net" "int type" -.Ft void -.Fn setnetent "int stayopen" -.Ft void -.Fn endnetent -.Sh DESCRIPTION -The -.Fn getnetent , -.Fn getnetbyname , -and -.Fn getnetbyaddr -subroutines -each return a pointer to an object with the following structure -containing the broken-out fields of a line in the -.Pa networks -database. -.Bd -literal -offset indent -struct netent { - char *n_name; /* official name of net */ - char **n_aliases; /* alias list */ - int n_addrtype; /* net number type */ - long n_net; /* net number */ -}; -.Ed -.Pp -The members of this structure are: -.Bl -tag -width "n_addrtype" -.It n_name -The official name of the network. -.It n_aliases -A zero-terminated list of alternate names for the network. -.It n_addrtype -The type of the network number returned: -.Dv AF_INET . -.It n_net -The network number. Network numbers are returned in machine byte -order. -.El -.Pp -If the -.Fa stayopen -flag on a -.Fn setnetent -subroutine is NULL, the -.Pa networks -database is opened. Otherwise, the -.Fn setnetent -has the effect of rewinding the -.Pa networks -database. -The -.Fn endnetent -subroutine may be called to -close the -.Pa networks -database when processing is complete. -.Pp -The -.Fn getnetent -subroutine simply reads the next -line while -.Fn getnetbyname -and -.Fn getnetbyaddr -search until a matching -.Fa name -or -.Fa net -number is found -(or until -.Dv EOF -is encountered). The -.Fa type must be -.Dv AF_INET . -The -.Fn getnetent -subroutine keeps a pointer in the database, allowing -successive calls to be used to search the entire file. -.Pp -Before a -.Ic while -loop using -.Fn getnetent , -a call to -.Fn setnetent -must be made -in order to perform initialization; a call to -.Fn endnetent -must be used after the loop. Both -.Fn getnetbyname -and -.Fn getnetbyaddr -make calls to -.Fn setnetent -and -.Fn endnetent . -.Sh FILES -.Pa /etc/networks -.Sh DIAGNOSTICS -Null pointer (0) returned on -.Dv EOF -or error. -.Sh SEE ALSO -.Xr networks @FORMAT_EXT@ , -RFC 1101. -.Sh HISTORY -The -.Fn "getnetent" , -.Fn "getnetbyaddr" , -.Fn "getnetbyname" , -.Fn "setnetent" , -and -.Fn "endnetent" -functions appeared in -.Bx 4.2 . -.Sh BUGS -The data space used by these functions is static; if future use requires the -data, it should be copied before any subsequent calls to these functions -overwrite it. Only Internet network numbers are currently understood. -Expecting network numbers to fit in no more than 32 bits is probably naive. diff --git a/contrib/bind/doc/man/hesiod.3 b/contrib/bind/doc/man/hesiod.3 deleted file mode 100644 index 284b8f4..0000000 --- a/contrib/bind/doc/man/hesiod.3 +++ /dev/null @@ -1,129 +0,0 @@ -.\" $Id: hesiod.3,v 8.1 1999/04/12 02:47:00 vixie Exp $ -.\" -.\" Copyright 1988, 1996 by the Massachusetts Institute of Technology. -.\" -.\" Permission to use, copy, modify, and distribute this -.\" software and its documentation for any purpose and without -.\" fee is hereby granted, provided that the above copyright -.\" notice appear in all copies and that both that copyright -.\" notice and this permission notice appear in supporting -.\" documentation, and that the name of M.I.T. not be used in -.\" advertising or publicity pertaining to distribution of the -.\" software without specific, written prior permission. -.\" M.I.T. makes no representations about the suitability of -.\" this software for any purpose. It is provided "as is" -.\" without express or implied warranty. -.\" -.TH HESIOD 3 "30 November 1996" -.SH NAME -hesiod, hesiod_init, hesiod_resolve, hesiod_free_list, hesiod_to_bind, hesiod_end \- Hesiod name server interface library -.SH SYNOPSIS -.nf -.B #include <hesiod.h> -.PP -.B int hesiod_init(void **\fIcontext\fP) -.B char **hesiod_resolve(void *\fIcontext\fP, const char *\fIname\fP, -.B const char *\fItype\fP) -.B void hesiod_free_list(void *\fIcontext\fP, char **\fIlist\fP); -.B char *hesiod_to_bind(void *\fIcontext\fP, const char *\fIname\fP, -.B const char *\fItype\fP) -.B void hesiod_end(void *\fIcontext\fP) -.fi -.SH DESCRIPTION -This family of functions allows you to perform lookups of Hesiod -information, which is stored as text records in the Domain Name -Service. To perform lookups, you must first initialize a -.IR context , -an opaque object which stores information used internally by the -library between calls. -.I hesiod_init -initializes a context, storing a pointer to the context in the -location pointed to by the -.I context -argument. -.I hesiod_end -frees the resources used by a context. -.PP -.I hesiod_resolve -is the primary interface to the library. If successful, it returns a -list of one or more strings giving the records matching -.I name -and -.IR type . -The last element of the list is followed by a NULL pointer. It is the -caller's responsibility to call -.I hesiod_free_list -to free the resources used by the returned list. -.PP -.I hesiod_to_bind -converts -.I name -and -.I type -into the DNS name used by -.IR hesiod_resolve . -It is the caller's responsibility to free the returned string using -.IR free . -.SH RETURN VALUES -If successful, -.I hesiod_init -returns 0; otherwise it returns \-1 and sets -.I errno -to indicate the error. On failure, -.I hesiod_resolve -and -.I hesiod_to_bind -return NULL and set the global variable -.I errno -to indicate the error. -.SH ENVIRONMENT -If the environment variable -.B HES_DOMAIN -is set, it will override the domain in the Hesiod configuration file. -If the environment variable -.B HESIOD_CONFIG -is set, it specifies the location of the Hesiod configuration file. -.SH SEE ALSO -`Hesiod - Project Athena Technical Plan -- Name Service', named(8), -hesiod.conf(5) -.SH ERRORS -Hesiod calls may fail because of: -.IP ENOMEM -Insufficient memory was available to carry out the requested -operation. -.IP ENOEXEC -.I hesiod_init -failed because the Hesiod configuration file was invalid. -.IP ECONNREFUSED -.I hesiod_resolve -failed because no name server could be contacted to answer the query. -.IP EMSGSIZE -.I hesiod_resolve -failed because the query or response was too big to fit into the -packet buffers. -.IP ENOENT -.I hesiod_resolve -failed because the name server had no text records matching -.I name -and -.IR type , -or -.I hesiod_to_bind -failed because the -.I name -argument had a domain extension which could not be resolved with type -``rhs-extension'' in the local Hesiod domain. -.SH AUTHOR -Steve Dyer, IBM/Project Athena -.br -Greg Hudson, MIT Team Athena -.br -Copyright 1987, 1988, 1995, 1996 by the Massachusetts Institute of Technology. -.SH BUGS -The strings corresponding to the -.I errno -values set by the Hesiod functions are not particularly indicative of -what went wrong, especially for -.I ENOEXEC -and -.IR ENOENT . diff --git a/contrib/bind/doc/man/host.1 b/contrib/bind/doc/man/host.1 deleted file mode 100644 index ae5736a..0000000 --- a/contrib/bind/doc/man/host.1 +++ /dev/null @@ -1,317 +0,0 @@ -.\" $FreeBSD$ -.\" ++Copyright++ 1993 -.\" - -.\" Copyright (c) 1993 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" - -.\" Portions Copyright (c) 1993 by Digital Equipment Corporation. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Digital Equipment Corporation not be used in advertising or -.\" publicity pertaining to distribution of the document or software without -.\" specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" - -.\" --Copyright-- -.\" $Id: host.1,v 8.7 2002/06/18 02:39:26 marka Exp $ -.Dd December 15, 1994 -.Dt HOST @CMD_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm host -.Nd look up host names using domain server -.Sh SYNOPSIS -.Nm host -.Op Fl l -.Op Fl v -.Op Fl w -.Op Fl r -.Op Fl d -.Op Fl t Ar querytype -.Op Fl a -.Ar host -.Op Ar server -.Sh DESCRIPTION -.Ic Host -looks for information about Internet hosts. It gets this information -from a set of interconnected servers that are spread across the -world. By default, it simply converts between host names and -Internet addresses. However, with the -.Dq Fl t -or -.Dq Fl a -options, it can be used -to find all of the information about this host that is maintained -by the domain server. -.Pp -The arguments can be either host names or host numbers. The program -first attempts to interpret them as host numbers. If this fails, -it will treat them as host names. A host number consists of -IPv4 dotted decimal quad (127.0.0.1) or IPv6 raw address (::1). -A host name consists of names separated by dots, e.g. topaz.rutgers.edu. -Unless the name ends in a dot, the local domain -is automatically tacked on the end. Thus, a Rutgers user can say -.Pp -.D1 Ic host topaz -.Pp -and it will actually look up "topaz.rutgers.edu". -If this fails, the name is tried unchanged (in this case, "topaz"). -This same convention is used for mail and other network utilities. -The actual suffix to tack on the end is obtained -by looking at the results of a -.Xr hostname @CMD_EXT@ -call, and using everything -starting at the first dot. (See below for a description of -.Sx CUSTOMIZING HOST NAME LOOKUP . ) -.Pp -The first argument is the host name you want to look up. -If this is a number, an -.Dq inverse query -is done, i.e. the domain -system looks in a separate set of databases used to convert numbers -to names. -.Pp -The second argument is optional. It -allows you to specify a particular server to query. If you don't -specify this argument, the default server (normally the local machine) -is used. -.Pp -If a name is specified, you may see output of three different kinds. -Here is an example that shows all of them: -.Pp -.D1 Ic % host sun4 -.Dl sun4.rutgers.edu is a nickname for ATHOS.RUTGERS.EDU -.Dl ATHOS.RUTGERS.EDU has address 128.6.5.46 -.Dl ATHOS.RUTGERS.EDU has address 128.6.4.4 -.Dl ATHOS.RUTGERS.EDU mail is handled by ARAMIS.RUTGERS.EDU -.Pp -The user has typed the command -.Dq Ic host sun4 . -The first line indicates that the name -.Dq Li sun4.rutgers.edu -is actually a nickname. The official host name is -.Dq Li ATHOS.RUTGERS.EDU . -The next two lines show the -address. If a system has more than one network interface, there -will be a separate address for each. The last line indicates -that -.Li ATHOS.RUTGERS.EDU -does not receive its own mail. Mail for -it is taken by -.Li ARAMIS.RUTGERS.EDU . -There may be more than one -such line, since some systems have more than one other system -that will handle mail for them. Technically, every system that -can receive mail is supposed to have an entry of this kind. If -the system receives its own mail, there should be an entry -the mentions the system itself; for example, -.Pp -.D1 Li XXX mail is handled by XXX -.Pp -However, many systems that receive -their own mail do not bother to mention that fact. If a system -has a -.Dq Li mail is handled by -entry, but no address, this indicates -that it is not really part of the Internet, but a system that is -on the network will forward mail to it. Systems on Usenet, Bitnet, -and a number of other networks have entries of this kind. -.Sh OPTIONS -There are a number of options that can be used before the -host name. Most of these options are meaningful only to the -staff who have to maintain the domain database. -.Bl -tag -width Fl -.It Fl w -This causes -.Ic host -to wait forever for a response. Normally -it will time out after approximate one minute. -.It Fl v -Use "verbose" format for printout. This -is the official domain master file format, which is documented -in the man page for -.Xr @INDOT@named @SYS_OPS_EXT@ . -Without this option, output still follows -this format in general terms, but some attempt is made to make it -more intelligible to normal users. Without -.Dq Fl v , -any "a", "mx", and "cname" records -are written out as "has address", "mail is handled by", and -"is a nickname for" (respectively), and TTL and class fields are not shown. -.It Fl r -Turn off recursion in the request. -This means that the name server will return only data it has in -its own database. It will not ask other servers for more -information. -.It Fl d -Turn on debugging. Network transactions are shown in detail. -.It Fl s -Chase signatures back to parent key (DNSSEC). -.It Fl t Ar querytype -Allows you to specify a particular -.Ar querytype -of information -to be looked up. The arguments are defined in the man page for -.Xr @INDOT@named @SYS_OPS_EXT@ . -Currently-supported types include: -.Dq Cm a , -.Dq Cm aaaa , -.Dq Cm ns , -.Dq Cm md , -.Dq Cm mf , -.Dq Cm cname , -.Dq Cm soa , -.Dq Cm mb , -.Dq Cm mg , -.Dq Cm mr , -.Dq Cm null , -.Dq Cm wks , -.Dq Cm ptr , -.Dq Cm hinfo , -.Dq Cm minfo , -.Dq Cm mx , -.Dq Cm uinfo , -.Dq Cm uid , -.Dq Cm gid , -.Dq Cm unspec . -Additionally, the wildcard, which may be written -as either -.Dq Cm any -or -.Dq Cm * , -can be used to specify any (all) of the above types. -Types must be given in lower case. -Note that the default is to look first for -.Dq Cm a , -and then -.Dq Cm mx , -except that if the verbose option is turned on, the default is only -.Dq Cm a . -The -.Dq Fl t -option is particularly useful for filtering information returned by -.Ic host ; -see the explanation of the -.Dq Fl l -option, below, for more information. -.It Fl a -.Dq all ; -this is equivalent to -.Dq Fl v Fl t Cm any . -.It Fl l -List a complete domain; e.g.: -.Pp -.D1 Ic host -l rutgers.edu -.Pp -will give a listing of all hosts in the rutgers.edu domain. The -.Dq Fl t -option is used to filter what information is presented, as you -would expect. The default is address information, which also -include PTR and NS records. The command -.Pp -.D1 Ic host -l -v -t any rutgers.edu -.Pp -will give a complete download of the zone data for rutgers.edu, -in the official master file format. (However the SOA record is -listed twice, for arcane reasons.) -.Pp -.Sy NOTE : -.Dq Fl l -is implemented by -doing a complete zone transfer and then filtering out the information -the you have asked for. This command should be used only if it -is absolutely necessary. -.El -.Sh CUSTOMIZING HOST NAME LOOKUP -In general, if the name supplied by the user does not -have any dots in it, a default domain is appended to the end. -This domain can be defined in -.Pa /etc/resolv.conf , -but is normally derived -by taking the local hostname after its first dot. The user can override -this, and specify a different default domain, using the environment -variable -.Ev LOCALDOMAIN . -In addition, the user can supply his own abbreviations for host names. -They should be in a file consisting of one line per abbreviation. -Each line contains an abbreviation, a space, and then the full -host name. The name file must be contained in the -.Ev HOSTALIASES -environment variable. -.Sh ENVIRONMENT -.Bl -tag -width "/etc/resolv.conf " -compact -.It Ev HOSTALIASES -Name of file containing -.Pq Ar host alias , full hostname -pairs. -.El -.Sh FILES -.Bl -tag -width "/etc/resolv.conf " -compact -.It Pa /etc/resolv.conf -See -.Xr resolver @FORMAT_EXT@ . -.El -.Sh SEE ALSO -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @FORMAT_EXT@ . -.Sh BUGS -Unexpected effects can happen when you type a name that is not -part of the local domain. Please always keep in mind the -fact that the local domain name is tacked onto the end of every -name, unless it ends in a dot. Only if this fails is the name -used unchanged. -.Pp -The -.Dq Fl l -option only tries the first name server listed for the -domain that you have requested. If this server is dead, you -may need to specify a server manually. E.g., to get a listing -of foo.edu, you could try -.Pp -.D1 Ic host -t ns foo.edu -.Pp -to get a list of all the name servers for foo.edu, and then try -.Pp -.D1 Ic host -l foo.edu xxx -.Pp -for all -.Dq Ic xxx -on the list of name servers, until you find one that works. diff --git a/contrib/bind/doc/man/hostname.7 b/contrib/bind/doc/man/hostname.7 deleted file mode 100644 index 1c5a256..0000000 --- a/contrib/bind/doc/man/hostname.7 +++ /dev/null @@ -1,168 +0,0 @@ -.\" Copyright (c) 1987 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted -.\" provided that the above copyright notice and this paragraph are -.\" duplicated in all such forms and that any documentation, -.\" advertising materials, and other materials related to such -.\" distribution and use acknowledge that the software was developed -.\" by the University of California, Berkeley. The name of the -.\" University may not be used to endorse or promote products derived -.\" from this software without specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR -.\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)hostname.7 6.4 (Berkeley) 1/16/90 -.\" -.Dd February 16, 1994 -.Dt HOSTNAME @DESC_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm hostname -.Nd host name resolution description -.Sh DESCRIPTION -Hostnames are domains. A domain is a hierarchical, dot-separated list -of subdomains. For example, the machine -.Dq Li monet , -in the -.Dq Li Berkeley -subdomain of the -.Dq Li EDU -subdomain of the Internet Domain Name System would be represented as -.Pp -.Dl monet.Berkeley.EDU -.Pp -(with no trailing dot). -.Pp -Hostnames are often used with network client and server programs, -which must generally translate the name to an address for use. -(This task is usually performed by the library routine -.Xr gethostbyname @LIB_NETWORK_EXT@ . ) -The default method for resolving hostnames by the Internet name resolver is -to follow RFC 1535's security recommendations. Actions can be taken -by the administrator to override these recommendations and to have the -resolver behave the same as earlier, non-RFC 1535 -resolvers. -.Pp -The default method (using RFC 1535 guidelines) follows: -.Pp -If the name consists of a single component, i.e. contains no dot, and if the -environment variable -.Dq Ev HOSTALIASES -is set to the name of a file, -that file is searched for a string matching the input hostname. The file -should consist of lines made up of two strings separated by white-space, the -first of which is the hostname alias, and the second of which is the complete -hostname to be substituted for that alias. If a case-insensitive match is -found between the hostname to be resolved and the first field of a line in -the file, the substituted name is looked up with no further processing. -.Pp -If there is at least one dot in the name, then the name is first tried -.Dq as-is . -The number of dots to cause this action is configurable by setting the -threshold using the -.Dq Li ndots -option in -.Pa /etc/resolv.conf -(default: 1). If the name ends with a dot, the trailing dot is -removed, and the remaining name is looked up (regardless of the setting of -the -.Li ndots -option), without further processing. -.Pp -If the input name does not end with a trailing dot, it is looked up by -searching through a list of domains until a match is found. If neither the -search option in the -.Pa /etc/resolv.conf -file or the -.Dq Ev LOCALDOMAIN -environment variable is used, then the -search list of domains contains only the full domain specified by the -.Li domain -option (in -.Pa /etc/resolv.conf ) -or the domain used in the local hostname (see -.Xr hostname @CMD_EXT@ -and -.Xr resolver @FORMAT_EXT@ ) . -For example, if the -.Dq Li domain -option is set to -.Li CS.Berkeley.EDU , -then only -.Li CS.Berkeley.EDU -will be in the search list, and this will be the only -domain appended to the partial hostname. For example, if -.Dq Li lithium -is the name to be resolved, this would make -.Li lithium.CS.Berkeley.EDU -the only name to be tried using the search list. -.Pp -If the -.Li search -option is used in -.Pa /etc/resolv.conf -or the environment variable -.Dq Ev LOCALDOMAIN -is set by the user, then -the search list will include what is set by these methods. For -example, if the -.Dq Li search -option contained -.Pp -.Dl CS.Berkeley.EDU CChem.Berkeley.EDU Berkeley.EDU -.Pp -then the partial hostname (e.g., -.Dq Li lithium ) -will be tried with -.Em each -domain name appended (in the same order specified); the resulting hostnames -that would be tried are: -.Bd -literal -offset indent -lithium.CS.Berkeley.EDU -lithium.CChem.Berkeley.EDU -lithium.Berkeley.EDU -.Ed -.Pp -The environment variable -.Dq Ev LOCALDOMAIN -overrides the -.Dq Li search -and -.Dq Li domain -options, and if both -.Li search -and -.Li domain -options are present in the resolver configuration file, then only the -.Em last -one listed is used (see -.Xr resolver @FORMAT_EXT@ ) . -.Pp -If the name was not previously tried -.Dq as-is -(i.e., it fell below the -.Dq Li ndots -threshold or did not contain a dot), then the name as -originally provided is attempted. -.Sh ENVIRONMENT -.Bl -tag -width "/etc/resolv.conf " -.It Ev LOCALDOMAIN -Affects domains appended to partial hostnames. -.It Ev HOSTALIASES -Name of file containing -.Pq Ar host alias , full hostname -pairs. -.El -.Sh FILES -.Bl -tag -width "/etc/resolv.conf " -compact -.It Pa /etc/resolv.conf -See -.Xr resolve @FORMAT_EXT@ . -.El -.Sh SEE ALSO -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ , -.Xr mailaddr @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ . diff --git a/contrib/bind/doc/man/inet_cidr.3 b/contrib/bind/doc/man/inet_cidr.3 deleted file mode 100644 index 0bed686..0000000 --- a/contrib/bind/doc/man/inet_cidr.3 +++ /dev/null @@ -1,94 +0,0 @@ -.\" $Id: inet_cidr.3,v 8.3 2001/08/08 07:50:06 marka Exp $ -.\" -.\"Copyright (c) 1998,1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.\" -.Dd October 19, 1998 -.Dt INET_CIDR @LIB_NETWORK_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm inet_cidr_ntop , -.Nm inet_cidr_pton -.Nd network translation routines -.Sh SYNOPSIS -.Fd #include <sys/types.h> -.Fd #include <sys/socket.h> -.Fd #include <netinet/in.h> -.Fd #include <arpa/inet.h> -.Fn inet_cidr_ntop "int af" "const void *src" "int bits" "char *dst" "size_t size" -.Fn inet_cidr_pton "int af" "const char *src" "void *dst" "int *bits" -.Sh DESCRIPTION -These routines are used for converting addresses to and from network and -presentation forms with CIDR (Classless Inter-Domain Routing) representation, -embedded net mask. -.Pp -.Bd -literal - 130.155.16.1/20 -.Ed -.\" ::ffff:130.155.16.1/116 -.Pp -.Fn inet_cidr_ntop -converts an address from network to presentation format. -.Pp -.Ft af -describes the type of address that is being passed in -.Ft src . -.\"Currently defined types are AF_INET and AF_INET6. -Currently only AF_INET is supported. -.Pp -.Ft src -is an address in network byte order, its length is determined from -.Ft af . -.Pp -.Ft bits -specifies the number of bits in the netmask unless it is -1 in which case -the CIDR representation is omitted. -.Pp -.Ft dst -is a caller supplied buffer of at least -.Ft size -bytes. -.Pp -.Fn inet_cidr_ntop -returns -.Ft dst -on success or NULL. -Check errno for reason. -.Pp -.Fn inet_cidr_pton -converts and address from presentation format, with optional CIDR -reperesentation, to network format. -The resulting address is zero filled if there were insufficint bits in -.Ft src . -.Pp -.Ft af -describes the type of address that is being passed in via -.Ft src -and determines the size of -.Ft dst . -.Pp -.Ft src -is an address in presentation format. -.Pp -.Ft bits -returns the number of bits in the netmask or -1 if a CIDR representation was -not supplied. -.Pp -.Fn inet_cidr_pton -returns 0 on succces or -1 on error. -Check errno for reason. -ENOENT indicates an invalid netmask. -.Sh SEE ALSO -.Xr intro 2 diff --git a/contrib/bind/doc/man/irs.conf.5 b/contrib/bind/doc/man/irs.conf.5 deleted file mode 100644 index 9ee5882..0000000 --- a/contrib/bind/doc/man/irs.conf.5 +++ /dev/null @@ -1,201 +0,0 @@ -.\" Copyright (c) 1996,1999 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" -.\" Copyright (c) 1986, 1991, 1993 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" -.\" $Id: irs.conf.5,v 8.4 1999/01/18 07:46:45 vixie Exp $ -.\" -.Dd November 16, 1997 -.Dt IRS.CONF 5 -.Os BIND 8.1 -.Sh NAME -.Nm irs.conf -.Nd Information Retrieval System configuration file -.Sh SYNOPSIS -.Nm irs.conf -.Sh DESCRIPTION -The -.Xr irs 3 -functions are a set of routines in the C library which provide access to -various system maps. -The maps that irs currently controls are the following: passwd, group, -services, protocols, hosts, networks and netgroup. -When a program first calls a function that accesses one of these maps, -the irs configuration file is read, -and the source of each map is determined for the life of the process. -.Pp -If this file does not exist, -the irs routines default to using local sources for all information, -with the exception of the host and networks maps, -which use the Domain Name System (DNS). -.Pp -Each record in the file consists of one line. -A record consists of a map-name, an access-method and possibly a (comma -delimited) set of options, -separated by tabs or spaces. -Blank lines, and text between a # and a newline are ignored. -.Pp -Available maps: -.Bd -literal -offset indent -Map name Information in map -========= ================================== -passwd User authentication information -group User group membership information -services Network services directory -protocols Network protocols directory -hosts Network hosts directory -networks Network "network names" directory -netgroup Network "host groups" directory -.Ed -.Pp -Available access methods: -.Bd -literal -offset indent -Access method Description -============= ================================================= -local Use a local file, usually in /etc -dns Use the domain name service (includes hesiod) -nis Use the Sun-compatible Network Information Service -irp Use the IRP daemon on the localhost. -.Ed -.Pp -Available options: -.Bd -literal -offset indent -Option Description -======== ================================================ -continue don't stop searching if you can't find something -merge don't stop searching if you CAN find something -.Ed -.Pp -The continue option creates -.Dq "union namespaces" -whereby subsequent access methods of the same map type can be tried -if a name cannot be found using earlier access methods. -This can be quite confusing in the case of host names, -since the name to address and address to name mappings can be visibly -asymmetric even though the data used by any given access method is -entirely consistent. This behavior is, therefore, not the default. -.Pp -The merge option only affects lookups in the groups map. -If set, subsequent access methods will be tried in order to cause -local users to appear in NIS (or other remote) groups in addition -to the local groups. -.Sh EXAMPLE -.Bd -literal -offset indent -# Get password entries from local file, or failing that, NIS -passwd local continue -passwd nis - -# Build group membership from both local file, and NIS. -group local continue,merge -group nis - -# Services comes from just the local file. -services local - -protocols local - -# Hosts comes first from DNS, failing that, the local file -hosts dns continue -hosts local - -# Networks comes first from the local file, and failing -# that the, irp daemon -networks local continue -networks irp - -netgroup local -.Ed -.Sh NOTES -If a local user needs to be in the local host's -.Dq wheel -group but not in every host's -.Dq wheel -group, put them in the local host's -.Pa /etc/group -.Dq wheel -entry and set up the -.Dq groups -portion of your -.Pa /etc/irs.conf -file as: -.Bd -literal -offset indent -group local continue,merge -group nis -.Ed -.Pp -NIS takes a long time to time out. -Especially for hosts if you use the -.Fl d -option to your server's -.Dq ypserv -daemon. -.Pp -It is important that the -.Pa irs.conf -file contain an entry for each map. -If a map is not mentioned in the -.Pa irs.conf -file, all queries to that map will fail. -.Pp -The classic NIS mechanism for specifying union namespaces is to add an entry -to a local map file whose name is ``+''. In IRS, this is done via ``continue'' -and/or ``merge'' map options. While this results in a small incompatibility -when local map files are imported from non-IRS systems to IRS systems, there -are compensating advantages in security and configurability. -.Sh FILES -.Bl -tag -width /etc/irs.confXXXX -compact -.It Pa /etc/irs.conf -The file -.Nm irs.conf -resides in -.Pa /etc . -.El -.Sh SEE ALSO -.Xr groups 5 , -.Xr hosts 5 , -.Xr netgroup 5 , -.Xr networks 5 , -.Xr passwd 5 , -.Xr protocols 5 , -.Xr services 5 diff --git a/contrib/bind/doc/man/mailaddr.7 b/contrib/bind/doc/man/mailaddr.7 deleted file mode 100644 index f194321..0000000 --- a/contrib/bind/doc/man/mailaddr.7 +++ /dev/null @@ -1,179 +0,0 @@ -.\" Copyright (c) 1983, 1987 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted -.\" provided that the above copyright notice and this paragraph are -.\" duplicated in all such forms and that any documentation, -.\" advertising materials, and other materials related to such -.\" distribution and use acknowledge that the software was developed -.\" by the University of California, Berkeley. The name of the -.\" University may not be used to endorse or promote products derived -.\" from this software without specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR -.\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)mailaddr.7 6.5 (Berkeley) 2/14/89 -.\" -.Dd February 14, 1989 -.Dt MAILADDR @DESC_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm mailaddr -.Nd mail addressing description -.Sh DESCRIPTION -Mail addresses are based on the ARPANET protocol listed at the end of this -manual page. These addresses are in the general format -.Pp -.Bd -ragged -offset indent-two -.Li user@domain -.Ed -.Pp -where a domain is a hierarchical, dot-separated list of subdomains. For -example, the address -.Pp -.Bd -ragged -offset indent-two -.Li eric@monet.berkeley.edu -.Ed -.Pp -is normally interpreted from right to left: the message should go to the -ARPA name tables (which do not correspond exactly to the physical ARPANET), -then to the Berkeley gateway, after which it should go to the local host -.Dq Li monet . -When the message reaches -.Li monet , -it is delivered to the user -.Dq Li eric . -.Pp -Unlike some other forms of addressing, this does not imply any routing. -Thus, although this address is specified as an ARPA address, it might -travel by an alternate route if that were more convenient or efficient. -For example, at Berkeley, the associated message would probably go directly -to -.Li monet -over the Ethernet rather than going via the Berkeley ARPANET gateway. -.Ss Abbreviation -.Pp -Under certain circumstances, it may not be necessary to type the entire -domain name. In general, anything following the first dot may be omitted -if it is the same as the domain from which you are sending the message. -For example, a user on -.Dq Li calder.berkeley.edu -could send to -.Dq Li eric@monet -without adding the -.Dq Li berkeley.edu -since it is the same on both sending and receiving hosts. -.Pp -Certain other abbreviations may be permitted as special cases. For -example, at Berkeley, ARPANET hosts may be referenced without adding the -.Dq Li berkeley.edu -as long as their names do not conflict with a local host name. -.Ss Compatibility -.Pp -Certain old address formats are converted to the new format to provide -compatibility with the previous mail system. In particular, -.Bd -ragged -offset indent-two -.Li user@host.ARPA -.Ed -.Pp -is allowed and -.Bd -ragged -offset indent-two -.Li host:user -.Ed -.Pp -is converted to -.Bd -ragged -offset indent-two -.Li user@host -.Ed -.Pp -in order to be consistent with the -.Xr rcp @CMD_EXT@ -command. -.Pp -Also, the syntax -.Bd -ragged -offset indent-two -.Li host!user -.Ed -.Pp -is converted to: -.Bd -ragged -offset indent-two -.Li user@host.UUCP -.Ed -.Pp -This is normally converted back to the -.Dq Li host!user -form before being sent on, for compatibility with older UUCP hosts. -.Pp -The current implementation is not able to route messages automatically through -the UUCP network. Until that time you must explicitly tell the mail system -which hosts to send your message through to get to your final destination. -.Ss Case Distinctions -.Pp -Domain names (i.e., anything after the -.Dq Li @ -sign) may be given in any mixture -of upper and lower case with the exception of UUCP hostnames. Most hosts -accept any combination of case in user names, with the notable exception of -MULTICS sites. -.Ss Route-addrs. -.Pp -Under some circumstances it may be necessary to route a message through -several hosts to get it to the final destination. Normally this routing -is done automatically, but sometimes it is desirable to route the message -manually. Addresses which show these relays are termed -.Dq route-addrs . -These use the syntax: -.Bd -ragged -offset indent-two -.Li <@hosta,@hostb:user@hostc> -.Ed -.Pp -This specifies that the message should be sent to -.Li hosta , -from there to -.Li hostb , -and finally to -.Li hostc . -This path is forced even if there is a more efficient path to -.Li hostc . -.Pp -Route-addrs occur frequently on return addresses, since these are generally -augmented by the software at each host. It is generally possible to ignore -all but the -.Dq Li user@domain -part of the address to determine the actual sender. -.Ss Postmaster -.Pp -Every site is required to have a user or user alias designated -.Dq Li postmaster -to which problems with the mail system may be addressed. -.Ss Other Networks -.Pp -Some other networks can be reached by giving the name of the network as the -last component of the domain. -.Em This is not a standard feature -and may -.Em not -be supported at all sites. For example, messages to CSNET or BITNET sites -can often be sent to -.Dq Li user@host.CSNET -or -.Dq Li user@host.BITNET , -respectively. -.Sh BUGS -The RFC822 group syntax -.Pq Dq Li group:user1,user2,user3; -is not supported except in the special case of -.Dq LI group:; -because of a conflict with old berknet-style addresses. -.Pp -Route-Address syntax is grotty. -.Pp -UUCP- and ARPANET-style addresses do not coexist politely. -.Sh SEE ALSO -.Xr mail @CMD_EXT@ , -.Xr sendmail @SYS_OPS_EXT@ ; -Crocker, D. H., RFC822, -.Do -Standard for the Format of Arpa Internet Text Messages -.Dc . diff --git a/contrib/bind/doc/man/mkdep.1 b/contrib/bind/doc/man/mkdep.1 deleted file mode 100644 index bf46eaf..0000000 --- a/contrib/bind/doc/man/mkdep.1 +++ /dev/null @@ -1,82 +0,0 @@ -.\" Copyright (c) 1987 Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted -.\" provided that the above copyright notice and this paragraph are -.\" duplicated in all such forms and that any documentation, -.\" advertising materials, and other materials related to such -.\" distribution and use acknowledge that the software was developed -.\" by the University of California, Berkeley. The name of the -.\" University may not be used to endorse or promote products derived -.\" from this software without specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR -.\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -.\" WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)mkdep.1 5.8 (Berkeley) 10/24/88 -.\" -.Dd October 24, 1988 -.Dt MKDEP @CMD_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm mkdep -.Nd construct Makefile dependency list -.Sh SYNOPSIS -.Nm mkdep -.Op Fl ap -.Op Fl f Ar depend_file -.Op Ar flags -.Ar -.Sh DESCRIPTION -.Ic Mkdep -takes a set of flags for the C compiler and a list -of C source files as arguments and constructs a set of -.Li include -file dependencies which are written into the file -.Pa depend_file , -or -.Dq Pa .depend -by default. An example of its use in a -.Pa Makefile -might be: -.Bd -literal -offset indent -CFLAGS= -O -DDEBUG -I../include -I. -SRCS= file1.c file2.c - -depend: - mkdep ${CFLAGS} ${SRCS} -.Ed -.Pp -where the macro -.Dq Li SRCS -is the list of C source files and the macro -.Dq Li CFLAGS -is the list of flags for the C compiler. -.Pp -If the -.Dq Fl p -option is provided, -.Ic mkdep -produces dependencies -of the form -.Dq Li program: program.c -so that subsequent calls to -.Xr make @CMD_EXT@ -will produce -.Dq Pa program -directly from its C module rather than using an intermediate -.Dq Pa \&.o -module. This is useful in directories which -contain many programs, each of whose source is contained in a single -C module. -.Pp -The -.Dq Fl a -option causes appending to the output file, so that multiple -.Ic mkdep Ns 's -may be run from a single -.Pa Makefile . -.Sh SEE ALSO -.Xr cc @CMD_EXT@ , -.Xr cpp @CMD_EXT@ , -.Xr make @CMD_EXT@ . diff --git a/contrib/bind/doc/man/named-bootconf.8 b/contrib/bind/doc/man/named-bootconf.8 deleted file mode 100644 index 2798637..0000000 --- a/contrib/bind/doc/man/named-bootconf.8 +++ /dev/null @@ -1,69 +0,0 @@ -.\" $NetBSD: named-bootconf.8,v 1.1 1998/11/19 21:11:45 tron Exp $ -.\" -.\" Copyright (c) 1998 The NetBSD Foundation, Inc. -.\" All rights reserved. -.\" -.\" This documentation is derived from software contributed to The NetBSD -.\" Foundation by Matthias Scheler. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the NetBSD -.\" Foundation, Inc. and its contributors. -.\" 4. Neither the name of The NetBSD Foundation nor the names of its -.\" contributors may be used to endorse or promote products derived -.\" from this software without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS -.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED -.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS -.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR -.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF -.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS -.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN -.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) -.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE -.\" POSSIBILITY OF SUCH DAMAGE. -.\" -.\" Copyright (c) 1999 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.Dd November 19, 1998 -.Dt NAMED-BOOTCONF 8 -.Os NetBSD -.Sh NAME -.Nm named-bootconf -.Nd convert name server configuration files -.Sh SYNOPSIS -.Nm -.Sh DESCRIPTION -.Nm -converts named configuration files from BIND 4 format to BIND 8 format. -.Sh EXAMPLES -named-bootconf < named.boot > named.conf -.Sh BUGS -Comments from the source file will not always appear at the appropriate place -in the target file. -.Sh SEE ALSO -.Xr named 8 , -.Xr named.conf 5 diff --git a/contrib/bind/doc/man/named-xfer.8 b/contrib/bind/doc/man/named-xfer.8 deleted file mode 100644 index 05ccb5a..0000000 --- a/contrib/bind/doc/man/named-xfer.8 +++ /dev/null @@ -1,210 +0,0 @@ -.\" ++Copyright++ 1985 -.\" - -.\" Copyright (c) 1985 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" - -.\" Portions Copyright (c) 1993 by Digital Equipment Corporation. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Digital Equipment Corporation not be used in advertising or -.\" publicity pertaining to distribution of the document or software without -.\" specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" - -.\" Portions Copyright (c) 1999 by Check Point Software Technologies, Inc. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Check Point Software Technologies Incorporated not be used -.\" in advertising or publicity pertaining to distribution of the document -.\" or software without specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND CHECK POINT SOFTWARE TECHNOLOGIES -.\" INCORPORATED DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, -.\" INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. -.\" IN NO EVENT SHALL CHECK POINT SOFTWARE TECHNOLOGIES INCORPORATED -.\" BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR -.\" ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER -.\" IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT -.\" OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. -.\" -.\" --Copyright-- -.\" -.\" from named.8 6.6 (Berkeley) 2/14/89 -.\" -.Dd June 26, 1993 -.Dt @XFER_INDOT_U@NAMED-XFER @SYS_OPS_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm @XFER_INDOT@named-xfer -.Nd ancillary agent for inbound zone transfers -.Sh SYNOPSIS -.Nm named-xfer -.Fl z Ar zone_to_transfer -.Fl f Ar db_file -.Fl s Ar serial_no -.Op Fl d Ar debuglevel -.Op Fl l Ar debug_log_file -.Op Fl i Ar ixfr_file -.Op Fl t Ar trace_file -.Op Fl p Ar port# -.Op Fl C Ar class -.Op Fl S -.Op Fl q -.Op Fl x Ar src_address -.Op Fl T Ar tsig_file -.Ar nameserver -.Op Sy axfr | ixfr -.Sh DESCRIPTION -.Ic Named-xfer -is an ancillary program executed by -.Xr @INDOT@named @SYS_OPS_EXT@ -to perform an inbound zone transfer. It is rarely executed directly, and then -only by system administrators who are trying to debug a zone transfer problem. -See RFC's 1033, 1034, and 1035 for more information on the Internet -name-domain system. -.Pp -Options are: -.Bl -tag -width Fl -.It Fl z Ar zone_to_transfer -specifies the name of the zone to be transferred. -.It Fl f Ar db_file -specifies the name of the -.Ar db_file -into which the zone should be dumped -when it is received from the primary server. -.It Fl s Ar serial_no -specifies the serial number of our current copy of this zone. If the -.Sy SOA RR -we get from the primary server does not have a serial -number higher than this, the transfer will be aborted. -.It Fl d Ar debuglevel -Print debugging information. -The -.Ar debuglevel -is a number determines the level of messages printed. -.It Fl l Ar debug_log_file -Specifies a log file for debugging messages. The default is system- -dependent but is usually in -.Pa /var/tmp -or -.Pa /usr/tmp . -Note that this only applies if -.Dq Fl d -is also specified. -.It Fl i Ar ixfr_file -Specifies the name of the -.Ar ixfr_file -into which the zone changes from Incremental Zone Transfer (IXFR) -should be dumped when it is received from the primary server. -.It Fl t Ar trace_file -Specifies a -.Ar trace_file -which will contain a protocol trace of the zone -transfer. This is probably only of interest to people debugging the name -server itself. -.It Fl p Ar port# -Use a different port number. The default is the standard port number -as returned by -.Xr getservbyname @LIB_NETWORK_EXT@ -for the service -.Dq Li domain . -.It Fl C Ar class -Defines which class to use. -Defaults to 'IN'. -.It Fl S -Perform a restricted transfer of only the SOA, NS records and glue A records -for the zone. The SOA record will not be loaded by -.Xr @INDOT@named @SYS_OPS_EXT@ -but will be used to -determine when to verify the NS records. See the -.Dq Li stubs -directive in -.Xr @INDOT@named @SYS_OPS_EXT@ -for more information. -.It Fl q -Tells @INDOT@named-xfer to be quiet. -.It Fl x Ar src_address -Specifies the source address to use for this query. -.It Fl T Ar tsig_file -Specifies a file to transfer TSIG information to @INDOT@named-xfer. -Multiple entries of the following format: -.Pp -.Bl -hang -width "IP address" -compact -.It IP address -When connecting to this address use this TSIG key. -.It key name -.It algorithm -157 (HMAC-MD5) is the only algorithm supported. -.It key data -base64 -.El -.Pp -@INDOT@named-xfer expects this file to be temporary in nature and -will explicitly delete this file after its use. -.El -.Pp -Additional arguments are taken as name server addresses in so-called -.Dq dotted-quad -syntax -.Em only ; -no host name are allowed here. At least one address must be specified. -Any additional addresses will be tried, in order, if the first one fails -to transfer to us successfully. -The -.Sy axfr -or -.Sy ixfr -after name server address designates the type of zone transfer to perform. -Use -.Sy axfr -for a full zone transfer or -.Sy ixfr -for an incremental zone transfer. -.Sh SEE ALSO -.Xr hostname @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ , -RFC 882, RFC 883, RFC 973, RFC 974, RFC 1033, RFC 1034, RFC 1035, -RFC 1123, RFC 1995 -.Dq Name Server Operations Guide for Sy BIND . diff --git a/contrib/bind/doc/man/named.8 b/contrib/bind/doc/man/named.8 deleted file mode 100644 index 1c31c37..0000000 --- a/contrib/bind/doc/man/named.8 +++ /dev/null @@ -1,445 +0,0 @@ -.\" ++Copyright++ 1985, 1996 -.\" - -.\" Copyright (c) 1985, 1996 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" - -.\" Portions Copyright (c) 1993 by Digital Equipment Corporation. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Digital Equipment Corporation not be used in advertising or -.\" publicity pertaining to distribution of the document or software without -.\" specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" - -.\" --Copyright-- -.\" -.\" @(#)named.8 6.6 (Berkeley) 2/14/89 -.\" -.Dd February 1, 1996 -.Dt @INDOT_U@named @SYS_OPS_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm @INDOT@named -.Nd Internet domain name server (DNS) -.Sh SYNOPSIS -.Nm @INDOT@named -.Op Fl d Ar debuglevel -.Op Fl p Ar port# -.Oo Fl Po -.Cm b Ns \&| Ns Cm c -.Pc -.Ar config_file -.Oc -.Op Fl f q r v -.Op Fl u Ar user_name -.Op Fl g Ar group_name -.Op Fl t Ar directory -.Op Fl w Ar directory -.Op Ar config_file -.Sh DESCRIPTION -.Ic Named -is the Internet domain name server. -See RFC's 1033, 1034, and 1035 for more information on the Internet -name-domain system. Without any arguments, -.Ic named -will read the default configuration file -.Pa /etc/named.conf , -read any initial data, and listen for queries. A -.Ar config_file -argument given at the end of the command line will override any -.Ar config_file -specified by using the -.Dq Fl b -or -.Dq Fl c -flags. -.Pp -.Sy NOTE : -Several of -.Nm named Ns 's -options, and much more of its behaviour, can be controlled in the configuration -file. Please refer to the configuration file guide included with this -.Sy BIND -distribution for further information. -.Pp -Options are: -.Bl -tag -width Fl -.It Fl d Ar debuglevel -Print debugging information. -The -.Ar debuglevel -is a number determines the level of messages printed. If negative, -.Ar debuglevel -is set to -.Dq 1 . -.Pp -.Sy NOTE : -The new debugging framework is considerably more sophisticated than it -was in older versions of -.Nm @INDOT@named . -The configuration file's -.Dq Li logging -statement allows for multiple, distinct levels of debugging for each of -a large set of categories of events (such as queries, transfers in or out, -etc.). Please refer to the configuration file guide included with this -.Sy BIND -distribution for further information about these extensive new capabilities. -.It Fl p Ar port# -Use the specified remote port number; this is the port number to which -.Nm @INDOT@named -will send queries. The default value is the standard port number, i.e., -the port number returned by -.Xr getservbyname @LIB_NETWORK_EXT@ -for service -.Dq Li domain . -.Pp -.Sy NOTE : -Previously, the syntax -.Dq Fl p Ar port# Ns Op Ar \&/localport# -was supported; the first port was that used when contacting -.Em remote -servers, and the second one was the service port bound by the -.Em local -instance of -.Nm @INDOT_U@named . -The current usage is equivalent to the old usage without the -.Ar localport# -specified; this functionality can be specified with the -.Dq Li listen-on -clause of the configuration file's -.Dq Li options -statement. -.It Xo Fl Po -.Cm b Ns \&| Ns Cm c -.Pc Ar config_file -.Xc -Use an alternate -.Ar config_file ; -this argument is overridden by any -.Ar config_file -which is specified at the end of the command line. -The default value is -.Pa /etc/named.conf . -.It Fl f -Run this process in the foreground; don't -.Xr fork @SYSCALL_EXT@ -and daemonize. (The default is to daemonize.) -.It Fl q -Trace all incoming queries if -.Nm @INDOT_U@named -has been compiled with -.Li QRYLOG -defined. -.Pp -.Sy NOTE : -This option is deprecated in favor of the -.Dq Li queries -.Em logging category -of the configuration file's -.Dq Li logging -statement; for more information, please refer to the configuration file guide -included with this distribution of -.Sy BIND . -.It Fl r -Turns recursion off in the server. Answers can come only from local -(primary or secondary) zones. This can be used on root servers. -The default is to use recursion. -.Pp -.Sy NOTE : -This option can be overridden by and is deprecated in favor of the -.Dq Li recursion -clause of the configuration file's -.Dq Li options -statement. -.It Fl v -Report the version and exit. -.It Fl u Ar user_name -Specifies the user the server should run as after it initializes. The value -specified may be either a username or a numeric user id. If the -.Dq Fl g -flag is not specified, then the group id used will be the primary group of -the user specified (initgroups() is called, so all of the user's groups will -be available to the server). -.Pp -.It Fl g Ar group_name -Specifies the group the server should run as after it initializes. The value -specified may be either a groupname or a numeric group id. -.Pp -.It Fl t Ar directory -Specifies the directory the server should chroot() into as soon as it is -finished processing command line arguments. -.Pp -.It Fl w Ar directory -Sets the working directory of the server. The -.Dq Li directory -clause of the configuration file's -.Dq Li options -statement overrides any value specified on the command line. -The default working directory is the current directory -.Pq Dq \&. . -.El -.Pp -Any additional argument is taken as the name of the configuration file, for -compatibility with older implementations; as noted above, this argument -overrides any -.Ar config_file -specified by the use of the -.Dq Fl b -or -.Dq Fl c -flags. If no further argument is given, then the default configuration file -is used -.Pq Pa /etc/named.conf . -.Ss Master File Format -The master file consists of control information and a list of resource -records for objects in the zone of the forms: -.Bd -literal -offset indent -$INCLUDE <filename> <opt_domain> -$ORIGIN <domain> -$TTL <ttl> -<domain> <opt_ttl> <opt_class> <type> <resource_record_data> -.Ed -.Pp -where: -.Bl -tag -width "opt_domain " -.It Ar domain -is -.Dq Li .\& -for root, -.Dq Li @ -for the current origin, or a standard domain name. If -.Ar domain -is a standard domain name that does -.Em not -end with -.Dq Li \&. , -the current origin is appended to the domain. Domain names ending with -.Dq Li .\& -are unmodified. -.It Ar opt_domain -This field is used to define an origin for the data in an included file. -It is equivalent to placing an -.Li $ORIGIN -statement before the first line of the included file. The field is optional. -Neither the -.Ar opt_domain -field nor -.Li $ORIGIN -statements in the included file modify the current origin for this file. -.It Ar ttl -A integer number that sets the default time-to-live for future records without -an explicit ttl. -.It Ar opt_ttl -An optional integer number for the time-to-live field. -If not set the ttl is taken from the last $TTL statement. -If no $TTL statement has occurred then the SOA minimum value is used and a -warning is generated. -.It Ar opt_class -The object address type; currently only one type is supported, -.Dv IN , -for objects connected to the DARPA Internet. -.It Ar type -This field contains one of the following tokens; the data expected in the -.Ar resource_record_data -field is in parentheses: -.Bl -tag -width "HINFO " -offset indent -.It Dv A -a host address (dotted-quad IP address) -.It Dv NS -an authoritative name server (domain) -.It Dv MX -a mail exchanger (domain), preceded by a preference value (0..32767), -with lower numeric values representing higher logical preferences. -.It Dv CNAME -the canonical name for an alias (domain) -.It Dv SOA -marks the start of a zone of authority (domain of originating host, -domain address of maintainer, a serial number and the following -parameters in seconds: refresh, retry, expire and minimum TTL (see RFC 883 -and RFC 2308)). -.It Dv NULL -a null resource record (no format or data) -.It Dv RP -a Responsible Person for some domain name (mailbox, TXT-referral) -.It Dv PTR -a domain name pointer (domain) -.It Dv HINFO -host information (cpu_type OS_type) -.El -.El -.Pp -Resource records normally end at the end of a line, -but may be continued across lines between opening and closing parentheses. -Comments are introduced by semicolons and continue to the end of the line. -.Pp -.Sy NOTE : -There are other resource record types not shown here. You should -consult the -.Sy BIND -Operations Guide -.Pq Dq BOG -for the complete -list. Some resource record types may have been standardized in newer RFC's -but not yet implemented in this version of -.Sy BIND . -.Ss SOA Record Format -Each master zone file should begin with an SOA record for the zone. -An example SOA record is as follows: -.Bd -literal -@ IN SOA ucbvax.Berkeley.EDU. rwh.ucbvax.Berkeley.EDU. ( - 1989020501 ; serial - 10800 ; refresh - 3600 ; retry - 3600000 ; expire - 86400 ) ; minimum -.Ed -.Pp -The SOA specifies a serial number, which should be incremented each time the -master file is changed. Note that the serial number can be given as a -dotted number, but this is a -.Em very -unwise thing to do since the -translation to normal integers is via concatenation rather than -multiplication and addition. You can spell out the year, month, day of -month, and 0..99 version number and still fit inside the unsigned 32-bit -size of this field. (It's true that we will have to rethink this strategy in -the year 4294, but we're not worried about it.) -.Pp -Secondary servers -check the serial number at intervals specified by the refresh time in -seconds; if the serial number changes, a zone transfer will be done to load -the new data. If a master server cannot be contacted when a refresh is due, -the retry time specifies the interval at which refreshes should be attempted. -If a master server cannot be contacted within the interval given by the -expire time, all data from the zone is discarded by secondary servers. The -minimum value is the cache time-to-live for negative answers (RFC 2308). -.Sh NOTES -The boot file directives -.Dq Li domain -and -.Dq Li suffixes -have been -obsoleted by a more useful, resolver-based implementation of -suffixing for partially-qualified domain names. The prior mechanisms -could fail under a number of situations, especially when then local -nameserver did not have complete information. -.Pp -The following signals have the specified effect when sent to the -server process using the -.Xr kill @CMD_EXT@ -command: -.Pp -.Bl -tag -width "SIGWINCH" -.It Dv SIGHUP -Causes server to read -.Pa named.conf -and reload the database. If the server -is built with the -.Li FORCED_RELOAD -compile-time option, then -.Dv SIGHUP -will -also cause the server to check the serial number on all secondary zones; -normally, the serial numbers are only checked at the SOA-specified intervals. -.It Dv SIGINT -Dumps the current data base and cache to -.Dq Pa /var/tmp/named_dump.db -or the value of -.Dv _PATH_DUMPFILE . -.It Dv SIGILL -Dumps statistics data into -.Pa named.stats -if the server is compiled with -.Li -DSTATS . -Statistics data is appended to the file. -.It Dv SIGSYS -Dumps the profiling data in -.Pa /var/tmp -if the server is compiled with profiling (server forks, chdirs and exits). -.It Dv SIGTERM -Saves any modified dynamic zones to the file system, and shuts down the server. -.It Dv SIGUSR1 -Turns on debugging; each -.Dv SIGUSR1 -increments debug level. -.Po -.Dv SIGEMT -on older systems without -.Dv SIGUSR1 . -.Pc -.It Dv SIGUSR2 -Turns off debugging completely. -.Po -.Dv SIGFPE -on older systems without -.Dv SIGUSR2 . -.Pc -.It Dv SIGWINCH -Toggles logging of all incoming queries via -.Xr syslog @LIB_C_EXT@ -(requires server to have been built with the -.Li QRYLOG -option). -.El -.Sh FILES -.Bl -tag -width "/var/tmp/named_dump.db (_PATH_DUMPFILE) " -compact -.It Pa /etc/named.conf -default name server configuration file -.It Pa /var/run/named.pid Pq Dv _PATH_PIDFILE -the process id -.It Pa /var/tmp/named_dump.db Pq Dv _PATH_DUMPFILE -dump of the name server database -.It Pa /var/tmp/named.run Pq file: Dv _PATH_DEBUG -debug output -.It Pa /var/tmp/named.stats Pq file: Dv _PATH_STATS -nameserver statistics data -.El -.Sh SEE ALSO -.Xr named.conf @FORMAT_EXT@ , -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr kill @CMD_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ , -.Xr signal @LIB_C_EXT@ , -RFC 882, RFC 883, RFC 973, RFC 974, RFC 1033, RFC 1034, RFC 1035, RFC 1123, -RFC 2308 -.Dq Name Server Operations Guide for Sy BIND diff --git a/contrib/bind/doc/man/named.conf.5 b/contrib/bind/doc/man/named.conf.5 deleted file mode 100644 index 2d7e627..0000000 --- a/contrib/bind/doc/man/named.conf.5 +++ /dev/null @@ -1,2145 +0,0 @@ -.\" Copyright (c) 1999-2000 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.Dd January 7, 1999 -.Dt NAMED.CONF 5 -.Os BSD 4 -.Sh NAME -.Nm named.conf -.Nd configuration file for -.Xr named 8 -.Sh OVERVIEW -BIND 8 is much more configurable than previous release of BIND. There -are entirely new areas of configuration, such as access control lists -and categorized logging. Many options that previously applied to all -zones can now be used selectively. These features, plus a -consideration of future configuration needs led to the creation of a -new configuration file format. -.Ss General Syntax -A BIND 8 configuration consists of two general features, statements -and comments. All statements end with a semicolon. Many statements -can contain substatements, which are each also terminated with a -semicolon. -.Pp -The following statements are supported: -.Bl -tag -width 0n -.It Ic logging -specifies what the server logs, and where the log messages are sent -.It Ic options -controls global server configuration options and sets defaults for other -statements -.It Ic zone -defines a zone -.It Ic acl -defines a named IP address matching list, for access control and other uses -.It Ic key -specifies key information for use in authentication and authorization -.It Ic trusted-keys -defines DNSSEC keys that are preconfigured into the server and implicitly -trusted -.It Ic server -sets certain configuration options for individual remote servers -.It Ic controls -declares control channels to be used by the -.Nm ndc -utility -.It Ic include -includes another file -.El -.Pp -The -.Ic logging -and -.Ic options -statements may only occur once per configuration, while the rest may -appear numerous times. Further detail on each statement is provided -in individual sections below. -.Pp -Comments may appear anywhere that whitespace may appear in a BIND -configuration file. To appeal to programmers of all kinds, they can -be written in C, C++, or shell/perl constructs. -.Pp -C-style comments start with the two characters -.Li /* -(slash, star) and end with -.Li */ -(star, slash). -Because they are completely delimited with these characters, -they can be used to comment only a portion of a line or to span -multiple lines. -.Pp -C-style comments cannot be nested. For example, the following is -not valid because the entire comment ends with the first -.Li */ : -.Bd -literal -offset indent -/* This is the start of a comment. - This is still part of the comment. -/* This is an incorrect attempt at nesting a comment. */ - This is no longer in any comment. */ -.Ed -.Pp -C++-style comments start with the two characters -.Li // -(slash, slash) and continue to the end of the physical line. -They cannot be continued across multiple physical lines; to have -one logical comment span multiple lines, each line must use the -.Li // -pair. For example: -.Bd -literal -offset indent -// This is the start of a comment. The next line -// is a new comment, even though it is logically -// part of the previous comment. -.Ed -.Pp -Shell-style (or perl-style, if you prefer) comments start with the -character -.Li # -(hash or pound or number or octothorpe or whatever) and continue to -the end of the physical line, like C++ comments. For example: -.Bd -literal -offset indent -# This is the start of a comment. The next line -# is a new comment, even though it is logically -# part of the previous comment. -.Ed -.Pp -.Em WARNING : -you cannot use the -.Li ; -(semicolon) character to start a comment such as you would in a zone -file. The semicolon indicates the end of a configuration statement, -so whatever follows it will be interpreted as the start of the next -statement. -.Ss Converting from BIND 4.9.x -BIND 4.9.x configuration files can be converted to the new format -by using -.Pa src/bin/named/named-bootconf , -a shell script that is part of the BIND 8.2.x source kit. -.Sh DOCUMENTATION DEFINITIONS -Described below are elements used throughout the BIND configuration -file documentation. Elements which are only associated with one -statement are described only in the section describing that statement. -.Bl -tag -width 0n -.It Va acl_name -The name of an -.Va address_match_list -as defined by the -.Ic acl -statement. -.It Va address_match_list -A list of one or more -.Va ip_addr , -.Va ip_prefix , -.Va key_id , -or -.Va acl_name -elements, as described in the -.Sx ADDRESS MATCH LISTS -section. -.It Va dotted-decimal -One or more integers valued 0 through 255 separated only by dots -(``.''), such as -.Li 123 , -.Li 45.67 -or -.Li 89.123.45.67 . -.It Va domain_name -A quoted string which will be used as a DNS name, for example -.Qq Li my.test.domain . -.It Va path_name -A quoted string which will be used as a pathname, such as -.Qq Li zones/master/my.test.domain . -.It Va ip_addr -An IP address with exactly four elements in -.Va dotted-decimal -notation. -.It Va ip_port -An IP port -.Va number . -.Va number is limited to -.Li 0 -through -.Li 65535 , -with values below 1024 typically restricted to -root-owned processes. In some cases an asterisk (``*'') character -can be used as a placeholder to select a random high-numbered port. -.It Va ip_prefix -An IP network specified in -.Va dotted-decimal -form, followed by ``/'' -and then the number of bits in the netmask. E.g. -.Li 127/8 -is -the network -.Li 127.0.0.0 -with netmask -.Li 255.0.0.0 . -.Li 1.2.3.0/28 -is network -.Li 1.2.3.0 -with netmask -.Li 255.255.255.240. -.It Va key_name -A string representing the name of a shared key, to be used for transaction -security. -.It Va number -A non-negative integer with an entire range limited by the range of a -C language signed integer (2,147,483,647 on a machine with 32 bit -integers). Its acceptable value might further be limited by the -context in which it is used. -.It Va size_spec -A -.Va number , -the word -.Li unlimited , -or the word -.Li default . -.Pp -The maximum value of -.Va size_spec -is that of unsigned long integers on the machine. -.Li unlimited -requests unlimited use, or the maximum available amount. -.Li default -uses the limit that was in force when the server was started. -.Pp -A -.Va number -can optionally be followed by a scaling factor: -.Li K -or -.Li k -for kilobytes, -.Li M -or -.Li m -for megabytes, and -.Li G -or -.Li g -for gigabytes, which scale by 1024, 1024*1024, and 1024*1024*1024 -respectively. -.Pp -Integer storage overflow is currently silently ignored during -conversion of scaled values, resulting in values less than intended, -possibly even negative. Using -.Li unlimited -is the best way to safely set a really large number. -.It Va yes_or_no -Either -.Li yes -or -.Li no . -The words -.Li true -and -.Li false -are also accepted, as are the numbers -.Li 1 and -.Li 0 . -.El -.Sh ADDRESS MATCH LISTS -.Ss Syntax -.Bd -literal -\fIaddress_match_list\fR = 1\&*\fIaddress_match_element\fR -.Pp -\fIaddress_match_element\fR = [ \&"!\&" ] ( \fIaddress_match_list\fR / - \fIip_address\fR / \fIip_prefix\fR / - \fIacl_name\fR / \&"key \&" \fIkey_id\fR ) \&";\&" -.Ed -.Ss Definition and Usage -Address match lists are primarily used to determine access control for -various server operations. They are also used to define priorities -for querying other nameservers and to set the addresses on which -.Nm named -will listen for queries. -The elements which constitute an address match list can be any -of the following: -.Bl -bullet -.It -an -.Va ip-address -(in -.Va dotted-decimal -notation, -.It -an -.Va ip-prefix -(in the '/'-notation), -.It -A -.Va key_id , -as defined by the -.Ic key -statement, -.It -the name of an address match list previously defined with -the -.Ic acl -statement, or -.It -another -.Va address_match_list . -.El -.Pp -Elements can be negated with a leading exclamation mark (``!''), and -the match list names -.Li any , -.Li none , -.Li localhost -and -.Li localnets -are predefined. More information on those names can be found in the -description of the -.Ic acl -statement. -.Pp -The addition of the -.Ic key -clause made the name of this syntactic element something of a -misnomer, since security keys can be used to validate access without -regard to a host or network address. Nonetheless, the term ``address -match list'' is still used throughout the documentation. -.Pp -When a given IP address or prefix is compared to an address match -list, the list is traversed in order until an element matches. The -interpretation of a match depends on whether the list is being used -for access control, defining -.Ic listen-on -ports, or as a topology, and whether the element was -negated. -.Pp -When used as an access control list, a non-negated match allows access -and a negated match denies access. If there is no match at all in the -list, access is denied. The clauses -.Ic allow-query , -.Ic allow-transfer , -.Ic allow-update , -.Ic allow-recursion , -and -.Ic blackhole -all use address match lists like this. Similarly, the -.Ic listen-on -option will cause the server to not accept queries on any of the -machine's addresses which do not match the list. -.Pp -When used with the -.Ic topology -option, a non-negated match returns a distance based on its position on -the list (the closer the match is to the start of the list, the -shorter the distance is between it and the server). A negated match -will be assigned the maximum distance from the server. If there is no -match, the address will get a distance which is further than any -non-negated list element, and closer than any negated element. -.Pp -Because of the first-match aspect of the algorithm, an element that -defines a subset of another element in the list should come before the -broader element, regardless of whether either is negated. For -example, in -.Dl 1.2.3/24; !1.2.3.13 -the 1.2.3.13 element is completely useless, because the algorithm will -match any lookup for 1.2.3.13 to the 1.2.3/24 element. Using -.Dl !1.2.3.13; 1.2.3/24 -fixes that problem by having 1.2.3.13 blocked by the negation but all -other 1.2.3.* hosts fall through. -.Sh THE LOGGING STATEMENT -.Ss Syntax -.Bd -literal -logging { - [ channel \fIchannel_name\fR { - ( file \fIpath_name\fR - [ versions ( \fInumber\fR | unlimited ) ] - [ size \fIsize_spec\fR ] - | syslog ( kern | user | mail | daemon | auth | syslog | lpr | - news | uucp | cron | authpriv | ftp | - local0 | local1 | local2 | local3 | - local4 | local5 | local6 | local7 ) - | null ); -.Pp - [ severity ( critical | error | warning | notice | - info | debug [ \fIlevel\fR ] | dynamic ); ] - [ print-category \fIyes_or_no\fR; ] - [ print-severity \fIyes_or_no\fR; ] - [ print-time \fIyes_or_no\fR; ] - }; ] -.Pp - [ category \fIcategory_name\fR { - \fIchannel_name\fR; [ \fIchannel_name\fR; ... ] - }; ] - ... -}; -.Ed -.Ss Definition and Usage -The -.Ic logging -statement configures a wide variety of logging options for the nameserver. -Its -.Ic channel -phrase associates output methods, format options and -severity levels with a name that can then be used with the -.Ic category -phrase to select how various classes of messages are logged. -.Pp -Only one -.Ic logging -statement is used to define as many channels and categories as are wanted. -If there are multiple logging statements in a configuration, the first -defined determines the logging, and warnings are issued for the -others. If there is no logging statement, the logging configuration -will be: -.Bd -literal - logging { - category default { default_syslog; default_debug; }; - category panic { default_syslog; default_stderr; }; - category packet { default_debug; }; - category eventlib { default_debug; }; - }; -.Ed -.Pp -The logging configuration is established as soon as the -.Ic logging -statement is parsed. If you want to redirect -messages about processing of the entire configuration file, the -.Ic logging -statement must appear first. Even if you do not -redirect configuration file parsing messages, we recommend -always putting the -.Ic logging -statement first so that this rule need not be consciously recalled if -you ever do want the parser's messages relocated. -.Ss The channel phrase -All log output goes to one or more ``channels''; you can make as many -of them as you want. -.Pp -Every channel definition must include a clause that says whether -messages selected for the channel go to a file, to a particular syslog -facility, or are discarded. It can optionally also limit the message -severity level that will be accepted by the channel (default is -.Li info ) , -and whether to include a time stamp generated by -.Nm named , -the category name, or severity level. The default is not to include -any of those three. -.Pp -The word -.Li null -as the destination option for the -channel will cause all messages sent to it to be discarded; other -options for the channel are meaningless. -.Pp -The -.Ic file -clause can include limitations both on how -large the file is allowed to become, and how many versions of the file -will be saved each time the file is opened. -.Pp -The -.Ic size -option for files is simply a hard ceiling on -log growth. If the file ever exceeds the size, then -.Nm named -will just not write anything more to it until the file is reopened; -exceeding the size does not automatically trigger a reopen. The -default behavior is to not limit the size of the file. -.Pp -If you use the -.Ic version -logfile option, then -.Nm named -will retain that many backup versions of the file -by renaming them when opening. For example, if you choose to keep 3 -old versions of the file lamers.log then just before it is opened -lamers.log.1 is renamed to lames.log.2, lamers.log.0 is renamed to -lamers.log.1, and lamers.log is renamed to lamers.log.0. No rolled -versions are kept by default; any existing log file is simply appended. -The -.Li unlimited -keyword is synonymous with -.Li 99 -in current BIND releases. Example usage of size and versions options: -.Bd -literal - channel an_example_level { - file "lamers.log" versions 3 size 20m; - print-time yes; - print-category yes; - }; -.Ed -.Pp -The argument for the -.Ic syslog -clause is a syslog facility as described in the -.Xr syslog 3 -manual page. How -.Nm syslogd -will handle messages sent to this facility is described in the -.Xr syslog.conf 5 -manual page. If you have a system which uses a very old version of -syslog that only uses two arguments to the -.Fn openlog -function, then this clause is silently ignored. -.Pp -The -.Ic severity -clause works like syslog's ``priorities'', except that they can also be -used if you are writing straight to a file rather than using -syslog. Messages which are not at least of the severity level given -will not be selected for the channel; messages of higher severity -levels will be accepted. -.Pp -If you are using syslog, then the -.Pa syslog.conf -priorities will also determine what eventually passes through. -For example, defining a channel facility and severity as -.Li daemon -and -.Li debug -but only logging -.Li daemon.warning -via -.Pa syslog.conf -will cause messages of severity -.Li info -and -.Li notice -to be dropped. If the situation were reversed, with -.Nm named -writing messages of only -.Li warning -or higher, then -.Nm syslogd -would print all messages it received from the channel. -.Pp -The server can supply extensive debugging information when it is in -debugging mode. If the server's global debug level is greater than -zero, then debugging mode will be active. The global debug level is -set either by starting the -.Nm named -server with the -.Fl d -flag followed by a positive integer, or by sending the running server the -.Dv SIGUSR1 -signal (for example, by using -.Ic ndc trace ) . -The global debug level can be set to -zero, and debugging mode turned off, by sending the server the -.Dv SIGUSR2 -signal (as with -.Ic ndc notrace ) . -All debugging messages in the server have a -debug level, and higher debug levels give more more detailed output. -Channels that specify a specific debug severity, e.g. -.Bd -literal - channel specific_debug_level { - file \&"foo\&"; - severity debug 3; - }; -.Ed -.Pp -will get debugging output of level 3 or less any time the -server is in debugging mode, regardless of the global debugging level. -Channels with -.Li dynamic -severity use the server's global level to determine what messages to -print. -.Pp -If -.Ic print-time -has been turned on, then the date and time will be logged. -.Ic print-time -may be specified for a syslog channel, but is usually pointless since -syslog also prints the date and time. -If -.Ic print-category -is requested, then the category of the message will be logged as well. -Finally, if -.Ic print-severity -is on, then the severity level of the message will be logged. The -.Ic print- -options may be used -in any combination, and will always be printed in the following order: -time, category, severity. Here is an example where all three -.Ic print- -options are on: -.Bd -literal - 28-Apr-1997 15:05:32.863 default: notice: Ready to answer queries. -.Ed -.Pp -There are four predefined channels that are used for -default logging as follows. How they are used -used is described in the next section, -.Sx The category phrase . -.Bd -literal - channel default_syslog { - syslog daemon; # send to syslog's daemon facility - severity info; # only send priority info and higher - }; -.Pp - channel default_debug { - file \&"named.run\&"; # write to named.run in the working directory - # Note: stderr is used instead of \&"named.run\&" - # if the server is started with the -f option. - severity dynamic; # log at the server's current debug level - }; -.Pp - channel default_stderr { # writes to stderr - file \&"<stderr>\&"; # this is illustrative only; there's currently - # no way of specifying an internal file - # descriptor in the configuration language. - severity info; # only send priority info and higher - }; -.Pp - channel null { - null; # toss anything sent to this channel - }; -.Ed -.Pp -Once a channel is defined, it cannot be redefined. Thus you cannot -alter the built-in channels directly, but you can modify the default -logging by pointing categories at channels you have defined. -.Ss The category phrase -There are many categories, so you can send the logs you want to see -wherever you want, without seeing logs you don't want. If you don't -specify a list of channels for a category, then log messages in that -category will be sent to the -.Li default -category instead. -If you don't specify a default category, the following ``default -default'' is used: -.Bd -literal - category default { default_syslog; default_debug; }; -.Ed -.Pp -As an example, let's say you want to log security events to a file, -but you also want keep the default logging behavior. You'd specify -the following: -.Bd -literal - channel my_security_channel { - file \&"my_security_file\&"; - severity info; - }; - category security { my_security_channel; - default_syslog; default_debug; }; -.Ed -.Pp -To discard all messages in a category, specify the -.Li null -channel: -.Bd -literal - category lame-servers { null; }; - category cname { null; }; -.Ed -.Pp -The following categories are available: -.Bl -tag -width 0n -.It Ic default -The catch-all. Many things still aren't classified into categories, -and they all end up here. Also, if you don't specify any channels for -a category, the default category is used instead. If you do not -define the default category, the following definition is used: -.Dl category default { default_syslog; default_debug; }; -.It Ic config -High-level configuration file processing. -.It Ic parser -Low-level configuration file processing. -.It Ic queries -A short log message is generated for every query the server receives. -.It Ic lame-servers -Messages like ``Lame server on ...'' -.It Ic statistics -Statistics. -.It Ic panic -If the server has to shut itself down due to an internal problem, it -will log the problem in this category as well as in the problem's native -category. If you do not define the panic category, the following definition -is used: -.Dl category panic { default_syslog; default_stderr; }; -.It Ic update -Dynamic updates. -.It Ic update-security -Denied dynamic updates due to access controls. -.It Ic ncache -Negative caching. -.It Ic xfer-in -Zone transfers the server is receiving. -.It Ic xfer-out -Zone transfers the server is sending. -.It Ic db -All database operations. -.It Ic eventlib -Debugging info from the event system. Only one channel may be specified for -this category, and it must be a file channel. If you do not define the -eventlib category, the following definition is used: -.Dl category eventlib { default_debug; }; -.It Ic packet -Dumps of packets received and sent. Only one channel may be specified for -this category, and it must be a file channel. If you do not define the -packet category, the following definition is used: -.Dl category packet { default_debug; }; -.It Ic notify -The NOTIFY protocol. -.It Ic cname -Messages like ``... points to a CNAME''. -.It Ic security -Approved/unapproved requests. -.It Ic os -Operating system problems. -.It Ic insist -Internal consistency check failures. -.It Ic maintenance -Periodic maintenance events. -.It Ic load -Zone loading messages. -.It Ic response-checks -Messages arising from response checking, such as -``Malformed response ...'', ``wrong ans. name ...'', -``unrelated additional info ...'', ``invalid RR type ...'', -and ``bad referral ...''. -.El -.Sh THE OPTIONS STATEMENT -.Ss Syntax -.Bd -literal -options { - [ hostname \fIhostname_string\fR; ] - [ version \fIversion_string\fR; ] - [ directory \fIpath_name\fR; ] - [ named-xfer \fIpath_name\fR; ] - [ dump-file \fIpath_name\fR; ] - [ memstatistics-file \fIpath_name\fR; ] - [ pid-file \fIpath_name\fR; ] - [ statistics-file \fIpath_name\fR; ] - [ auth-nxdomain \fIyes_or_no\fR; ] - [ deallocate-on-exit \fIyes_or_no\fR; ] - [ dialup \fIyes_or_no\fR; ] - [ fake-iquery \fIyes_or_no\fR; ] - [ fetch-glue \fIyes_or_no\fR; ] - [ has-old-clients \fIyes_or_no\fR; ] - [ host-statistics \fIyes_or_no\fR; ] - [ host-statistics-max \fInumber\fR; ] - [ multiple-cnames \fIyes_or_no\fR; ] - [ notify ( \fIyes_or_no\fR | explicit ); ] - [ suppress-initial-notify \fIyes_or_no\fR; ] - [ recursion \fIyes_or_no\fR; ] - [ rfc2308-type1 \fIyes_or_no\fR; ] - [ use-id-pool \fIyes_or_no\fR; ] - [ treat-cr-as-space \fIyes_or_no\fR; ] - [ also-notify \fIyes_or_no\fR; ] - [ forward ( only | first ); ] - [ forwarders { [ \fIin_addr\fR ; [ \fIin_addr\fR ; ... ] ] }; ] - [ check-names ( master | slave | response ) ( warn | fail | ignore ); ] - [ allow-query { \fIaddress_match_list\fR }; ] - [ allow-recursion { \fIaddress_match_list\fR }; ] - [ allow-transfer { \fIaddress_match_list\fR }; ] - [ blackhole { \fIaddress_match_list\fR }; ] - [ listen-on [ port \fIip_port\fR ] { \fIaddress_match_list\fR }; ] - [ query-source [ address ( \fIip_addr\fR | * ) ] - [ port ( \fIip_port\fR | * ) ] ; ] - [ lame-ttl \fInumber\fR; ] - [ max-transfer-time-in \fInumber\fR; ] - [ max-ncache-ttl \fInumber\fR; ] - [ min-roots \fInumber\fR; ] - [ serial-queries \fInumber\fR; ] - [ transfer-format ( one-answer | many-answers ); ] - [ transfers-in \fInumber\fR; ] - [ transfers-out \fInumber\fR; ] - [ transfers-per-ns \fInumber\fR; ] - [ transfer-source \fIip_addr\fR; ] - [ maintain-ixfr-base \fIyes_or_no\fR; ] - [ max-ixfr-log-size \fInumber\fR; ] - [ coresize \fIsize_spec\fR ; ] - [ datasize \fIsize_spec\fR ; ] - [ files \fIsize_spec\fR ; ] - [ stacksize \fIsize_spec\fR ; ] - [ cleaning-interval \fInumber\fR; ] - [ heartbeat-interval \fInumber\fR; ] - [ interface-interval \fInumber\fR; ] - [ statistics-interval \fInumber\fR; ] - [ topology { \fIaddress_match_list\fR }; ] - [ sortlist { \fIaddress_match_list\fR }; ] - [ rrset-order { \fIorder_spec\fR ; [ \fIorder_spec\fR ; ... ] }; ] - [ preferred-glue ( A | AAAA ); ] - [ edns-udp-size \fInumber\fR; ] -}; -.Ed -.Ss Definition and Usage -The options statement sets up global options to be used by -BIND. This statement may appear at only once in a -configuration file; if more than one occurrence is found, the -first occurrence determines the actual options used, -and a warning will be generated. If there is no options statement, -an options block with each option set to its default will be used. -.Ss Server Information -.Bl -tag -width 0n -.It Ic hostname -This defaults to the hostname of the machine hosting the nameserver as found by gethostname(). -Its prime purpose is to be able to identify which of a number of anycast -servers is actually answering your queries by sending a txt query for -.Pa hostname.bind -in class chaos to the anycast server and geting back a unique name. -Setting -the hostname to a empty string ("") will disable processing of the queries. -.It Ic version -The version the server should report via the ndc command or via a query of -name -.Pa version.bind -in class chaos. -The default is the real version number of the server, -but some server operators prefer the string ( -.Ic surely you must be joking -). -.El -.Ss Pathnames -.Bl -tag -width 0n -.It Ic directory -The working directory of the server. Any non-absolute -pathnames in the configuration file will be taken as relative to this -directory. The default location for most server output files -(e.g. -.Pa named.run ) -is this directory. If a directory is not -specified, the working directory defaults to -.Pa \&. , -the directory from which the -server was started. The directory specified should be an absolute path. -.It Ic named-xfer -The pathname to the named-xfer program that the server uses for -inbound zone transfers. If not specified, the default is -system dependent (e.g. -.Pa /usr/sbin/named-xfer -). -.It Ic dump-file -The pathname of the file the server dumps the database to when it -receives -.Dv SIGINT -signal (as sent by -.Ic ndc dumpdb -). If not specified, the default is -.Pa named_dump.db . -.It Ic memstatistics-file -The pathname of the file the server writes memory usage statistics to -on exit, if -.Ic deallocate-on-exit -is -.Li yes . -If not specified, the default is -.Pa named.memstats . -.It Ic pid-file -The pathname of the file the server writes its process ID in. If not -specified, the default is operating system dependent, but is usually -.Pa /var/run/named.pid -or -.Pa /etc/named.pid . -The pid-file is used by programs like -.Nm ndc -that want to send signals to the running nameserver. -.It Ic statistics-file -The pathname of the file the server appends statistics to when it -receives -.Dv SIGILL -signal (from -.Ic ndc stats ) . -If not specified, the default is -.Pa named.stats . -.El -.Ss Boolean Options -.Bl -tag -width 0n -.It Ic auth-nxdomain -If -.Li yes , -then the -.Li AA -bit is always set on -.Dv NXDOMAIN -responses, even if the server is not actually authoritative. -The default is -.Li no . -Turning -.Lc auth-nxdomain -will allow older clients that require -.Li AA -to be set to accept -.Dv NXDOMAIN -responses to work. -.It Ic deallocate-on-exit -If -.Li yes , -then when the server exits it will painstakingly deallocate every -object it allocated, and then write a memory usage report to the -.Ic memstatistics-file . -The default is -.Li no , -because it is faster to let the operating system clean up. -.Ic deallocate-on-exit -is handy for detecting memory leaks. -.It Ic dialup -If -.Li yes , -then the server treats all zones as if they are doing zone transfers -across a dial on demand dialup link, which can be brought up by -traffic originating from this server. This has different effects -according to zone type and concentrates the zone maintenance so that -it all happens in a short interval, once every -.Ic heartbeat-interval -and hopefully during the one call. -It also suppresses some of the normal zone maintenance traffic. -The default is -.Li no . -The -.Ic dialup -option may also be specified in the -.Ic zone -statement, in which -case it overrides the -.Ic options dialup -statement. -.Pp -If the zone is a -.Ic master -then the server will send out -.Dv NOTIFY -request to all the slaves. -This will trigger the zone up to date checking in the slave (providing -it supports -.Dv NOTIFY ) -allowing the slave -to verify the zone while the call us up. -.Pp -If the zone is a -.Ic slave -or -.Ic stub -then the server will suppress the zone regular zone up to date queries -and only perform the when the -.Ic heartbeat-interval -expires. -.It Ic fake-iquery -If -.Li yes , -the server will simulate the obsolete DNS query type -.Dv IQUERY . -The default is -.Li no . -.It Ic fetch-glue -If -.Li yes -(the default), the server will fetch ``glue'' resource -records it doesn't have when constructing the additional data section of -a response. -.Ic fetch-glue no -can be used in conjunction with -.Ic recursion no -to prevent the server's cache from growing or -becoming corrupted (at the cost of requiring more work from the client). -.It Ic has-old-clients -Setting the option to -.Li yes , -is equivalent to setting the following three options: -.Ic auth-nxdomain yes ; , -.Ic maintain-ixfr-base yes ; , -and -.Ic rfc2308-type1 no ; -.Pp -The use of -.Ic has-old-clients -with -.Ic auth-nxdomain , -.Ic maintain-ixfr-base , -and -.Ic rfc2308-type1 -is order dependent. -.It Ic host-statistics -If -.Li yes , -then statistics are kept for every host that the the nameserver -interacts with. The default is -.Li no . -.Em Note : -turning on -.Ic host-statistics -can consume huge amounts of memory. -.It Ic maintain-ixfr-base -If -.Li yes , -a IXFR database file is kept for all dynamically updated zones. -This enables the server to answer IXFR queries which can speed up -zone transfers enormously. -The default is -.Li no . -.It Ic multiple-cnames -If -.Li yes , -then multiple CNAME resource records will be -allowed for a domain name. The default is -.Li no . -Allowing multiple CNAME records is against standards and is not recommended. -Multiple CNAME support is available because previous versions of BIND -allowed multiple CNAME records, and these records have been used for load -balancing by a number of sites. -.It Ic notify -If -.Li yes -(the default), DNS NOTIFY messages are sent when a -zone the server is authoritative for changes. The use of NOTIFY -speeds convergence between the master and its slaves. Slave servers -that receive a NOTIFY message and understand it will contact the -master server for the zone and see if they need to do a zone transfer, and -if they do, they will initiate it immediately. -If -.Li explicit , -the DNS NOTIFY messages will only be sent to the addresses in the -.Ic also-notify -list. -The -.Ic notify -option may also be specified in the -.Ic zone -statement, in which case it overrides the -.Ic options notify -statement. -.It Ic suppress-initial-notify -If -.Li yes , -suppress the initial notify messages when the server first loads. -The default is -.Li no . -.It Ic recursion -If -.Li yes , -and a DNS query requests recursion, then the -server will attempt to do all the work required to answer the query. -If recursion is not on, the server will return a referral to the -client if it doesn't know the answer. The default is -.Li yes . -See also -.Ic fetch-glue -above. -.It Ic rfc2308-type1 -If -.Li yes, -the server will send NS records along with the SOA record for negative -answers. You need to set this to no if you have an old BIND server using -you as a forwarder that does not understand negative answers which contain -both SOA and NS records or you have an old version of sendmail. The correct -fix is to upgrade the broken server or sendmail. The default is -.Li no . -.It Ic use-id-pool -If -.Li yes, -the server will keep track of its own outstanding query ID's to avoid duplication -and increase randomness. This will result in 128KB more memory being consumed -by the server. The default is -.Li no . -.It Ic treat-cr-as-space -If -.Li yes, -the server will treat CR characters the same way it treats a space -or tab. This may be necessary when loading zone files on a UNIX system -that were generated on an NT or DOS machine. The default is -.Li no . -.El -.Ss Also-Notify -.Ic also-notify -.Pp -Defines a global list of IP addresses that also get sent NOTIFY messages -whenever a fresh copy of the zone is loaded. This helps to ensure that copies of -the zones will quickly converge on ``stealth'' servers. If an -.Ic also-notify -list is given in a -.Ic zone -statement, it will override the -.Ic options also-notify -statement. When a -.Ic zone notify -statement is set to -.Ic no , -the IP addresses in -the global -.Ic also-notify -list will not get sent NOTIFY messages for that zone. -The default is the empty list (no global notification list). -.Ss Forwarding -The forwarding facility can be used to create a large site-wide -cache on a few servers, reducing traffic over links to external -nameservers. It can also be used to allow queries by servers that do -not have direct access to the Internet, but wish to look up exterior -names anyway. Forwarding occurs only on those queries for which the -server is not authoritative and does not have the answer in its cache. -.Bl -tag -width 0n -.It Ic forward -This option is only meaningful if the -.Ic forwarders -list is -not empty. A value of -.Li first , -the default, causes the -server to query the forwarders first, and if that doesn't answer the -question the server will then look for the answer itself. If -.Li only -is specified, the server will only query the forwarders. -.It Ic forwarders -Specifies the IP addresses to be used for forwarding. The default is the -empty list (no forwarding). -.El -.Pp -Forwarding can also be configured on a per-zone basis, allowing for -the global forwarding options to be overridden in a variety of ways. -You can set particular zones to use different forwarders, or have -different -.Ic forward only/first -behavior, or to not forward -at all. See -.Sx THE ZONE STATEMENT -section for more information. -.Pp -Future versions of BIND 8 will provide a more powerful forwarding -system. The syntax described above will continue to be supported. -.Ss Name Checking -The server can check domain names based upon their expected client contexts. -For example, a domain name used as a hostname can be checked for compliance -with the RFCs defining valid hostnames. -.Pp -Three checking methods are available: -.Bl -tag -width 0n -.It Ic ignore -No checking is done. -.It Ic warn -Names are checked against their expected client contexts. Invalid names are -logged, but processing continues normally. -.It Ic fail -Names are checked against their expected client contexts. Invalid names are -logged, and the offending data is rejected. -.El -.Pp -The server can check names three areas: master zone files, slave -zone files, and in responses to queries the server has initiated. If -.Ic check-names response fail -has been specified, and -answering the client's question would require sending an invalid name -to the client, the server will send a -.Dv REFUSED -response code to the client. -.Pp -The defaults are: -.Bd -literal - check-names master fail; - check-names slave warn; - check-names response ignore; -.Ed -.Pp -.Ic check-names -may also be specified in the -.Ic zone -statement, in which case it overrides the -.Ic options check-names -statement. When used in a -.Ic zone -statement, the area is not specified (because it can be deduced from -the zone type). -.Ss Access Control -Access to the server can be restricted based on the IP address of the -requesting system or via shared secret keys. See -.Sx ADDRESS MATCH LISTS -for details on how to specify access criteria. -.Bl -tag -width 0n -.It Ic allow-query -Specifies which hosts are allowed to ask ordinary questions. -.Ic allow-query -may also be specified in the -.Ic zone -statement, in which case it overrides the -.Ic options allow-query -statement. If not specified, the default is to allow queries -from all hosts. -.Bl -tag -width 0n -.It Ic allow-recursion -Specifies which hosts are allowed to ask recursive questions. -If not specified, the default is to allow recursive queries -from all hosts. -.It Ic allow-transfer -Specifies which hosts are allowed to receive zone transfers from the -server. -.Ic allow-transfer -may also be specified in the -.Ic zone -statement, in which case it overrides the -.Ic options allow-transfer -statement. If not specified, the default -is to allow transfers from all hosts. -.It Ic blackhole -Specifies a list of addresses that the server will not accept queries from -or use to resolve a query. Queries from these addresses will not be -responded to. -.El -.El -.Ss Interfaces -The interfaces and ports that the server will answer queries from may -be specified using the -.Ic listen-on -option. -.Ic listen-on -takes an optional port, and an address match list. -The server will listen on all interfaces allowed by the address match -list. If a port is not specified, port 53 will be used. -.Pp -Multiple -.Ic listen-on -statements are allowed. For example, -.Bd -literal - listen-on { 5.6.7.8; }; - listen-on port 1234 { !1.2.3.4; 1.2/16; }; -.Ed -.Pp -will enable the nameserver on port 53 for the IP address 5.6.7.8, and -on port 1234 of an address on the machine in net 1.2 that is not -1.2.3.4. -.Pp -If no -.Ic listen-on -is specified, the server will listen on port -53 on all interfaces. -.Ss Query Address -If the server doesn't know the answer to a question, it will query -other nameservers. -.Ic query-source -specifies the address and port used for such queries. If -.Ic address -is -.Li * -or is omitted, a wildcard IP address -( -.Dv INADDR_ANY ) -will be used. If -.Va port -is -.Li * -or is omitted, a random unprivileged port will be used. -The default is -.Dl query-source address * port *; -.Pp -Note: -.Ic query-source -currently applies only to UDP queries; -TCP queries always use a wildcard IP address and a random unprivileged -port. -.Ss Zone Transfers -.Bl -tag -width 0n -.It Ic max-transfer-time-in -Inbound zone transfers ( -.Nm named-xfer -processes) running -longer than this many minutes will be terminated. -The default is 120 minutes (2 hours). -.It Ic transfer-format -The server supports two zone transfer methods. -.Li one-answer -uses one DNS message per resource record -transferred. -.Li many-answers -packs as many resource records -as possible into a message. -.Li many-answers -is more efficient, but is only known to be understood by BIND 8.1 and -patched versions of BIND 4.9.5. The default is -.Li one-answer . -.Ic transfer-format -may be overridden on a per-server basis by using the -.Ic server -statement. -.It Ic transfers-in -The maximum number of inbound zone transfers that can be running -concurrently. The default value is 10. Increasing -.Ic transfers-in -may speed up the convergence of slave zones, -but it also may increase the load on the local system. -.It Ic transfers-out -This option will be used in the future to limit the number of -concurrent outbound zone transfers. It is checked for syntax, but is -otherwise ignored. -.It Ic transfers-per-ns -The maximum number of inbound zone transfers ( -.Nm named-xfer -processes) that can be concurrently transferring from a given remote -nameserver. The default value is 2. Increasing -.Ic transfers-per-ns -may speed up the convergence of slave zones, but it also may increase -the load on the remote nameserver. -.Ic transfers-per-ns -may be overridden on a per-server basis by using the -.Ic transfers -phrase of the -.Ic server -statement. -.It Ic transfer-source -.Nm transfer-source -determines which local address will be bound to the TCP connection used to fetch all zones -transferred inbound by the server. If not set, it defaults to a system controlled value which will usually be the address of the interface ``closest to`` the remote end. This -address must appear in the remote end's -.Nm allow-transfer -option for the zones being transferred, if one is specified. This statement sets the -.Nm transfer-source -for all zones, but can be overridden on a per-zone basis by including a -.Nm transfer-source -statement within the zone block in the configuration file. -.El -.Ss Resource Limits -The server's usage of many system resources can be limited. Some -operating systems don't support some of the limits. On such systems, -a warning will be issued if the unsupported limit is used. Some -operating systems don't support limiting resources, and on these systems -a -.D1 cannot set resource limits on this system -message will -be logged. -.Pp -Scaled values are allowed when specifying resource limits. For -example, -.Li 1G -can be used instead of -.Li 1073741824 -to specify a limit of one gigabyte. -.Li unlimited -requests unlimited use, or the maximum -available amount. -.Li default -uses the limit that was in -force when the server was started. -See the definition of -.Va size_spec -in the -.Sx DOCUMENTATION DEFINITIONS -section for more details. -.Bl -tag -width 0n -.It Ic coresize -The maximum size of a core dump. The default value is -.Li default . -.It Ic datasize -The maximum amount of data memory the server may use. The default -value is -.Li default . -.It Ic files -The maximum number of files the server may have open concurrently. -The default value is -.Li unlimited . -Note that on some operating systems the server cannot set an unlimited -value and cannot determine the maximum number of open files the kernel -can support. On such systems, choosing -.Li unlimited -will cause the server to use -the larger of the -.Va rlim_max -from -.Fn getrlimit RLIMIT_NOFILE -and the value returned by -.Fn sysconf _SC_OPEN_MAX . -If the -actual kernel limit is larger than this value, use -.Ic limit files -to specify the limit explicitly. -.It Ic max-ixfr-log-size -The -.Li max-ixfr-log-size -will be used in a future release of the server to limit the size of the transaction -log kept for Incremental Zone Transfer. -.It Ic stacksize -The maximum amount of stack memory the server may use. The default value is -.Li default . -.El -.Ss Periodic Task Intervals -.Bl -tag -width 0n -.It Ic cleaning-interval -The server will remove expired resource records from the cache every -.Ic cleaning-interval -minutes. The default is 60 minutes. If set -to 0, no periodic cleaning will occur. -.It Ic heartbeat-interval -The server will perform zone maintenance tasks for all zones marked -.Ic dialup yes -whenever this interval expires. -The default is 60 minutes. Reasonable values are up to 1 day (1440 minutes). -If set to 0, no zone maintenance for these zones will occur. -.It Ic interface-interval -The server will scan the network interface list every -.Ic interface-interval -minutes. The default is 60 minutes. -If set to 0, interface scanning will only occur when the configuration -file is loaded. After the scan, listeners will be started on any new -interfaces (provided they are allowed by the -.Ic listen-on -configuration). Listeners on interfaces that have gone away will be -cleaned up. -.It Ic statistics-interval -Nameserver statistics will be logged every -.Ic statistics-interval -minutes. The default is 60. If set to 0, no statistics will be logged. -.El -.Ss Topology -All other things being equal, when the server chooses a nameserver -to query from a list of nameservers, it prefers the one that is -topologically closest to itself. The -.Ic topology -statement takes an address match list and interprets it in a special way. -Each top-level list element is assigned a distance. -Non-negated elements get a distance based on -their position in the list, where the closer the match is to the start -of the list, the shorter the distance is between it and the server. A -negated match will be assigned the maximum distance from the server. -If there is no match, the address will get a distance which is further -than any non-negated list element, and closer than any negated -element. For example, -.Bd -literal - topology { - 10/8; - !1.2.3/24; - { 1.2/16; 3/8; }; - }; -.Ed -.Pp -will prefer servers on network 10 the most, followed by hosts on -network 1.2.0.0 (netmask 255.255.0.0) and network 3, with the exception -of hosts on network 1.2.3 (netmask 255.255.255.0), which is preferred least -of all. -.Pp -The default topology is -.Dl topology { localhost; localnets; }; -.Ss Resource Record sorting -When returning multiple RRs, the nameserver will normally return them in -.Ic Round Robin , -i.e. after each request, the first RR is put to the end of the list. -As the order of RRs is not defined, this should not cause any problems. -.Pp -The client resolver code should re-arrange the RRs as appropriate, i.e. using -any addresses on the local net in preference to other addresses. However, not all -resolvers can do this, or are not correctly configured. -.Pp -When a client is using a local server, the sorting can be performed in the server, -based on the client's address. This only requires configuring the nameservers, -not all the clients. -.Pp -The -.Ic sortlist -statement takes an address match list and interprets it even more -specially than the -.Ic topology -statement does. -.Pp -Each top level statement in the sortlist must itself be an explicit address match -list with one or two elements. The first element (which may be an IP address, -an IP prefix, an ACL name or nested address match list) of each top level list is -checked against the source address of the query until a match is found. -.Pp -Once the source address of the query has been matched, if the top level -statement contains only one element, the actual primitive element that -matched the source address is used to select the address in the response to -move to the beginning of the response. If the statement is a list of two elements, -the second element is treated like the address match list in a topology -statement. Each top level element is assigned a distance and the address in the -response with the minimum distance is moved to the beginning of the response. -.Pp -In the following example, any queries received from any of the addresses of the -host itself will get responses preferring addresses on any of the locally -connected networks. Next most preferred are addresses on the 192.168.1/24 -network, and after that either the 192.168.2/24 or 192.168.3/24 network with no -preference shown between these two networks. Queries received from a host on -the 192.168.1/24 network will prefer other addresses on that network to the -192.168.2/24 and 192.168.3/24 networks. Queries received from a host on the -192.168.4/24 or the 192.168.5/24 network will only prefer other addresses on -their directly connected networks. -.Bd -literal -sortlist { - { localhost; // IF the local host - { localnets; // THEN first fit on the - 192.168.1/24; // following nets - { 192,168.2/24; 192.168.3/24; }; }; }; - { 192.168.1/24; // IF on class C 192.168.1 - { 192.168.1/24; // THEN use .1, or .2 or .3 - { 192.168.2/24; 192.168.3/24; }; }; }; - { 192.168.2/24; // IF on class C 192.168.2 - { 192.168.2/24; // THEN use .2, or .1 or .3 - { 192.168.1/24; 192.168.3/24; }; }; }; - { 192.168.3/24; // IF on class C 192.168.3 - { 192.168.3/24; // THEN use .3, or .1 or .2 - { 192.168.1/24; 192.168.2/24; }; }; }; - { { 192.168.4/24; 192.168.5/24; }; // if .4 or .5, prefer that net - }; -}; -.Ed -.Pp -The following example will give reasonable behaviour for the local host and -hosts on directly connected networks. It is similar to the behavior of the -address sort in BIND 4.9.x. Responses sent to queries from the local host will -favor any of the directly connected networks. Responses sent to queries from -any other hosts on a directly connected network will prefer addresses on that -same network. Responses to other queries will not be sorted. -.Bd -literal -sortlist { - { localhost; localnets; }; - { localnets; }; -}; -.Ed -.Ss RRset Ordering -When multiple records are returned in an answer it may be useful to configure -the order the records are placed into the response. For example the records for -a zone might be configured to always be returned in the order they are defined -in the zone file. Or perhaps a random shuffle of the records as they are -returned is wanted. The rrset-order statement permits configuration of the -ordering made of the records in a multiple record response. The default, if no -ordering is defined, is a cyclic ordering (round robin). -.Pp -An -.Ic order_spec -is defined as follows: -.Bd -literal - [ \fIclass class_name\fR ][ \fItype type_name\fR ][ \fIname\fR "FQDN" ] \fIorder\fR ordering -.Ed -.Pp -If no class is specified, the default is -.Ic ANY . -If no -.Li Ictype -is specified, the default is -.Ic ANY . -If no name is specified, the default is "*". -.Pp -The legal values for -.Ic ordering -are: -.Bl -tag -width indent -.It Ic fixed -Records are returned in the order they are defined in the zone file. -.It Ic random -Records are returned in some random order. -.It Ic cyclic -Records are returned in a round-robin order. -.El -.Pp -For example: -.Bd -literal - rrset-order { - class IN type A name "rc.vix.com" order random; - order cyclic; - }; -.Ed -.Pp -will cause any responses for type A records in class IN that have "rc.vix.com" as -a suffix, to always be returned in random order. All other records are returned -in cyclic order. -.Pp -If multiple -.Ic rrset-order -statements appear, they are not combined--the last one applies. -.Pp -If no -.Ic rrset-order -statement is specified, a default one of: -.Bd -literal - rrset-order { class ANY type ANY name "*" order cyclic ; }; -.Ed -.Pp -is used. -.Ss Glue Ordering -When running a root nameserver it is sometimes necessary to ensure that other -nameservers that are priming are successful. -This requires that glue A records for at least of the nameservers are returned -in the answer to a priming query. -This can be achieved by setting -.Ic preferred-glue A; -which will add A records before other types in the additional section. -.Ss EDNS -Some firewalls fail to pass EDNS/UDP messages that are larger than -certain size, 512 or the UDP reassembly buffer. -To allow EDNS to -work across such firewalls it is necessary to advertise a EDNS -buffer size that is small enough to not trigger failures. -.Ic edns-udp-size -can be use to adjust the advertised size. -Values less than 512 will be increased to 512 and values greater than -4096 will be truncated to 4096. -.Ss Tuning -.Bl -tag -width 0n -.It Ic lame-ttl -Sets the number of seconds to cache a lame server indication. 0 disables -caching. Default is 600 (10 minutes). Maximum value is 1800 (30 minutes) -.It Ic max-ncache-ttl -To reduce network traffic and increase performance the server store negative -answers. -.Ic max-ncache-ttl -is used to set a maximum retention time -for these answers in the server is seconds. The default -.Ic max-ncache-ttl -is 10800 seconds (3 hours). -.Ic max-ncache-ttl -cannot exceed the maximum retention time for ordinary (positive) -answers (7 days) and will be silently truncated to 7 days if set to a -value which is greater that 7 days. -.It Ic min-roots -The minimum number of root servers that is required for a request for the root -servers to be accepted. Default is 2. -.El -.Sh THE ZONE STATEMENT -.Ss Syntax -.Bd -literal -zone \fIdomain_name\fR [ ( in | hs | hesiod | chaos ) ] { - type master; - file \fIpath_name\fR; - [ check-names ( warn | fail | ignore ); ] - [ allow-update { \fIaddress_match_list\fR }; ] - [ allow-query { \fIaddress_match_list\fR }; ] - [ allow-transfer { \fIaddress_match_list\fR }; ] - [ forward ( only | first ); ] - [ forwarders { [ \fIip_addr\fR ; [ \fIip_addr\fR ; ... ] ] }; ] - [ dialup \fIyes_or_no\fR; ] - [ notify ( \fIyes_or_no\fR | explicit ); ] - [ also-notify { \fIip_addr\fR; [ \fIip_addr\fR; ... ] }; - [ pubkey \fInumber\fR \fInumber\fR \fInumber\fR \fIstring\fR; ] -}; -.Pp -zone \fIdomain_name\fR [ ( in | hs | hesiod | chaos ) ] { - type ( slave | stub ); - [ file \fIpath_name\fR; ] - masters [ port \fIip_port\fR ] { \fIip_addr\fR [ key \fIkey_id\fR ]; [ ... ] }; - [ check-names ( warn | fail | ignore ); ] - [ allow-update { \fIaddress_match_list\fR }; ] - [ allow-query { \fIaddress_match_list\fR }; ] - [ allow-transfer { \fIaddress_match_list\fR }; ] - [ forward ( only | first ); ] - [ forwarders { [ \fIip_addr\fR ; [ \fIip_addr\fR ; ... ] ] }; ] - [ transfer-source \fIip_addr\fR; ] - [ max-transfer-time-in \fInumber\fR; ] - [ notify \fIyes_or_no\fR; ] - [ also-notify { \fIip_addr\fR; [ \fIip_addr\fR; ... ] }; - [ pubkey \fInumber\fR \fInumber\fR \fInumber\fR \fIstring\fR; ] -}; -.Pp -zone \fIdomain_name\fR [ ( in | hs | hesiod | chaos ) ] { - type forward; - [ forward ( only | first ); ] - [ forwarders { [ \fIip_addr\fR ; [ \fIip_addr\fR ; ... ] ] }; ] - [ check-names ( warn | fail | ignore ); ] -}; -.Pp -zone \&".\&" [ ( in | hs | hesiod | chaos ) ] { - type hint; - file \fIpath_name\fR; - [ check-names ( warn | fail | ignore ); ] -}; -.Ed -.Ss Definition and Usage -The -.Ic zone -statement is used to define how information about particular DNS zones -is managed by the server. There are five different zone types. -.Bl -tag -width 0n -.It Ic master -The server has a master copy of the data for the zone and will be able -to provide authoritative answers for it. -.It Ic slave -A -.Ic slave -zone is a replica of a master zone. The -.Ic masters -list specifies one or more IP addresses that the slave contacts to -update its copy of the zone. If a -.Ic port -is specified then checks to see if the zone is current and zone transfers -will be done to the port given. If -.Ic file -is specified, then the replica will be written to the named file. -Use of the -.Ic file -clause is highly recommended, since it often speeds server startup -and eliminates a needless waste of bandwidth. -.It Ic stub -A -.Ic stub -zone is like a slave zone, except that it replicates -only the NS records of a master zone instead of the entire zone. -.It Ic forward -A -.Ic forward -zone is used to direct all queries in it to other servers, as described in -.Sx THE OPTIONS STATEMENT -section. The specification of options in such a zone will override -any global options declared in the -.Ic options -statement. -.Pp -If either no -.Ic forwarders -clause is present in the zone or an empty list for -.Ic forwarders -is given, then no forwarding will be done for the zone, cancelling the -effects of any -.Ic forwarders -in the -.Ic options -statement. -Thus if you want to use this type of zone to change only the behavior of -the global -.Ic forward -option, and not the servers used, then you also need to respecify the -global forwarders. -.It Ic hint -The initial set of root nameservers is specified using a -.Ic hint -zone. When the server starts up, it uses the root hints -to find a root nameserver and get the most recent list of root nameservers. -.El -.Pp -Note: previous releases of BIND used the term -.Ic primary -for a master zone, -.Ic secondary -for a slave zone, and -.Ic cache -for a hint zone. -.Ss Classes -The zone's name may optionally be followed by a class. If a class is not -specified, class -.Ic in -(for "internet"), is assumed. This is correct for the vast majority -of cases. -.Pp -The -.Ic hesiod -class is for an information service from MIT's Project Athena. It is -used to share information about various systems databases, such as -users, groups, printers and so on. More information can be found at -ftp://athena-dist.mit.edu/pub/ATHENA/usenix/athena_changes.PS. -The keyword -.Ic hs -is a synonym for -.Ic hesiod . -.Pp -Another MIT development was CHAOSnet, a LAN protocol created in the -mid-1970s. It is still sometimes seen on LISP stations and other -hardware in the AI community, and zone data for it can be specified -with the -.Ic chaos -class. -.Ss Options -.Bl -tag -width 0n -.It Ic check-names -See the subsection on -.Sx Name Checking -in -.Sx THE OPTIONS STATEMENT . -.It Ic allow-query -See the description of -.Ic allow-query -in the -.Sx Access Control -subsection of -.Sx THE OPTIONS STATEMENT . -.It Ic allow-update -Specifies which hosts are allowed to submit Dynamic DNS updates to the -server. The default is to deny updates from all hosts. -.It Ic allow-transfer -See the description of -.Ic allow-transfer -in the -.Sx Access Control -subsection of -.Sx THE OPTIONS STATEMENT . -.It Ic transfer-source -.Ic transfer-source -determines which local address will be bound to the TCP connection -used to fetch this zone. If not set, it defaults to a system -controlled value which will usually be the address of the interface -``closest to'' the remote end. This address must appear in the remote end's -.Ic allow-transfer -option for this zone if one is specified. -.It Ic max-transfer-time-in -See the description of -.Ic max-transfer-time-in -in the -.Sx Zone Transfers -subsection of -.Sx THE OPTIONS STATEMENT . -.It Ic dialup -See the description of -.Ic dialup -in the -.Sx Boolean Options -subsection of -.Sx THE OPTIONS STATEMENT . -.It Ic notify -See the description of -.Sx notify -in the -.Sx Boolean Options -subsection of the -.Sx THE OPTIONS STATEMENT . -.It Ic also-notify -.Ic also-notify -is only meaningful if -.Ic notify -is active for this zone. -The set of machines that will receive a DNS NOTIFY message for this -zone is made up of all the listed nameservers for the zone (other than -the primary master) plus any IP addresses specified with -.Ic also-notify . -.Ic also-notify -is not meaningful for -.Ic stub -zones. The default is the empty list. -.It Ic forward -.Ic forward -is only meaningful if the zone has a -.Ic forwarders -list. The -.Ic only -value causes the lookup to fail after trying the -.Ic forwarders -and getting no answer, while -.Ic first -would allow a normal lookup to be tried. -.It Ic forwarders -The -.Ic forwarders -option in a zone is used to override the list of global forwarders. -If it is not specified in a zone of type -.Ic forward , -.Em no -forwarding is done for the zone; the global options are not used. -.It Ic pubkey -The DNSSEC flags, protocol, and algorithm are specified, as well as a base-64 -encoded string representing the key. -.El -.Sh THE ACL STATEMENT -.Ss Syntax -.Bd -literal -acl \fIname\fR { - \fIaddress_match_list\fR -}; -.Ed -.Ss Definition and Usage -The -.Ic acl -statement creates a named address match list. -It gets its name from a primary use of address match lists: Access -Control Lists (ACLs). -.Pp -Note that an address match list's name must be defined with -.Ic acl -before it can be used elsewhere; no forward -references are allowed. -.Pp -The following ACLs are built-in: -.Bl -tag -width 0n -.It Ic any -Allows all hosts. -.It Ic none -Denies all hosts. -.It Ic localhost -Allows the IP addresses of all interfaces on the system. -.It Ic localnets -Allows any host on a network for which the system has an interface. -.El -.Sh THE KEY STATEMENT -.Ss Syntax -.Bd -literal -key \fIkey_id\fR { - algorithm \fIalgorithm_id\fR; - secret \fIsecret_string\fR; -}; -.Ed -.Ss Definition and Usage -The -.Ic key -statement defines a key ID which can be used in a -.Ic server -statement to associate a method of authentication with a particular -name server that is more rigorous than simple IP address matching. -A key ID must be created with the -.Ic key -statement before it can be used in a -.Ic server -definition or an address match list. -.Pp -The -.Va algorithm_id -is a string that specifies a -security/authentication algorithm. -.Va secret_string -is the secret to be used by the algorithm, -and is treated as a base-64 encoded string. -It should go without saying, but probably can't, -that if you have -.Va secret_string 's -in your -.Pa named.conf , -then it should not be readable by anyone but the superuser. -.Sh THE TRUSTED-KEYS STATEMENT -.Ss Syntax -.Bd -literal -trusted-keys { - [ \fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ] -}; -.Ed -.Ss Definition and Usage -The -.Ic trusted-keys -statement is for use with DNSSEC-style security, originally specified -in RFC 2065. DNSSEC is meant to -provide three distinct services: key distribution, data origin -authentication, and transaction and request authentication. A -complete description of DNSSEC and its use is beyond the scope of this -document, and readers interested in more information should start with -RFC 2065 and then continue with the Internet Drafts available at -http://www.ietf.org/ids.by.wg/dnssec.html. -.Pp -Each trusted key is associated with a domain name. Its attributes are -the non-negative integral -.Va flags , -.Va protocol , -and -.Va algorithm , -as well as a base-64 encoded string representing the -.Va key . -.Pp -Any number of trusted keys can be specified. -.Sh THE SERVER STATEMENT -.Ss Syntax -.Bd -literal -server \fIip_addr\fR { - [ edns \fIyes_or_no\fR; ] - [ bogus \fIyes_or_no\fR; ] - [ support-ixfr \fIyes_or_no\fR; ] - [ transfers \fInumber\fR; ] - [ transfer-format ( one-answer | many-answers ); ] - [ keys { \fIkey_id\fR [ \fIkey_id\fR ... ] }; ] -}; -.Ed -.Ss Definition and Usage -The server statement defines the characteristics to be -associated with a remote name server. -.Pp -If you discover that a server does not support EDNS you can prevent -named making EDNS queries to it by specifying -.Ic edns -.Ic no; . -The default value of -.Ic edns -is -.Ic yes . -.Pp -If you discover that a server is giving out bad data, marking it as -.Ic bogus -will prevent further queries to it. The default value of -.Ic bogus -is -.Li no . -.Pp -If the server supports IXFR you can tell named to attempt to -perform a IXFR style zone transfer by specifing -.Ic support-ixfr -.Li yes . -The default value of -.Ic support-ixfr -is -.Li no . -.Pp -The server supports two zone transfer methods. The first, -.Ic one-answer , -uses one DNS message per resource record transferred. -.Ic many-answers -packs as many resource records as possible into a message. -.Ic many-answers -is more efficient, but is only known to be understood by BIND 8.1 and -patched versions of BIND 4.9.5. You can specify which method to use -for a server with the -.Ic transfer-format -option. If -.Ic transfer-format -is not specified, the -.Ic transfer-format -specified by the -.Ic options -statement will be used. -.Pp -The -.Ic transfers -will be used in a future release of the server to limit the number of -concurrent in-bound zone transfers from the specified server. It is -checked for syntax but is otherwise ignored. -.Pp -The -.Ic keys -clause is used to identify a -.Va key_id -defined by the -.Ic key -statement, to be used for transaction security when talking to the -remote server. -The -.Ic key -statement must come before the -.Ic server -statement that references it. -.Pp -The -.Ic keys -statement is intended for future use by the -server. It is checked for syntax but is otherwise ignored. -.Sh THE CONTROLS STATEMENT -.Ss Syntax -.Bd -literal -controls { - [ inet \fIip_addr\fR - port \fIip_port\fR - allow { \fIaddress_match_list\fR; }; ] - [ unix \fIpath_name\fR - perm \fInumber\fR - owner \fInumber\fR - group \fInumber\fR; ] -}; -.Ed -.Ss Definition and Usage -The -.Ic controls -statement declares control channels to be used by system -administrators to affect the operation of the local name server. -These control channels are used by the -.Nm ndc -utility to send commands -to and retrieve non-DNS results from a name server. -.Pp -A -.Ic unix -control channel is a FIFO in the file system, and access to it is -controlled by normal file system permissions. It is created by -.Nm named -with the specified file mode bits (see -.Xr chmod 1 ) , -user and group owner. Note that, unlike -.Nm chmod , -the mode bits specified for -.Ic perm -will normally have a leading -.Li 0 -so the number is interpreted as octal. Also note that the user and -group ownership specified as -.Ic owner -and -.Ic group -must be given as numbers, not names. -It is recommended that the -permissions be restricted to administrative personnel only, or else any -user on the system might be able to manage the local name server. -.Pp -An -.Ic inet -control channel is a TCP/IP socket accessible to the Internet, created -at the specified -.Va ip_port -on the specified -.Va ip_addr . -Modern -.Nm telnet -clients are capable of speaking directly to these -sockets, and the control protocol is ARPAnet-style text. -It is recommended that 127.0.0.1 be the only -.Va ip_addr -used, and this only if you trust all non-privileged users on the local -host to manage your name server. -.Sh THE INCLUDE STATEMENT -.Ss Syntax -.Bd -literal -include \fIpath_name\fR; -.Ed -.Ss Definition and Usage -The -.Ic include -statement inserts the specified file at the point that the -.Ic include -statement is encountered. It cannot be used within another statement, -though, so a line such as -.Dl acl internal_hosts { include "internal_hosts.acl"; }; -is not allowed. -.Pp -Use -.Ic include -to break the configuration up into easily-managed chunks. -For example: -.Bd -literal -include "/etc/security/keys.bind"; -include "/etc/acls.bind"; -.Ed -.Pp -could be used at the top of a BIND configuration file in order to -include any ACL or key information. -.Pp -Be careful not to type -``#include'', like you would in a C program, because -``#'' is used to start a comment. -.Sh EXAMPLES -The simplest configuration file that is still realistically useful is -one which simply defines a hint zone that has a full path to the root -servers file. -.Bd -literal -zone \&".\&" in { - type hint; - file \&"/var/named/root.cache\&"; -}; -.Ed -.Pp -Here's a more typical real-world example. -.Bd -literal -/* - * A simple BIND 8 configuration - */ -.Pp -logging { - category lame-servers { null; }; - category cname { null; }; -}; -.Pp -options { - directory \&"/var/named\&"; -}; -.Pp -controls { - inet * port 52 allow { any; }; // a bad idea - unix \&"/var/run/ndc\&" perm 0600 owner 0 group 0; // the default -}; -.Pp -zone \&"isc.org\&" in { - type master; - file \&"master/isc.org\&"; -}; -.Pp -zone \&"vix.com\&" in { - type slave; - file \&"slave/vix.com\&"; - masters { 10.0.0.53; }; -}; -.Pp -zone \&"0.0.127.in-addr.arpa\&" in { - type master; - file \&"master/127.0.0\&"; -}; -.Pp -zone \&".\&" in { - type hint; - file \&"root.cache\&"; -}; -.Ed -.Sh FILES -.Bl -tag -width 0n -compact -.It Pa /etc/named.conf -The BIND 8 -.Nm named -configuration file. -.El -.Sh SEE ALSO -.Xr named 8 , -.Xr ndc 8 diff --git a/contrib/bind/doc/man/ndc.8 b/contrib/bind/doc/man/ndc.8 deleted file mode 100644 index 33a7076..0000000 --- a/contrib/bind/doc/man/ndc.8 +++ /dev/null @@ -1,133 +0,0 @@ -.\" Copyright (c) 1998,1999 by Internet Software Consortium -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\" ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\" CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" -.Dd December 31, 1998 -.Dt @INDOT_U@NDC @SYS_OPS_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm ndc -.Nd name daemon control program -.Sh SYNOPSIS -.Nm ndc -.Op Fl c Ar channel -.Op Fl l Ar localsock -.Op Fl p Ar pidfile -.Op Fl d -.Op Fl q -.Op Fl s -.Op Fl t -.Op Ar command -.Sh DESCRIPTION -This command allows the system administrator to control the operation -of a name server. If no -.Ar command -is given, -.Ic ndc -will prompt for commands until it reads EOF. -.Pp -Options are: -.Bl -tag -width Fl -.It Fl c Ar channel -Specifies the rendezvous point for the control channel. The default is -.Pa /var/run/ndc -(a UNIX domain socket which is also the server's default control channel). -If the desired control channel is a TCP/IP socket, then the format of the -.Ar channel -argument is -.Sy ipaddr/port -(for example, -.Sy 127.0.0.1/54 -would be TCP port 54 on the local host.) -.It Fl l Ar localsock -This option will -.Xr bind 2 -the client side of the control channel to a specific address. Servers can -be configured to reject connections which do not come from specific addresses. -The format is the same as for -.Ar channel -(see above). -.It Fl p Ar pidfile -For backward compatibility with older name servers, -.Ic ndc -is able to use UNIX signals for control communications. This capability is -optional in modern name servers and will disappear altogether at some future -time. Note that the available -.Ar command -set is narrower when the signal interface is used. A likely -.Ar pidfile -argument would be something like -.Pa /var/run/named.pid . -.It Fl d -Turns on debugging output, which is of interest mainly to developers. -.It Fl q -Suppresses prompts and result text. -.It Fl s -Suppresses nonfatal error announcements. -.It Fl t -Turns on protocol and system tracing, useful in installation debugging. -.El -.Sh COMMANDS -Several commands are built into -.Ic ndc , -but the full set of commands supported by the name server is dynamic and -should be discovered using the -.Ar help -command (see below). Builtin commands are: -.Bl -tag -width Fl -.It Ar /help -Provides help for builtin commands. -.It Ar /exit -Exit from -.Ic ndc -command interpreter. -.It Ar /trace -Toggle tracing (see -.Fl t -description above). -.It Ar /debug -Toggle debugging (see -.Fl d -description above). -.It Ar /quiet -Toggle quietude (see -.Fl q -description above). -.It Ar /silent -Toggle silence (see -.Fl s -description above). -.El -.Sh NOTES -If running in -.Ar pidfile -mode, any arguments to -.Ar start -and -.Ar restart -commands are passed to the new -.Ic @INDOT@named -on its command line. If running in -.Ar channel -mode, there is no -.Ar start -command and the -.Ar restart -command just tells the name server to -.Xr execvp @LIB_C_EXT@ -itself. -.Sh AUTHOR -Paul Vixie (Internet Software Consortium) -.Sh SEE ALSO -.Xr @INDOT@named @SYS_OPS_EXT@ , diff --git a/contrib/bind/doc/man/nslookup.8 b/contrib/bind/doc/man/nslookup.8 deleted file mode 100644 index e33993c..0000000 --- a/contrib/bind/doc/man/nslookup.8 +++ /dev/null @@ -1,537 +0,0 @@ -.\" -.\" ++Copyright++ 1985, 1989 -.\" - -.\" Copyright (c) 1985, 1989 -.\" The Regents of the University of California. All rights reserved. -.\" -.\" Redistribution and use in source and binary forms, with or without -.\" modification, are permitted provided that the following conditions -.\" are met: -.\" 1. Redistributions of source code must retain the above copyright -.\" notice, this list of conditions and the following disclaimer. -.\" 2. Redistributions in binary form must reproduce the above copyright -.\" notice, this list of conditions and the following disclaimer in the -.\" documentation and/or other materials provided with the distribution. -.\" 3. All advertising materials mentioning features or use of this software -.\" must display the following acknowledgement: -.\" This product includes software developed by the University of -.\" California, Berkeley and its contributors. -.\" 4. Neither the name of the University nor the names of its contributors -.\" may be used to endorse or promote products derived from this software -.\" without specific prior written permission. -.\" -.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND -.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE -.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE -.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE -.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL -.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS -.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) -.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT -.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY -.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF -.\" SUCH DAMAGE. -.\" - -.\" Portions Copyright (c) 1993 by Digital Equipment Corporation. -.\" -.\" Permission to use, copy, modify, and distribute this software for any -.\" purpose with or without fee is hereby granted, provided that the above -.\" copyright notice and this permission notice appear in all copies, and that -.\" the name of Digital Equipment Corporation not be used in advertising or -.\" publicity pertaining to distribution of the document or software without -.\" specific, written prior permission. -.\" -.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL -.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES -.\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT -.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\" SOFTWARE. -.\" - -.\" --Copyright-- -.\" -.\" @(#)nslookup.8 5.3 (Berkeley) 6/24/90 -.\" $FreeBSD$ -.\" -.Dd June 24, 1990 -.Dt NSLOOKUP @SYS_OPS_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm nslookup -.Nd query Internet name servers interactively -.Sh SYNOPSIS -.Nm nslookup -.Op Fl option Ar ... -.Op Ar host-to-find | Fl Op Ar server -.Sh DESCRIPTION -.Ic Nslookup -is a program to query Internet domain name servers. -.Ic Nslookup -has two modes: interactive and non-interactive. -Interactive mode allows the user to query name servers for -information about various hosts and domains or to print a list of hosts -in a domain. -Non-interactive mode is used to print just the name and requested information -for a host or domain. -.Sh ARGUMENTS -Interactive mode is entered in the following cases: -.Bl -tag -width "a) " -.It a) -when no arguments are given (the default name server will be used), -.It b) -when the first argument is a hyphen (-) and the second argument -is the host name or Internet address of a name server. -.El -.Pp -Non-interactive mode is used when the name or Internet address -of the host to be looked up -is given as the first argument. The optional second argument specifies -the host name or address of a name server. -.Pp -The options listed under the -.Dq Li set -command below can be specified in -the -.Pa .nslookuprc -file in the user's home directory if they are listed -one per line. Options can also be specified -on the command line if they precede the arguments and are prefixed with -a hyphen. For example, to change the default query type to host information, -and the initial timeout to 10 seconds, type: -.Bd -literal -offset indent - nslookup -query=hinfo -timeout=10 -.Ed -.Sh INTERACTIVE COMMANDS -Commands may be interrupted at any time by typing a control-C. -To exit, type a control-D -.Pq Dv EOF -or type -.Li exit . -The command line length must be less than 256 characters. -To treat a built-in command as a host name, -precede it with an escape character -.Pq \e -.Sy N.B.: -An unrecognized command will be interpreted as a host name. -.Bl -tag -width "lserver" -.It Ar host Op Ar server -Look up information for -.Ar host -using the current default server or using -.Ar server , -if specified. -If -.Ar host -is an Internet address and the query type is -.Dv A -or -.Dv PTR , -the name of the host is returned. -If -.Ar host -is a name and does not have a trailing period, the default -domain name is appended to the name. (This behavior depends on the state of the -.Ic set -options -.Ic domain , srchlist , defname , -and -.Ic search . ) -.Pp -To look up a host not in the current domain, append a period to -the name. -.It Ic server Ar domain -.It Ic lserver Ar domain -Change the default server to -.Ar domain ; -.Ic lserver -uses the initial server to look up information about -.Ar domain , -while -.Ic server -uses the current default server. -If an authoritative answer can't be found, the names of servers -that might have the answer are returned. -.It Ic root -Changes the default server to the server for the root of the domain name space. -Currently, the host -.Li ns.internic.net -is used. -(This command is a synonym for -.Dq Ic lserver ns.internic.net . ) -The name of the root server can be changed with the -.Dq Ic set root -command. -.It Xo Ic finger Op Ar name -.Op Ic > Ar filename -.Xc -.It Xo Ic finger Op Ar name -.Op Ic >> Ar filename -.Xc -Connects with the finger server on the current host. -The current host is defined when a previous lookup for a host -was successful and returned address information (see the -.Dq Ic set querytype Ns = Ns Dv A -command). -The -.Ar name -is optional. -.Ic > -and -.Ic >> -can be used to redirect output in the usual manner. -.It Xo Ic ls Op Ar option -.Ar domain Op Ic > Ar filename -.Xc -.It Xo Ic ls Op Ar option -.Ar domain Op Ic >> Ar filename -.Xc -List the information available for -.Ar domain , -optionally creating or appending to -.Ar filename . -The default output contains host names and their Internet addresses. -.Ar Option -can be one of the following: -.Bl -tag -width "-a " -.It Fl t Ar querytype -lists all records of the specified type (see -.Ar querytype -below). -.It Fl a -lists aliases of hosts in the domain; -synonym for -.Dq Fl t Dv CNAME . -.It Fl d -lists all records for the domain; -synonym for -.Dq Fl t Dv ANY . -.It Fl h -lists CPU and operating system information for the domain; -synonym for -.Dq Fl t Dv HINFO . -.It Fl s -lists well-known services of hosts in the domain; -synonym for -.Dq Fl t Dv WKS . -.El -.Pp -When output is directed to a file, hash marks are printed for every -50 records received from the server. -.It Ic view Ar filename -Sorts and lists the output of previous -.Ic ls -command(s) with -.Xr more @CMD_EXT@ . -.It Ic help -.It Ic ?\& -Prints a brief summary of commands. -.It Ic exit -Exits the program. -.It Xo -.Ic set -.Ar keyword Ns Op = Ns Ar value -.Xc -This command is used to change state information that affects the lookups. -Valid keywords are: -.Bl -tag -width "class=v" -.It Ic all -Prints the current values of the frequently-used options to -.Ic set . -Information about the current default server and host is also printed. -.It Ic class Ns = Ns Ar value -Change the query class to one of: -.Bl -tag -width "HESIOD " -.It Dv IN -the Internet class -.It Dv CHAOS -the Chaos class -.It Dv HESIOD -the MIT Athena Hesiod class -.It Dv ANY -wildcard (any of the above) -.El -.Pp -The class specifies the protocol group of the information. -.Pp -(Default = -.Dv IN ; -abbreviation = -.Ic cl ) -.It Xo -.Oo Ic no Oc Ns Ic debug -.Xc -Turn debugging mode on. A lot more information is printed about the -packet sent to the server and the resulting answer. -.Pp -(Default = -.Ic nodebug ; -abbreviation = -.Oo Ic no Oc Ns Ic deb ) -.It Xo -.Oo Ic no Oc Ns Ic d2 -.Xc -Turn exhaustive debugging mode on. -Essentially all fields of every packet are printed. -.Pp -(Default = -.Ic nod2 ) -.It Ic domain Ns = Ns Ar name -Change the default domain name to -.Ar name . -The default domain name is appended to a lookup request depending on the -state of the -.Ic defname -and -.Ic search -options. -The domain search list contains the parents of the default domain if it has -at least two components in its name. -For example, if the default domain -is CC.Berkeley.EDU, the search list is CC.Berkeley.EDU and Berkeley.EDU. -Use the -.Dq Ic set srchlist -command to specify a different list. -Use the -.Dq Ic set all -command to display the list. -.Pp -(Default = value from -.Xr hostname @CMD_EXT@ , -.Pa /etc/resolv.conf , -or -.Ev LOCALDOMAIN ; -abbreviation = -.Ic do ) -.It Xo -.Sm off -.Ic srchlist No = -.Ar name1 No / -.Ar name2 No / -.Ar ... -.Sm on -.Xc -Change the default domain name to -.Ar name1 -and the domain search list -to -.Ar name1 , name2 , -etc. A maximum of 6 names separated by slashes (/) -can be specified. -For example, -.Bd -literal -offset indent -set srchlist=lcs.MIT.EDU/ai.MIT.EDU/MIT.EDU -.Ed -.Pp -sets the domain to lcs.MIT.EDU and the search list to the three names. -This command overrides the -default domain name and search list of the -.Dq Ic set domain -command. -Use the -.Dq Ic set all -command to display the list. -.Pp -(Default = value based on -.Xr hostname @CMD_EXT@ , -.Pa /etc/resolv.conf , -or -.Ev LOCALDOMAIN ; -abbreviation = -.Ic srchl ) -.It Xo -.Oo Ic no Oc Ns Ic defname -.Xc -If set, append the default domain name to a single-component lookup request -(i.e., one that does not contain a period). -.Pp -(Default = -.Ic defname ; -abbreviation = -.Oo Ic no Oc Ns Ic defname ) -.It Xo -.Oo Ic no Oc Ns Ic search -.Xc -If the lookup request contains at least one period but -.Em doesn't -end with a trailing period, append the domain names in the domain search list -to the request until an answer is received. -.Pp -(Default = -.Ic search ; -abbreviation = -.Oo Ic no Oc Ns Ic sea ) -.It Ic port Ns = Ns Ar value -Change the default TCP/UDP name server port to -.Ar value . -.Pp -(Default = 53; -abbreviation = -.Ic \&po ) -.It Ic querytype Ns = Ns Ar value -.It Ic type Ns = Ns Ar value -Change the type of information query to one of: -.Bl -tag -width "HINFO " -.It Dv A -the host's Internet address. -.It Dv CNAME -the canonical name for an alias. -.It Dv HINFO -the host CPU and operating system type. -.It Dv MINFO -the mailbox or mail list information. -.It Dv MX -the mail exchanger. -.It Dv NS -the name server for the named zone. -.It Dv PTR -the host name if the query is an Internet address; -otherwise, the pointer to other information. -.It Dv SOA -the domain's -.Dq start-of-authority -information. -.It Dv TXT -the text information. -.It Dv UINFO -the user information. -.It Dv WKS -the supported well-known services. -.El -.Pp -Other types -.Dv ( ANY , AXFR , MB , -.Dv MD , MF , NULL ) -are described in the RFC-1035 document. -.Pp -(Default = -.Dv A ; -abbreviations = -.Ic q , ty ) -.It Xo -.Oo Ic no Oc Ns Ic recurse -.Xc -Tell the name server to query other servers if it does not have the -information. -.Pp -(Default = -.Ic recurse ; -abbreviation = -.Oo Ic no Oc Ns Ic rec ) -.It Ic retry Ns = Ns Ar number -Set the number of retries to -.Ar number . -When a reply to a request is not received within a certain -amount of time (changed with -.Dq Ic set timeout ) , -the timeout period is doubled and the request is resent. -The retry value controls how many times a request is resent before giving up. -.Pp -(Default = 4, abbreviation = -.Ic ret ) -.It Ic root Ns = Ns Ar host -Change the name of the root server to -.Ar host . -This affects the -.Dq Ic root -command. -.Pp -(Default = -.Ic ns.internic.net. ; -abbreviation = -.Ic ro ) -.It Ic timeout Ns = Ns Ar number -Change the initial timeout interval for waiting for a reply to -.Ar number -seconds. Each retry doubles the timeout period. -.Pp -(Default = 5 seconds; abbreviation = -.Ic ti ) -.It Xo -.Oo Ic no Oc Ns Ic vc -.Xc -Always use a virtual circuit when sending requests to the server. -.Pp -(Default = -.Ic novc ; -abbreviation = -.Oo Ic no Oc Ns Ic v ) -.It Xo -.Oo Ic no Oc Ns Ic ignoretc -.Xc -Ignore packet truncation errors. -.Pp -(Default = -.Ic noignoretc ; -abbreviation = -.Oo Ic no Oc Ns Ic ig ) -.El -.El -.Sh DIAGNOSTICS -If the lookup request was not successful, an error message is printed. -Possible errors are: -.Bl -tag -width "Timed" -.It Li Timed out -The server did not respond to a request after a certain amount of -time (changed with -.Dq Ic set timeout Ns = Ns Ar value ) -and a certain number of retries (changed with -.Do -.Ic set retry Ns = Ns Ar value -.Dc ) . -.It Li \&No response from server -No name server is running on the server machine. -.It Li \&No records -The server does not have resource records of the current query type for the -host, although the host name is valid. -The query type is specified with the -.Dq Ic set querytype -command. -.It Li Non-existent domain -The host or domain name does not exist. -.It Li Connection refused -.It Li Network is unreachable -The connection to the name or finger server could not be made -at the current time. -This error commonly occurs with -.Ic ls -and -.Ic finger -requests. -.It Li Server failure -The name server found an internal inconsistency in its database -and could not return a valid answer. -.It Li Refused -The name server refused to service the request. -.It Li Format error -The name server found that the request packet was not in the proper format. -It may indicate an error in -.Nm nslookup . -.El -.Sh FILES -.Bl -tag -width "/usr/share/misc/nslookup.helpXXX" -compact -.It Pa /etc/resolv.conf -initial domain name and name server addresses -.It Pa $HOME/.nslookuprc -user's initial options -.It Pa /usr/share/misc/nslookup.help -summary of commands -.El -.Sh ENVIRONMENT -.Bl -tag -width "HOSTALIASESXXXX" -compact -.It Ev HOSTALIASES -file containing host aliases -.It Ev LOCALDOMAIN -overrides default domain -.El -.Sh SEE ALSO -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ ; -RFC-1034, -.Dq Domain Names - Concepts and Facilities ; -RFC-1035, -.Dq Domain Names - Implementation and Specification . -.Sh AUTHOR -Andrew Cherenson diff --git a/contrib/bind/doc/man/nsupdate.8 b/contrib/bind/doc/man/nsupdate.8 deleted file mode 100644 index 6045984..0000000 --- a/contrib/bind/doc/man/nsupdate.8 +++ /dev/null @@ -1,203 +0,0 @@ -.\" $Id: nsupdate.8,v 8.8 2002/04/22 04:38:04 marka Exp $ -.\" -.\"Copyright (c) 1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.Dd March 5, 1999 -.Dt NSUPDATE @SYS_OPS_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm nsupdate -.Nd update Internet name servers interactively -.Sh SYNOPSIS -.Nm nsupdate -.Op Fl k Ar keydir:keyname -.Op Fl d -.Op Fl v -.Op Ar filename -.Sh DESCRIPTION -.Ic Nsupdate -is a program to update Internet domain name servers -supporting dynamic update. -.Ic Nsupdate -uses the DNS resolver library to pass messages -to a DNS server requesting the additional or deletion of -DNS resource records (RRs). -.Ic Nsupdate -reads input from -.Ar filename -or standard input. -.Sh ARGUMENTS -.Bl -tag -width Fl -.It Fl k -Sign updates with TSIG. -.It Fl d -Debug mode. -.It Fl v -Virtual circuit - use TCP to communication with server. -Default is UDP. -.El -.Sh INPUT FORMAT -.Ic Nsupdate -reads input records, one per line, -each line contributing a resource record to an -update request. -All domain names used in a single update request -must belong to the same DNS zone. -Updates are sent to the master server as defined in the SOA -MNAME field. -A blank line causes the accumulated -records to be formated into a single update request -and transmitted to the zone's authoritative name servers. -Additional records may follow, -which are formed into additional, -completely independent update requests. -For the last request to be transmitted, a blank line -must end the input. -.Pp -Records take one of two general forms. -.Em Prerequisite -records specify conditions that must be satisfied before -the request will be processed. -.Em Update -records specify changes to be made to the DNS database. -A update request consists of zero or more prerequisites -and one or more updates. -Each update request is processed atomically - -all prerequisites must be satisfied, then all updates -will be performed. -.Pp -.Ic Nsupdate -understands the following input record formats: -.Pp -.Bl -hang -.It Ic prereq nxdomain Va domain-name -Requires that no RR of any type exists with name -.Va domain-name . -.It Ic prereq yxdomain Va domain-name -Requires that at least one RR named -.Va domain-name -must exist. -.It Xo -.Ic prereq nxrrset Va domain-name Op class -.Va type -.Xc -Requires that no RR exists of the specified -.Va type -and -.Va domain-name . -.It Xo -.Ic prereq yxrrset -.Va domain-name Op Va class -.Va type Op Va data... -.Xc -Requires that a RR exists of the specified -.Va type -and -.Va domain-name . -If -.Va data -is specified, it must match exactly. -.It Xo -.Ic update delete -.Va domain-name Op Va class -.Op Va type Op Va data... -.Xc -Deletes RRs named -.Va domain-name . -If -.Va type -(and possibly -.Va data ) -is specified, -only matching records will be deleted. -.It Xo -.Ic update add -.Va domain-name ttl Op Va class -.Va type data... -.Xc -Adds a new RR with specified -.Va ttl , type , -and -.Va data . -.El -.Sh EXAMPLES -The following example illustrates the interactive use of -.Ic nsupdate -to change an IP address by deleting any existing A records -for a domain name and then inserting a new one. -Since no prerequisites are specified, -the new record will be added even if -there were no existing records to delete. -Note the -trailing blank line, required to process the request. -.Bd -literal -offset indent -$ nsupdate -> update delete test.example.com A -> update add test.example.com 3600 A 10.1.1.1 -> -.Ed -.Pp -In this example, a CNAME alias is added to the database -only if there are no existing A or CNAME records for -the domain name. -.Bd -literal -offset indent -$ nsupdate -> prereq nxrrset www.example.com A -> prereq nxrrset www.example.com CNAME -> update add www.example.com 3600 CNAME test.example.com -> -.Ed -.Pp -In this example, the nsupdate will be signed with the key "mykey", which -is in the directory "/var/named/keys". -.Bd -literal -offset indent -$ nsupdate -k /var/named/keys:mykey -> update add ftp.example.com 60 A 192.168.5.1 -> -.Ed -.Sh DIAGNOSTICS -.Bl -hang -.It Qq send error -Typically indicates that the authoritative nameservers could not be reached -.It Qq failed update packet -Typically indicates that the nameserver has rejected the update, -either because the nameserver doesn't support dynamic update, -or due to an authentication failure -.It Qq res_mkupdate: packet size = Va size -(and no other messages) -The update was successfully received and authenticated by the nameserver. -The prerequisites, however, may have prevented the update from actually -being performed. The only way to determine if the update was performed -is to use debug mode -.Fl ( d ) -and examine the status field in the nameserver's reply. -.El -.Sh FILES -.Bl -hang -.It Pa /etc/resolv.conf -initial domain name and name server addresses -.El -.Sh SEE ALSO -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ ; -RFC-1034, -.Dq Domain Names - Concepts and Facilities ; -RFC-1035, -.Dq Domain Names - Implementation and Specification ; -RFC-2136, -Dynamic Updates in the Domain Name System. -.Sh AUTHOR -Brent Baccala diff --git a/contrib/bind/doc/man/resolver.3 b/contrib/bind/doc/man/resolver.3 deleted file mode 100644 index f7c5424..0000000 --- a/contrib/bind/doc/man/resolver.3 +++ /dev/null @@ -1,653 +0,0 @@ -.\" Copyright (c) 1985, 1995 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted provided -.\" that: (1) source distributions retain this entire copyright notice and -.\" comment, and (2) distributions including binaries display the following -.\" acknowledgement: ``This product includes software developed by the -.\" University of California, Berkeley and its contributors'' in the -.\" documentation or other materials provided with the distribution and in -.\" all advertising materials mentioning features or use of this software. -.\" Neither the name of the University nor the names of its contributors may -.\" be used to endorse or promote products derived from this software without -.\" specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED -.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF -.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)resolver.3 6.5 (Berkeley) 6/23/90 -.\" $Id: resolver.3,v 8.17.6.1 2003/06/02 09:11:27 marka Exp $ -.\" -.Dd July 4, 2000 -.Dt RESOLVER @LIB_NETWORK_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm res_ninit , -.Nm res_ourserver_p , -.Nm fp_resstat , -.Nm res_hostalias , -.Nm res_pquery , -.Nm res_nquery , -.Nm res_nsearch , -.Nm res_nquerydomain , -.Nm res_nmkquery , -.Nm res_nsend , -.Nm res_nupdate , -.Nm res_nmkupdate , -.Nm res_nclose , -.Nm res_nsendsigned , -.Nm res_findzonecut , -.Nm res_getservers , -.Nm res_setservers , -.Nm dn_comp , -.Nm dn_expand , -.Nm hstrerror , -.Nm res_init , -.Nm res_isourserver , -.Nm fp_nquery , -.Nm p_query , -.Nm hostalias , -.Nm res_query , -.Nm res_search , -.Nm res_querydomain , -.Nm res_mkquery , -.Nm res_send , -.Nm res_update , -.Nm res_close , -.Nm herror -.Nd resolver routines -.Sh SYNOPSIS -.Fd #include <sys/types.h> -.Fd #include <netinet/in.h> -.Fd #include <arpa/nameser.h> -.Fd #include <resolv.h> -.Fd #include <res_update.h> -.Vt typedef struct __res_state *res_state ; -.Pp -.Ft int -.Fn res_ninit "res_state statp" -.Ft int -.Fn res_ourserver_p "const res_state statp" "const struct sockaddr_in *addr" -.Ft void -.Fn fp_resstat "const res_state statp" "FILE *fp" -.Ft "const char *" -.Fn res_hostalias "const res_state statp" "const char *name" "char *buf" "size_t buflen" -.Ft int -.Fn res_pquery "const res_state statp" "const u_char *msg" "int msglen" "FILE *fp" -.Ft int -.Fn res_nquery "res_state statp" "const char *dname" "int class" "int type" "u_char *answer" "int anslen" -.Ft int -.Fn res_nsearch "res_state statp" "const char *dname" "int class" "int type" "u_char * answer" "int anslen" -.Ft int -.Fn res_nquerydomain "res_state statp" "const char *name" "const char *domain" "int class" "int type" "u_char *answer" "int anslen" -.Ft int -.Fo res_nmkquery -.Fa "res_state statp" -.Fa "int op" -.Fa "const char *dname" -.Fa "int class" -.Fa "int type" -.Fa "const u_char *data" -.Fa "int datalen" -.Fa "const u_char *newrr" -.Fa "u_char *buf" -.Fa "int buflen" -.Fc -.Ft int -.Fn res_nsend "res_state statp" "const u_char *msg" "int msglen" "u_char *answer" "int anslen" -.Ft int -.Fn res_nupdate "res_state statp" "ns_updrec *rrecp_in" -.Ft int -.Fn res_nmkupdate "res_state statp" "ns_updrec *rrecp_in" "u_char *buf" "int buflen" -.Ft void -.Fn res_nclose "res_state statp" -.Ft int -.Fn res_nsendsigned "res_state statp" "const u_char *msg" "int msglen" "ns_tsig_key *key" "u_char *answer" "int anslen" -.Ft int -.Fn res_findzonecut "res_state statp" "const char *dname" "ns_class class" "int options" "char *zname" "size_t zsize" "struct in_addr *addrs" "int naddrs" -.Ft int -.Fn res_getservers "res_state statp" "union res_sockaddr_union *set" "int cnt" -.Ft void -.Fn res_setservers "res_state statp" "const union res_sockaddr_union *set" "int cnt" -.Ft int -.Fn dn_comp "const char *exp_dn" "u_char *comp_dn" "int length" "u_char **dnptrs" "u_char **lastdnptr" -.Ft int -.Fn dn_expand "const u_char *msg" "const u_char *eomorig" "const u_char *comp_dn" "char *exp_dn" "int length" -.Ft "const char *" -.Fn hstrerror "int err" -.Ss DEPRECATED -.Fd #include <sys/types.h> -.Fd #include <netinet/in.h> -.Fd #include <arpa/nameser.h> -.Fd #include <resolv.h> -.Fd #include <res_update.h> -.Ft int -.Fn res_init "void" -.Ft int -.Fn res_isourserver "const struct sockaddr_in *addr" -.Ft int -.Fn fp_nquery "const u_char *msg" "int msglen" "FILE *fp" -.Ft void -.Fn p_query "const u_char *msg" "FILE *fp" -.Ft "const char *" -.Fn hostalias "const char *name" -.Ft int -.Fn res_query "const char *dname" "int class" "int type" "u_char *answer" "int anslen" -.Ft int -.Fn res_search "const char *dname" "int class" "int type" "u_char *answer" "int anslen" -.Ft int -.Fn res_querydomain "const char *name" "const char *domain" "int class" "int type" "u_char *answer" "int anslen" -.Ft int -.Fo res_mkquery -.Fa "int op" -.Fa "const char *dname" -.Fa "int class" -.Fa "int type" -.Fa "const char *data" -.Fa "int datalen" -.Fa "struct rrec *newrr" -.Fa "u_char *buf" -.Fa "int buflen" -.Fc -.Ft int -.Fn res_send "const u_char *msg" "int msglen" "u_char *answer" "int anslen" -.Ft int -.Fn res_update "ns_updrec *rrecp_in" -.Ft void -.Fn res_close "void" -.Ft void -.Fn herror "const char *s" -.Sh DESCRIPTION -These routines are used for making, sending and interpreting -query and reply messages with Internet domain name servers. -.Pp -State information is kept in -.Fa statp -and is used to control the behavior of these functions. -.Fa statp -should be set to all zeros prior to the first call to any of these functions. -.Pp -The functions -.Fn res_init , -.Fn res_isourserver , -.Fn fp_nquery , -.Fn p_query , -.Fn hostalias , -.Fn res_query , -.Fn res_search , -.Fn res_querydomain , -.Fn res_mkquery , -.Fn res_send , -.Fn res_update , -.Fn res_close -and -.Fn herror -are deprecated and are supplied for compatability with old source -code. -They use global configuration and state information that is -kept in the structure -.Ft _res -rather than that referenced through -.Ft statp . -.Pp -Most of the values in -.Ft statp -and -.Ft _res -are initialized on the first call to -.Fn res_ninit -/ -.Fn res_init -to reasonable defaults and can be ignored. -Options -stored in -.Ft statp->options -/ -.Ft _res.options -are defined in -.Pa resolv.h -and are as follows. -Options are stored as a simple bit mask containing the bitwise -.Dq OR -of the options enabled. -.Bl -tag -width "RES_DEB" -.It Dv RES_INIT -True if the initial name server address and default domain name are -initialized (i.e., -.Fn res_ninit -/ -.Fn res_init -has been called). -.It Dv RES_DEBUG -Print debugging messages. -.It Dv RES_AAONLY -Accept authoritative answers only. -Should continue until it finds an authoritative answer or finds an error. -Currently this is not implemented. -.It Dv RES_USEVC -Use TCP connections for queries instead of UDP datagrams. -.It Dv RES_STAYOPEN -Used with -.Dv RES_USEVC -to keep the TCP connection open between queries. -This is useful only in programs that regularly do many queries. -UDP should be the normal mode used. -.It Dv RES_IGNTC -Ignore truncation errors, i.e., don't retry with TCP. -.It Dv RES_RECURSE -Set the recursion-desired bit in queries. -This is the default. -(\c -.Fn res_nsend -/ -.Fn res_send -does not do iterative queries and expects the name server -to handle recursion.) -.It Dv RES_DEFNAMES -If set, -.Fn res_nsearch -/ -.Fn res_search -will append the default domain name to single-component names -(those that do not contain a dot). -This option is enabled by default. -.It Dv RES_DNSRCH -If this option is set, -.Fn res_nsearch -/ -.Fn res_search -will search for host names in the current domain and in parent domains; see -.Xr hostname @DESC_EXT@ . -This is used by the standard host lookup routine -.Xr gethostbyname @LIB_NETWORK_EXT@ . -This option is enabled by default. -.It Dv RES_NOALIASES -This option turns off the user level aliasing feature controlled by -the -.Ev HOSTALIASES -environment variable. -Network daemons should set this option. -.It Dv RES_USE_INET6 -This option causes -.Xr gethostbyname @LIB_NETWORK_EXT@ -to look for AAAA records before looking for A records if none are found. -.It Dv RES_ROTATE -This options causes the -.Fn res_nsend -/ -.Fn res_send -to rotate the list of nameservers in -.Fa statp->nsaddr_list -/ -.Fa _res.nsaddr_list . -.It Dv RES_KEEPTSIG -This option causes -.Fn res_nsendsigned -to leave the message unchanged after TSIG verification; otherwise the TSIG -record would be removed and the header updated. -.It Dv RES_NOTLDQUERY -This option causes -.Fn res_nsearch -to not attempt to resolve a unqualified name as if it were a top level -domain (TLD). -This option can cause problems if the site has "localhost" as a TLD rather -than having localhost on one or more elements of the search list. -This option has no effect if neither -.Dv RES_DEFNAMES -or -.Dv RES_DNSRCH -is set. -.El -.Pp -The -.Fn res_ninit -/ -.Fn res_init -routine -reads the configuration file (if any; see -.Xr resolver @FORMAT_EXT@ ) -to get the default domain name, search list and -the Internet address of the local name server(s). -If no server is configured, the host running the resolver is tried. -The current domain name is defined by the hostname -if not specified in the configuration file; -it can be overridden by the environment variable -.Ev LOCALDOMAIN . -This environment variable may contain several blank-separated -tokens if you wish to override the -.Dq search list -on a per-process basis. This is similar to the -.Ic search -command in the configuration file. -Another environment variable -.Pq Dq Ev RES_OPTIONS -can be set to override certain internal resolver options which are otherwise -set by changing fields in the -.Ft statp -/ -.Ft _res -structure or are inherited from the configuration file's -.Ic options -command. The syntax of the -.Dq Ev RES_OPTIONS -environment variable is explained in -.Xr resolver @FORMAT_EXT@ . -Initialization normally occurs on the first call -to one of the other resolver routines. -.Pp -The -.Fn res_nquery -/ -.Fn res_query -functions provides interfaces to the server query mechanism. -They constructs a query, sends it to the local server, -awaits a response, and makes preliminary checks on the reply. -The query requests information of the specified -.Fa type -and -.Fa class -for the specified fully-qualified domain name -.Fa dname . -The reply message is left in the -.Fa answer -buffer with length -.Fa anslen -supplied by the caller. -.Fn res_nquery -/ -.Fn res_query -return -1 on error or the length of the answer. -.Pp -The -.Fn res_nsearch -/ -.Fn res_search -routines make a query and awaits a response like -.Fn res_nquery -/ -.Fn res_query , -but in addition, it implements the default and search rules -controlled by the -.Dv RES_DEFNAMES -and -.Dv RES_DNSRCH -options. -It returns the length of the first successful reply which is stored in -.Ft answer -or -1 on error. -.Pp -The remaining routines are lower-level routines used by -.Fn res_nquery -/ -.Fn res_query . -The -.Fn res_nmkquery -/ -.Fn res_mkquery -functions -constructs a standard query message and places it in -.Fa buf . -It returns the size of the query, or \-1 if the query is -larger than -.Fa buflen . -The query type -.Fa op -is usually -.Dv QUERY , -but can be any of the query types defined in -.Pa <arpa/nameser.h> . -The domain name for the query is given by -.Fa dname . -.Fa Newrr -is currently unused but is intended for making update messages. -.Pp -The -.Fn res_nsend -/ -.Fn res_send -/ -.Fn res_nsendsigned -routines -sends a pre-formatted query and returns an answer. -It will call -.Fn res_ninit -/ -.Fn res_init -if -.Dv RES_INIT -is not set, send the query to the local name server, and -handle timeouts and retries. Additionally, -.Fn res_nsendsigned -will use TSIG signatures to add authentication to the query and verify the -response. In this case, only one nameserver will be contacted. -The length of the reply message is returned, or \-1 if there were errors. -.Pp -.Fn res_nquery -/ -.Fn res_query , -.Fn res_nsearch -/ -.Fn res_search -and -.Fn res_nsend -/ -.Fn res_send -return a length that may be bigger than -.Fa anslen . -In that case the query should be retried with a bigger buffer. -NOTE the answer to the second query may be larger still so supplying -a buffer that bigger that the answer returned by the previous -query is recommended. -.Pp -.Fa answer -MUST be big enough to receive a maximum UDP response from the server or -parts of the answer will be silently discarded. -The default maximum UDP response size is 512 bytes. -.Pp -The function -.Fn res_ourserver_p -returns true when -.Fa inp -is one of the servers in -.Fa statp->nsaddr_list -/ -.Fa _res.nsaddr_list . -.Pp -The functions -.Fn fp_nquery -/ -.Fn p_query -print out the query and any answer in -.Fa msg -on -.Fa fp . -.Fn p_query -is equivalent to -.Fn fp_nquery -with -.Fa msglen -set to 512. -.Pp -The function -.Fn fp_resstat -prints out the active flag bits in -.Fa statp->options -preceeded by the text ";; res options:" on -.Fa file . -.Pp -The functions -.Fn res_hostalias -/ -.Fn hostalias -lookup up name in the file referred to by the -.Ev HOSTALIASES -files return a fully qualified hostname if found or NULL if -not found or an error occurred. -.Fn res_hostalias -uses -.Fa buf -to store the result in, -.Fn hostalias -uses a static buffer. -.Pp -The functions -.Fn res_getservers -and -.Fn res_setservers -are used to get and set the list of server to be queried. -.Pp -The functions -.Fn res_nupdate -/ -.Fn res_update -take a list of ns_updrec -.Fa rrecp_in . -Identifies the containing zone for each record and groups the records -according to containing zone maintaining in zone order then sends and update -request to the servers for these zones. The number of zones updated is -returned or -1 on error. Note that -.Fn res_nupdate -will perform TSIG authenticated dynamic update operations if the key is not -NULL. -.Pp -The function -.Fn res_findzonecut -discovers the closest enclosing zone cut for a specified domain name, -and finds the IP addresses of the zone's master servers. -.Pp -The functions -.Fn res_nmkupdate -/ -.Fn res_mkupdate -take a linked list of ns_updrec -.Fa rrecp_in -and construct a UPDATE message in -.Fa buf . -.Fn res_nmkupdate -/ -.Fn res_mkupdate -return the length of the constructed message on no error or one of the -following error values. -.Bl -inset -width "-5" -.It -1 -An error occurred parsing -.Fa rrecp_in . -.It -2 -The buffer -.Fa buf -was too small. -.It -3 -The first record was not a zone section or there was a section order problem. -The section order is S_ZONE, S_PREREQ and S_UPDATE. -.It -4 -A number overflow occurred. -.It -5 -Unknown operation or no records. -.El -.Pp -The functions -.Fn res_nclose -/ -.Fn res_close -close any open files referenced through -.Fa statp -/ -.Fa _res . -.Pp -The -.Fn dn_comp -function -compresses the domain name -.Fa exp_dn -and stores it in -.Fa comp_dn . -The size of the compressed name is returned or \-1 if there were errors. -The size of the array pointed to by -.Fa comp_dn -is given by -.Fa length . -The compression uses -an array of pointers -.Fa dnptrs -to previously-compressed names in the current message. -The first pointer points to -to the beginning of the message and the list ends with -.Dv NULL . -The limit to the array is specified by -.Fa lastdnptr . -A side effect of -.Fn dn_comp -is to update the list of pointers for labels inserted into the message -as the name is compressed. If -.Fa dnptr -is -.Dv NULL , -names are not compressed. If -.Fa lastdnptr -is -.Dv NULL , -the list of labels is not updated. -.Pp -The -.Fn dn_expand -entry -expands the compressed domain name -.Fa comp_dn -to a full domain name. -The compressed name is contained in a query or reply message; -.Fa msg -is a pointer to the beginning of the message. -.Fa eomorig -is a pointer to the first location after the message. -The uncompressed name is placed in the buffer indicated by -.Fa exp_dn -which is of size -.Fa length . -The size of compressed name is returned or \-1 if there was an error. -.Pp -The variables -.Ft statp->res_h_errno -/ -.Ft _res.res_h_errno -and external variable -.Ft h_errno -is set whenever an error occurs during resolver operation. The following -definitions are given in -.Pa <netdb.h> : -.Bd -literal -#define NETDB_INTERNAL -1 /* see errno */ -#define NETDB_SUCCESS 0 /* no problem */ -#define HOST_NOT_FOUND 1 /* Authoritative Answer Host not found */ -#define TRY_AGAIN 2 /* Non-Authoritative not found, or SERVFAIL */ -#define NO_RECOVERY 3 /* Non-Recoverable: FORMERR, REFUSED, NOTIMP */ -#define NO_DATA 4 /* Valid name, no data for requested type */ -.Ed -.Pp -The -.Fn herror -function writes a message to the diagnostic output consisting of the string -parameter -.Fa s , -the constant string ": ", and a message corresponding to the value of -.Ft h_errno . -.Pp -The -.Fn hstrerror -function returns a string which is the message text corresponding to the -value of the -.Fa err -parameter. -.Sh FILES -.Bl -tag -width "/etc/resolv.conf " -.It Pa /etc/resolv.conf -See -.Xr resolver @FORMAT_EXT@ . -.El -.Sh SEE ALSO -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @FORMAT_EXT@ ; -RFC1032, RFC1033, RFC1034, RFC1035, RFC974; -SMM:11, -.Dq Name Server Operations Guide for BIND diff --git a/contrib/bind/doc/man/resolver.5 b/contrib/bind/doc/man/resolver.5 deleted file mode 100644 index 84ada33..0000000 --- a/contrib/bind/doc/man/resolver.5 +++ /dev/null @@ -1,240 +0,0 @@ -.\" Copyright (c) 1986 The Regents of the University of California. -.\" All rights reserved. -.\" -.\" Redistribution and use in source and binary forms are permitted -.\" provided that the above copyright notice and this paragraph are -.\" duplicated in all such forms and that any documentation, -.\" advertising materials, and other materials related to such -.\" distribution and use acknowledge that the software was developed -.\" by the University of California, Berkeley. The name of the -.\" University may not be used to endorse or promote products derived -.\" from this software without specific prior written permission. -.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR -.\" IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED -.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. -.\" -.\" @(#)resolver.5 5.9 (Berkeley) 12/14/89 -.\" $Id: resolver.5,v 8.9 2001/12/28 04:24:21 marka Exp $ -.\" -.Dd November 11, 1993 -.Dt RESOLVER @FORMAT_EXT_U@ -.Os BSD 4 -.Sh NAME -.Nm resolver -.Nd resolver configuration file -.Sh SYNOPSIS -.Pa /etc/resolv.conf -.Sh DESCRIPTION -The -.Nm resolver -is a set of routines in the C library -.Pq Xr resolve @LIB_NETWORK_EXT@ -that provide access to the Internet Domain Name System. -The -.Nm resolver -configuration file contains information that is read -by the -.Nm resolver -routines the first time they are invoked by a process. -The file is designed to be human readable and contains a list of -keywords with values that provide various types of -.Nm resolver -information. -.Pp -On a normally configured system, this file should not be necessary. -The only name server to be queried will be on the local machine, -the domain name is determined from the host name, -and the domain search path is constructed from the domain name. -.Pp -The different configuration directives are: -.Bl -tag -width "nameser" -.It Li nameserver -Internet address (in dot notation) of a name server that the -.Nm resolver -should query. Up to -.Dv MAXNS -(see -.Pa <resolv.h> ) -name servers may be listed, one per keyword. -If there are multiple servers, the -.Nm resolver -library queries them in the order listed. -If no -.Li nameserver -entries are present, the default is to use the name server on the local machine. -(The algorithm used is to try a name server, and if the query times out, -try the next, until out of name servers, -then repeat trying all the name servers -until a maximum number of retries are made). -.It Li domain -Local domain name. -Most queries for names within this domain can use short names -relative to the local domain. -If no -.Li domain -entry is present, the domain is determined from the local host name returned by -.Xr gethostname @BSD_SYSCALL_EXT@ ; -the domain part is taken to be everything after the first -.Sq \&. . -Finally, if the host name does not contain a domain part, the root -domain is assumed. -.It Li search -Search list for host-name lookup. -The search list is normally determined from the local domain name; -by default, it contains only the local domain name. -This may be changed by listing the desired domain search path -following the -.Li search -keyword with spaces or tabs separating the names. -Most -.Nm resolver -queries will be attempted using each component -of the search path in turn until a match is found. -Note that this process may be slow and will generate a lot of network -traffic if the servers for the listed domains are not local, -and that queries will time out if no server is available -for one of the domains. -.Pp -The search list is currently limited to six domains -with a total of 256 characters. -.It Li sortlist -Allows addresses returned by gethostbyname to be sorted. -A -.Li sortlist -is specified by IP address netmask pairs. The netmask is -optional and defaults to the natural netmask of the net. The IP address -and optional network pairs are separated by slashes. Up to 10 pairs may -be specified. For example: -.Bd -literal -offset indent -sortlist 130.155.160.0/255.255.240.0 130.155.0.0 -.Ed -.It Li options -Allows certain internal -.Nm resolver -variables to be modified. -The syntax is -.D1 Li options Ar option ... -where -.Ar option -is one of the following: -.Bl -tag -width "ndots:n " -.It Li debug -sets -.Dv RES_DEBUG -in -.Ft _res.options . -.It Li ndots: Ns Ar n -sets a threshold for the number of dots which -must appear in a name given to -.Fn res_query -(see -.Xr resolver @LIB_NETWORK_EXT@ ) -before an -.Em initial absolute query -will be made. The default for -.Ar n -is -.Dq 1 , -meaning that if there are -.Em any -dots in a name, the name will be tried first as an absolute name before any -.Em search list -elements are appended to it. -.It Li timeout: Ns Ar n -sets the amount of time the resolver will wait for a response from a remote -name server before retrying the query via a different name server. Measured in -seconds, the default is -.Dv RES_TIMEOUT -(see -.Pa <resolv.h> ) . -.It Li attempts: Ns Ar n -sets the number of times the resolver will send a query to its name servers -before giving up and returning an error to the calling application. The -default is -.Dv RES_DFLRETRY -(see -.Pa <resolv.h> ) . -.It Li rotate -sets -.Dv RES_ROTATE -in -.Ft _res.options , -which causes round robin selection of nameservers from among those listed. -This has the effect of spreading the query load among all listed servers, -rather than having all clients try the first listed server first every time. -.It Li no-check-names -sets -.Dv RES_NOCHECKNAME -in -.Ft _res.options , -which disables the modern BIND checking of incoming host names and mail names -for invalid characters such as underscore (_), non-ASCII, or control characters. -.It Li inet6 -sets -.Dv RES_USE_INET6 -in -.Ft _res.options . -This has the effect of trying a AAAA query before an A query inside the -.Ft gethostbyname -function, and of mapping IPv4 responses in IPv6 ``tunnelled form'' if no -AAAA records are found but an A record set exists. -.It Li no-tld-query -sets -.Dv RES_NOTLDQUERY -in -.Ft _res.options . -This option causes -.Fn res_nsearch -to not attempt to resolve a unqualified name as if it were a top level -domain (TLD). -This option can cause problems if the site has "localhost" as a TLD rather -than having localhost on one or more elements of the search list. -This option has no effect if neither -.Dv RES_DEFNAMES -or -.Dv RES_DNSRCH -is set. -.El -.El -.Pp -The -.Li domain -and -.Li search -keywords are mutually exclusive. -If more than one instance of these keywords is present, -the last instance wins. -.Pp -The -.Li search -keyword of a system's -.Pa resolv.conf -file can be -overridden on a per-process basis by setting the environment variable -.Dq Ev LOCALDOMAIN -to a space-separated list of search domains. -.Pp -The -.Li options -keyword of a system's -.Pa resolv.conf -file can be amended on a per-process basis by setting the environment variable -.Dq Ev RES_OPTIONS to a space-separated list of -.Nm resolver -options as explained above under -.Li options . -.Pp -The keyword and value must appear on a single line, and the keyword -(e.g., -.Li nameserver ) -must start the line. The value follows the keyword, separated by white space. -.Sh FILES -.Pa /etc/resolv.conf -.Pa <resolv.h> -.Sh SEE ALSO -.Xr gethostbyname @LIB_NETWORK_EXT@ , -.Xr hostname @DESC_EXT@ , -.Xr @INDOT@named @SYS_OPS_EXT@ , -.Xr resolver @LIB_NETWORK_EXT@ , -.Xr resolver @FORMAT_EXT@ . -.Dq Name Server Operations Guide for Sy BIND diff --git a/contrib/bind/doc/man/tsig.3 b/contrib/bind/doc/man/tsig.3 deleted file mode 100644 index 300527a..0000000 --- a/contrib/bind/doc/man/tsig.3 +++ /dev/null @@ -1,240 +0,0 @@ -.\" $Id: tsig.3,v 8.3 2001/08/08 07:50:19 marka Exp $ -.\" -.\"Copyright (c) 1995-1999 by Internet Software Consortium -.\" -.\"Permission to use, copy, modify, and distribute this software for any -.\"purpose with or without fee is hereby granted, provided that the above -.\"copyright notice and this permission notice appear in all copies. -.\" -.\"THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS -.\"ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES -.\"OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE -.\"CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL -.\"DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR -.\"PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS -.\"ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS -.\"SOFTWARE. -.\" -.Dd January 1, 1996 -.Os BSD 4 -.Dt TSIG @SYSCALL_EXT@ -.Sh NAME -.Nm ns_sign , -.Nm ns_sign_tcp , -.Nm ns_sign_tcp_init , -.Nm ns_verify , -.Nm ns_verify_tcp , -.Nm ns_verify_tcp_init , -.Nm ns_find_tsig -.Nd TSIG system -.Sh SYNOPSIS -.Ft int -.Fo ns_sign -.Fa "u_char *msg" -.Fa "int *msglen" -.Fa "int msgsize" -.Fa "int error" -.Fa "void *k" -.Fa "const u_char *querysig" -.Fa "int querysiglen" -.Fa "u_char *sig" -.Fa "int *siglen" -.Fa "time_t in_timesigned" -.Fc -.Ft int -.Fn ns_sign_tcp "u_char *msg" "int *msglen" "int msgsize" "int error" \ - "ns_tcp_tsig_state *state" "int done" -.Ft int -.Fn ns_sign_tcp_init "void *k" "const u_char *querysig" "int querysiglen" \ - "ns_tcp_tsig_state *state" -.Ft int -.Fo ns_verify -.Fa "u_char *msg" -.Fa "int *msglen" -.Fa "void *k" -.Fa "const u_char *querysig" -.Fa "int querysiglen" -.Fa "u_char *sig" -.Fa "int *siglen" -.Fa "time_t in_timesigned" -.Fa "int nostrip" -.Fc -.Ft int -.Fn ns_verify_tcp "u_char *msg" "int *msglen" "ns_tcp_tsig_state *state" \ - "int required" -.Ft int -.Fn ns_verify_tcp_init "void *k" "const u_char *querysig" "int querysiglen" \ - "ns_tcp_tsig_state *state" -.Ft u_char * -.Fn ns_find_tsig "u_char *msg" "u_char *eom" -.Sh DESCRIPTION -The TSIG routines are used to implement transaction/request security of -DNS messages. -.Pp -.Fn ns_sign -and -.Fn ns_verify -are the basic routines. -.Fn ns_sign_tcp -and -.Fn ns_verify_tcp -are used to sign/verify TCP messages that may be split into multiple packets, -such as zone transfers, and -.Fn ns_sign_tcp_init , -.Fn ns_verify_tcp_init -initialize the state structure necessary for TCP operations. -.Fn ns_find_tsig -locates the TSIG record in a message, if one is present. -.Pp -.Fn ns_sign -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv msg -the incoming DNS message, which will be modified -.It Dv msglen -the length of the DNS message, on input and output -.It Dv msgsize -the size of the buffer containing the DNS message on input -.It Dv error -the value to be placed in the TSIG error field -.It Dv key -the (DST_KEY *) to sign the data -.It Dv querysig -for a response, the signature contained in the query -.It Dv querysiglen -the length of the query signature -.It Dv sig -a buffer to be filled with the generated signature -.It Dv siglen -the length of the signature buffer on input, the signature length on output -.El -.Pp -.Fn ns_sign_tcp -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv msg -the incoming DNS message, which will be modified -.It Dv msglen -the length of the DNS message, on input and output -.It Dv msgsize -the size of the buffer containing the DNS message on input -.It Dv error -the value to be placed in the TSIG error field -.It Dv state -the state of the operation -.It Dv done -non-zero value signifies that this is the last packet -.El -.Pp -.Fn ns_sign_tcp_init -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv k -the (DST_KEY *) to sign the data -.It Dv querysig -for a response, the signature contained in the query -.It Dv querysiglen -the length of the query signature -.It Dv state -the state of the operation, which this initializes -.El -.Pp -.Fn ns_verify -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv msg -the incoming DNS message, which will be modified -.It Dv msglen -the length of the DNS message, on input and output -.It Dv key -the (DST_KEY *) to sign the data -.It Dv querysig -for a response, the signature contained in the query -.It Dv querysiglen -the length of the query signature -.It Dv sig -a buffer to be filled with the signature contained -.It Dv siglen -the length of the signature buffer on input, the signature length on output -.It Dv nostrip -non-zero value means that the TSIG is left intact -.El -.Pp -.Fn ns_verify_tcp -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv msg -the incoming DNS message, which will be modified -.It Dv msglen -the length of the DNS message, on input and output -.It Dv state -the state of the operation -.It Dv required -non-zero value signifies that a TSIG record must be present at this step -.El -.Pp -.Fn ns_verify_tcp_init -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv k -the (DST_KEY *) to verify the data -.It Dv querysig -for a response, the signature contained in the query -.It Dv querysiglen -the length of the query signature -.It Dv state -the state of the operation, which this initializes -.El -.Pp -.Fn ns_find_tsig -.Bl -tag -width "in_timesigned" -compact -offset indent -.It Dv msg -the incoming DNS message -.It Dv msglen -the length of the DNS message -.El -.Sh RETURN VALUES -.Fn ns_find_tsig -returns a pointer to the TSIG record if one is found, and NULL otherwise. -.Pp -All other routines return 0 on success, modifying arguments when necessary. -.Pp -.Fn ns_sign -and -.Fn ns_sign_tcp -return the following errors: -.Bl -tag -width "NS_TSIG_ERROR_NO_SPACE" -compact -offset indent -.It Dv (-1) -bad input data -.It Dv (-ns_r_badkey) -The key was invalid, or the signing failed -.It Dv NS_TSIG_ERROR_NO_SPACE -the message buffer is too small. -.El -.Pp -.Fn ns_verify -and -.Fn ns_verify_tcp -return the following errors: -.Bl -tag -width "NS_TSIG_ERROR_NO_SPACE" -compact -offset indent -.It Dv (-1) -bad input data -.It Dv NS_TSIG_ERROR_FORMERR -The message is malformed -.It Dv NS_TSIG_ERROR_NO_TSIG -The message does not contain a TSIG record -.It Dv NS_TSIG_ERROR_ID_MISMATCH -The TSIG original ID field does not match the message ID -.It Dv (-ns_r_badkey) -Verification failed due to an invalid key -.It Dv (-ns_r_badsig) -Verification failed due to an invalid signature -.It Dv (-ns_r_badtime) -Verification failed due to an invalid timestamp -.It Dv ns_r_badkey -Verification succeeded but the message had an error of BADKEY -.It Dv ns_r_badsig -Verification succeeded but the message had an error of BADSIG -.It Dv ns_r_badtime -Verification succeeded but the message had an error of BADTIME -.El -.Pp -.Sh SEE ALSO -.Xr resolver 3 . -.Sh AUTHORS -Brian Wellington, TISLabs at Network Associates -.\" .Sh BUGS diff --git a/contrib/bind/doc/misc/DynamicUpdate b/contrib/bind/doc/misc/DynamicUpdate deleted file mode 100644 index fb4152c..0000000 --- a/contrib/bind/doc/misc/DynamicUpdate +++ /dev/null @@ -1,284 +0,0 @@ - - - Description of Dynamic Update and T_UNSPEC Code - - - - - Added by Mike Schwartz - University of Washington Computer Science Department - 11/86 - schwartz@cs.washington.edu - - - - -I have incorporated 2 new features into BIND: - 1. Code to allow (unauthenticated) dynamic updates: surrounded by - #ifdef ALLOW_UPDATES - 2. Code to allow data of unspecified type: surrounded by - #ifdef ALLOW_T_UNSPEC - -Note that you can have one or the other or both (or neither) of these -modifications running, by appropriately modifying the makefiles. Also, -the external interface isn't changed (other than being extended), i.e., -a BIND server that allows dynamic updates and/or T_UNSPEC data can -still talk to a 'vanilla' server using the 'vanilla' operations. - -The description that follows is broken into 3 parts: a functional -description of the dynamic update facility, a functional description of -the T_UNSPEC facility, and a discussion of the implementation of -dynamic updates. The implementation description is mostly intended for -those who want to make future enhancements (especially the addition of -a good authentication mechanism). If you make enhancements, I would be -interested in hearing about them. - - - - - - 1. Dynamic Update Facility - -I added this code in conjunction with my research into naming in large -heterogeneous systems. For the purposes of this research, I ignored -security issues. In other words, no authentication/authorization -mechanism exists to control updates. Authentication will hopefully be -addressed at some future point (although probably not by me). In the -mean time, BIND Internet name servers (as opposed to "private" name -server networks operating with their own port numbers, as I use in my -research) should be compiled *without* -DALLOW_UPDATES, so that the -integrity of the Internet name database won't be compromised by this -code. - - -There are 5 different dynamic update interfaces: - UPDATEA - add a resource record - UPDATED - delete a specific resource record - UPDATEDA - delete all named resource records - UPDATEM - modify a specific resource record - UPDATEMA - modify all named resource records - -These all work through the normal resolver interface, i.e., these -interfaces are opcodes, and the data in the buffers passed to -res_mkquery must conform to what is expected for the particular -operation (see the #ifdef ALLOW_UPDATES extensions to nstest.c for -example usage). - -UPDATEM is logically equivalent to an UPDATED followed by an UPDATEA, -except that the updates occur atomically at the primary server (as -usual with Domain servers, secondaries may become temporarily -inconsistent). The difference between UPDATED and UPDATEDA is that the -latter allows you to delete all RRs associated with a name; similarly -for UPDATEM and UPDATEMA. The reason for the UPDATE{D,M}A interfaces -is two-fold: - - 1. Sometimes you want to delete/modify some data, but you know you'll - only have a single RR for that data; in such a case, it's more - convenient to delete/modify the RR by just giving the name; - otherwise, you would have to first look it up, and then - delete/modify it. - - 2. It is sometimes useful to be able to delete/modify multiple RRs - this way, since one can then perform the operation atomically. - Otherwise, one would have to delete/modify the RRs one-by-one. - -One additional point to note about UPDATEMA is that it will return a -success status if there were *zero* or more RRs associated with the given -name (and the RR add succeeds), whereas UPDATEM, UPDATED, and UPDATEDA -will return a success status if there were *one* or more RRs associated -with the given name. The reason for the difference is to handle the -(probably common) case where what you want to do is set a particular -name to contain a single RR, irrespective of whether or not it was -already set. - - - - - 2. T_UNSPEC Facility - -Type T_UNSPEC allows you to store data whose layout BIND doesn't -understand. Data of this type is not marshalled (i.e., converted -between host and network representation, as is done, for example, with -Internet addresses) by BIND, so it is up to the client to make sure -things work out ok w.r.t. heterogeneous data representations. The way -I use this type is to have the client marshal data, store it, retrieve -it, and demarshal it. This way I can store arbitrary data in BIND -without having to add new code for each specific type. - -T_UNSPEC data is dumped in an ASCII-encoded, checksummed format so -that, although it's not human-readable, it at least doesn't fill the -dump file with unprintable characters. - -Type T_UNSPEC is important for my research environment, where -potentially lots of people want to store data in the name service, and -each person's data looks different. Instead of having BIND understand -the format of each of their data types, the clients define marshaling -routines and pass buffers of marshalled data to BIND; BIND never tries -to demarshal the data...it just holds on to it, and gives it back to -the client when the client requests it, and the client must then -demarshal it. - -The Xerox Network System's name service (the Clearinghouse) works this -way. The reason 'vanilla' BIND understands the format of all the data -it holds is probably that BIND is tailored for a very specific -application, and wants to make sure the data it holds makes sense (and, -for some types, BIND needs to take additional action depending on the -data's semantics). For more general purpose name services (like the -Clearinghouse and my usage of BIND), this approach is less tractable. - -See the #ifdef ALLOW_T_UNSPEC extensions to nstest.c for example usage of -this type. - - - - - - - 3. Dynamic Update Implementation Description - -This section is divided into 3 subsections: General Discussion, -Miscellaneous Points, and Known Defects. - - - - - 3.1 General Discussion - -The basic scheme is this: When an update message arrives, a call is -made to InitDynUpdate, which first looks up the SOA record for the zone -the update affects. If this is the primary server for that zone, we do -the update and then update the zone serial number (so that secondaries -will refresh later). If this is a secondary server, we forward the -update to the primary, and if that's successful, we update our copy -afterwards. If it's neither, we refuse the update. (One might think -to try to propagate the update to an authoritative server; I figured -that updates will probably be most likely within an administrative -domain anyway; this could be changed if someone has strong feelings -about it). - -Note that this mechanism disallows updates when the primary is -down, preserving the Domain scheme's consistency requirements, -but making the primary a critical point for updates. This seemed -reasonable to me because - 1. Alternative schemes must deal with potentially complex - situations involving merging of inconsistent secondary - updates - 2. Updates are presumed to be rare relative to read accesses, - so this increased restrictiveness for updates over reads is - probably not critical - -I have placed comments through out the code, so it shouldn't be -too hard to see what I did. The majority of the processing is in -doupdate() and InitDynUpdate(). Also, I added a field to the zone -struct, to keep track of when zones get updated, so that only changed -zones get checkpointed. - - - - - - 3.2 Miscellaneous Points - -I use ns_maint to call zonedump() if the database changes, to -provide a checkpointing mechanism. I use the zone refresh times to -set up ns_maint interrupts if there are either secondaries or -primaries. Hence, if there is a secondary, this interrupt can cause -zoneref (as before), and if there is a primary, this interrupt can -cause doadump. I also checkpoint if needed before shutting down. - -You can force a server to checkpoint any changed zones by sending the -maint signal (SIGALRM) to the process. Otherwise it just checkpoints -during maint. interrupts, or when being shutdown (with SIGTERM). -Sending it the dump signal causes the database to be dumped into the -(single) dump file, but doesn't checkpoint (i.e., update the boot -files). Note that the boot files will be overwritten with checkpoint -files, so if you want to preserve the comments, you should keep copies -of the original boot files separate from the versions that are actually -used. - -I disallow T_SOA updates, for several reasons: - - T_SOA deletes at the primary wont be discovered by the secondaries - until they try to request them at maint time, which will cause - a failure - - the corresponding NS record would have to be deleted at the same - time (atomically) to avoid various problems - - T_SOA updates would have to be done in the right order, or else - the primary and secondaries will be out-of-sync for that zone. -My feeling is that changing the zone topology is a weighty enough thing -to do that it should involve changing the load file and reloading all -affected servers. - -There are alot of places where bind exits due to catastrophic failures -(mainly malloc failures). I don't try to dump the database in these -places because it's probably inconsistent anyway. It's probably better -to depend on the most recent dump. - - - - - - 3.2 Known Defects - -1. I put the following comment in nlookup (db_lookup.c): - - Note: at this point, if np->n_data is NULL, we could be in one - of two situations: Either we have come across a name for which - all the RRs have been (dynamically) deleted, or else we have - come across a name which has no RRs associated with it because - it is just a place holder (e.g., EDU). In the former case, we - would like to delete the namebuf, since it is no longer of use, - but in the latter case we need to hold on to it, so future - lookups that depend on it don't fail. The only way I can see - of doing this is to always leave the namebufs around (although - then the memory usage continues to grow whenever names are - added, and can never shrink back down completely when all their - associated RRs are deleted). - - Thus, there is a problem that the memory usage will keep growing for - the situation described. You might just choose to ignore this - problem (since I don't see any good way out), since things probably - wont grow fast anyway (how many names are created and then deleted - during a single server incarnation, after all?) - - The problem is that one can't delete old namebufs because one would - want to do it from db_update, but db_update calls nlookup to do the - actual work, and can't do it there, since we need to maintain place - holders. One could make db_update not call nlookup, so we know it's - ok to delete the namebuf (since we know the call is part of a delete - call); but then there is code with alot of overlapping functionality - in the 2 routines. - - This also causes another problem: If you create a name and then do - UPDATEDA, all it's RRs get deleted, but the name remains; then, if you - do a lookup on that name later, the name is found in the hash table, - but no RRs are found for it. It then forwards the query to itself (for - some reason), and then somehow decides there is no such domain, and then - returns (with the correct answer, but after going through extra work). - But the name remains, and each time it is looked up, we go through - these same steps. This should be fixed, but I don't have time right - now (and the right answer seems to come back anyway, so it's good - enough for now). - -2. There are 2 problems that crop up when you store data (other than - T_SOA and T_NS records) in the root: - a. Can't get primary to doaxfr RRs other than SOA and NS to - secondary. - b. Upon checkpoint (zonedump), this data sometimes comes out after other - data in the root, so that (since the SOA and NS records have null - names), they will get interpreted as being records under the - other names upon the next boot up. For example, if you have a - T_A record called ABC, the checkpoint may look like: - $ORIGIN . - ABC IN A 128.95.1.3 - 99999999 IN NS UW-BORNEO. - IN SOA UW-BORNEO. SCHWARTZ.CS.WASHINGTON.EDU. - ( 50 3600 300 3600000 3600 ) - Then when booting up the next time, the SOA and NS records get - interpreted as being called "ABC" rather than the null root - name. - -3. The secondary server caches the T_A RR for the primary, and hence when - it tries to ns_forw an update, it won't find the address of the primary - using nslookup unless that T_A RR is *also* stored in the main hashtable - (by putting it in a named.db file as well as the named.ca file). - diff --git a/contrib/bind/doc/misc/FAQ.1of2 b/contrib/bind/doc/misc/FAQ.1of2 deleted file mode 100644 index 9eea797..0000000 --- a/contrib/bind/doc/misc/FAQ.1of2 +++ /dev/null @@ -1,1939 +0,0 @@ -Path: senator-bedfellow.mit.edu!bloom-beacon.mit.edu!news-out.cwix.com!news1.cwix.com!newsfeed.cwix.com!204.59.152.222!news-peer.gip.net!news.gsl.net!gip.net!news.idt.net!newsin.iconnet.net!IConNet!not-for-mail -From: cdp2582@hertz.njit.edu (Chris Peckham) -Newsgroups: comp.protocols.tcp-ip.domains,comp.answers,news.answers,comp.protocols.dns.bind -Subject: comp.protocols.tcp-ip.domains Frequently Asked Questions (FAQ) (Part 1 of 2) -Supersedes: <cptd-faq-1-916718634@njit.edu> -Followup-To: comp.protocols.tcp-ip.domains -Organization: NJIT.EDU - New Jersey Institute of Technology, Newark, NJ, USA -Lines: 1919 -Sender: cdp@chipmunk.iconnet.net -Approved: news-answers-request@MIT.EDU -Distribution: world -Expires: Thursday, 18 Mar 99 15:18:37 EDT -Message-ID: <cptd-faq-1-918764317@njit.edu> -Reply-To: cdp@intac.com (comp.protocols.tcp-ip.domains FAQ comments) -Keywords: BIND,DOMAIN,DNS -X-Posting-Frequency: posted during the first week of each month -Date: Thu, 11 Feb 1999 20:18:01 GMT -NNTP-Posting-Host: chipmunk.iconnet.net -NNTP-Posting-Date: Thu, 11 Feb 1999 15:18:01 EDT -Xref: senator-bedfellow.mit.edu comp.protocols.tcp-ip.domains:22750 comp.answers:35016 news.answers:151035 comp.protocols.dns.bind:6289 - -Posted-By: auto-faq 3.3 beta (Perl 5.004) -Archive-name: internet/tcp-ip/domains-faq/part1 - -Note that this posting has been split into two parts because of its size. - -$Id: FAQ.1of2,v 8.5 2000/07/11 04:23:13 vixie Exp $ - -A new version of this document appears monthly. If this copy is more -than a month old it may be out of date. - -This FAQ is edited and maintained by Chris Peckham, <cdp@intac.com>. The -most recently posted version may be found for anonymous ftp from - -rtfm.mit.edu : /pub/usenet/news.answers/internet/tcp-ip/domains-faq - -It is also available in HTML from http://www.intac.com/~cdp/cptd-faq/. - -If you can contribute any answers for items in the TODO section, please do -so by sending e-mail to <cdp@intac.com> ! If you know of any items that -are not included and you feel that they should be, send the relevant -information to <cdp@intac.com>. - -=============================================================================== - -Index - - Section 1. TO DO / UPDATES - Q1.1 Contributions needed - Q1.2 UPDATES / Changes since last posting - - Section 2. INTRODUCTION / MISCELLANEOUS - Q2.1 What is this newsgroup ? - Q2.2 More information - Q2.3 What is BIND ? - Q2.4 What is the difference between BIND and DNS ? - Q2.5 Where is the latest version of BIND located ? - Q2.6 How can I find the path taken between two systems/domains ? - Q2.7 How do you find the hostname given the TCP-IP address ? - Q2.8 How do I register a domain ? - Q2.9 How can I change the IP address of our server ? - Q2.10 Issues when changing your domain name - Q2.11 How memory and CPU does DNS use ? - Q2.12 Other things to consider when planning your servers - Q2.13 Reverse domains (IN-ADDR.ARPA) and their delegation - Q2.14 How do I get my address assigned from the NIC ? - Q2.15 Is there a block of private IP addresses I can use? - Q2.16 Does BIND cache negative answers (failed DNS lookups) ? - Q2.17 What does an NS record really do ? - Q2.18 DNS ports - Q2.19 What is the cache file - Q2.20 Obtaining the latest cache file - Q2.21 Selecting a nameserver/root cache - Q2.22 Domain names and legal issues - Q2.23 Iterative and Recursive lookups - Q2.24 Dynamic DNS - Q2.25 What version of bind is running on a server ? - Q2.26 BIND and Y2K - - Section 3. UTILITIES - Q3.1 Utilities to administer DNS zone files - Q3.2 DIG - Domain Internet Groper - Q3.3 DNS packet analyzer - Q3.4 host - Q3.5 How can I use DNS information in my program? - Q3.6 A source of information relating to DNS - - Section 4. DEFINITIONS - Q4.1 TCP/IP Host Naming Conventions - Q4.2 What are slaves and forwarders ? - Q4.3 When is a server authoritative? - Q4.4 My server does not consider itself authoritative ! - Q4.5 NS records don't configure servers as authoritative ? - Q4.6 underscore in host-/domainnames - Q4.7 How do I turn the "_" check off ? - Q4.8 What is lame delegation ? - Q4.9 How can I see if the server is "lame" ? - Q4.10 What does opt-class field in a zone file do? - Q4.11 Top level domains - Q4.12 US Domain - Q4.13 Classes of networks - Q4.14 What is CIDR ? - Q4.15 What is the rule for glue ? - Q4.16 What is a stub record/directive ? - - Section 5. CONFIGURATION - Q5.1 Upgrading from 4.9.x to 8.x - Q5.2 Changing a Secondary server to a Primary server ? - Q5.3 Moving a Primary server to another server - Q5.4 How do I subnet a Class B Address ? - Q5.5 Subnetted domain name service - Q5.6 Recommended format/style of DNS files - Q5.7 DNS on a system not connected to the Internet - Q5.8 Multiple Domain configuration - Q5.9 wildcard MX records - Q5.10 How do you identify a wildcard MX record ? - Q5.11 Why are fully qualified domain names recommended ? - Q5.12 Distributing load using named - Q5.13 Round robin IS NOT load balancing - Q5.14 Order of returned records - Q5.15 resolv.conf - Q5.16 How do I delegate authority for sub-domains ? - Q5.17 DNS instead of NIS on a Sun OS 4.1.x system - Q5.18 Patches to add functionality to BIND - Q5.19 How to serve multiple domains from one server - Q5.20 hostname and domain name the same - Q5.21 Restricting zone transfers - Q5.22 DNS in firewalled and private networks - Q5.23 Modifying the Behavior of DNS with ndots - Q5.24 Different DNS answers for same RR - - Section 6. PROBLEMS - Q6.1 No address for root server - Q6.2 Error - No Root Nameservers for Class XX - Q6.3 Bind 4.9.x and MX querying? - Q6.4 Do I need to define an A record for localhost ? - Q6.5 MX records, CNAMES and A records for MX targets - Q6.6 Can an NS record point to a CNAME ? - Q6.7 Nameserver forgets own A record - Q6.8 General problems (core dumps !) - Q6.9 malloc and DECstations - Q6.10 Can't resolve names without a "." - Q6.11 Why does swapping kill BIND ? - Q6.12 Resource limits warning in system - Q6.13 ERROR:ns_forw: query...learnt - Q6.14 ERROR:zone has trailing dot - Q6.15 ERROR:Zone declared more then once - Q6.16 ERROR:response from unexpected source - Q6.17 ERROR:record too short from [zone name] - Q6.18 ERROR:sysquery: findns error (3) - Q6.19 ERROR:Err/TO getting serial# for XXX - Q6.20 ERROR:zonename IN NS points to a CNAME - Q6.21 ERROR:Masters for secondary zone [XX] unreachable - Q6.22 ERROR:secondary zone [XX] expired - Q6.23 ERROR:bad response to SOA query from [address] - Q6.24 ERROR:premature EOF, fetching [zone] - Q6.25 ERROR:Zone [XX] SOA serial# rcvd from [Y] is < ours - Q6.26 ERROR:connect(IP/address) for zone [XX] failed - Q6.27 ERROR:sysquery: no addrs found for NS - Q6.28 ERROR:zone [name] rejected due to errors - - Section 7. ACKNOWLEDGEMENTS - Q7.1 How is this FAQ generated ? - Q7.2 What formats are available ? - Q7.3 Contributors - -=============================================================================== - -Section 1. TO DO / UPDATES - - Q1.1 Contributions needed - Q1.2 UPDATES / Changes since last posting - ------------------------------------------------------------------------------ - -Question 1.1. Contributions needed - -Date: Mon Jan 18 22:57:01 EST 1999 - -* Additional information on the new TLDs -* Expand on Q: How to serve multiple domains from one server -* Q: DNS ports - need to expand/correct some issues - ------------------------------------------------------------------------------ - -Question 1.2. UPDATES / Changes since last posting - -Date: Thu Feb 11 14:36:02 EST 1999 - -* DNS in firewalled and private networks - Updated with comment about hint - file -* host - Updated NT info -* How do I register a domain ? - JP NIC -* BIND and Y2K - -=============================================================================== - -Section 2. INTRODUCTION / MISCELLANEOUS - - Q2.1 What is this newsgroup ? - Q2.2 More information - Q2.3 What is BIND ? - Q2.4 What is the difference between BIND and DNS ? - Q2.5 Where is the latest version of BIND located ? - Q2.6 How can I find the path taken between two systems/domains ? - Q2.7 How do you find the hostname given the TCP-IP address ? - Q2.8 How do I register a domain ? - Q2.9 How can I change the IP address of our server ? - Q2.10 Issues when changing your domain name - Q2.11 How memory and CPU does DNS use ? - Q2.12 Other things to consider when planning your servers - Q2.13 Reverse domains (IN-ADDR.ARPA) and their delegation - Q2.14 How do I get my address assigned from the NIC ? - Q2.15 Is there a block of private IP addresses I can use? - Q2.16 Does BIND cache negative answers (failed DNS lookups) ? - Q2.17 What does an NS record really do ? - Q2.18 DNS ports - Q2.19 What is the cache file - Q2.20 Obtaining the latest cache file - Q2.21 Selecting a nameserver/root cache - Q2.22 Domain names and legal issues - Q2.23 Iterative and Recursive lookups - Q2.24 Dynamic DNS - Q2.25 What version of bind is running on a server ? - Q2.26 BIND and Y2K - ------------------------------------------------------------------------------ - -Question 2.1. What is this newsgroup ? - -Date: Thu Dec 1 11:08:28 EST 1994 - -comp.protocols.tcp-ip.domains is the usenet newsgroup for discussion on -issues relating to the Domain Name System (DNS). - -This newsgroup is not for issues directly relating to IP routing and -addressing. Issues of that nature should be directed towards -comp.protocols.tcp-ip. - ------------------------------------------------------------------------------ - -Question 2.2. More information - -Date: Fri Dec 6 00:41:03 EST 1996 - -You can find more information concerning DNS in the following places: - -* The BOG (BIND Operations Guide) - in the BIND distribution -* The FAQ included with BIND 4.9.5 in doc/misc/FAQ -* DNS and BIND by Albitz and Liu (an O'Reilly & Associates Nutshell - handbook) -* A number of RFCs (920, 974, 1032, 1034, 1101, 1123, 1178, 1183, 1348, - 1535, 1536, 1537, 1591, 1706, 1712, 1713, 1912, 1918) -* The DNS Resources Directory (DNSRD) http://www.dns.net/dnsrd/ -* If you are having troubles relating to sendmail and DNS, you may wish to - refer to the USEnet newsgroup comp.mail.sendmail and/or the FAQ for that - newsgroup which may be found for anonymous ftp at rtfm.mit.edu : - /pub/usenet/news.answers/mail/sendmail-faq -* Information concerning some frequently asked questions relating to the - Internet (i.e., what is the InterNIC, what is an RFC, what is the IETF, - etc) may be found for anonymous ftp from ds.internic.net : /fyi/fyi4.txt - A version may also be obtained with the URL - gopher://ds.internic.net/00/fyi/fyi4.txt. -* Information on performing an initial installation of BIND may be found - using the DNS Resources Directory at - http://www.dns.net/dnsrd/docs/basic.txt -* Three other USEnet newsgroups: - - * comp.protocols.dns.bind - * comp.protocols.dns.ops - * comp.protocols.dns.std - ------------------------------------------------------------------------------ - -Question 2.3. What is BIND ? - -Date: Tue Sep 10 23:15:58 EDT 1996 - -From the BOG Introduction - - -The Berkeley Internet Name Domain (BIND) implements an Internet name -server for the BSD operating system. The BIND consists of a server (or -``daemon'') and a resolver library. A name server is a network -service that enables clients to name resources or objects and share this -information with other objects in the network. This in effect is a -distributed data base system for objects in a computer network. BIND -is fully integrated into BSD (4.3 and later releases) network programs -for use in storing and retrieving host names and address. The system -administrator can configure the system to use BIND as a replacement to -the older host table lookup of information in the network hosts file -/etc/hosts. The default configuration for BSD uses BIND. - ------------------------------------------------------------------------------ - -Question 2.4. What is the difference between BIND and DNS ? - -Date: Tue Sep 10 23:15:58 EDT 1996 - -(text provided by Andras Salamon) DNS is the Domain Name System, a set of -protocols for a distributed database that was originally designed to -replace /etc/hosts files. DNS is most commonly used by applications to -translate domain names of hosts to IP addresses. A client of the DNS is -called a resolver; resolvers are typically located in the application -layer of the networking software of each TCP/IP capable machine. Users -typically do not interact directly with the resolver. Resolvers query the -DNS by directing queries at name servers that contain parts of the -distributed database that is accessed by using the DNS protocols. In -common usage, `the DNS' usually refers just to the data in the database. - -BIND (Berkeley Internet Name Domain) is an implementation of DNS, both -server and client. Development of BIND is funded by the Internet Software -Consortium and is coordinated by Paul Vixie. BIND has been ported to -Windows NT and VMS, but is most often found on Unix. BIND source code is -freely available and very complex; most of the development on the DNS -protocols is based on this code; and most Unix vendors ship BIND-derived -DNS implementations. As a result, the BIND name server is the most widely -used name server on the Internet. In common usage, `BIND' usually refers -to the name server that is part of the BIND distribution, and sometimes to -name servers in general (whether BIND-derived or not). - ------------------------------------------------------------------------------ - -Question 2.5. Where is the latest version of BIND located ? - -Date: Mon Sep 14 22:46:00 EDT 1998 - -This information may be found at http://www.vix.com/isc/bind/. - -Presently, there are two 'production level' versions of BIND. They are -versions 4 and 8. - -Version 4 is the last "traditional" BIND -- the one everybody on the -Internet runs, except a few hundred sites running... - -Version 8 has been called "BIND-ng" (Next Generation). Many new features -are found in version 8. - -BIND-8.1 has the following features: - -* DNS Dynamic Updates (RFC 2136) -* DNS Change Notification (RFC 1996) -* Completely new configuration syntax -* Flexible, categorized logging system -* IP-address-based access control for queries, zone transfers, and updates - that may be specified on a zone-by-zone basis -* More efficient zone transfers -* Improved performance for servers with thousands of zones -* The server no longer forks for outbound zone transfers -* Many bug fixes. - -Bind version 8.1.2 may be found at the following location: - -* Source ftp.isc.org : /isc/bind/src/8.1.2/bind-8.1.2-src.tar.gz -* Documentation ftp.isc.org : /isc/bind/src/8.1.2/bind-8.1.2-doc.tar.gz -* Contributed packages ftp.isc.org : - /isc/bind/src/8.1.2/bind-8.1.2-contrib.tar.gz - -At this time, BIND version 4.9.7 may be found for anonymous ftp from - -ftp.isc.org : /isc/bind/src/4.9.7/bind-4.9.7-REL.tar.gz - -Other sites that officially mirror the BIND distribution are - -* bind.fit.qut.edu.au : /pub/bind -* ftp.funet.fi : /pub/unix/tcpip/dns/bind -* ftp.univ-lyon1.fr : /pub/mirrors/unix/bind -* ftp.oleane.net : /pub/mirrors/unix/bind -* ftp.ucr.ac.cr : /pub/Unix/dns/bind -* ftp.luth.se : /pub/unix/dns/bind/beta - -You may need GNU zip, Larry Wall's patch program (if there are any patch -files), and a C compiler to get BIND running from the above mentioned -source. - -GNU zip is available for anonymous ftp from - -prep.ai.mit.edu : /pub/gnu/gzip-1.2.4.tar - -patch is available for anonymous ftp from - -prep.ai.mit.edu : /pub/gnu/patch-2.1.tar.gz - -A version of BIND for Windows NT is available for anonymous ftp from - -ftp.isc.org : /isc/bind/contrib/ntbind/ntdns497relbin.zip - -and - -ftp.isc.org : /isc/bind/contrib/ntbind/ntbind497rel.zip - -If you contact access@drcoffsite.com, he will send you information -regarding a Windows NT/WIN95 bind port of 4.9.6 release. - -A Freeware version of Bind for NT is available at http://www.software.com. - ------------------------------------------------------------------------------ - -Question 2.6. How can I find the path taken between two systems/domains ? - -Date: Wed Jan 14 12:07:03 EST 1998 - -On a Unix system, use traceroute. If it is not available to you, you may -obtain the source source for 'traceroute', compile it and install it on -your system. - -One version of this program with additional functionality may be found for -anonymous ftp from - -ftp.nikhef.nl : /pub/network/traceroute.tar.Z - -Another version may be found for anonymous ftp from - -ftp.psc.edu : /pub/net_tools/traceroute.tar - -NT/Windows 95 users may use the command TRACERT.EXE, which is installed -with the TCP/IP protocol support. There is a Winsock utility called -WS_PING by John Junod that provides ping, traceroute, and nslookup -functionality. - -There are several shareware TCP/IP utilities that provide ping, -traceroute, and DNS lookup functionality for a Macintosh: Mac TCP Watcher -and IP Net Monitor are two of them. - ------------------------------------------------------------------------------ - -Question 2.7. How do you find the hostname given the TCP-IP address ? - - Mon Jun 15 21:32:57 EDT 1998 - -For an address a.b.c.d you can always do: - - % nslookup - > set q=ptr - > d.c.b.a.in-addr.arpa. - -Most newer version of nslookup (since 4.8.3) will recognize an address, so -you can just say: - - % nslookup a.b.c.d - -DiG will work like this also: - - % dig -x a.b.c.d - -dig is included in the bind distribution. host from the bind distribution -may also be used. - -On a Macintosh, some shareware utilities may be used. IP Net Monitor has -a very nice NS Lookup feature, producing DiG-like output; Mac TCP Watcher -just has a simple name-to-address and address-to-name translator. - ------------------------------------------------------------------------------ - -Question 2.8. How do I register a domain ? - -Date: Thu Feb 11 14:51:50 EST 1999 - -Procedures for registering a domain name depend on the top level domain -(TLD) to which the desired domain name will belong, i.e. the rightmost -suffix of the desired domain name. See the answer to "Top level domains" -question in the DEFINITIONS SECTION of this FAQ. - -Although domain registration may be performed by a direct contact with the -appropriate domain registration authorities (domain name registrars), the -easiest way to do it is to talk to your Internet Service Providers. They -can submit a domain registration request on your behalf, as well as to set -up secondary DNS for your domain (or both DNS servers, if you need a -domain name for Web hosting and/or mail delivery purposes only). - -In the case where the registration is done by the organization itself, it -still makes the whole process much easier if the ISP is approached for -secondary (see RFC 2182) servers _before_ the InterNIC is approached -for registration. - -In any case, you will need at least two domain name servers when you -register your domain. Many ISP's are willing to provide primary and/or -secondary name service for their customers. If you want to register a -domain name ending with .COM, .NET, .ORG, you'll want to take a look to -the InterNIC: - -* http://www.internic.net/ -> Registration Services -* internic.net : /templates/domain-template.txt -* gopher://rs.internic.net/ - -Please note that the InterNIC charges a fee for domain names in the "COM", -"ORG", and "NET". More information may be found from the Internic at - -http://rs.internic.net/domain-info/fee-policy.html. - -Note that InterNIC doesn't allocate and assign IP numbers any more. Please -refer to the answer to "How do I get my address assigned from the NIC?" in -this section. - -Registration of domain names ending with country code suffixes (ISO 3166 - -.FR, .CH, .SE etc.) is being done by the national domain name registrars -(NICs). If you want to obtain such a domain, please refer to the following -links: - -Additional domain/whois information may be found: - -* http://rs.internic.net/help/other-reg.html -* http://www.iana.org/ -* http://www.ripe.net/centr/tld.html -* http://www.UNINETT.NO/navn/domreg.html -* http://www.nic.fr/Guides/AutresNics/ -* http://www.arin.net -* whois.apnic.net -* whois.nic.ad.jp (with /e at the end of query for English) -* sipb.mit.edu : /pub/whois/whois-servers.list -* http://www.geektools.com/whois.html - -Many times, registration of a domain name can be initiated by sending -e-mail to the zone contact. You can obtain the contact in the SOA record -for the country, or in a whois server: - - $ nslookup -type=SOA fr. - origin = ns1.nic.fr - mail addr = nic.nic.fr - ... - -The mail address to contact in this case is 'nic@nic.fr' (you must -substitute an '@' for the first dot in the mail addr field). - -An alternate method to obtain the e-mail address of the national NIC is -the 'whois' server at InterNIC. - -You may be requested to make your request to another email address or -using a certain information template/application. You may be requested to -make your request to another email address or using a certain information -template/application. Please remember that every TLD registrar has its own -registration policies and procedures. - ------------------------------------------------------------------------------ - -Question 2.9. How can I change the IP address of our server ? - -Date: Wed Jan 14 12:09:09 EST 1998 - -(From Mark Andrews) Before the move. - -* Ensure you are running a modern nameserver. BIND 4.9.6-P1 or 8.1.1 are - good choices. -* Inform all your secondaries that you are going to change. Have them - install both the current and new addresses in their named.boot's. -* Drop the ttl of the A's associated with the nameserver to something - small (5 min is usually good). -* Drop the refresh and retry times of the zone containing the forward - records for the server. -* Configure the new reverse zone before the move and make sure it is - operational. -* On the day of the move add the new A record(s) for the server. Don't - forget to have these added to parent domains. You will look like you are - multihomed with one interface dead. - -Move the machine after gracefully terminating any other services it is -offering. Then, - -* Fixup the A's, ttl, refresh and retry counters. (If you are running an - all server EDIT out all references to the old addresses in the cache - files). -* Inform all the secondaries the move is complete. -* Inform the parents of all zones you are primary of the new NS/A pairs - for the relevant zones. If you're changing the address of a server - registered with the InterNIC, you also need to submit a Modify Host form - to the InterNIC, so they will update the glue records on the root - servers. It can take the InterNIC a few days to process this form, and - the old glue records have 2-day TTL's, so this transition may be - problematic. -* Inform all the administrators of zones you are secondarying that the - machine has moved. -* For good measure update the serial no for all zones you are primary for. - This will flush out old A's. - ------------------------------------------------------------------------------ - -Question 2.10. Issues when changing your domain name - -Date: Sun Nov 27 23:32:41 EST 1994 - -If you are changing your domain name from abc.foobar.com to foobar.net, -the forward zones are easy and there are a number of ways to do it. One -way is the following: - -Have a single db file for the 2 domains, and have a single machine be the -primary server for both abc.foobar.com and foobar.net. - -To resolve the host foo in both domains, use a single zone file which -merely uses this for the host: - -foo IN A 1.2.3.4 - -Use a "@" wherever the domain would be used ie for the SOA: - -@ IN SOA (... - -Then use this pair of lines in your named.boot: - -primary abc.foobar.com db.foobar -primary foobar.net db.foobar - -The reverse zones should either contain PTRs to both names, or to -whichever name you believe to be canonical currently. - ------------------------------------------------------------------------------ - -Question 2.11. How memory and CPU does DNS use ? - -Date: Fri Dec 6 01:07:56 EST 1996 - -It can use quite a bit ! The main thing that BIND needs is memory. It -uses very little CPU or network bandwidth. The main considerations to -keep in mind when planning are: - -* How many zones do you have and how large are they ? -* How many clients do you expect to serve and how active are they ? - -As an example, here is a snapshot of memory usage from CSIRO Division of -Mathematics and Statistics, Australia - - Named takes several days to stabilize its memory usage. - - Our main server stabalises at ~10Mb. It takes about 3 days to - reach this size from 6 M at startup. This is under Sun OS 4.1.3U1. - -As another example, here is the configuration of ns.uu.net (from late -1994): - - ns.uu.net only does nameservice. It is running a version of BIND - 4.9.3 on a Sun Classic with 96 MB of RAM, 220 MB of swap (remember - that Sun OS will reserve swap for each fork, even if it is not needed) - running Sun OS 4.1.3_U1. - - Joseph Malcolm, of Alternet, states that named generally hovers at - 5-10% of the CPU, except after a reload, when it eats it all. - ------------------------------------------------------------------------------ - -Question 2.12. Other things to consider when planning your servers - -Date: Mon Jan 2 14:24:51 EST 1995 - -When making the plans to set up your servers, you may want to also -consider the following issues: - - A) Server O/S limitations/capacities (which tend to be widely - divergent from vendor to vendor) - B) Client resolver behavior (even more widely divergent) - C) Expected query response time - D) Redundancy - E) Desired speed of change propagation - F) Network bandwidth availability - G) Number of zones/subdomain-levels desired - H) Richness of data stored (redundant MX records? HINFO records?) - I) Ease of administration desired - J) Network topology (impacts reverse-zone volume) - - Assuming a best-possible case for the factors above, particularly (A), (B), - (C), (F), (G) & (H), it would be possible to run a 1000-node domain - using a single lowly 25 or 40 MHz 386 PC with a fairly modest amount of RAM - by today's standards, e.g. 4 or 8 Meg. However, this configuration would - be slow, unreliable, and would provide no functionality beyond your basic - address-to-name and name-to-address mappings. - - Beyond that baseline case, depending on what factors listed above, - you may want look at other strategies, such splitting up the DNS - traffic among several machines strategically located, possibly larger ones, - and/or subdividing your domain itself. There are many options, tradeoffs, - and DNS architectural paradigms from which to choose. - ------------------------------------------------------------------------------ - -Question 2.13. Reverse domains (IN-ADDR.ARPA) and their delegation - -Date: Mon Jun 15 23:28:47 EDT 1998 - -(The following section was contributed by Berislav Todorovic.) - -Reverse domains (subdomains of the IN-ADDR.ARPA domain) are being used by -the domain name service to perform reverse name mapping - from IP -addresses to host names. Reverse domains are more closely related to IP -address space usage than to the "forward" domain names used. For example, -a host using IP address 10.91.8.6 will have its "reverse" name: -6.8.91.10.IN-ADDR.ARPA, which must be entered in the DNS, by a PTR record: - -6.8.91.10.in-addr.arpa. IN PTR myserver.mydomain.com. - -In spite of the fact that IP address space is not longer divided into -classes (A, B, C, D, E - see the answer to "What is CIDR?" in the -DEFINITIONS section), the reverse host/domain names are organized on IP -address byte boundaries. Thus, the reverse host name -6.8.91.10.IN-ADDR.ARPA may belong to one of the following reverse domains, -depending on the address space allocated/assigned to you and your DNS -configuration: - -(1) 8.91.10.in-addr.arpa -> - assigned one or more "C class" networks (IP >= /24) -(2) 91.10.in-addr.arpa -> - assigned a whole "B class" 10.91/16 (IP = /16) -(3) ISP dependent -> - assigned < "C class" - e.g. 10.91.8/26 (IP < /24) - -No matter what is your case (1, 2 or 3) - the reverse domain name must be -properly delegated - registered in the IN-ADDR.ARPA zone. Otherwise, -translation IP -> host name will fail, which may cause troubles when using -some Internet services and accessing some public sites. - -To register your reverse domain, talk to your Internet service provider, -to ensure proper DNS configuration, according to your network topology and -address space assigned. They will point you to a further instance, if -necessary. Generally speaking, while forward domain name registration is a -matter of domain name registrars (InterNIC, national NICs), reverse domain -name delegation is being done by the authorities, assigning IP address -space - Internet service providers and regional Internet registries (see -the answer to "How do I get my address assigned from the NIC?" in this -section). - -Important notes: - -(1) If you're assigned a block or one or more "Class C" networks, you'll -have to maintain a separate reverse domain zone file for each "Class C" -from the block. For example, if you're assigned 10.91.8/22, you'll have to -configure a separate zone file for 4 domains: - -8.91.10.in-addr.arpa -9.91.10.in-addr.arpa -10.91.10.in-addr.arpa -11.91.10.in-addr.arpa - -and to delegate them further in the DNS (according to the advice from your -ISP). - -(2) If you're assigned a whole "B class" (say, 10.91/16), you're in charge -for the whole 91.10.IN-ADDR.ARPA zone. See the answer to "How do I subnet -a Class B Address?" in the CONFIGURATION section. - -(3) If you're assigned only a portion of a "C class" (say, 10.91.8.0/26) -see the answer to "Subnetted domain name service" question in the -CONFIGURATION section. - -For more information on reverse domain delegations see: - -* http://www.arin.net/templates/inaddrtemplate.txt -* http://www.ripe.net/docs/ripe-159.html -* ftp.apnic.net : /apnic/docs/in-addr-request - ------------------------------------------------------------------------------ - -Question 2.14. How do I get my address assigned from the NIC ? - -Date: Mon Jun 15 22:48:24 EDT 1998 - -IP address space assignment to end users is no longer being performed by -regional Internet registries (InterNIC, ARIN, RIPE NCC, APNIC). If you -need IP address space, you should make a request to your Internet service -provider. If you already have address space and need more IP numbers, -make a request to your ISP again and you may be given more numbers -(different ISPs have different allocation requirements and procedures). -If you are a smaller ISP - talk to your upstream ISP to obtain necessary -numbers for your customers. If you change the ISP in the future, you MAY -have to renumber your network. See RFC 2050 and RFC 2071 for more -information on this issue. - -Currently, address space is being distributed in a hierarchical manner: -ISPs assign addresses to their end customers. The regional Internet -registries allocate blocks of addresses (usually sized between /19 (32 "C -class") and /16 (a "B class")) to the ISPs. Finally - IANA (Internet -Assigned Number Authority) allocates necessary address space (/8 ("A -class") sized blocks) to the regional registries, as the need for address -space arises. This hierarchical process ensures more efficient routing on -the backbones (less traffic caused by routing information updates, better -memory utilization in backbone routers etc.) as well as more rational -address usage. - -If you are an ISP, planning to connect yourself to more than one ISP (i.e. -becoming multi-homed) and/or expecting to have a lot of customers, you'll -have to obtain ISP independent address space from a regional Internet -registry. Depending on your geographical locations, you can obtain such -address blocks (/19 and larger blocks) from: - -* RIPE NCC (http://www.ripe.net/) -> Europe, North Africa and Middle East -* ARIN (http://www.arin.net/) -> North and South America, Central Africa -* APNIC (http://www.apnic.net/) -> Asian and Pacific region - -While the regional registries do not sell address space, they do charge -for their services (allocation of address space, reverse domain -delegations etc.) - ------------------------------------------------------------------------------ - -Question 2.15. Is there a block of private IP addresses I can use? - -Date: Sun May 5 23:02:49 EDT 1996 - -Yes there is. Please refer to RFC 1918: - - 1918 Address Allocation for Private Internets. Y. Rekhter, B. - Moskowitz, D. Karrenberg, G. de Groot, & E. Lear. February 1996. - (Format: TXT=22270 bytes) - -RFC 1918 documents the allocation of the following addresses for use by -``private internets'': - - 10.0.0.0 - 10.255.255.255 - 172.16.0.0 - 172.31.255.255 - 192.168.0.0 - 192.168.255.255 - ------------------------------------------------------------------------------ - -Question 2.16. Does BIND cache negative answers (failed DNS lookups) ? - -Date: Mon Jan 2 13:55:50 EST 1995 - -Yes, BIND 4.9.3 and more recent versions will cache negative answers. - ------------------------------------------------------------------------------ - -Question 2.17. What does an NS record really do ? - -Date: Wed Jan 14 12:28:46 EST 1998 - -The NS records in your zone data file pointing to the zone's name servers -(as opposed to the servers of delegated subdomains) don't do much. -They're essentially unused, though they are returned in the authority -section of reply packets from your name servers. - -However, the NS records in the zone file of the parent domain are used to -find the right servers to query for the zone in question. These records -are more important than the records in the zone itself. - -However, if the parent domain server is a secondary or stub server for the -child domain, it will "hoist" the NS records from the child into the -parent domain. This frequently happens with reverse domains, since the -ISP operates primary reverse DNS for its CIDR block and also often runs -secondary DNS for many customers' reverse domains. - -Caching servers will often replace the NS records learned from the parent -server with the authoritative list that the child server sends in its -authority section. If the authoritative list is missing the secondary -servers, those caching servers won't be able to look up in this domain if -the primary goes down. - -After all of this, it is important that your NS records be correct ! - ------------------------------------------------------------------------------ - -Question 2.18. DNS ports - -Date: Wed Jan 14 12:31:39 EST 1998 - -The following table shows what TCP/UDP ports bind before 8.x DNS uses to -send and receive queries: - - Prot Src Dst Use - udp 53 53 Queries between servers (eg, recursive queries) - Replies to above - tcp 53 53 Queries with long replies between servers, zone - transfers Replies to above - udp >1023 53 Client queries (sendmail, nslookup, etc ...) - udp 53 >1023 Replies to above - tcp >1023 53 Client queries with long replies - tcp 53 >1023 Replies to above - - Note: >1023 is for non-priv ports on Un*x clients. On other client - types, the limit may be more or less. - -BIND 8.x no longer uses port 53 as the source port for recursive queries. -By defalt it uses a random port >1023, although you can configure a -specific port (53 if you want). - -Another point to keep in mind when designing filters for DNS is that a DNS -server uses port 53 both as the source and destination for its queries. -So, a client queries an initial server from an unreserved port number to -UDP port 53. If the server needs to query another server to get the -required info, it sends a UDP query to that server with both source and -destination ports set to 53. The response is then sent with the same -src=53 dest=53 to the first server which then responds to the original -client from port 53 to the original source port number. - -The point of all this is that putting in filters to only allow UDP between -a high port and port 53 will not work correctly, you must also allow the -port 53 to port 53 UDP to get through. - -Also, ALL versions of BIND use TCP for queries in some cases. The -original query is tried using UDP. If the response is longer than the -allocated buffer, the resolver will retry the query using a TCP -connection. If you block access to TCP port 53 as suggested above, you -may find that some things don't work. - -Newer version of BIND allow you to configure a list of IP addresses from -which to allow zone transfers. This mechanism can be used to prevent -people from outside downloading your entire namespace. - ------------------------------------------------------------------------------ - -Question 2.19. What is the cache file - -Date: Fri Dec 6 01:15:22 EST 1996 - -From the "Name Server Operations Guide" - - 6.3. Cache Initialization - - 6.3.1. root.cache - - The name server needs to know the servers that - are the authoritative name servers for the root - domain of the network. To do this we have to prime - the name server's cache with the addresses of these - higher authorities. The location of this file is - specified in the boot file. ... - ------------------------------------------------------------------------------ - -Question 2.20. Obtaining the latest cache file - -Date: Fri Dec 6 01:15:22 EST 1996 - -If you have a version of dig running, you may obtain the information with -the command - - dig @a.root-servers.net. . ns - -A perl script to handle some possible problems when using this method -from behind a firewall and that can also be used to periodically obtain -the latest cache file was posted to comp.protocols.tcp-ip.domains during -early October, 1996. It was posted with the subject "Keeping db.cache -current". It is available at -http://www.intac.com/~cdp/cptd-faq/current_db_cache.txt. - -The latest cache file may also be obtained from the InterNIC via ftp or -gopher: - - ; This file is made available by InterNIC registration services - ; under anonymous FTP as - ; file /domain/named.root - ; on server FTP.RS.INTERNIC.NET - ; -OR- under Gopher at RS.INTERNIC.NET - ; under menu InterNIC Registration Services (NSI) - ; submenu InterNIC Registration Archives - ; file named.root - ------------------------------------------------------------------------------ - -Question 2.21. Selecting a nameserver/root cache - -Date: Mon Aug 5 22:54:11 EDT 1996 - -Exactly how is the a root server selected from the root cache? Does the -resolver attempt to pick the closest host or is it random or is it via -sortlist-type workings? If the root server selected is not available (for -whatever reason), will the the query fail instead of attempting another -root server in the list ? - -Every recursive BIND name server (that is, one which is willing to go out -and find something for you if you ask it something it doesn't know) will -remember the measured round trip time to each server it sends queries to. -If it has a choice of several servers for some domain (like "." for -example) it will use the one whose measured RTT is lowest. - -Since the measured RTT of all NS RRs starts at zero (0), every one gets -tried one time. Once all have responded, all RTT's will be nonzero, and -the "fastest server" will get all queries henceforth, until it slows down -for some reason. - -To promote dispersion and good record keeping, BIND will penalize the RTT -by a little bit each time a server is reused, and it will penalize the RTT -a _lot_ if it ever has to retransmit a query. For a server to stay "#1", -it has to keep on answering quickly and consistently. - -Note that this is something BIND does that the DNS Specification does not -mention at all. So other servers, those not based on BIND, might behave -very differently. - ------------------------------------------------------------------------------ - -Question 2.22. Domain names and legal issues - -Date: Mon Jun 15 22:15:32 EDT 1998 - -A domain name may be someone's trademark and the use of a trademark -without its owner's permission may be a trademark violation. This may -lead to a legal dispute. RFC 1591 allows registration authorities to -play a neutral role in domain name disputes, stating that: - - In case of a dispute between domain name registrants as to the - rights to a particular name, the registration authority shall have - no role or responsibility other than to provide the contact - information to both parties. - -The InterNIC's current domain dispute policy (effective February 25, 1998) -is located at: - -http://www.internic.net/domain-info/internic-domain-6.html - -Other domain registrars have similar domain dispute policies. - -The following information was submitted by Carl Oppedahl -<oppedahl@patents.com> : - -If the jealous party happens to have a trademark registration, it is quite -likely that the domain name owner will lose the domain name, even if they -aren't infringing the trademark. This presents a substantial risk of loss -of a domain name on only 30 days' notice. Anyone who is the manager of an -Internet-connected site should be aware of this risk and should plan for -it. - -See "How do I protect myself from loss of my domain name?" at -http://www.patents.com/weblaw.sht#domloss. - -For an example of an ISP's battle to keep its domain name, see -http://www.patents.com/nsi.sht. - -A compendium of information on the subject may be found at -http://www.law.georgetown.edu/lc/internic/domain1.html. - ------------------------------------------------------------------------------ - -Question 2.23. Iterative and Recursive lookups - -Date: Wed Jul 9 22:05:32 EDT 1997 - -Q: What is the difference between iterative and recursive lookups ? How -do you configure them and when would you specify one over the other ? - -A: (from an answer written by Barry Margolin) In an iterative lookup, the -server tells the client "I don't know the answer, try asking <list of -other servers>". In a recursive lookup, the server asks one of the other -servers on your behalf, and then relays the answer back to you. - -Recursive servers are usually used by stub resolvers (the name lookup -software on end systems). They're configured to ask a specific set of -servers, and expect those servers to return an answer rather than a -referral. By configuring the servers with recursion, they will cache -answers so that if two clients try to look up the same thing it won't have -to ask the remote server twice, thus speeding things up. - -Servers that aren't intended for use by stub resolvers (e.g. the root -servers, authoritative servers for domains). Disabling recursion reduces -the load on them. - -In BIND 4.x, you disable recursion with "options no-recursion" in the -named.boot file. - ------------------------------------------------------------------------------ - -Question 2.24. Dynamic DNS - -Mon Jan 18 20:31:58 EST 1999 - -Q: Bind 8 includes some support for Dynamic DNS as specified in RFC 2136. -It does not currently include the authentication mechanism that is -described in RFC 2137, meaning that any update requests received from -allowed hosts will be honored. - -Could someone give me a working example of what syntax nsupdate expects ? -Is it possible to write an update routine which directs it's update to a -particular server, ignoring what the DNS servers are the serving NS's? - -A: You might check out Michael Fuhr's Net::DNS Perl module, which you can -use to put together dynamic update requests. See -http://www.fuhr.net/~mfuhr/perldns/Update.html for additional information. -Michael posted a sample script to show how to use Net::DNS: - - #!/usr/local/bin/perl -w - use Net::DNS; - $res = new Net::DNS::Resolver; - $res->nameservers("some-nameserver.foo.com"); - $update = new Net::DNS::Update("foo.com"); - $update->push("update", rr_del("old-host.foo.com")); - $update->push("update", rr_add("new-host.foo.com A 10.1.2.3")); - $ans = $res->send($update); - print $ans ? $ans->header->rcode : $res->errorstring, "\n"; - -Additional information for Dynamic DNS updates may be found at -http://simmons.starkville.ms.us/tips/081797/. - ------------------------------------------------------------------------------ - -Question 2.25. What version of bind is running on a server ? - -Date: Mon Mar 9 22:15:11 EST 1998 - -On 4.9+ servers, you may obtain the version of bind running with the -following command: - -dig @server.to.query txt chaos version.bind. - -and optionally pipe that into 'grep VERSION'. Please note that this will -not work on an older nameserver. - ------------------------------------------------------------------------------ - -Question 2.26. BIND and Y2K - -Date: Thu Feb 11 14:58:04 EST 1999 - -Is the "Y2K" problem an issue for bind ? - -You will find the Internet Software Consortium's comment on the "Y2K" -issue at http://www.isc.org/y2k.html. - -=============================================================================== - -Section 3. UTILITIES - - Q3.1 Utilities to administer DNS zone files - Q3.2 DIG - Domain Internet Groper - Q3.3 DNS packet analyzer - Q3.4 host - Q3.5 How can I use DNS information in my program? - Q3.6 A source of information relating to DNS - ------------------------------------------------------------------------------ - -Question 3.1. Utilities to administer DNS zone files - -Date: Tue Jan 7 00:22:31 EST 1997 - -There are a few utilities available to ease the administration of zone -files in the DNS. - -Two common ones are h2n and makezones. Both are perl scripts. h2n is -used to convert host tables into zone data files. It is available for -anonymous ftp from - -ftp.uu.net : /published/oreilly/nutshell/dnsbind/dns.tar.Z - -makezones works from a single file that looks like a forward zone file, -with some additional syntax for special cases. It is included in the -current BIND distribution. The newest version is always available for -anonymous ftp from - -ftp.cus.cam.ac.uk : /pub/software/programs/DNS/makezones - -bpp is a m4 macro package for pre-processing the master files bind uses to -define zones. Information on this package may be found at -http://www.meme.com/soft. - -More information on various DNS related utilities may be found using the -DNS Resources Directory - -http://www.dns.net/dnsrd/. - ------------------------------------------------------------------------------ - -Question 3.2. DIG - Domain Internet Groper - -Date: Thu Dec 1 11:09:11 EST 1994 - -The latest and greatest, official, accept-no-substitutes version of the -Domain Internet Groper (DiG) is the one that comes with BIND. Get the -latest kit. - ------------------------------------------------------------------------------ - -Question 3.3. DNS packet analyzer - -Date: Mon Jun 15 21:42:11 EDT 1998 - -There is a free ethernet analyzer called Ethload available for PC's -running DOS. The latest filename is ETHLD200.ZIP. It understands lots of -protocols including TCP/UDP. It'll look inside there and display -DNS/BOOTP/ICMP packets etc. (Ed. note: something nice for someone to add -to tcpdump ;^) ). Depending on the ethernet controller it's given it'll -perform slightly differently. It handles NDIS/Novell/Packet drivers. It -works best with Novell's promiscuous mode drivers. The current home page -for Ethload is http://www.ping.be/ethload. - ------------------------------------------------------------------------------ - -Question 3.4. host - -Date: Thu Feb 11 14:43:39 EST 1999 - -A section from the host man page: - - host looks for information about Internet hosts and domain - names. It gets this information from a set of intercon- - nected servers that are spread across the world. The infor- - mation is stored in the form of "resource records" belonging - to hierarchically organized "zones". - - By default, the program simply converts between host names - and Internet addresses. However, with the -t, -a and -v - options, it can be used to find all of the information about - domain names that is maintained by the domain nameserver - system. The information printed consists of various fields - of the associated resource records that were retrieved. - - The arguments can be either host names (domain names) or - numeric Internet addresses. - -'host' is compatible with both BIND 4.9 and BIND 4.8 - -'host' may be found in contrib/host in the BIND distribution. The latest -version always available for anonymous ftp from - -ftp.nikhef.nl : /pub/network/host.tar.Z - -It may also be found for anonymous ftp from - -ftp.uu.net : /networking/ip/dns/host.tar.Z - -Programs with some of the functionality of host for NT may be found at -http://www.tucows.com under "Network Tools, DNS Lookup Utilities". - ------------------------------------------------------------------------------ - -Question 3.5. How can I use DNS information in my program? - -Date: Fri Feb 10 15:25:11 EST 1995 - -It depends on precisely what you want to do: - -* Consider whether you need to write a program at all. It may well be - easier to write a shell program (e.g. using awk or perl) to parse the - output of dig, host or nslookup. -* If all you need is names and addresses, there will probably be system - routines 'gethostbyname' and 'gethostbyaddr' to provide this - information. -* If you need more details, then there are system routines (res_query and - res_search) to assist with making and sending DNS queries. However, - these do not include a routine to parse the resulting answer (although - routines to assist in this task are provided). There is a separate - library available that will take a DNS response and unpick it into its - constituent parts, returning a C structure that can be used by the - program. The source for this library is available for anonymous ftp at - - hpux.csc.liv.ac.uk : /hpux/Networking/Admin/resparse-1.2 - ------------------------------------------------------------------------------ - -Question 3.6. A source of information relating to DNS - -Mon Jan 18 20:35:49 EST 1999 - -You may find utilities and tools to help you manage your zone files -(including WWW front-ends) in the "tools" section of the DNS resources -directory: - -http://www.dns.net/dnsrd/tools.html - -Two that come to mind are MIT's WebDNS and the University of Utah tools. - -There are also a number of commercial IP management tools available. Data -Communications had an article on the subject in Sept/Oct of 1996. The -tools mentioned in the article and a few others may be found at the -following sites: - -* IP Address management, http://www.accugraph.com -* IP-Track, http://www.on.com -* NetID, http://www.isotro.com -* QIP, http://www.quadritek.com -* UName-It, http://www.esm.com -* dnsboss, http://www.dnsboss.com - -=============================================================================== - -Section 4. DEFINITIONS - - Q4.1 TCP/IP Host Naming Conventions - Q4.2 What are slaves and forwarders ? - Q4.3 When is a server authoritative? - Q4.4 My server does not consider itself authoritative ! - Q4.5 NS records don't configure servers as authoritative ? - Q4.6 underscore in host-/domainnames - Q4.7 How do I turn the "_" check off ? - Q4.8 What is lame delegation ? - Q4.9 How can I see if the server is "lame" ? - Q4.10 What does opt-class field in a zone file do? - Q4.11 Top level domains - Q4.12 US Domain - Q4.13 Classes of networks - Q4.14 What is CIDR ? - Q4.15 What is the rule for glue ? - Q4.16 What is a stub record/directive ? - ------------------------------------------------------------------------------ - -Question 4.1. TCP/IP Host Naming Conventions - -Date: Mon Aug 5 22:49:46 EDT 1996 - -One guide that may be used when naming hosts is RFC 1178, "Choosing a Name -for Your Computer", which is available via anonymous FTP from - -ftp.internic.net : /rfc/rfc1178.txt - -RFCs (Request For Comments) are specifications and guidelines for how many -aspects of TCP/IP and the Internet (should) work. Most RFCs are fairly -technical documents, and some have semantics that are hotly contested in -the newsgroups. But a few, like RFC 1178, are actually good to read for -someone who's just starting along a TCP/IP path. - ------------------------------------------------------------------------------ - -Question 4.2. What are slaves and forwarders ? - -Date: Mon Jan 18 22:14:30 EST 1999 - -Parts of this section were contributed by Albert E. Whale. - -"forwarders" is a list of NS records that are _prepended_ to a list of NS -records to query if the data is not available locally. This allows a rich -cache of records to be built up at a centralized location. This is good -for sites that have sporadic or very slow connections to the Internet. -(demand dial-up, for example) It's also just a good idea for very large -distributed sites to increase the chance that you don't have to go off to -the Internet to get an IP address. (sometimes for addresses across the -street!) - -If you have a "forwarders" line, you will only consult the root servers if -you get no response from the forwarder. If you get a response, and it -says there's no such host, you'll return that answer to the client -- you -won't consult the root. - -The "forwarders" statement is found in the /etc/named.boot file which is -read each time DNS is started. The command format is as follows: - -forwarders <IP Address #1> [<IP Address #2>, .... <IP Address #n>] -The "forwarders" line specifies the IP Address(es) of DNS servers that -accept queries from other servers. - -The "forwarders" command is used to cause a large site wide cache to be -created on a master and reduce traffic over the network to other servers. -It can also be used to allow DNS servers to answer Internet name queries -which do not have direct access to the Internet. - -The forwarders command is used in conjunction with the traditional DNS -configuration which requires that a NS entry be found in the cache file. -The DNS server can support the forwarders command if the server is able to -resolve entries that are not part of the local server's cache. - -"slave" modifies this to say to replace the list of NS records with the -forwarders entry, instead of prepending to it. This is for firewalled -environments, where the nameserver can't directly get out to the Internet -at all. - -"slave" is meaningless (and invalid, in late-model BINDs) without -"forwarders". "forwarders" is an entry in named.boot, and therefore -applies only to the nameserver (not to resolvers). - -The "slave" command is usually found immediately following the forwarders -command in the boot file. It is normally used on machines that are -running DNS but do not have direct access to the Internet. By using the -"forwarders" and "slave" commands the server can contact another DNS -server which can answer DNS queries. The "slave" option may also be used -behind a firewall where there may not be a network path available to -directly contact nameservers listed in the cache. - -Additional information on slave servers may be found in the BOG (BIND -Operations Guide http://www.isc.org/bind.html) section 6.1.8 (Slave -Servers). - ------------------------------------------------------------------------------ - -Question 4.3. When is a server authoritative? - -Date: Mon Jan 2 13:15:13 EST 1995 - -In the case of BIND: - -* The server contains current data in files for the zone in question (Data - must be current for secondaries, as defined in the SOA) -* The server is told that it is authoritative for the zone, by a 'primary' - or 'secondary' keyword in /etc/named.boot. -* The server does an error-free load of the zone. - ------------------------------------------------------------------------------ - -Question 4.4. My server does not consider itself authoritative ! - -Date: Mon Jan 2 13:15:13 EST 1995 - -The question was: - - What if I have set up a DNS where there is an SOA record for - the domain, but the server still does not consider itself - authoritative. (when using nslookup and set server=the correct machine.) - It seems that something is not matching up somewhere. I suspect - that this is because the service provider has not given us control - over the IP numbers in our own domain, and so while the machine listed - has an A record for an address, there is no corresponding PTR record. - -With the answer: - - That's possible too, but is unrelated to the first question. - You need to be delegated a zone before outside people will start - talking to your server. However, a server can still be authoritative - for a zone even though it hasn't been delegated authority (it's just - that only the people who use that as their server will see the data). - - A server may consider itself non-authoritative even though it's a - primary if there is a syntax error in the zone (see the list in the - previous question). - ------------------------------------------------------------------------------ - -Question 4.5. NS records don't configure servers as authoritative ? - -Date: Fri Dec 6 16:13:34 EST 1996 - -Nope, delegation is a separate issue from authoritativeness. You can -still be authoritative, but not delegated. (you can also be delegated, -but not authoritative -- that's a "lame delegation") - ------------------------------------------------------------------------------ - -Question 4.6. underscore in host-/domainnames - -Date: Sat Aug 9 20:30:37 EDT 1997 - -The question is "Are underscores are allowed in host- or domainnames" ? - RFC 1033 allows them. - RFC 1035 doesn't. - RFC 1123 doesn't. - dnswalk complains about them. - - -Which RFC is the final authority these days? - -Actually RFC 1035 deals with names of machines or names of mail domains. -i.e "_" is not permitted in a hostname or on the RHS of the "@" in -local@domain. - -Underscore is permitted where ever the domain is NOT one of these types -of addresses. - -In general the DNS mostly contains hostnames and mail domainnames. This -will change as new resource record types for authenticating DNS queries -start to appear. - -The latest version of 'host' checks for illegal characters in A/MX record -names and the NS/MX target names. - -After saying all of that, remember that RFC 1123 is a Required Internet -Standard (per RFC 1720), and RFC 1033 isn't. Even RFC 1035 isn't a -required standard. Therefore, RFC 1123 wins, no contest. - -From RFC 1123, Section 2.1 - - 2.1 Host Names and Numbers - - The syntax of a legal Internet host name was specified in RFC-952 - [DNS:4]. One aspect of host name syntax is hereby changed: the - restriction on the first character is relaxed to allow either a - letter or a digit. Host software MUST support this more liberal - syntax. - - And described by Dave Barr in RFC1912: - - Allowable characters in a label for a host name are only ASCII - letters, digits, and the `-' character. Labels may not be all - numbers, but may have a leading digit (e.g., 3com.com). Labels must - end and begin only with a letter or digit. See [RFC 1035] and [RFC - 1123]. (Labels were initially restricted in [RFC 1035] to start with - a letter, and some older hosts still reportedly have problems with - the relaxation in [RFC 1123].) Note there are some Internet - hostnames which violate this rule (411.org, 1776.com). - - -Finally, one more piece of information (From Paul Vixie): - - RFC 1034 says only that domain names have characters in them, though it - says so with enough fancy and indirection that it's hard to tell exactly. - - Generally, for second level domains (i.e., something you would get from - InterNIC or from the US Domain Registrar and probably other ISO 3166 - country code TLDs), RFC 952 is thought to apply. RFC 952 was about host - names rather than domain names, but the rules seemed good enough. - - <domainname> ::= <hname> - - <hname> ::= <name>*["."<name>] - <name> ::= <let>[*[<let-or-digit-or-hyphen>]<let-or-digit>] - -There has been a recent update on this subject which may be found in - -ftp.internic.net : /internet-drafts/draft-andrews-dns-hostnames-03.txt. - -An RFC Internet standards track protocol on the subject "Clarifications to -the DNS Specification" may be found in RFC 2181. This updates RFC 1034, -RFC 1035, and RFC 1123. - ------------------------------------------------------------------------------ - -Question 4.7. How do I turn the "_" check off ? - -Date: Mon Nov 10 22:54:54 EST 1997 - -In the 4.9.5-REL and greater, you may turn this feature off with the -option "check-names" in the named boot file. This option is documented -in the named manual page. The syntax is: - - check-names primary warn - ------------------------------------------------------------------------------ - -Question 4.8. What is lame delegation ? - -Date: Tue Mar 11 21:51:21 EST 1997 - -Two things are required for a lame delegation: - -* A nameserver X is delegated as authoritative for a zone. -* Nameserver X is not performing nameservice for that zone. - -Try to think of a lame delegation as a long-term condition, brought about -by a misconfiguration somewhere. Bryan Beecher's 1992 LISA paper on lame -delegations is good to read on this. The problem really lies in -misconfigured nameservers, not "lameness" brought about by transient -outages. The latter is common on the Internet and hard to avoid, while -the former is correctable. - -In order to be performing nameservice for a zone, it must have (presumed -correct) data for that zone, and it must be answering authoritatively to -resolver queries for that zone. (The AA bit is set in the flags section) - -The "classic" lame delegation case is when nameserver X is delegated as -authoritative for domain Y, yet when you ask X about Y, it returns -non-authoritative data. - -Here's an example that shows what happens most often (using dig, dnswalk, -and doc to find). - -Let's say the domain bogus.com gets registered at the NIC and they have -listed 2 primary name servers, both from their *upstream* provider: - - bogus.com IN NS ns.bogus.com - bogus.com IN NS upstream.com - bogus.com IN NS upstream1.com - -So the root servers have this info. But when the admins at bogus.com -actually set up their zone files they put something like: - - bogus.com IN NS upstream.com - bogus.com IN NS upstream1.com - -So your name server may have the nameserver info cached (which it may have -gotten from the root). The root says "go ask ns.bogus.com" since they are -authoritative - -This is usually from stuff being registered at the NIC (either nic.ddn.mil -or rs.internic.net), and then updated later, but the folks who make the -updates later never let the folks at the NIC know about it. - ------------------------------------------------------------------------------ - -Question 4.9. How can I see if the server is "lame" ? - -Date: Mon Sep 14 22:09:35 EDT 1998 - -Go to the authoritative servers one level up, and ask them who they think -is authoritative, and then go ask each one of those delegees if they think -that they themselves are authoritative. If any responds "no", then you -know who the lame delegation is, and who is delegating lamely to them. -You can then send off a message to the administrators of the level above. - -The 'lamers' script from Byran Beecher really takes care of all this for -you. It parses the lame delegation notices from BIND's syslog and -summarizes them for you. It may be found in the contrib section of the -latest BIND distribution. The latest version is included in the BIND -distribution. - -If you want to actively check for lame delegations, you can use 'doc' and -'dnswalk'. You can check things manually with 'dig'. - -The InterNIC recently announced a new lame delegation that will be in -effect on 01 October, 1996. Here is a summary: - -* After receipt/processing of a name registration template, and at random - intervals thereafter, the InterNIC will perform a DNS query via UDP - Port 53 on domain names for an SOA response for the name being - registered. -* If the query of the domain name returns a non-authoritative response - from all the listed name servers, the query will be repeated four times - over the next 30 days at random intervals approximately 7 days apart, - with notification to all listed whois and nameserver contacts of the - possible pending deletion. If at least one server answers correctly, - but one or more are lame, FYI notifications will be sent to all contacts - and checking will be discontinued. Additionally, e-mail notices will be - provided to the contact for the name servers holding the delegation to - alert them to the "lame" condition. Notifications will state explicitly - the consequences of not correcting the "lame" condition and will be - assigned a descriptive subject as follows: - - Subject: Lame Delegation Notice: DOMAIN_NAME - - The notification will include a timestamp for when the query was - performed. -* If, following 30 days, the name servers still provide no SOA response, - the name will be placed in a "hold" status and the DNS information will - no longer be propagated. The administrative contact will be notified by - postal mail and all whois contacts will be notified by e-mail, with - instructions for taking corrective action. -* Following 60 days in a "hold" status, the name will be deleted and made - available for re-registration. Notification of the final deletion will - be sent to the name server and domain name contacts listed in the NIC - database. - ------------------------------------------------------------------------------ - -Question 4.10. What does opt-class field in a zone file do? - -Date: Thu Dec 1 11:10:39 EST 1994 - -This field is the address class. From the BOG - - - ...is the address class; currently, only one class - is supported: IN for internet addresses and other - internet information. Limited support is included for - the HS class, which is for MIT/Athena ``Hesiod'' - information. - ------------------------------------------------------------------------------ - -Question 4.11. Top level domains - -Date: Mon Jun 15 22:25:57 EDT 1998 - -RFC 1591 defines the term "Top Level Domain" (TLD) as: - - - 2. The Top Level Structure of the Domain Names - - In the Domain Name System (DNS) naming of computers there is a - hierarchy of names. The root of system is unnamed. There are a set - of what are called "top-level domain names" (TLDs). These are the - generic TLDs (EDU, COM, NET, ORG, GOV, MIL, and INT), and the two - letter country codes from ISO-3166. It is extremely unlikely that - any other TLDs will be created. - -The unnamed root-level domain (usually denoted as ".") is currently being -maintained by the Internet Assigned Number Authority (IANA). Beside that, -IANA is currently in charge for some other vital functions on the Internet -today, including global distribution of address space, autonomous system -numbers and all other similar numerical constants, necessary for proper -TCP/IP protocol stack operation (e.g. port numbers, protocol identifiers -and so on). According to the recent proposals of the US Government, better -known as "Green Paper": - -http://www.ntia.doc.gov/ntiahome/domainname/domainname130.htm - -IANA will gradually transfer its current functions to a new non-profit -international organization, which won't be influenced exclusively by the -US Government. This transfer will occur upon the final version of the -"Green Paper" has been issued. - -Currently, the root zone contains five categories of top level domains: - - -(1) World wide gTLDs - maintained by the InterNIC: - - COM - Intended for commercial entities - companies, corporations etc. - - NET - Intended for Internet service providers and similar entities. - - ORG - Intended for other organizations, which don't fit to the above. - -(2) Special status gTLDs - - EDU - Restricted to 4 year colleges and universities only. - - INT - Intended for international treaties and infrastructural databases. - -(3) US restricted gTLDs - - GOV - Intended for US Government offices and agencies. - - MIL - Intended for the US military. - -(4) ISO 3166 country code TLDs (ccTLDs) - FR, CH, SE etc. - -(5) Reverse TLD - IN-ADDR.ARPA. - -Generic TLDs COM, NET, ORG and EDU are currently being maintained by the -InterNIC. IANA maintains INT and IN-ADDR.ARPA. The US Government and US -Army maintain their TLDs independently. - -The application form for the EDU, COM, NET, ORG, and GOV domains may be -found for anonymous ftp from: - -internic.net : /templates/domain-template.txt - -The country code domains (ISO 3166 based - example, FR, NL, KR, US) are -each organized by an administrator for that country. These administrators -may further delegate the management of portions of the naming tree. These -administrators are performing a public service on behalf of the Internet -community. The ISO-3166 country codes may be found for anonymous ftp -from: - -* ftp.isi.edu : /in-notes/iana/assignments/country-codes -* ftp.ripe.net : /iso3166-codes - -More information about particular country code TLDs may be found at: - -* http://www.iana.org/ -* http://www.UNINETT.NO/navn/domreg.html -* http://www.ripe.net/centr/tld.html -* http://www.nic.fr/Guides/AutresNics/ -* sipb.mit.edu : /pub/whois/whois-servers.list - -Contrary to the initial plans, stated in the RFC 1591, not to include -more TLDs in the near future, some other forums don't share that opinion. - -The International Ad Hoc Committee (IAHC) ({http://www.iahc.org/) was was -selected by the IAB, IANA, ITU, INTA, WIPO, and ISOC to study and -recommend changes to the existing Domain Name System (DNS). The IAHC -recommended the following regarding TLD's on February 4, 1997: - - In order to cope with the great and growing demand for Internet - addresses in the generic top level domains, the generic Top Level - Domain (gTLD) MoU calls for the establishment of seven new gTLDs in - addition to the existing three. These will be .FIRM, .STORE, .WEB, - .ARTS, .REC, .NOM and .INFO. In addition, the MoU provides for the - setting up of an initial 28 new registrars around the world four - from each of seven world regions. More registrars will be added as - operational and administrative issues are worked out. Registrars - will compete on a global basis, and users will be able shop around - for the registrar which offers them the best arrangement and price. - Users will also be able to change registrar at any time while - retaining the same domain address, thus ensuring global portability. - -The full text of the recommendation may be found at: - -http://www.iahc.org/draft-iahc-recommend-00.html. - -Beside IAHC, several other forums have been created, by people willing to -change the current addressing structure in the global network. Some of -them may be found at: - -* http://www.alternic.net/ -* http://www.eu.org/ -* http://www.webtld.com/ - -You may participate in one of the discussions on iTLD proposals at - -* To sign up: http://www.newdom.com/lists -* Old postings: http://www.newdom.com/archive - ------------------------------------------------------------------------------ - -Question 4.12. US Domain - -Date: Mon Jun 15 22:25:57 EDT 1998 - -Information on the US domain registration services may be found at -http://www.isi.edu/in-notes/usdnr/. - -The application form for the US domain may be found: - -* for anonymous ftp from internic.net : /templates/us-domain-template.txt -* http://www.isi.edu/us-domain/ - -A WWW interface to a whois server for the US domain may be found at -http://www.isi.edu/in-notes/usdnr/rwhois.html. This whois server may be -used with the command - % whois -h nii-server.isi.edu k12.ks.us - OR - % whois k12.ks.us@nii-server.isi.edu - (depending on your version of whois). - - ------------------------------------------------------------------------------ - -Question 4.13. Classes of networks - -Date: Sun Feb 9 22:36:21 EST 1997 - -The usage of 'classes of networks' (class A, B, C) are historical and have -been replaced by CIDR blocks on the Internet. That being said... - -An Internet Protocol (IP) address is 32 bit in length, divided into two -or three parts (the network address, the subnet address (if present), and -the host address. The subnet addresses are only present if the network -has been divided into subnetworks. The length of the network, subnet, and -host field are all variable. - -There are five different network classes. The leftmost bits indicate the -class of the network. - - # of # of - bits in bits in - network host -Class field field Internet Protocol address in binary Ranges -============================================================================ - A 7 24 0NNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH 1-127.x.x.x - B 14 16 10NNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH 128-191.x.x.x - C 21 8 110NNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH 192-223.x.x.x - D NOTE 1 1110xxxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 224-239.x.x.x - E NOTE 2 11110xxx.xxxxxxxx.xxxxxxxx.xxxxxxxx 240-247.x.x.x - - where N represents part of the network address and H represents part of - the host address. When the subnet address is defined, the needed bits - are assigned from the host address space. - - NOTE 1: Reserved for multicast groups - RFC 1112 - NOTE 2: Reserved for future use - - 127.0.0.1 is reserved for local loopback. - ------------------------------------------------------------------------------ - -Question 4.14. What is CIDR ? - -Date: Tue Nov 5 23:47:29 EST 1996 - -CIDR is "Classless Inter-Domain Routing (CIDR). From RFC 1517: - - ...Classless Inter-Domain Routing (CIDR) attempts to deal with - these problems by defining a mechanism to slow the growth of - routing tables and reduce the need to allocate new IP network - numbers. - -Much more information may be obtained in RFCs 1467, 1517, 1518, 1520; -with primary reference 1519. - -Also please see the CIDR FAQ at - -* http://www.ibm.net.il/~hank/cidr.html -* http://www.rain.net/faqs/cidr.faq.html -* http://www.lab.unisource.ch/services/internet/direct/cidr.html - ------------------------------------------------------------------------------ - -Question 4.15. What is the rule for glue ? - -Date: Mon Sep 14 22:04:42 EDT 1998 - -A glue record is an A record for a name that appears on the right-hand -side of a NS record. So, if you have this: - - - sub.foobar.com. IN NS dns.sub.foobar.com. - dns.sub.foobar.com. IN A 1.2.3.4 - -then the second record is a glue record (for the NS record above it). - -You need glue records when -- and only when -- you are delegating -authority to a nameserver that "lives" in the domain you are delegating -*and* you aren't a secondary server for that domain. - -In other words, in the example above, you need to add an A record for -dns.sub.foobar.com since it "lives" in the domain it serves. This boot -strapping information is necessary: How are you supposed to find out the -IP address of the nameserver for domain FOO if the nameserver for FOO -"lives" in FOO? - -If you have this NS record: - - sub.foobar.com. IN NS dns.xyz123.com. - -you do NOT need a glue record, and, in fact, adding one is a very bad -idea. If you add one, and then the folks at xyz123.com change the -address, then you will be passing out incorrect data. - -Also, unless you actually have a machine called something.IN-ADDR.ARPA, -you will never have any glue records present in any of your "reverse" -files. - -There is also a sort of implicit glue record that can be useful (or -confusing :^) ). If the parent server (abc.foobar.com domain in example -above) is a secondary server for the child, then the A record will be -fetched from the child server when the zone transfer is done. The glue is -still there but it's a little different, it's in the ip address in the -named.boot line instead of explicitly in the data. In this case you can -leave out the explicit glue A record and leave the manually configured -"glue" in just the one place in the named.boot file. - -RFC 1537 says it quite nicely: - - 2. Glue records - - Quite often, people put unnecessary glue (A) records in their - zone files. Even worse is that I've even seen *wrong* glue records - for an external host in a primary zone file! Glue records need only - be in a zone file if the server host is within the zone and there - is no A record for that host elsewhere in the zone file. - - Old BIND versions ("native" 4.8.3 and older versions) showed the - problem that wrong glue records could enter secondary servers in - a zone transfer. - -In response to a question on glue records, Mark Andrews stated the -following: - - BIND's current position is somewhere between the overly restrictive - position given above and the general allow all glue position that - prevailed in 4.8.x. - - BIND's current break point is below the *parent* zone, i.e. it - allows glue records from sibling zones of the zone being - delegated. - - The following applies for glue - - Below child: always required - Below parent: often required - Elsewhere: seldom required - - The main reason for resticting glue is not that it in not - required but that it is impossible to track down *bad* glue if - you allow glue that falls into "elsewhere". Ask UUNET or any - other large provider the problems that BIND 4.8.x general glue - rules caused. If you want to examine a true data virus you need - only look at the A records for ns.uu.net. - - The "below parent" and "below child" both allow you to find bad - glue records. Below the parent has a bigger search space to that - of below the child but is still managable. - - It is believed that the elsewhere cases are sufficiently rare - that they can be ignored in practice and if detected can be worked - around by creating be creating A records for the nameservers - that fall into one of the other two cases. This requires - resolvers to correctly lookup missing glue and requery when they - have this glue. BIND does *not* do this correctly at present. ------------------------------------------------------------------------------ - -Question 4.16. What is a stub record/directive ? - -Date: Mon Nov 10 22:45:33 EST 1997 - -Q: What is the difference, or advantages, of using a stub record versus -using an NS record and a glue record in the zone file? - -Cricket Liu responds, - - "Stub" is a directive, not a record (well, it's a directive in BIND 4; -in BIND 8, it's an option to the "zone" statement). The stub directive -configures your name server to do a zone transfer just as a secondary -master name server would, but to use just the NS records. It's a -convenient way for a parent name server to keep track of the servers -for subzones. - -and Barry Margolin adds, - - Using stub records ensures that the NS records in the parent will be -consistent with the NS records in the child. If you have to enter NS -records manually, you run the possibility that the child will change his -servers without telling you. Then you'll give out incorrect delegation -information, possibly resulting in the infamous "lame delegation". - - -The remainder of the FAQ is in the next part (Part 2 of 2). - diff --git a/contrib/bind/doc/misc/FAQ.2of2 b/contrib/bind/doc/misc/FAQ.2of2 deleted file mode 100644 index f9594ee..0000000 --- a/contrib/bind/doc/misc/FAQ.2of2 +++ /dev/null @@ -1,2071 +0,0 @@ -Path: senator-bedfellow.mit.edu!bloom-beacon.mit.edu!news.kodak.com!news-nysernet-16.sprintlink.net!news-in-east1.sprintlink.net!news.sprintlink.net!newshub.northeast.verio.net!news.idt.net!newsin.iconnet.net!IConNet!not-for-mail -From: cdp2582@hertz.njit.edu (Chris Peckham) -Newsgroups: comp.protocols.tcp-ip.domains,comp.answers,news.answers,comp.protocols.dns.bind -Subject: comp.protocols.tcp-ip.domains Frequently Asked Questions (FAQ) (Part 2 of 2) -Supersedes: <cptd-faq-2-911181667@njit.edu> -Followup-To: comp.protocols.tcp-ip.domains -Organization: NJIT.EDU - New Jersey Institute of Technology, Newark, NJ, USA -Lines: 2050 -Sender: cdp@chipmunk.iconnet.net -Approved: news-answers-request@MIT.EDU -Distribution: world -Expires: Wednesday, 20 Jan 99 11:47:26 EDT -Message-ID: <cptd-faq-2-913826846@njit.edu> -References: <cptd-faq-1-913826846@njit.edu> -Reply-To: domain-faq@pfmc.net (comp.protocols.tcp-ip.domains FAQ comments) -Keywords: BIND,DOMAIN,DNS -X-Posting-Frequency: posted during the first week of each month -Date: Wed, 16 Dec 1998 16:47:32 GMT -NNTP-Posting-Host: chipmunk.iconnet.net -NNTP-Posting-Date: Wed, 16 Dec 1998 11:47:32 EDT -Xref: senator-bedfellow.mit.edu comp.protocols.tcp-ip.domains:22180 comp.answers:34269 news.answers:146737 comp.protocols.dns.bind:6040 - -Posted-By: auto-faq 3.3 beta (Perl 5.004) -Archive-name: internet/tcp-ip/domains-faq/part2 - -(Continued from Part 1, where you'll find the introduction and -table of contents.) - - -=============================================================================== - -Section 5. CONFIGURATION - - Q5.1 Upgrading from 4.9.x to 8.x - Q5.2 Changing a Secondary server to a Primary server ? - Q5.3 Moving a Primary server to another server - Q5.4 How do I subnet a Class B Address ? - Q5.5 Subnetted domain name service - Q5.6 Recommended format/style of DNS files - Q5.7 DNS on a system not connected to the Internet - Q5.8 Multiple Domain configuration - Q5.9 wildcard MX records - Q5.10 How do you identify a wildcard MX record ? - Q5.11 Why are fully qualified domain names recommended ? - Q5.12 Distributing load using named - Q5.13 Round robin IS NOT load balancing - Q5.14 Order of returned records - Q5.15 resolv.conf - Q5.16 How do I delegate authority for sub-domains ? - Q5.17 DNS instead of NIS on a Sun OS 4.1.x system - Q5.18 Patches to add functionality to BIND - Q5.19 How to serve multiple domains from one server - Q5.20 hostname and domain name the same - Q5.21 Restricting zone transfers - Q5.22 DNS in firewalled and private networks - Q5.23 Different DNS answers for same RR - ------------------------------------------------------------------------------ - -Question 5.1. Upgrading from 4.9.x to 8.x - -Date: Wed Jul 9 22:00:07 EDT 1997 - -Q: Help ! How do I use the Completely new configuration syntax in BIND 8 -? I've attempted to upgrade bind from 4.9.5 to 8.1, but unfortunately it -didn't seem to like the same config/zone files.. is this normal or should -8.1 be able to read the same files as 4.9.5 did? - -A: If you then look in doc/html/config.html, you will find directions on -how to convert a 4.9.x .boot file to 8.x .conf file, as well as directions -on how to utilize all of the new features of the 8.x .conf file format. - ------------------------------------------------------------------------------ - -Question 5.2. Changing a Secondary server to a Primary server ? - -Date: Fri Jul 5 23:54:35 EDT 1996 - -For 4.8.3, it's prudent to kill and restart following any changes to -named.boot. - -In BIND 4.9.3, you only have to kill and restart named if you change a -primary zone to a secondary or v-v, or if you delete a zone and remain -authoritative for its parent. Every other case should be taken care of by -a HUP. (Ed. note: 4.9.3b9 may still require you to kill and restart the -server due to some bugs in the HUP code). - -You will also need to update the server information on the root servers. -You can do this by filing a new domain registration form to inform -InterNIC of the change. They will then update the root server's SOA -records. This process usually takes 10-12 business days after they -receive the request. - ------------------------------------------------------------------------------ - -Question 5.3. Moving a Primary server to another server - -Date: Fri Jul 5 23:54:35 EDT 1996 - -The usual solution is to move the primary to ns.newserver.com, and have -ns.oldserver.com be configured as a secondary server until the change to -the root servers takes place after the request has been made to the -InterNIC. - -If you are moving to a different ISP which will change your IP's, the -recommend setting for the SOA that would minimize problems for your name -servers using the old settings can be done as follows: - -Gradually lower the TTL value in your SOA (that's the last one of the five -numbers) to always be equal to the time left until you change over. -(assuming that none of your resource records have individual TTL's set, if -so, do likewise with them.) So, the day before, lower to 43200 seconds -(12 hours). Then lower every few hours to be the time remaining until -the change-over. So, an hour before the change, you may just want to -lower it all the way to 60 seconds or so. That way no one can cache -information past the change-over. - -After the change, start gradually incrementing the TTL value, because -you'll probably be making changes to work out problems. Once everything -stabilizes, move the TTL up to whatever your normal values are. - -To minimize name servers from using the "old settings", you can do the -same thing with the "refresh" interval in the SOA (the second number of -the SOA). That will tell the secondaries to refresh every X seconds. -Lower that value as you approach the changeover date. You probably don't -want to go much below an hour or you'll start the primary thrashing as all -the secondaries perpetually refresh. - -Also see the answer to the "How can I change the IP address of our server -?" in the INTRODUCTION section. - ------------------------------------------------------------------------------ - -Question 5.4. How do I subnet a Class B Address ? - -Date: Mon Jun 15 23:21:39 EDT 1998 - -That you need to subnet at all is something of a misconception. You can -also think of a class B network as giving you 65,534 individual hosts, and -such a network will work. You can also configure your class B as 16,384 -networks of 2 hosts each. That's obviously not very practical, but it -needs to be made clear that you are not constrained by the size of an -octet (remember that many older devices would not work in a network -configured in this manner). - -So, the question is: why do you need to subnet? One reason is that it is -easier to manage a subnetted network, and in fact, you can delegate the -responsibility for address space management to local administrators on the -various subnets. Also, IP based problems will end up localized rather -than affecting your entire network. - -If your network is a large backbone with numerous segments individually -branching off the backbone, that too suggests subnetting. - -Subnetting can also be used to improve routing conditions. - -You may wish to partition your network to disallow certain protocols on -certain segments of your net. You can, for example, restrict IP or IPX to -certain segments only by adding a router routing high level protocols, -and across the router you may have to subnet. - -Finally, as far as how many subnets you need depends on the answer to the -above question. As far as subnet masks are concerned, the mask can be -anything from 255.0.0.0 to 255.255.255.252. You'll probably be looking at -9 or 10 bits for the subnet (last octet 128 or 192 respectively). RFC -1219 discusses the issue of subnetting very well and leaves the network -administrator with a large amount of flexibility for future growth. - -(The following section was contributed by Berislav Todorovic.) - -A user or an ISP, having a whole /16 sized IP block (former "Class B") -network assigned/allocated, has the responsibility of maintaining the -reverse domain for the whole network. That policy is currently applied by -all regional Internet registries (RIPE NCC, ARIN, APNIC). In other words, -if you're assigned a whole "B class" (say, 10.91/16), you're in charge for -the whole 91.10.IN-ADDR.ARPA zone. This zone may be organized using two -methods, according to the network topology being in use. - -The first, "brute force" method is to place all PTR records directly into -a single zone file. Example: - - $origin 91.10.in-addr.arpa - @ IN SOA (usual stuff) - IN NS ns1.mydomain.com. - IN NS ns2.mydomain.com. - - 1.1 IN PTR one-1.mydomain.com. ; ---> 10.91.1.1 - 2.1 IN PTR one-2.mydomain.com. ; ---> 10.91.1.2 - ... - 254.1 IN PTR one-254.mydomain.com. ; ---> 10.91.1.254 - 1.2 IN PTR two-1.mydomain.com. ; ---> 10.91.2.1 - -While this approach may look simple in the networks with a central -management authority (say, campus networks), maintaining such a zone file -becomes more and more difficult in the more complex environment. Thus, -this becomes a bad method. Furthermore, if you're an ISP, it is more -likely that a /16 network will be subnetted and its subnets be assigned to -your customers. - -Therefore, another "smarter" approach is to delegate portions of the -reverse domain 91.10.IN-ADDR.ARPA to the end users of the subnets of -10.91/16. There would only be NS records in the zone file, while PTR -record insertion would be the responsibility of the end users. For -example, if you assign: - - * 10.91.0.0/22 (10.91.0.0 - 10.91.3.255) to Customer-A.COM - * 10.91.4.0/23 (10.91.4.0 - 10.91.5.255) to Customer-B.COM - * 10.91.7.0/24 (10.91.7.0 - 10.91.7.255) to Customer-C.COM - -then each customer will maintain zone files for the reverse domains of -their own networks (say, Customer C will maintain the zone -7.91.10.IN-ADDR.ARPA, customer B their 2 zones, Customer A their own 4 -zones). In this constellation, the zone file for reverse domain -91.10.IN-ADDR.ARPA will look like this: - - $origin 91.10.in-addr.arpa - @ IN SOA (usual stuff) - IN NS ns1.mydomain.com. - IN NS ns2.mydomain.com. - - ; --- Customer-A.COM - - - 0 IN NS ns.customer-A.com. - IN NS ns1.mydomain.com. - 1 IN NS ns.customer-A.com. - IN NS ns1.mydomain.com. - 2 IN NS ns.customer-A.com. - IN NS ns1.mydomain.com. - 3 IN NS ns.customer-A.com. - IN NS ns1.mydomain.com. - - ; --- Customer-B.COM - - 4 IN NS ns.customer-B.com. - IN NS ns1.mydomain.com. - 5 IN NS ns.customer-B.com. - IN NS ns1.mydomain.com. - - ; --- Customer-C.COM - - 7 IN NS ns.customer-C.com. - IN NS ns1.mydomain.com. - -The zone file of the Customer C reverse domain would look like this: - - $origin 7.91.10.in-addr.arpa - @ IN SOA (usual stuff) - IN NS ns.customer-C.com. - IN NS ns1.mydomain.com. - - 1 IN PTR one.customer-C.com. - 2 IN PTR two.customer-C.com. - 3 IN PTR three.customer-C.com. - ... - ------------------------------------------------------------------------------ - -Question 5.5. Subnetted domain name service - -Date: Thu Jul 16 10:50:41 EDT 1998 - -If you are looking for some examples of handling subnetted class C -networks as separate DNS domains, see RFC 2317 for more information. - -Details follow- You need to delegate down to the fourth octet, so you will -have one domain per IP address ! Here is how you can subdelegate a -in-addr.arpa address for non-byte aligned subnet masks: - -Take as an example the net 192.1.1.x, and example subnet mask -255.255.255.240. - -We first define the domain for the class C net, - - $origin 1.1.192.in-addr.arpa - @ SOA (usual stuff) - @ ns some.nameserver - ns some.other.nameserver - ; delegate a subdomain - one ns one.nameserver - ns some.nameserver - ; delegate another - two ns two.nameserver - ns some.nameserver - ; CNAME pointers to subdomain one - 0 CNAME 0.one - 1 CNAME 1.one - ; through - 15 CNAME 15.one - ; CNAME pointers to subdomain two - 16 CNAME 16.two - 17 CNAME 17.two - 31 CNAME 31.two - ; CNAME as many as required. - -Now, in the delegated nameserver, one.nameserver - - $origin one.1.1.192.in-addr.arpa - @ SOA (usual stuff) - NS one.nameserver - NS some.nameserver ; secondary for us - 0 PTR onenet.one.domain - 1 PTR onehost.one.domain - ; through - 15 PTR lasthost.one.domain - -And similar for the two.1.1.192.in-addr.arpa delegated domain. - -There is additional documentation and a perl script that may be used for -this purpose available for anonymous ftp from: - -ftp.is.co.za : /networking/ip/dns/gencidrzone/gencidrzone - ------------------------------------------------------------------------------ - -Question 5.6. Recommended format/style of DNS files - -Date: Sun Nov 27 23:32:41 EST 1994 - -This answer is quoted from an article posted by Paul Vixie: - - I've gone back and forth on the question of whether the BOG should - include a section on this topic. I know what I myself prefer, but - I'm wary of ramming my own stylistic preferences down the throat of - every BOG reader. But since you ask :-)... - - Create /var/named. If your system is too old to have a /var, either - create one or use /usr/local/adm/named instead. Put your named.boot - in it, and make /etc/named.boot a symlink to it. If your system - doesn't have symlinks, you're S-O-L (but you knew that). In - named.boot, put a "directory" directive that specifies your actual - BIND working directory: - - directory /var/named - - All relative pathnames used in "primary", "secondary", and "cache" - directives will be evaluated relative to this directory. Create two - subdirectories, /var/named/pri and /var/named/sec. Whenever you add - a "primary" directive to your named.boot, use "pri/WHATEVER" as the - path name. And then put the primary zone file into "pri/WHATEVER". - Likewise when you add "secondary" directives, use "sec/WHATEVER" and - BIND (really named-xfer) will create the files in that - subdirectory. - - (Variations: (1) make a midlevel directory "zones" and put "pri" and - "sec" into it; (2) if you tend to pick up a lot of secondaries from - a few hosts, group them together in their own subdirectories -- - something like /var/named/zones/uucp if you're a UUCP Project name - server.) - - For your forward files, name them after the zone. dec.com becomes - "/var/named/zones/pri/dec.com". For your reverse files, name them - after the network number. 0.1.16.in-addr.arpa becomes - "/var/named/zones/pri/16.1.0". - - When creating or maintaining primary zone files, try to use the same - SOA values everywhere, except for the serial number which varies per - zone. Put a $ORIGIN directive at the top of the primary zone file, - not because its needed (it's not since the default origin is the - zone named in the "primary" directive) but because it make it easier - to remember what you're working on when you have a lot of primary - zones. Put some comments up there indicating contact information - for the real owner if you're proxying. Use RCS and put the "Id" - in a ";" comment near the top of the zone file. - - The SOA and other top level information should all be listed - together. But don't put IN on every line, it defaults nicely. For - example: - -============== -@ IN SOA gw.home.vix.com. postmaster.vix.com. ( - 1994082501 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 mins) - 604800 ; expire (7 days) - 3600 ) ; minimum (1 hour) - - NS gw.home.vix.com. - NS ns.uu.net. - NS uucp-gw-1.pa.dec.com. - NS uucp-gw-2.pa.dec.com. - - MX 10 gw.home.vix.com. - MX 20 uucp-gw-1.pa.dec.com. - MX 20 uucp-gw-1.pa.dec.com. -============== - - I don't necessarily recommend those SOA values. Not every zone is - as volatile as the example shown. I do recommend that serial number - format; it's in date format with a 2-digit per-day revision number. - This format will last us until 2147 A.D. at which point I expect a - better solution will have been found :-). (Note that it would last - until 4294 A.D. except that there are some old BINDs out there that - use a signed quantity for representing serial number internally; I - suppose that as long as none of these are still running after 2047 - A.D., that we can use the above serial number format until 4294 - A.D., at which point a better solution will HAVE to be found.) - - You'll note that I use a tab stop for "IN" even though I never again - specify it. This leaves room for names longer than 7 bytes without - messing up the columns. You might also note that I've put the MX - priority and destination in the same tab stop; this is because both - are part of the RRdata and both are very different from MX which is - an RRtype. Some folks seem to prefer to group "MX" and the priority - together in one tab stop. While this looks neat it's very confusing - to newcomers and for them it violates the law of least - astonishment. - - If you have a multi-level zone (one which contains names that have - dots in them), you can use additional $ORIGIN statements but I - recommend against it since there is no "back" operator. That is, - given the above example you can add: - -============= -$ORIGIN home -gw A 192.5.5.1 -============= - - The problem with this is that subsequent RR's had better be - somewhere under the "home.vix.com" name or else the $ORIGIN that - introduces them will have to use a fully qualified name. FQDN - $ORIGIN's aren't bad and I won't be mad if you use them. - Unqualified ones as shown above are real trouble. I usually stay - away from them and just put the whole name in: - -============= -gw.home A 192.5.5.1 -============= - - In your reverse zones, you're usually in some good luck because the - owner name is usually a single short token or sometimes two. - -============= -$ORIGIN 5.5.192.in-addr.arpa. -@ IN SOA ... - NS ... -1 PTR gw.home.vix.com. -========================================= -$ORIGIN 1.16.in-addr.arpa. -@ IN SOA ... - NS ... -2.0 PTR gatekeeper.dec.com. -============= - - It is usually pretty hard to keep your forward and reverse zones in - sync. You can avoid that whole problem by just using "h2n" (see - the ORA book, DNS and BIND, and its sample toolkit, included in the - BIND distribution or on ftp.uu.net (use the QUOTE SITE EXEC INDEX - command there to find this -- I never can remember where it's at). - "h2n" and many tools like it can just read your old /etc/hosts file - and churn it into DNS zone files. (May I recommend - contrib/decwrl/mkdb.pl from the BIND distribution?) However, if you - (like me) prefer to edit these things by hand, you need to follow - the simple convention of making all of your holes consistent. If - you use 192.5.5.1 and 192.5.5.3 but not (yet) 192.5.5.2, then in - your forward file you will have something like - -============= -... -gw.home A 192.5.5.1 -;avail A 192.5.5.2 -pc.home A 192.5.5.3 -============= - - and in your reverse file you will have something like - -============= -... -1 PTR gw.home.vix.com. -;2 PTR avail -3 PTR pc.home.vix.com. -============= - - This convention will allow you to keep your sanity and make fewer - errors. Any kind of automation (h2n, mkdb, or your own - perl/tcl/awk/python tools) will help you maintain a consistent - universe even if it's also a complex one. Editing by hand doesn't - have to be deadly but you MUST take care. - ------------------------------------------------------------------------------ - -Question 5.7. DNS on a system not connected to the Internet - -Date: Sun Nov 27 23:32:41 EST 1994 - -You need to create your own root domain name server until you connect to -the internet. Your roots need to delegate to mydomain.com and any -in-addr.arpa subdomains you might have, and that's about it. As soon as -you're connected, rip out the fake roots and use the real ones. - -It does not actually have to be another server pretending to be the root. -You can set up the name server so that it is primary for each domain above -you and leave them empty (i.e. you are foo.bar.com - claim to be primary -for bar.com and com) - -If you connect intermittently and want DNS to work when you are connected, -and "fail" when you are not, you can point the resolver at the name server -at the remote site and if the connection (SLIP/PPP) isn't up, the resolver -doesn't have a route to the remote server and since there's only one name -server in resolv.conf, the resolver quickly backs off the using -/etc/hosts. No problem. You could do the same with multiple name server -and a resolver that did configurable /etc/hosts fallback. - ------------------------------------------------------------------------------ - -Question 5.8. Multiple Domain configuration - -Date: Fri Dec 2 15:40:49 EST 1994 - -If you want to have multiple domain names pointing to the same -destination, such as: - - ftp ftp.biff.com connects user to -> ftp.biff.com - ftp ftp.fred.com connects user to -> ftp.biff.com - ftp ftp.bowser.com connects user to -> ftp.biff.com - -You may do this by using CNAMEs: - - ftp.bowser.com. IN CNAME ftp.biff.com. - -You can also do the same thing with multiple A records. - ------------------------------------------------------------------------------ - -Question 5.9. wildcard MX records - -Date: Sun Nov 27 23:32:41 EST 1994 - -Does BIND not understand wildcard MX records such as the following? - - *.foo.com MX 0 mail.foo.com. - -No. It just doesn't work. - -Explicit RR's at one level of specificity will, by design, "block" a -wildcard at a lesser level of specificity. I suspect that you have an RR -(an A RR, perhaps?) for "bar.foo.com" which is blocking the application of -your "*.foo.com" wildcard. The initial MX query is thus failing (NOERROR -but an answer count of 0), and the backup query finds the A RR for -"bar.foo.com" and uses it to deliver the mail directly (which is what you -DIDN'T want it to do). Adding an explicit MX RR for the host is therefore -the right way to handle this situation. - -See RFC 1034, Section 4.3.3 ("Wildcards") for more information on this -"blocking" behavior, along with an illustrative example. See also RFC 974 -for an explanation of standard mailer behavior in the face of an "empty" -response to one's MX query. - -Basically, what it boils down to is, there is no point in trying to use a -wildcard MX for a host which is otherwise listed in the DNS. - -It just doesn't work. - ------------------------------------------------------------------------------ - -Question 5.10. How do you identify a wildcard MX record ? - -Date: Thu Dec 1 11:10:39 EST 1994 - -You don't really need to "identify" a wildcard MX RR. The precedence for -u@dom is: - - exact match MX - exact match A - wildcard MX - -One way to implement this is to query for ("dom",IN,MX) and if the answer -name that comes back is "*." something, you know it's a wildcard, -therefore you know there is no exact match MX, and you therefore query for -("dom",IN,A) and if you get something, use it. if you don't, use the -previous wildcard response. - -RFC 974 explains this pretty well. - ------------------------------------------------------------------------------ - -Question 5.11. Why are fully qualified domain names recommended ? - -Date: Sun Nov 27 23:32:41 EST 1994 - -The documentation for BIND 4.9.2 says that the hostname should be set to -the full domain style name (i.e host.our.domain rather than host). What -advantages are there in this, and are there any adverse consequences if we -don't? - -Paul Vixie likes to do it :-) He lists a few reasons - - -* Sendmail can be configured to just use Dj$w rather than Dj$w.mumble - where "mumble" is something you have to edit in by hand. Granted, most - people use "mumble" elsewhere in their config files ("tack on local - domain", etc) but why should it be a requirement ? -* The real reason is that not doing it violates a very useful invariant: - gethostbyname(gethostname) == gethostbyaddr(primary_interface_address) - - - If you take an address and go "backwards" through the PTR's with it, - you'll get a FQDN, and if you push that back through the A RR's, you get - the same address. Or you should. Many multi-homed hosts violate this - uncaringly. - - If you take a non-FQDN hostname and push it "forwards" through the A - RR's, you get an address which, if you push it through the PTR's, comes - back as a FQDN which is not the same as the hostname you started with. - Consider the fact that, absent NIS/YP, there is no "domainname" command - analogous to the "hostname" command. (NIS/YP's doesn't count, of - course, since it's sometimes-but-only-rarely the same as the Internet - domain or subdomain above a given host's name.) The "domain" keyword in - resolv.conf doesn't specify the parent domain of the current host; it - specifies the default domain of queries initiated on the current host, - which can be a very different thing. (As of RFC 1535 and BIND 4.9.2's - compliance with it, most people use "search" in resolv.conf, which - overrides "domain", anyway.) - - What this means is that there is NO authoritative way to - programmatically discover your host's FQDN unless it is set in the - hostname, or unless every application is willing to grovel the "netstat - -in" tables, find what it hopes is the primary address, and do a PTR - query on it. - - FQDN /bin/hostnames are, intuitively or not, the simplest way to go. - ------------------------------------------------------------------------------ - -Question 5.12. Distributing load using named - -Date: Thu Jul 16 10:42:05 EDT 1998 - -When you attempt to distribute the load on a system using named, the first -response be cached, and then later queries use the cached value (This -would be for requests that come through the same server). Therefore, it -can be useful to use a lower TTL on records where this is important. You -can use values like 300 or 500 seconds. - -If your local caching server has ROUND_ROBIN, it does not matter what the -authoritative servers have -- every response from the cache is rotated. - -But if it doesn't, and the authoritative server site is depending on this -feature (or the old "shuffle-A") to do load balancing, then if one doesn't -use small TTLs, one could conceivably end up with a really nasty -situation, e.g., hundreds of workstations at a branch campus pounding on -the same front end at the authoritative server's site during class -registration. - -Not nice. - -Paul Vixie has an example of the ROUND_ROBIN code in action. Here is -something that he wrote regarding his example: - - I want users to be distributed evenly among those 3 hosts. - - Believe it or not :-), BIND offers an ugly way to do this. I offer - for your collective amusement the following snippet from the - ugly.vix.com zone file: - - hydra cname hydra1 - cname hydra2 - cname hydra3 - hydra1 a 10.1.0.1 - a 10.1.0.2 - a 10.1.0.3 - hydra2 a 10.2.0.1 - a 10.2.0.2 - a 10.2.0.3 - hydra3 a 10.3.0.1 - a 10.3.0.2 - a 10.3.0.3 - - Note that having multiple CNAME RR's at a given name is - meaningless according to the DNS RFCs but BIND doesn't mind (in - fact it doesn't even complain). If you call - gethostbyname("hydra.ugly.vix.com") (try it!) you will get - results like the following. Note that there are two round robin - rotations going on: one at ("hydra",CNAME) and one at each - ("hydra1",A) et al. I used a layer of CNAME's above the layer of - A's to keep the response size down. If you don't have nine - addresses you probably don't care and would just use a pile of - CNAME's pointing directly at real host names. - - {hydra.ugly.vix.com - name: hydra2.ugly.vix.com - aliases: hydra.ugly.vix.com - addresses: 10.2.0.2 10.2.0.3 10.2.0.1 - - {hydra.ugly.vix.com - name: hydra3.ugly.vix.com - aliases: hydra.ugly.vix.com - addresses: 10.3.0.2 10.3.0.3 10.3.0.1 - - {hydra.ugly.vix.com - name: hydra1.ugly.vix.com - aliases: hydra.ugly.vix.com - addresses: 10.1.0.2 10.1.0.3 10.1.0.1 - - {hydra.ugly.vix.com - name: hydra2.ugly.vix.com - aliases: hydra.ugly.vix.com - addresses: 10.2.0.3 10.2.0.1 10.2.0.2 - - {hydra.ugly.vix.com - name: hydra3.ugly.vix.com - aliases: hydra.ugly.vix.com - addresses: 10.3.0.3 10.3.0.1 10.3.0.2 - -Please note that this is not a recommended practice and will not work with -modern BIND unless you have the entry "multiple-cnames yes" in your -named.conf file. - ------------------------------------------------------------------------------ - -Question 5.13. Round robin IS NOT load balancing - -Date: Mon Mar 9 22:10:51 EST 1998 - -Round robin != load balancing. It's a very crude attempt at load -balancing, and a method that is possible without breaking DNS protocols. -If a host is down that is included in a round robin list, then -connections to that particular host will fail. In addition, true load -balancing should take into consideration the actual LOAD on the system. - -Information on one such technique, implemented by Roland J. Schemers III -at Stanford, may be found at -http://www-leland.stanford.edu/~schemers/docs/lbnamed/lbnamed.html. - -Additional information may be found in RFC 1794. MultiNet for OpenVMS -also includes this feature. - ------------------------------------------------------------------------------ - -Question 5.14. Order of returned records - -Date: Tue Apr 8 20:21:02 EDT 1997 - -Sorting, is the *resolver's* responsibility. RFC 1123: - - - 6.1.3.4 Multihomed Hosts - - When the host name-to-address function encounters a host - with multiple addresses, it SHOULD rank or sort the - addresses using knowledge of the immediately connected - network number(s) and any other applicable performance or - history information. - - DISCUSSION: - The different addresses of a multihomed host generally - imply different Internet paths, and some paths may be - preferable to others in performance, reliability, or - administrative restrictions. There is no general way - for the domain system to determine the best path. A - recommended approach is to base this decision on local - configuration information set by the system - administrator. - -In BIND 4.9.x's resolver code, the "sortlist" directive in resolv.conf -can be used to configure this. The directive may also be used in the -named.boot as well. - ------------------------------------------------------------------------------ - -Question 5.15. resolv.conf - -Date: Fri Feb 10 15:46:17 EST 1995 - -The question was asked one time, "Why should I use 'real' IP addresses in -/etc/resolv.conf and not 0.0.0.0 or 127.0.0.1" ? - -Paul Vixie writes on the issue of the contents of resolv.conf: - - It's historical. Some kernels can't unbind a UDP socket's source - address, and some resolver versions (notably not including BIND - 4.9.2 or 4.9.3's) try to do this. The result can be wide area - network traffic with 127.0.0.1 as the source address. Rather than - giving out a long and detailed map of version/vendor combinations of - kernels/BINDs that have/don't this problem, I just tell folks not to - use 127.0.0.1 at all. - - 0.0.0.0 is just an alias for the first interface address assigned - after a system boot, and if that interface is a up-and-down point to - point link (PPP, SLIP, whatever), there's no guarantee that you'll - be able to reach yourself via 0.0.0.0 during the entire lifetime of - any system instance. On most kernels you can finesse this by adding - static routes to 127.0.0.1 for each of your interface addresses, but - some kernels don't like that trick and rather than give a detailed - map of which ones work and which ones don't, I just globally - recommend against 0.0.0.0. - - If you know enough to know that 127.0.0.1 or 0.0.0.0 is safe on your - kernel and resolver, then feel free to use them. If you don't know - for sure that it is safe, don't use them. I never use them (except - on my laptop, whose hostname is "localhost" and whose 0.0.0.0 is - 127.0.0.1 since I ifconfig my lo0 before any other interface). The - operational advantage to using a real IP address rather than an - wormhole like 0.0.0.0 or 127.0.0.1, is that you can then "rdist" or - otherwise share identical copies of your resolv.conf on all the - systems on any given subnet, not all of which will be servers. - -The problem was with older versions of the resolver (4.8.X). If you -listed 127.0.0.1 as the first entry in resolv.conf, and for whatever -reason the local name server wasn't running and the resolver fell back to -the second name server listed, it would send queries to the name server -with the source IP address set to 127.0.0.1 (as it was set when the -resolver was trying to send to 127.0.0.1--you use the loopback address to -send to the loopback address). - ------------------------------------------------------------------------------ - -Question 5.16. How do I delegate authority for sub-domains ? - -Date: Mon Nov 10 22:57:54 EST 1997 - -When you start having a very big domain that can be broken into logical -and separate entities that can look after their own DNS information, you -will probably want to do this. Maintain a central area for the things -that everyone needs to see and delegate the authority for the other parts -of the organization so that they can manage themselves. - -Another essential piece of information is that every domain that exists -must have it NS records associated with it. These NS records denote the -name servers that are queried for information about that zone. For your -zone to be recognized by the outside world, the server responsible for the -zone above you must have created a NS record for your your new servers -(NOTE that the new servers DO NOT have to be in the new domain). For -example, putting the computer club onto the network and giving them -control over their own part of the domain space we have the following. - -The machine authorative for gu.uwa.edu.au is mackerel and the machine -authorative for ucc.gu.uwa.edu.au is marlin. - -in mackerel's data for gu.uwa.edu.au we have the following - - @ IN SOA ... - IN A 130.95.100.3 - IN MX mackerel.gu.uwa.edu.au. - IN MX uniwa.uwa.edu.au. - - marlin IN A 130.95.100.4 - - ucc IN NS marlin.gu.uwa.edu.au. - IN NS mackerel.gu.uwa.edu.au. - -Marlin is also given an IP in our domain as a convenience. If they blow -up their name serving there is less that can go wrong because people can -still see that machine which is a start. You could place "marlin.ucc" in -the first column and leave the machine totally inside the ucc domain as -well. - -The second NS line is because mackerel will be acting as secondary name -server for the ucc.gu domain. Do not include this line if you are not -authorative for the information included in the sub-domain. - -To delegate authority for PTR records, the same concepts apply. - - stub 10.168.192.in-addr.arpa <subdomain server addr> db.192.168.10 - -may be added to your primary server's named.boot in recent versions of -bind. In other versions (and recent ones :-) ), the following lines may -be added to the db.192.168.10 zone file to perform the same function: - - xxx IN NS <server1> - xxx IN NS <server2> - xxx IN NS <server3> ; if needed -... - xxx IN NS <serverN> ; if needed - ------------------------------------------------------------------------------ - -Question 5.17. DNS instead of NIS on a Sun OS 4.1.x system - -Date: Sat Dec 7 01:14:17 EST 1996 - -Comments relating to running bind 4.9.x on a Sun OS 4.1.x system and the -effect on sendmail, ftp, telnet and other TCP/IP services bypassing NIS -and directly using named is documented quite well in the -comp.sys.sun.admin FAQ in questions one and two. You can get them from: - -* ftp.ece.uc.edu : /pub/sun-faq/FAQs/sun-faq.general -* http://www.cis.ohio-state.edu/hypertext/faq/usenet/comp-sys-sun-faq - -as well as from rtfm.mit.edu in the usual place, etc. - ------------------------------------------------------------------------------ - -Question 5.18. Patches to add functionality to BIND - -Date: Wed Jan 14 11:57:20 EST 1998 - -There are others, but these are listed here: - -* When using the round robin DNS and assigning 3 IPs to a host (for - example), a process to guarantee that all 3 IPs are reachable may be - found at - http://www-leland.stanford.edu/~schemers/docs/lbnamed/lbnamed.html - -* Patches for 4.9.3-REL that will support the IPv6 AAAA record format may - be found at ftp.inria.fr : /network/ipv6/ - - This is built into more recent versions of BIND (after 4.9.5?) - -* A patch for 4.9.3-REL that will allow you to turn off forwarding of - information from my server may be found at ftp.vix.com : - /pub/bind/release/4.9.3/contrib/noforward.tar.gz - - Also look at - - ftp.is.co.za : /networking/ip/dns/bind/contrib/noforward.tar.gz - -* How do I tell a server to listen to a particular interface to listen and - respond to DNS queries on ? - - Mark Andrews has a patch that will tell a 4.9.4 server to listen to a - particular interface and respond to DNS queries. It may be found at an - unofficial location: http://www.ultra.net/~jzp/andrews.patch.txt - - This is built into BIND 8.1.1. - -* A patch to implement "selective forwarding" from Todd Aven at - http://www.dns.net/dnsrd/servers.html. - ------------------------------------------------------------------------------ - -Question 5.19. How to serve multiple domains from one server - -Date: Tue Nov 5 23:44:02 EST 1996 - -Most name server implementations allow information about multiple domains -to be kept on one server, and questions about those domains to be -answered by that one server. For instance, there are many large servers -on the Internet that each serve information about more than 1000 -different domains. - -To be completely accurate, a server contains information about zones, -which are parts of domains that are kept as a single unit. [Ed note: for -a definition of zones and domains, see Section 2: The Name Service in the -"Name Server Operations Guide" included with the BIND 4.9.5 distribution.] - -In the configuration of the name server, the additional zones need to be -specified. An important consideration is whether a particular server is -primary or secondary for any specific zone--a secondary server maintains -only a copy of the zone, periodically refreshing its copy from another, -specified, server. In BIND, to set up a server as a secondary server for -the x.y.z zone, to the configuration file /etc/named.boot add the line - - secondary x.y.z 10.0.0.1 db.x.y.z - -where 10.0.0.1 is the IP address of the server that the zone will be -copied from, and db.x.y.z is a local filename that will contain the copy -of the zone. - -If this is a question related to how to set up multiple IP numbers on one -system, which you do not need to do to act as a domain server for -multiple domains, see - -http://www.thesphere.com/%7Edlp/TwoServers/. - ------------------------------------------------------------------------------ - -Question 5.20. hostname and domain name the same - -Date: Wed Jul 9 21:47:36 EDT 1997 - -Q: I have a subdomain sub.foobar.com. I would like to name a host -sub.foobar.com. It should also be the mail relay for all hosts in -sub.foobar.com. How do I do this ? - -A: You would add an A record for sub.foobar.com, and multiple MX records -pointing to this host (sub.foobar.com). For example: - -sub.foobar.com. IN A 1.2.3.4 ; address of host -; -foo.sub.foobar.com. IN MX 10 sub.foobar.com. -bar.sub.foobar.com. IN MX 10 sub.foobar.com. - -The host, sub.foobar.com, may also need to be to configured to understand -that mail addressed to user@sub.foobar.com and possibly other sub.foobar.com -hosts should be treated as local. - ------------------------------------------------------------------------------ - -Question 5.21. Restricting zone transfers - -Date: Wed Jan 14 12:16:35 EST 1998 - -Q: How do I restrict my zone transfers to my secondaries or other trusted -hosts? - -A: Use the 'xfrnets' directive within the named.boot file or the -'secure_zone' TXT RR within a zone file. The BOG has more information on -both of these options. - -As an example within an 4.9.x named.boot file: - - xfernets 10.1.2.0&255.255.255.0 44.66.10.0&255.255.255.0 - - -Only Nameservers on these networks will be able to do zone transfers from -the server with this configuration. - -Please note that 'secure_zone' restricts all access to the containing -zone, as well as restricting zone transfers :-) . - -BIND 8.x supports restricting zone transfers on a per-zone basis in the -named.conf file, whereas BIND 4.9.x only supports xfrnets as a global -option. - ------------------------------------------------------------------------------ - -Question 5.22. DNS in firewalled and private networks - -Date: Mon Sep 14 22:15:16 EDT 1998 - -(The following section was contributed by Berislav Todorovic) - -When talking about private networks, we distinguish between two cases: - -* Networks consisting of firewall-separated private and public subnetworks - - * Same domain name used in private and public part of the network - * Different domain names used in the public and private subnetwork - -* Closed networks, not connected the Internet at all - -* The first case of the "Same domain name", we're talking about DNS - configuration, usually referred to as "split DNS". In this case, two - different DNS servers (or two separate DNS processes on the same - multi-homed machine) have to be configured. One of them ("private DNS") - will serve the internal network and will contain data about all hosts in - the private part of the network. The other one ("public DNS") will serve - Internet users and will contain only the most necessary RR's for - Internet users (like MX records for email exchange, A and CNAME records - for public Web servers, records for other publicly accessible hosts - etc.). Both of them will be configured as primary for the same corporate - domain (e.g. DOMAIN.COM). The public DNS will be delegated with the - appropriate NIC as authoritative for domain DOMAIN.COM. - - Private DNS - resolves names from DOMAIN.COM for hosts inside the - private network. If asked for a name outside DOMAIN.COM, they should - forward the request to the public DNS (forwarders line should be used in - the boot file). They should NEVER contact a root DNS on the Internet. - The boot file for the private DNS should, therefore, be: - - primary domain.com ZONE.domain.com - primary 1.10.in-addr.arpa REV.10.1 - forwarders 172.16.12.10 - slave - Public DNS - resolves names from DOMAIN.COM for hosts on the public part - of the network. If asked for a name outside DOMAIN.COM they should - contact root DNS servers or (optionally) forward the request to a - forwarder on the ISP network. Boot file for the public DNS should be of - the form: - - primary domain.com ZONE.domain.com - primary 12.16.172.in-addr.arpa REV.172.16.12 - ... (other domains) - Zone files for domain DOMAIN.COM on the public and private DNS should - be: - - ; --- Public DNS - zone file for DOMAIN.COM - - domain.com. IN SOA ns.domain.com. hostmaster.domain.com. ( ... ) - IN NS ns.domain.com. - IN NS ns.provider.net. - IN MX 10 mail.provider.net. - - ns IN A 172.16.12.10 - www IN A 172.16.12.12 - ftp IN A 172.16.12.13 - ... - - ; --- Private DNS - zone file for DOMAIN.COM - - domain.com. IN SOA ns1.domain.com. hostmaster.domain.com. ( ... ) - IN NS ns1.domain.com. - IN NS ns2.domain.com. - wks1-1 IN A 10.1.1.1 - wks1-2 IN A 10.1.1.2 - ... - - The second case of the "Same domain name", is simpler than the previous - case: in the internal network, a separate domain name might be used. - Recommended domain name syntax is "name.local" (e.g. DOMAIN.LOCAL). - Sample configuration: - - ; --- Private DNS - named.boot - - primary domain.local ZONE.domain.local - ... - forwarders 172.16.12.10 - slave - - ; --- Public DNS - named.boot - - primary domain.com ZONE.domain.com - ... - IMPLEMENTATION NOTES - - Location of the DNS service in both cases is irrelevant. Usually, they - are located on two different physical servers, each of them connected to - the appropriate part of the network (private, public). Certain savings - may be done if public DNS service is hosted on the ISP network - in that - case, the user will need only one (private) DNS server. - - Finally, both public and private DNS, in some cases, may be placed on - the servers in the private network, behind the firewall. With a Cisco - PIX, a statical public/private IP address mapping in this case would be - needed. Two servers for the same domain could be even placed on the - same physical server, with two different DNS processes running on - different IP interfaces. Note that BIND 8 is needed in the latter case. - -* If the network is not connected to the Internet at all, only private DNS - servers are needed. However, due to the lack of Internet connectivity, - internal servers will fail to contact the root DNS servers every time a - user types, by mistake, an address outside the corporate domain - DOMAIN.COM. Some older servers won't even work if they can't reach root - servers. To overcome this, it is most proper to create a so-called "fake - root zone" on one or more DNS servers in the corporation. That would - make all DNS servers within the corporation think there is only one or - two DNS servers in the world, all located on the corporation network. - Only domain names used within the corporation (DOMAIN.COM, appropriate - inverse domains etc.) should be entered in the fake root zone file. Note - that no cache line in the boot file of the "root" DNS makes sense. - Sample configuration: - - ; --- named.boot - - primary domain.com ZONE.domain.com - primary 1.10.in-addr.arpa REV.10.1 - priamry . ZONE.root - ... (other data; NOTE - do *NOT* place any "cache" line here !!!) - - ; --- ZONE.root - fake root zone file, containing only corporation domains - - . IN NS ns.domain.com. hostmaster.domain.com. ( ... ) - IN NS ns.domain.com. - IN NS ns2.domain.com. - - domain.com. IN NS ns.domain.com. - ns.domain.com. IN A 10.1.1.1 - domain.com. IN NS ns2.domain.com. - ns2.domain.com. IN A 10.1.1.2 - - 1.10.in-addr.arpa. IN NS ns.domain.com. - IN NS ns2.domain.com. - - Other zone files follow standard configuration. - ------------------------------------------------------------------------------ - -Question 5.23. Different DNS answers for same RR - -Date: Mon Sep 14 22:15:16 EDT 1998 - -(The following section was contributed by Berislav Todorovic) - -Many times there is a need for a DNS server to send different answers for -same RR's, depending on the IP address of the request sender. For example, -many coprporations wish to make their customers to use the "geographically -closest" Web server when accessing corporate Web pages. A corporation may -impose the following policy: if someone asked for the IP address of -WWW.DOMAIN.COM, they may want to: - -* Answer that the IP address is 172.16.2.3, if the request came from one - of the following IP networks: 172.1/16, 172.2/16 or 172.10/16. -* Answer that the IP address is 172.16.1.1, if the request came from the - IP address 172.16/16 or 172.17.128/18. -* By default, for all other requests send the answer that the IP address - is 172.16.2.3. - -The example above will need a DNS to send different A RR's, depending on -the source of queries. A similar approach may be imposed for MX's, CNAME's -etc. The question which arise here is: IS IT POSSIBLE? - -[Ed note: There are commercial products such as Cisco's Distributed -Director that also will address this issue] - -The simple answer to the question is: NOT DIRECTLY. This is true if -standard DNS software (e.g. BIND) is used on the DNS servers. However, -there are two workarounds which may solve this problem: - -* Using two DNS servers on different UDP ports + UDP redirector -* Using two DNS servers on different IP addresses + NAT on the router - -Solution 1: (tested on a Linux system and should work on other Unix boxes -as well). Software needed is: - -* BIND 8 -* udprelay - a package which redirects traffic to other UDP port - (sunsite.unc.edu: /pub/Linux/system/network/misc/udprelay-0.2.tar.Z ). - -Build and install udprelay and bring up two DNS servers on different UDP -ports, using different configuration files (i.e., bring one on 5300 and -the other one on 5400): - - // --- named.conf.5300 - options { - directory "/var/named" - listen-on port 5300 { any; }; - ... (other options) - }; - - zone "domain.com" { - type master; - file "domain.com.5300"; - }; - - // --- named.conf.5400 - - options { - directory "/var/named" - listen-on port 5400 { any; }; - ... (other options) - }; - - zone "domain.com" { - type master; - file "domain.com.5400"; - }; - - - ; domain.com.5300 - ... (SOA and other stuff) - - www IN A 172.16.2.3 - - ; --- domain.com.5400 - ... (SOA and other stuff) - - www IN A 172.16.1.1 - -As can be seen, there will be two separate zone files for DOMAIN.COM, -depending on which UDP port the server listens to. Each zone file can -contain different records. Now, when configure udprelay to forward UDP -traffic from port 53 to 5300 or 5400, depending on the remote IP address: - - relay 172.1.0.0 mask 255.255.0.0 * 53 172.16.1.1 5300 53 - relay 172.2.0.0 mask 255.255.0.0 * 53 172.16.1.1 5300 53 - relay 172.10.0.0 mask 255.255.0.0 * 53 172.16.1.1 5300 53 - relay 172.16.0.0 mask 255.255.0.0 * 53 172.16.1.1 5400 53 - relay 172.17.0.0 mask 255.255.0.0 * 53 172.16.1.1 5400 53 - relay * * 53 172.16.1.1 5400 53 -After starting udprelay, all traffic coming to port 53 will be redirected -to 5300 or 5400, depending on the source IP address. - -NOTE - This solution deals with the UDP part of DNS only. Zone xfers will -be able to be done from one DNS server only, since this solution doesn't -deal the TCP part of DNS. This is, thus, a partial solution but it works! - -Solution 2: Bring up two DNS servers on your network, using "private" IP -addresses (RFC 1918), say ns1.domain.com (10.1.1.1) and ns2.domain.com -(10.1.1.2). Both servers will have the same public address - 172.16.1.1, -which will be used to access the servers. Configure them to be both -primary for domain DOMAIN.COM. Let one of them (say, ns1) be the -"default" DNS, which will be used in most of the cases. Establish NAT on -the router, so it translates the public IP address 172.16.1.1 to 10.1.1.1 -and delegate your "default" DNS with the appropriate NIC, using its public -address 172.16.1.1. Once you're assured everything works, setup your -router to translate the public IP address 172.16.1.1 to either 10.1.1.1 or -10.1.1.2, depending on the requestor IP address. After that, depending on -the source IP address, the router will return one translation or the -latter, thus forwarding the remote side to the appropriate DNS server. - -=============================================================================== - -Section 6. PROBLEMS - - Q6.1 No address for root server - Q6.2 Error - No Root Nameservers for Class XX - Q6.3 Bind 4.9.x and MX querying? - Q6.4 Do I need to define an A record for localhost ? - Q6.5 MX records, CNAMES and A records for MX targets - Q6.6 Can an NS record point to a CNAME ? - Q6.7 Nameserver forgets own A record - Q6.8 General problems (core dumps !) - Q6.9 malloc and DECstations - Q6.10 Can't resolve names without a "." - Q6.11 Why does swapping kill BIND ? - Q6.12 Resource limits warning in system - Q6.13 ERROR:ns_forw: query...learnt - Q6.14 ERROR:zone has trailing dot - Q6.15 ERROR:Zone declared more then once - Q6.16 ERROR:response from unexpected source - Q6.17 ERROR:record too short from [zone name] - Q6.18 ERROR:sysquery: findns error (3) - Q6.19 ERROR:Err/TO getting serial# for XXX - Q6.20 ERROR:zonename IN NS points to a CNAME - Q6.21 ERROR:Masters for secondary zone [XX] unreachable - Q6.22 ERROR:secondary zone [XX] expired - Q6.23 ERROR:bad response to SOA query from [address] - Q6.24 ERROR:premature EOF, fetching [zone] - Q6.25 ERROR:Zone [XX] SOA serial# rcvd from [Y] is < ours - Q6.26 ERROR:connect(IP/address) for zone [XX] failed - Q6.27 ERROR:sysquery: no addrs found for NS - Q6.28 ERROR:zone [name] rejected due to errors - ------------------------------------------------------------------------------ - -Question 6.1. No address for root server - -Date: Wed Jan 14 12:15:54 EST 1998 - -Q: I've been getting the following messages lately from bind-4.9.2.. - ns_req: no address for root server - -We are behind a firewall and have the following for our named.cache file - - - ; list of servers - . 99999999 IN NS POBOX.FOOBAR.COM. - 99999999 IN NS FOOHOST.FOOBAR.COM. - foobar.com. 99999999 IN NS pobox.foobar.com. - -You can't do that. Your nameserver contacts POBOX.FOOBAR.COM, gets the -correct list of root servers from it, then tries again and fails because -of your firewall. - -You will need a 'forwarder' definition, to ensure that all requests are -forwarded to a host which can penetrate the firewall. And it is unwise to -put phony data into 'named.cache'. - -Q: We are getting logging information in the form: - -Apr 8 08:05:22 gute named[107]: sysquery: no addrs found for root NS - (A.ROOT-SERVERS.NET) -Apr 8 08:05:22 gute named[107]: sysquery: no addrs found for root NS - (B.ROOT-SERVERS.NET) -Apr 8 08:05:22 gute named[107]: sysquery: no addrs found for root NS - (C.ROOT-SERVERS.NET) -... - -We are running bind 4.9.5PL1 Our system IS NOT behind a firewall. Any ideas ? - -This was discussed on the mailing list in November of 1996. The short -answer was to ignore it as it was not a problem. That being said, you -should upgrade to a newer version at this time if you are running a -non-current version :-) - ------------------------------------------------------------------------------ - -Question 6.2. Error - No Root Nameservers for Class XX - -Date: Sun Nov 27 23:32:41 EST 1994 - -Q: I've received errors before about "No root nameservers for class XX" - but they've been because of network connectivity problems. - I believe that Class 1 is Internet Class data. - And I think I heard someone say that Class 4 is Hesiod?? - Does anyone know what the various Class numbers are? - -From RFC 1700: - - DOMAIN NAME SYSTEM PARAMETERS - The Internet Domain Naming System (DOMAIN) includes several - parameters. These are documented in [RFC1034] and [RFC1035]. The - CLASS parameter is listed here. The per CLASS parameters are - defined in separate RFCs as indicated. - - Domain System Parameters: - - Decimal Name References - -------- ---- ---------- - 0 Reserved [PM1] - 1 Internet (IN) [RFC1034,PM1] - 2 Unassigned [PM1] - 3 Chaos (CH) [PM1] - 4 Hesoid (HS) [PM1] - 5-65534 Unassigned [PM1] - 65535 Reserved [PM1] - -DNS information for RFC 1700 was taken from - -ftp.isi.edu : /in-notes/iana/assignments/dns-parameters - -Hesiod is class 4, and there are no official root nameservers for class 4, -so you can safely declare yourself one if you like. You might want to -put up a packet filter so that no one outside your network is capable of -making Hesiod queries of your machines, if you define yourself to be a -root nameserver for class 4. - ------------------------------------------------------------------------------ - -Question 6.3. Bind 4.9.x and MX querying? - -Date: Sun Nov 27 23:32:41 EST 1994 - -If you query a 4.9.x DNS server for MX records, a list of the MX records -as well as a list of the authorative nameservers is returned. This -happens because bind 4.9.2 returns the list of nameserver that are -authorative for a domain in the response packet, along with their IP -addresses in the additional section. - ------------------------------------------------------------------------------ - -Question 6.4. Do I need to define an A record for localhost ? - -Date: Sat Sep 9 00:36:01 EDT 1995 - -Somewhere deep in the BOG (BIND Operations Guide) that came with 4.9.3 -(section 5.4.3), it says that you define this yourself (if need be) in -the same zone files as your "real" IP addresses for your domain. Quoting -the BOG: - - - ... As implied by this PTR - record, there should be a ``localhost.my.dom.ain'' - A record (with address 127.0.0.1) in every domain - that contains hosts. ``localhost.'' will lose its - trailing dot when 1.0.0.127.in-addr.arpa is queried - for;... - -The sample files in the BIND distribution show you what needs to be done -(see the BOG). - -Some HP boxen (especially those running HP OpenView) will also need -"loopback" defined with this IP address. You may set it as a CNAME -record pointing to the "localhost." record. - ------------------------------------------------------------------------------ - -Question 6.5. MX records, CNAMES and A records for MX targets - -Date: Sun Nov 27 23:32:41 EST 1994 - -The O'Reilly "DNS and Bind" book warns against using non-canonical names -in MX records, however, this warning is given in the context of mail hubs -that MX to each other for backup purposes. How does this apply to mail -spokes. RFC 974 has a similar warning, but where is it specifically -prohibited to us an alias in an MX record ? - -Without the restrictions in the RFC, a MTA must request the A records for -every MX listed to determine if it is in the MX list then reduce the list. -This introduces many more lookups than would other wise be required. If -you are behind a 1200 bps link YOU DON'T WANT TO DO THIS. The addresses -associated with CNAMES are not passed as additional data so you will force -additional traffic to result even if you are running a caching server -locally. - -There is also the problem of how does the MTA find all of it's IP -addresses. This is not straight forward. You have to be able to do this is -you allow CNAMEs (or extra A's) as MX targets. - -The letter of the law is that an MX record should point to an A record. - -There is no "real" reason to use CNAMEs for MX targets or separate As for -nameservers any more. CNAMEs for services other than mail should be used -because there is no specified method for locating the desired server yet. - -People don't care what the names of MX targets are. They're invisible to -the process anyway. If you have mail for "mary" redirected to "sue" is -totally irrelevant. Having CNAMEs as the targets of MX's just needlessly -complicates things, and is more work for the resolver. - -Having separate A's for nameservers like "ns.your.domain" is pointless -too, since again nobody cares what the name of your nameserver is, since -that too is invisible to the process. If you move your nameserver from -"mary.your.domain" to "sue.your.domain" nobody need care except you and -your parent domain administrator (and the InterNIC). Even less so for -mail servers, since only you are affected. - -Q: Given the example - - - hello in cname realname - mailx in mx 0 hello - - Now, while reading the operating manual of bind it clearly states - that this is *not* valid. These two statements clearly contradict - each other. Is there some later RFC than 974 that overrides what is - said in there with respect to MX and CNAMEs? Anyone have the - reference handy? - -A: This isn't what the BOG says at all. See below. You can have a CNAME - that points to some other RR type; in fact, all CNAMEs have to point - to other names (Canonical ones, hence the C in CNAME). What you - can't have is an MX that points to a CNAME. MX RR's that point to - names which have only CNAME RR's will not work in many cases, and - RFC 974 intimates that it's a bad idea: - - Note that the algorithm to delete irrelevant RRs breaks if LOCAL has - a alias and the alias is listed in the MX records for REMOTE. (E.g. - REMOTE has an MX of ALIAS, where ALIAS has a CNAME of LOCAL). This - can be avoided if aliases are never used in the data section of MX - RRs. - - Here's the relevant BOG snippet: - - aliases {ttl addr-class CNAME Canonical name - ucbmonet IN CNAME monet - - The Canonical Name resource record, CNAME, speci- - fies an alias or nickname for the official, or - canonical, host name. This record should be the - only one associated with the alias name. All other - resource records should be associated with the - canonical name, not with the nickname. Any - resource records that include a domain name as - their value (e.g., NS or MX) must list the canoni- - cal name, not the nickname. - ------------------------------------------------------------------------------ - -Question 6.6. Can an NS record point to a CNAME ? - -Date: Wed Mar 1 11:14:10 EST 1995 - -Can I do this ? Is it legal ? - - - @ SOA (.........) - NS ns.host.this.domain. - NS second.host.another.domain. - ns CNAME third - third IN A xxx.xxx.xxx.xxx - -No. Only one RR type is allowed to refer, in its data field, to a CNAME, -and that's CNAME itself. So CNAMEs can refer to CNAMEs but NSs and MXs -cannot. - -BIND 4.9.3 (Beta11 and later) explicitly syslogs this case rather than -simply failing as pre-4.9 servers did. Here's a current example: - - Dec 7 00:52:18 gw named[17561]: "foobar.com IN NS" \ - points to a CNAME (foobar.foobar.com) - -Here is the reason why: - -Nameservers are not required to include CNAME records in the Additional -Info section returned after a query. It's partly an implementation -decision and partly a part of the spec. The algorithm described in RFC -1034 (pp24,25; info also in RFC 1035, section 3.3.11, p 18) says 'Put -whatever addresses are available into the additional section, using glue -RRs [if necessary]'. Since NS records are speced to contain only primary -names of hosts, not CNAMEs, then there's no reason for algorithm to -mention them. If, on the other hand, it's decided to allow CNAMEs in NS -records (and indeed in other records) then there's no reason that CNAME -records might not be included along with A records. The Additional Info -section is intended for any information that might be useful but which -isn't strictly the answer to the DNS query processed. It's an -implementation decision in as much as some servers used to follow CNAMEs -in NS references. - ------------------------------------------------------------------------------ - -Question 6.7. Nameserver forgets own A record - -Date: Fri Dec 2 16:17:31 EST 1994 - -Q: Lately, I've been having trouble with named 4.9.2 and 4.9.3. - Periodically, the nameserver will seem to "forget" its own A record, - although the other information stays intact. One theory I had was - that somehow a site that the nameserver was secondary for was - "corrupting" the A record somehow. - -A: This is invariably due to not removing ALL of the cached zones - when you moved to 4.9.X. Remove ALL cached zones and restart - your nameservers. - - You get "ignoreds" because the primaries for the relevant zones are - running old versions of BIND which pass out more glue than is - required. named-xfer trims off this extra glue. - ------------------------------------------------------------------------------ - -Question 6.8. General problems (core dumps !) - -Date: Sun Dec 4 22:21:22 EST 1994 - -Paul Vixie says: - - I'm always interested in hearing about cases where BIND dumps core. - However, I need a stack trace. Compile with -g and not -O (unless - you are using gcc and know what you are doing) and then when it - dumps core, get into dbx or gdb using the executable and the core - file and use "bt" to get a stack trace. Send it to me - <paul@vix.com> along with specific circumstances leading to or - surrounding the crash (test data, tail of the debug log, tail of the - syslog... whatever matters) and ideally you should save your core - dump for a day or so in case I have questions you can answer via - gdb/dbx. - ------------------------------------------------------------------------------ - -Question 6.9. malloc and DECstations - -Date: Mon Jan 2 14:19:22 EST 1995 - -We have replaced malloc on our DECstations with a malloc that is more -compact in memory usage, and this helped the operation of bind a lot. The -source is now available for anonymous ftp from - -ftp.cs.wisc.edu : /pub/misc/malloc.tar.gz - ------------------------------------------------------------------------------ - -Question 6.10. Can't resolve names without a "." - -(Answer written by Mark Andrews) You are not using a RFC 1535 aware -resolver. Depending upon the age of your resolver you could try adding a -search directive to resolv.conf. - - e.g. - domain <domain> - search <domain> [<domain2> ...] - -If that doesn't work you can configure you server to serve the parent and -grandparent domains as this is the default search list. - -"domain langley.af.mil" has an implicit "search langley.af.mil af.mil mil" -in the old resolvers, and you are timing out trying to resolve the -address with one of these domains tacked on. - -When resolving internic.net the following will be tried in order. - - internic.net.langley.af.mil - internic.net.af.mil - internic.net.mil - internic.net. - -RFC 1535 aware resolvers try qualified address first. - - internic.net. - internic.net.langley.af.mil - internic.net.af.mil - internic.net.mil - -RFC 1535 documents the problems associated with the old search -algorithim, including security issues, and how to alleviate some of the -problems. - ------------------------------------------------------------------------------ - -Question 6.11. Why does swapping kill BIND ? - -Date: Thu Jul 4 23:20:20 EDT 1996 - -The question was: - - I've been diagnosing a problem with BIND 4.9.x (where x is usually 3BETA9 - or 3REL) for several months now. I finally tracked it down to swap space - utilization on the unix boxes. - - This happens under (at least) under Linux 1.2.9 & 1.2.13, SunOS 4.1.3U1, - 4.1.1, and Solaris 2.5. The symptom is that if these machines get into - swap at all bind quits resolving most, if not all queries. Mind you that - these machines are not "swapping hard", but rather we're talking about a - several hundred K TEMPORARY deficiency. I have noticed while digging - through various archives that there is some referral to "bind thrashing - itself to death". Is this what is happening ? - -And the answer is: - - Yes it is. Bind can't tolerate having even a few pages swapped out. - The time required to send responses climbs to several seconds/request, - and the request queue fills and overflows. - - It's possible to shrink memory consumption a lot by undefining STATS - and XSTATS, and recompiling. You could nuke DEBUG too, which will - cut the code size down some, but probably not the data size. If that - doesn't do the job then it sounds like you'll need to move DNS onto a - separate box. - - BIND tends to touch all of its resident pages all of the time with - normal activity... if you look at the RSS verses the total process - size, you will always see the RSS within, usually, 90% of the total - size of the process. This means that *any* paging of named-owned - pages will stall named. Thus, a machine running a heavily accessed - named process cannot afford to swap *at all*. - - (Paul Vixie continues on this subject): - I plan to try to get BIND to exhibit slightly better locality of - reference in some future release. Of course, I can only do this if - the query names also exhibit some kind of hot spots. If someone - queries all your names often, BIND will have to touch all of its VM - pool that often. (Right now, BIND touches everything pretty often - even if you're just hammering on some hot spots -- that's the part - I'd like to fix. Malloc isn't cooperating.) - ------------------------------------------------------------------------------ - -Question 6.12. Resource limits warning in system - -Date: Sun Feb 15 22:04:43 EST 1998 - -When bind-8.1.1 is started the following informational message appears in -the syslog... - - Feb 13 14:19:35 ns1named[1986]: - "cannot set resource limits on this system" - -What does this mean ? - -A: It means that BIND doesn't know how to implement the "coresize", -"datasize", "stacksize", or "files" process limits on your OS. - -If you're not using these options, you may ignore the message. - ------------------------------------------------------------------------------ - -Question 6.13. ERROR:ns_forw: query...learnt - -Date: Sun Feb 15 23:08:06 EST 1998 - -The following message appears in syslog: - - Jan 22 21:59:55 server1 named[21386]: ns_forw: query(testval) contains - our address (dns1.foobar.org:1.2.3.4) learnt (A=:NS=) - -what does it mean ? - -A: This means that when it was looking up the NS records for the domain -containing "testval" (i.e. the root domain), it found an NS record -pointing to dns1.foobar.org, and the A record for this is 1.2.3.4. -This is server1's own IP address, but it's not authoritative for the -root domain. The (A-:NS=) part of the message means that it didn't -learn these NS records from any other machine. - -You may have listed dns1.foobar.org in your root server cache -file, even though it's not configured as a root server. - - -\question 09jul:linuxq ERROR:recvfrom: Connection refused - -Date: Wed Jul 9 21:57:40 EDT 1997 - -DNS on my linux system is reporting the error - -\verbatim -Mar 26 12:11:20 idg named[45]: recvfrom: Connection refused - -When I start or restart the named program I get no errors. What could be -causing this ? - -A: Are you running the BETA9 version of bind 4.9.3 ? It is a bug that -does no harm and the error reporting was corrected in later releases. You -should upgrade to a newer version of bind. - ------------------------------------------------------------------------------ - -Question 6.14. ERROR:zone has trailing dot - -Date: Wed Jul 9 22:11:51 EDT 1997 - -If syslog reports "zone has trailing dot", the zone information contains a -trailing dot in the named.boot file where it does not belong. - - - example: - secondary domain.com. xxx.xxx.xxx.xxx S-domain.com - ^ ------------------------------------------------------------------------------ - -Question 6.15. ERROR:Zone declared more then once - -Date: Wed Jul 9 22:12:45 EDT 1997 - -If syslog reports "Zone declared more then once", - -A zone is specified multiple times in the named.boot file - - example: - secondary domain.com 198.247.225.251 S-domain.com - secondary zone.com 198.247.225.251 S-zone.com - primary domain.com P-domain.com - - domain.com is declared twice, once as primary, and once as secondary - ------------------------------------------------------------------------------ - -Question 6.16. ERROR:response from unexpected source - -Date: Wed Jul 9 22:12:45 EDT 1997 - -If syslog reports "response from unexpected source", BIND (pre 4.9.3) has -a bug if implimented on a multi homed server. This error indicates that -the response to a query came from an address other then the one sent to. -So, if ace gets a response from an unexpected source, ace will ignore the -response. - ------------------------------------------------------------------------------ - -Question 6.17. ERROR:record too short from [zone name] - -Date: Mon Jun 15 21:34:49 EDT 1998 - -If syslog report "record too short from [zone name]", The secondary server -is trying to pull a zone from the primary server. For some reason, the -primary sent an incomplete zone. This usually is a problem at the primary -server. - - To troubleshoot, try this: - - dig [zonename] axfr @[primary IP address] - - Often, this is caused by a line broken in the middle. - -When the primary server's "named.boot" file contains "xfrnets" entries -for other servers and the secondary is not listed, this error can occur. -Creating an "xfrnets" entry for the secondary will solve the error. - ------------------------------------------------------------------------------ - -Question 6.18. ERROR:sysquery: findns error (3) - -Date: Wed Jul 9 22:17:09 EDT 1997 - -If syslog reports "sysquery: findns error (3)" or -"qserial_query(zonename): sysquery FAILED", there is no ns record for the -zone. or the NS record is not defined correctly. - ------------------------------------------------------------------------------ - -Question 6.19. ERROR:Err/TO getting serial# for XXX - -Date: Wed Jul 9 22:18:41 EDT 1997 - -If syslog reports "Err/TO getting serial# for XXX", there could be a -number of possible errors: - - - An incorrect IP address in named.boot, - - A network reachibility problem, - - The primary is lame for the zone. - -An external check to see if you can retrieve the SOA is the best way to -work out which it is. - ------------------------------------------------------------------------------ - -Question 6.20. ERROR:zonename IN NS points to a CNAME - -Date: Wed Jul 9 22:20:29 EDT 1997 - -If syslog reports "zonename IN NS points to a CNAME" or "zonename IN MX -points to a CNAME", named is 'reminding' you that due to various RFCs, an -NS or MX record cannot point to a CNAME. - - EXAMPLE 1 - --------- - domain.com IN SOA (...stuff...) - IN NS ns.domain.com. - ns IN CNAME machine.domain.com. - machine IN A 1.2.3.4 - - The IN NS record points to ns, which is a CNAME for machine. This - is what results in the above error - - EXAMPLE 2 - --------- - domain.com IN SOA (...stuff...) - IN MX mail.domain.com. - mail IN CNAME machine.domain.com. - machine IN A 1.2.3.4 - - This would cause the MX variety of the error. - - The fix is point MX and NS records to a machine that is defined explicitly - by an IN A record. - ------------------------------------------------------------------------------ - -Question 6.21. ERROR:Masters for secondary zone [XX] unreachable - -Date: Wed Jul 9 22:24:27 EDT 1997 - -If syslog reports "Masters for secondary zone [XX] unreachable", the -initial attempts to load a zone failed, and the name server is still -trying. If this occurs multiple times, a problem exists, likely on the -primary server. This is a fairly generic error, and could indicate a vast -number of problems. It might be that named is not running on the primary -server, or they do not have the correct zone file. If this keeps up long -enough a zone might expire. - ------------------------------------------------------------------------------ - -Question 6.22. ERROR:secondary zone [XX] expired - -Date: Wed Jul 9 22:25:53 EDT 1997 - -If syslog reports "secondary zone [XX] expired", there has been a -expiration of a secondary zone on this server. - -An expired zone is one in which a transfer hasn't successfully been -completed in the amount of time specified before a zone expires. - -This problem could be anything which prevents a zone transfer: The primary -server is down, named isn't running on the primary, named.boot has the -wrong IP address, etc. - ------------------------------------------------------------------------------ - -Question 6.23. ERROR:bad response to SOA query from [address] - -Date: Wed Jan 14 12:15:11 EST 1998 - -If syslog reports "bad response to SOA query from [address], zone [name]", -a syntax error may exist in the SOA record of the zone your server is -attempting to pull. - -It may also indicate that the primary server is lame, possibly due to a -syntax error somewhere in the zone file. - ------------------------------------------------------------------------------ - -Question 6.24. ERROR:premature EOF, fetching [zone] - -Date: Wed Jul 9 22:28:26 EDT 1997 - -If syslog reports "premature EOF, fetching [zone]", a syntax error exists -on the zone at the primary location, likely towards the End of File (EOF) -location. - ------------------------------------------------------------------------------ - -Question 6.25. ERROR:Zone [XX] SOA serial# rcvd from [Y] is < ours - -Date: Wed Jul 9 22:30:03 EDT 1997 - -If syslog reports "Zone [name] SOA serial# rcvd from [address] is < ours", -the zone transfer failed because the primary machine has a lower serial -number in the SOA record than the one on file on this server. - ------------------------------------------------------------------------------ - -Question 6.26. ERROR:connect(IP/address) for zone [XX] failed - -Date: Wed Jan 14 12:21:40 EST 1998 - -If syslog reports "connect(address) for zone [name] failed: No route to -host" or "connect(address) for zone [name] failed: Connection timed out", -it could be that there is no route to the specified host or a slow primary -system. Try a traceroute to the address specified to isolate the problem. -The problem may be a mistyped IP address in named.boot. - -A very slow primary machine or a connection may have been initialized, -then connectivity lost for some reason, etc. Try networking -troubleshooting tools like ping and traceroute, then try connecting to -port 53 using nslookup or dig. - -If syslog reports "connect(address) for zone [name] failed: Connection -refused", the destination address is not allowing the connection. Either -the destination is not running DNS (port 53), or possibly filtering the -connection from you. It is also possible that the named.boot is pointing -to the wrong address. - ------------------------------------------------------------------------------ - -Question 6.27. ERROR:sysquery: no addrs found for NS - -Date: Wed Jul 9 22:37:01 EDT 1997 - -If syslog reports "sysquery: no addrs found for NS" , the IN NS record may -be pointing to a host with no IN A record. - ------------------------------------------------------------------------------ - -Question 6.28. ERROR:zone [name] rejected due to errors - -Date: Wed Jul 9 22:37:51 EDT 1997 - -If syslog reports "primary zone [name] rejected due to errors", there will -likely be another more descriptive error along with this, like "zonefile: -line 17: database format error". That zone file should be investigated -for errors. - -=============================================================================== - -Section 7. ACKNOWLEDGEMENTS - - Q7.1 How is this FAQ generated ? - Q7.2 What formats are available ? - Q7.3 Contributors - ------------------------------------------------------------------------------ - -Question 7.1. How is this FAQ generated ? - -Date: Mon Jun 15 21:45:53 EDT 1998 - -This FAQ is maintained in BFNN (Bizzarre Format with No Name). This -allows me to create ASCII, HTML, and GNU info (postscript coming soon) -from one source file. - -The perl script "bfnnconv.pl" that is available with the linux FAQ is used -to generate the various output files from the BFNN source. This script is -available at - -txs-11.mit.edu : /pub/linux/docs/linux-faq/linux-faq.source.tar.gz - ------------------------------------------------------------------------------ - -Question 7.2. What formats are available ? - -Date: Fri Dec 6 16:51:31 EST 1996 - -You may obtain one of the following formats for this document: - -* ASCII: http://www.intac.com/~cdp/cptd-faq/cptd-faq.ascii -* BFNN: http://www.intac.com/~cdp/cptd-faq/cptd-faq.bfnn -* GNU info: http://www.intac.com/~cdp/cptd-faq/cptd-faq.info -* HTML: http://www.intac.com/~cdp/cptd-faq/index.html - ------------------------------------------------------------------------------ - -Question 7.3. Contributors - -Date: Thu Jul 16 10:45:57 EDT 1998 - -Many people have helped put this list together. Listed in e-mail address -alphabetical order, the following people have contributed to this FAQ: - -* <BERI@etf.bg.ac.yu> (Berislav Todorovic) -* <Benoit.Grange@inria.fr> (Benoit.Grange) -* <D.T.Shield@csc.liv.ac.uk> (Dave Shield) -* <Karl.Auer@anu.edu.au> (Karl Auer) -* <Todd.Aven@BankersTrust.Com> -* <adam@comptech.demon.co.uk> (Adam Goodfellow) -* <andras@is.co.za> (Andras Salamon) -* <barmar@bbnplanet.com> (Barry Margolin) -* <barr@pop.psu.edu> (David Barr) -* <bj@herbison.com> (B.J. Herbison) -* <bje@cbr.fidonet.org> (Ben Elliston) -* <brad@birch.ims.disa.mil> (Brad Knowles) -* <ckd@kei.com> (Christopher Davis) -* <cdp2582@hertz.njit.edu> (Chris Peckham) -* <cricket@hp.com> (Cricket Liu) -* <cudep@csv.warwick.ac.uk> (Ian 'Vato' Dickinson [ID17]) -* <dj@netscape.com> (David Jagoda) -* <djk@cyber.com.au> (David Keegel) -* <dillon@best.com> (Matthew Dillon) -* <dparter@cs.wisc.edu> (David Parter) -* <e07@nikhef.nl> (Eric Wassenaar) -* <fitz@think.com> (Tom Fitzgerald) -* <fwp@CC.MsState.Edu> (Frank Peters) -* <gah@cco.caltech.edu> (Glen A. Herrmannsfeldt) -* <glenn@popco.com> (Glenn Fleishman) -* <harvey@indyvax.iupui.edu> (James Harvey) -* <hubert@cac.washington.edu> (Steve Hubert) -* <ivanl@pacific.net.sg> (Ivan Leong) -* <jpass@telxon.com> (Jim Pass) -* <jhawk@panix.com> (John Hawkinson) -* <jmalcolm@uunet.uu.net> (Joseph Malcolm) -* <jprovo@augustus.ultra.net> (Joe Provo) -* <jrs@foliage.com> (J. Richard Sladkey) -* <jsd@gamespot.com> (Jon Drukman) -* <jwells@pacificcoast.net> (John Wells) -* <kop@meme.com> (Karl O. Pinc) -* <kevin@cfc.com> (Kevin Darcy) -* <lamont@abstractsoft.com> (Sean T. Lamont) -* <lavondes@tidtest.total.fr> (Michel Lavondes) -* <mark@ucsalf.ac.uk> (Mark Powell) -* <marka@syd.dms.CSIRO.AU> (Mark Andrews) -* <mathias@unicorn.swi.com.sg> (Mathias Koerber) -* <mfuhr@dimensional.com> (Michael Fuhr) -* <mike@westie.gi.net> (Michael Hawk) -* <mjo@iao.ford.com> (Mike O'Connor) -* <nick@flapjack.ieunet.ie> (Nick Hilliard) -* <oppedahl@popserver.panix.com> (Carl Oppedahl) -* <patrick@oes.amdahl.com> (Patrick J. Horgan) -* <paul@software.com> (Paul Wren) -* <pb@fasterix.frmug.fr.net> (Pierre Beyssac) -* <ph10@cus.cam.ac.uk> (Philip Hazel) -* <phil@netpart.com> (Phil Trubey) -* <raj@ceeri.ernet.in> (Raj Singh) -* <rocky@panix.com> (R. Bernstein) -* <rv@seins.Informatik.Uni-Dortmund.DE> (Ruediger Volk) -* <sedwards@sedwards.com> (Steve Edwards) -* <shields@tembel.org> (Michael Shields) -* <spsprunk@pop.srv.paranet.com> (Stephen Sprunk) -* <tanner@george.arc.nasa.gov> (Rob Tanner) -* <vixie@vix.com> (Paul A Vixie) -* <wag@swl.msd.ray.com> (William Gianopoulos) -* <whg@inel.gov> (Bill Gray) -* <wolf@pasteur.fr> (Christophe Wolfhugel) - -Thank you ! - diff --git a/contrib/bind/doc/misc/rfc2317-notes.txt b/contrib/bind/doc/misc/rfc2317-notes.txt deleted file mode 100644 index 0b62d2a..0000000 --- a/contrib/bind/doc/misc/rfc2317-notes.txt +++ /dev/null @@ -1,105 +0,0 @@ -Message-Id: <200005230246.WAA03750@hrothgar.gw.com> -To: ... -Subject: Notes on RFC-2317 -Date: Mon, 22 May 2000 22:46:55 -0400 -From: Kimmo Suominen <kim@tac.nyc.ny.us> - -Hi! - -I wrote down some notes on RFC-2317. I've had discussions with all of -you regarding classless IN-ADDR.ARPA delegations, and I would very much -appreciate any comments you may have. Please feel free to forward this -to other parties as you see necessary or appropriate. - -The goal of these notes is to try and clarify the reasoning behind the -recommendations I've been making on implementing RFC-2317 delegations. -In particular the following issues keep coming up with again and again -with each vendor: - - - why use "-" instead of "/" - - why use particular NS records - - why delegate within IN-ADDR.ARPA - -I am hoping that the these notes could eventually be used to convince -ISPs to provide an efficient and smooth implementation of RFC-2317 with -the least amount of headache for the end-user. - -Regards, -+ Kim - - - -NOTES ON IMPLEMENTING CLASSLESS IN-ADDR.ARPA DELEGATION PER RFC-2317 - -1. Selecting the CNAME target zone - - RFC-2317 shows an example case where the target zone is a delegated - sub-zone of the IN-ADDR.ARPA zone for the natural class C network. - This will allow for the NS records for the zone can be independently - selected (see benefits described below). An example of such a zone - would be 0-28.150.80.204.IN-ADDR.ARPA. - - Now pay careful attention to the last paragraph of RFC-2317. There - are broken resolver implementations that apply the "valid host name" - restrictions on the CNAME target (it should only be applied to the - PTR target name). To avoid problems with such implementations it - is best to use a character that is allowed in a hostname. I prefer - using a hyphen, as I did in the example above. - - Some ISPs may at first refuse to delegate these zones (without any - explanation). Approach such ISPs with the reasoning in here first, - but if that fails consider using your "forward" zone as a fallback. - - There is nothing magic about the IN-ADDR.ARPA zone for RFC-2317 - delegations. You will have to sacrifice the optimization provided - by a correct IN-ADDR.ARPA delegation, but you will still retain - the ease of local administration for all name changes. - - I recommend using a dedicated subdomain for the PTR records, e.g. if - your "forward" domain is "HOME.GW.COM" use "REV.HOME.GW.COM" for the - PTR records. - -2. Selecting the NS records - - The NS records for the delegated zone should include all the NS - records of the parent zone, in addition to any NS records pointing - to the public name servers the delegate may want to use. Having the - name servers of the parent zone secondary the delegated zone allows - them to have the necessary authoritative data to return the CNAME - target in the additional records of a response to a PTR record query - (minimizing the number of queries needed to resolve an address). - - This can be achieved using any zone (i.e. even a subdomain of your - "forward" domain), of course. However, having the ISP delegate an - IN-ADDR.ARPA zone for your PTR records rather than you delegating a - zone to your ISP maintains the logical "owner" and "delegate" roles. - - If the primary server for the delegated zone is not permanently on - the Internet (e.g. a dial-on-demand connection) then you would not - want to advertise it in the NS records. It would just be a stealth - server which the advertised secondaries poll for updates. - -3. Example delegation - - To delegate our example zone 0-28.150.80.204.IN-ADDR.ARPA first look - at the NS records of the parent zone 150.80.204.IN-ADDR.ARPA. Let's - say they are the following: - - $ORIGIN 150.80.204.IN-ADDR.ARPA. - @ IN NS GRENDEL.GW.COM. - IN NS PYRY.GW.COM. - - To delegate 204.80.150.0/28 to SRV.HOME.GW.COM you would then insert - these records in the parent zone data: - - $ORIGIN 150.80.204.IN-ADDR.ARPA. - 0-28 IN NS SRV.HOME.GW.COM. - IN NS GRENDEL.GW.COM. - IN NS PYRY.GW.COM. - $GENERATE 0-15 $ IN CNAME $.0-28.150.80.204.IN-ADDR.ARPA. - - The necessary modifications to /etc/named.conf will be left as an - exercise to the reader. - -Kimmo Suominen -Global Wire Oy diff --git a/contrib/bind/doc/misc/style.txt b/contrib/bind/doc/misc/style.txt deleted file mode 100644 index a966066..0000000 --- a/contrib/bind/doc/misc/style.txt +++ /dev/null @@ -1,172 +0,0 @@ -Path: vixie!vixie -From: vixie@vix.com (Paul A Vixie) -Newsgroups: comp.protocols.tcp-ip.domains -Subject: Re: Format of DNS files (style question) -Date: 28 Aug 94 03:17:08 -Organization: Vixie Enterprises -Lines: 159 -Distribution: inet -Message-ID: <VIXIE.94Aug28031708@office.home.vix.com> -References: <33onnr$i4u@zombie.ncsc.mil> -NNTP-Posting-Host: office.home.vix.com -In-reply-to: sjr@zombie.ncsc.mil's message of 27 Aug 1994 21:02:51 -0400 - -> (Style) Suggestions for how to layout DNS configuration files (both -> forward and reverse)? - -I've gone back and forth on the question of whether the BOG should include a -section on this topic. I know what I myself prefer, but I'm wary of ramming -my own stylistic preferences down the throat of every BOG reader. But since -you ask :-)... - -Create /var/named. If your system is too old to have a /var, either create -one or use /usr/local/adm/named instead. Put your named.boot in it, and make -/etc/named.boot a symlink to it. If your system doesn't have symlinks, you're -S-O-L (but you knew that). In named.boot, put a "directory" directive that -specifies your actual BIND working directory: - - directory /var/named - -All relative pathnames used in "primary", "secondary", and "cache" directives -will be evaluated relative to this directory. Create two subdirectories, -/var/named/pri and /var/named/sec. Whenever you add a "primary" directive -to your named.boot, use "pri/WHATEVER" as the path name. And then put the -primary zone file into "pri/WHATEVER". Likewise when you add "secondary" -directives, use "sec/WHATEVER" and BIND (really named-xfer) will create the -files in that subdirectory. - -(Variations: (1) make a midlevel directory "zones" and put "pri" and "sec" -into it; (2) if you tend to pick up a lot of secondaries from a few hosts, -group them together in their own subdirectories -- something like -/var/named/zones/uucp if you're a UUCP Project name server.) - -For your forward files, name them after the zone. dec.com becomes -"/var/named/zones/pri/dec.com". For your reverse files, name them after the -network number. 0.1.16.in-addr.arpa becomes "/var/named/zones/pri/16.1.0". - -When creating or maintaining primary zone files, try to use the same SOA -values everywhere, except for the serial number which varies per zone. Put -a $ORIGIN directive at the top of the primary zone file, not because it's -needed (it's not since the default origin is the zone named in the "primary" -directive) but because it make it easier to remember what you're working on -when you have a lot of primary zones. Put some comments up there indicating -contact information for the real owner if you're proxying. Use RCS and put -the "$Id: style.txt,v 8.1 1995/12/22 21:59:52 vixie Exp $" in a ";" comment near the top of the zone file. - -The SOA and other top level information should all be listed together. But -don't put IN on every line, it defaults nicely. For example: - -============== -@ IN SOA gw.home.vix.com. postmaster.vix.com. ( - 1994082501 ; serial - 3600 ; refresh (1 hour) - 1800 ; retry (30 mins) - 604800 ; expire (7 days) - 3600 ) ; minimum (1 hour) - - NS gw.home.vix.com. - NS ns.uu.net. - NS uucp-gw-1.pa.dec.com. - NS uucp-gw-2.pa.dec.com. - - MX 10 gw.home.vix.com. - MX 20 uucp-gw-1.pa.dec.com. - MX 20 uucp-gw-1.pa.dec.com. -============== - -I don't necessarily recommend those SOA values. Not every zone is as volatile -as the example shown. I do recommend that serial number format; it's in date -format with a 2-digit per-day revision number. This format will last us until -2147 A.D. at which point I expect a better solution will have been found :-). -(Note that it would last until 4294 A.D. except that there are some old BINDs -out there that use a signed quantity for representing serial number interally; -I suppose that as long as none of these are still running after 2047 A.D., -that we can use the above serial number format until 4294 A.D., at which point -a better solution will HAVE to be found.) - -You'll note that I use a tab stop for "IN" even though I never again specify -it. This leaves room for names longer than 7 bytes without messing up the -columns. You might also note that I've put the MX priority and destination -in the same tab stop; this is because both are part of the RRdata and both -are very different from MX which is an RRtype. Some folks seem to prefer to -group "MX" and the priority together in one tab stop. While this looks neat -it's very confusing to newcomers and for them it violates the law of least -astonishment. - -If you have a multi-level zone (one which contains names that have dots in -them), you can use additional $ORIGIN statements but I recommend against it -since there is no "back" operator. That is, given the above example you can -add: - -============= -$ORIGIN home -gw A 192.5.5.1 -============= - -The problem with this is that subsequent RR's had better be somewhere under -the "home.vix.com" name or else the $ORIGIN that introduces them will have -to use a fully qualified name. FQDN $ORIGIN's aren't bad and I won't be mad -if you use them. Unqualified ones as shown above are real trouble. I usually -stay away from them and just put the whole name in: - -============= -gw.home A 192.5.5.1 -============= - -In your reverse zones, you're usually in some good luck because the owner name -is usually a single short token or sometimes two. - -============= -$ORIGIN 5.5.192.in-addr.arpa. -@ IN SOA ... - NS ... -1 PTR gw.home.vix.com. -------------- -$ORIGIN 1.16.in-addr.arpa. -@ IN SOA ... - NS ... -2.0 PTR gatekeeper.dec.com. -============= - -It is usually pretty hard to keep your forward and reverse zones in synch. -You can avoid that whole problem by just using "h2n" (see the ORA book, DNS -and BIND, and its sample toolkit, included in the BIND distribution or on -ftp.uu.net (use the QUOTE SITE EXEC INDEX command there to find this -- I -never can remember where it's at). "h2n" and many tools like it can just -read your old /etc/hosts file and churn it into DNS zone files. (May I -recommend contrib/decwrl/mkdb.pl from the BIND distribution?) However, if -you (like me) prefer to edit these things by hand, you need to follow the -simple convention of making all of your holes consistent. If you use -192.5.5.1 and 192.5.5.3 but not (yet) 192.5.5.2, then in your forward file -you will have something like - -============= -... -gw.home A 192.5.5.1 -;avail A 192.5.5.2 -pc.home A 192.5.5.3 -============= - -and in your reverse file you will have something like - -============= -... -1 PTR gw.home.vix.com. -;2 PTR avail -3 PTR pc.home.vix.com. -============= - -This convention will allow you to keep your sanity and make fewer errors. -Any kind of automation (h2n, mkdb, or your own perl/tcl/awk/python tools) -will help you maintain a consistent universe even if it's also a complex -one. Editing by hand doesn't have to be deadly but you MUST take care. - -Anyone who wants to know how to maintain nonleaf zones, i.e., zones which -have few or no hosts in them but have hundreds or thousands of delegations, -should attend Usenix LISA in San Diego and be there for the SENDS talk. -Contact office@usenix.org for conference information. --- -Paul Vixie -Redwood City, CA -decwrl!vixie!paul -<paul@vix.com> |
