* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

* PERFORMANCE OF THIS SOFTWARE.

*/

#ifndef CHECK_TOOL_H

#define CHECK_TOOL_H

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

/*

* Copyright (C) 2000-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

ADD_STRING(buf, " ");

}

result = dns_rdata_totext(rdata, NULL, buf);

check_result(result, "dns_rdata_totext");

if (query->lookup->identify) {

TIME_NOW(&now);

{

dns_name_t *name;

dns_rdataset_t *rdataset;

isc_result_t result, loopresult;

dns_name_t empty_name;

dns_rdata_t rdata = DNS_RDATA_INIT;

UNUSED(flags);

name = NULL;

dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);

for (rdataset = ISC_LIST_HEAD(name->list);

rdataset != NULL;

rdataset = ISC_LIST_NEXT(rdataset, link)) {

dns_rdataset_current(rdataset, &rdata);

result = say_message(&rdata, query,

buf);

check_result(result, "say_message");

loopresult = dns_rdataset_next(rdataset);

dns_rdata_reset(&rdata);

printf(" ad");

if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0)

printf(" cd");

printf("; QUERY: %u, ANSWER: %u, "

"AUTHORITY: %u, ADDITIONAL: %u\n",

/*

* Copyright (C) 2000-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file

* \note

char **tempp, FILE **fp);

isc_result_t removetmpkey(isc_mem_t *mctx, const char *file);

void clean_trustedkey(void);

#if DIG_SIGCHASE_BU

isc_result_t getneededrr(dns_message_t *msg);

void sigchase_bottom_up(dns_message_t *msg);

keynametext, isc_result_totext(result));

goto failure;

}

failure:

if (dstkey != NULL)

dst_key_free(&dstkey);

}

static void

create_search_list(lwres_conf_t *confdata) {

int i;

dig_searchlist_t *search;

debug("create_search_list()");

for (i = 0; i < confdata->searchnxt; i++) {

search = make_searchlist_entry(confdata->search[i]);

else { /* No search list. Use the domain name if any */

if (lwconf->domainname != NULL) {

domain = make_searchlist_entry(lwconf->domainname);

domain = NULL;

}

}

}

/*%

* Override the search list derived from resolv.conf by 'domain'.

*/

if (dnssec)

rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;

if (nsid) {

} else {

rdata->data = NULL;

rdata->length = 0;

isc_result_totext(ISC_R_NOMEMORY));

}

isc_task_send(global_task, &event);

}

query->waiting_connect = ISC_TRUE;

query->lookup->current_query = query;

result = get_address(query->servname, port, &query->sockaddr);

/*

* This servname doesn't have an address. Try the next server

* by triggering an immediate 'timeout' (we lie, but the effect

/* XXX Check the sense of this, need assertion? */

query->waiting_connect = ISC_FALSE;

result = get_address(query->servname, port, &query->sockaddr);

/* This servname doesn't have an address. */

force_timeout(l, query);

return;

}

void

{

return;

if (tk_list.nb_tk >= MAX_TRUSTED_KEY)

return;

return;

}

fclose(fp);

return (ISC_R_FAILURE);

}

#if 0

dst_key_tofile(key, DST_TYPE_PUBLIC,"/tmp");

#endif

}

return (ISC_R_SUCCESS);

}

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

.\"

.\" Permission to use, copy, modify, and/or distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

.\"

.hy 0

.ad l

Non\-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a name server.

.PP

Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial timeout to 10 seconds, type:

.SH "INTERACTIVE COMMANDS"

.PP

\fBhost\fR [server]

.PP

Andrew Cherenson

.SH "COPYRIGHT"

.br

"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

[<!ENTITY mdash "&#8212;">]>

<!--

-

- Permission to use, copy, modify, and/or distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- PERFORMANCE OF THIS SOFTWARE.

-->

<!--

- Copyright (c) 1985, 1989

- The Regents of the University of California. All rights reserved.

<year>2005</year>

<year>2006</year>

<year>2007</year>

<holder>Internet Systems Consortium, Inc. ("ISC")</holder>

</copyright>

</docinfo>

arguments and are prefixed with a hyphen. For example, to

change the default query type to host information, and the initial

timeout to 10 seconds, type:

<programlisting>

nslookup -query=hinfo -timeout=10

</programlisting>

</para>

</refsect1>

<!--

-

- Permission to use, copy, modify, and/or distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">nslookup</code> [<code class="option">-option</code>] [name | -] [server]</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">Nslookup</strong></span>

is a program to query Internet domain name servers. <span><strong class="command">Nslookup</strong></span>

has two modes: interactive and non-interactive. Interactive mode allows

</p>

</div>

<div class="refsect1" lang="en">

<p>

Interactive mode is entered in the following cases:

</p>

arguments and are prefixed with a hyphen. For example, to

change the default query type to host information, and the initial

timeout to 10 seconds, type:

nslookup -query=hinfo -timeout=10

<p>

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>

<dd>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p><code class="filename">/etc/resolv.conf</code>

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,

<span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,

<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.

</p>

</div>

<div class="refsect1" lang="en">

<p>

Andrew Cherenson

</p>

.\" Permission to use, copy, modify, and/or distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

.\" copyright notice and this permission notice appear in all copies.

.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

.\"

.hy 0

.ad l

<!--

- Permission to use, copy, modify, and/or distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

- copyright notice and this permission notice appear in all copies.

- THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH

- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY

- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM

- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code> {-s} [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>dir</code></em></code>] {dnsname}</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">dnssec-dsfromkey</strong></span>

outputs the Delegation Signer (DS) resource record (RR), as defined in

RFC 3658 and RFC 4509, for the given key(s).

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term">-1</span></dt>

<dd><p>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p>

To build the SHA-256 DS RR from the

<strong class="userinput"><code>Kexample.com.+003+26160</code></strong>

</p>

</div>

<div class="refsect1" lang="en">

<p>

The keyfile can be designed by the key identification

<code class="filename">Knnnn.+aaa+iiiii</code> or the full file name

</p>

</div>

<div class="refsect1" lang="en">

<p>

A keyfile error can give a "file not found" even if the file exists.

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>,

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-k</code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">dnssec-keyfromlabel</strong></span>

gets keys with the given label from a crypto hardware and builds

key files for DNSSEC (Secure DNS), as defined in RFC 2535

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>

<dd>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p>

When <span><strong class="command">dnssec-keyfromlabel</strong></span> completes

successfully,

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>,

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code> {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">dnssec-keygen</strong></span>

generates keys for DNSSEC (Secure DNS), as defined in RFC 2535

and RFC 4034. It can also generate keys for use with

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>

<dd>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p>

When <span><strong class="command">dnssec-keygen</strong></span> completes

successfully,

</p>

</div>

<div class="refsect1" lang="en">

<p>

To generate a 768-bit DSA key for the domain

<strong class="userinput"><code>example.com</code></strong>, the following command would be

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>,

<em class="citetitle">RFC 2539</em>,

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

/*

* Portions Copyright (C) 1999-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

if (delegation(name, node, NULL)) {

zonecut = dns_fixedname_name(&fzonecut);

dns_name_copy(name, zonecut, NULL);

}

}

/*%

* Generate NSEC records for the zone and remove NSEC3/NSEC3PARAM records.

*/

result = dns_dbiterator_first(dbiter);

check_result(result, "dns_dbiterator_first()");

while (!done) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

if (delegation(name, node, &nsttl)) {

zonecut = dns_fixedname_name(&fzonecut);

dns_name_copy(name, zonecut, NULL);

dns_fixedname_t fname, fnextname, fzonecut;

dns_name_t *name, *nextname, *zonecut;

dns_rdataset_t rdataset;

int order;

isc_boolean_t active;

isc_boolean_t done = ISC_FALSE;

result = dns_dbiterator_first(dbiter);

check_result(result, "dns_dbiterator_first()");

while (!done) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

result = dns_dbiterator_next(dbiter);

nextnode = NULL;

while (result == ISC_R_SUCCESS) {

while (!done) {

result = dns_dbiterator_current(dbiter, &node, name);

check_dns_dbiterator_current(result);

result = dns_dbiterator_next(dbiter);

nextnode = NULL;

while (result == ISC_R_SUCCESS) {

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code> [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">dnssec-signzone</strong></span>

signs a zone. It generates

NSEC and RRSIG records and produces a signed version of the

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term">-a</span></dt>

<dd><p>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p>

The following command signs the <strong class="userinput"><code>example.com</code></strong>

zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>

%</pre>

</div>

<div class="refsect1" lang="en">

<p>

<span><strong class="command">dnssec-signzone</strong></span> was designed so that it could

sign a zone partially, using only a subset of the DNSSEC keys

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,

<em class="citetitle">BIND 9 Administrator Reference Manual</em>,

<em class="citetitle">RFC 4033</em>.

</p>

</div>

<div class="refsect1" lang="en">

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

/*

* Copyright (C) 2001-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file

* \brief

static isc_result_t

do_version_lookup(dns_sdblookup_t *lookup) {

if (ns_g_server->version == NULL)

return (ISC_R_SUCCESS);

else

"Michael Graff",

"Andreas Gustafsson",

"Bob Halley",

"David Lawrence",

"Danny Mayer",

"Damien Neil",

if (b->contact != NULL)

contact = b->contact;

}

result = dns_sdb_putsoa(lookup, server, contact, 0);

if (result != ISC_R_SUCCESS)

return (ISC_R_FAILURE);

*dbdata = &authors_builtin;

else if (strcmp(argv[0], "id") == 0)

*dbdata = &id_builtin;

builtin_t *empty;

char *server;

char *contact;

* PERFORMANCE OF THIS SOFTWARE.

*/

#include <config.h>

/*

* Copyright (C) 2001-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

* isc_app_shutdown below.

*/

#endif

ns_server_flushonshutdown(ns_g_server, ISC_FALSE);

ns_os_shutdownmsg(command, text);

isc_app_shutdown();

result = ISC_R_SUCCESS;

} else if (command_compare(command, NS_COMMAND_STOP)) {

#ifdef HAVE_LIBSCF

if (ns_smf_got_instance == 1 && ns_smf_chroot == 1) {

result = ns_smf_add_message(text);

* PERFORMANCE OF THIS SOFTWARE.

*/

#ifndef NAMED_GLOBALS_H

#define NAMED_GLOBALS_H 1

EXTERN isc_boolean_t ns_g_memstatistics INIT(ISC_FALSE);

EXTERN isc_boolean_t ns_g_clienttest INIT(ISC_FALSE);

EXTERN isc_boolean_t ns_g_nosoa INIT(ISC_FALSE);

#undef EXTERN

#undef INIT

* PERFORMANCE OF THIS SOFTWARE.

*/

#ifndef NAMED_QUERY_H

#define NAMED_QUERY_H 1

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

ns_g_clienttest = ISC_TRUE;

else if (!strcmp(isc_commandline_argument, "nosoa"))

ns_g_nosoa = ISC_TRUE;

else

fprintf(stderr, "unknown -T flag '%s\n",

isc_commandline_argument);

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

static void

query_addwildcardproof(ns_client_t *client, dns_db_t *db,

dns_dbversion_t *version, dns_name_t *name,

{

isc_buffer_t *dbuf, b;

dns_name_t *fname;

goto cleanup;

query_findclosestnsec3(wname, db, NULL, client, rdataset,

if (!dns_rdataset_isassociated(rdataset))

goto cleanup;

query_addrrset(client, &fname, &rdataset, &sigrdataset,

/* XXX */

query_addwildcardproof(client, db, version, client->query.qname,

/*

* We'll need some resources...

query_releasename(client, &fname);

query_addwildcardproof(client, db, version,

client->query.qname,

}

}

if (dns_rdataset_isassociated(rdataset)) {

&sigrdataset,

NULL, DNS_SECTION_AUTHORITY);

query_addwildcardproof(client, db, version,

}

/*

/*

* We didn't match any rdatasets.

*/

result == ISC_R_NOMORE) {

/*

* XXXRTH If this is a secure zone and we

* glue. Ugh.

*/

if (!is_zone) {

authoritative = ISC_FALSE;

dns_rdatasetiter_destroy(&rdsiter);

if (RECURSIONOK(client)) {

if (need_wildcardproof && dns_db_issecure(db))

query_addwildcardproof(client, db, version,

dns_fixedname_name(&wildcardname),

cleanup:

CTRACE("query_find: cleanup");

/*

/*

* Assume authoritative response until it is known to be

* otherwise.

*/

/*

* Set AD. We must clear it if we add non-validated data to a

/*

* Copyright (C) 1999-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

{ "168.192.IN-ADDR.ARPA", ISC_TRUE },

#endif

{ "0.IN-ADDR.ARPA", ISC_FALSE }, /* THIS NETWORK */

{ "127.IN-ADDR.ARPA", ISC_FALSE }, /* LOOPBACK */

{ "254.169.IN-ADDR.ARPA", ISC_FALSE }, /* LINK LOCAL */

{ "2.0.192.IN-ADDR.ARPA", ISC_FALSE }, /* TEST NET */

{ "255.255.255.255.IN-ADDR.ARPA", ISC_FALSE }, /* BROADCAST */

/* Local IPv6 Unicast Addresses */

{ "A.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */

{ "B.E.F.IP6.ARPA", ISC_FALSE }, /* LINK LOCAL */

{ NULL, ISC_FALSE }

};

n = snprintf((char *)isc_buffer_used(text),

isc_buffer_availablelength(text),

"%d tsig keys deleted.\n", foundkeys);

return (ISC_R_NOSPACE);

isc_buffer_add(text, n);

return (ISC_R_SUCCESS);

n = snprintf((char *)isc_buffer_used(text),

isc_buffer_availablelength(text),

"no tsig keys found.\n");

return (ISC_R_NOSPACE);

isc_buffer_add(text, n);

}

/*

* Copyright (C) 1999-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

#include <config.h>

CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN, name,

rdataset.ttl, &sig_rdata));

dns_rdata_reset(&sig_rdata);

added_sig = ISC_TRUE;

}

if (!added_sig) {

/*

* Copyright (C) 1999-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

#include <config.h>

#ifdef DLZ

{

/*

*/

if (client->view->dlzdatabase != NULL) {

result = dns_dlzallowzonexfr(client->view,

&db);

if (result == ISC_R_NOPERM) {

#ifdef DLZ

if (is_dlz)

dns_message_gettsigkey(request),

tsigbuf,

3600,

&xfr));

else

#endif

dns_message_gettsigkey(request),

tsigbuf,

dns_zone_getmaxxfrout(zone),

.\" Copyright (C) 2000-2003 Internet Software Consortium.

.\"

.\" Permission to use, copy, modify, and/or distribute this software for any

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

.\"

.hy 0

.ad l

\fB\-k\fR.

.RE

.PP

\fBprereq nxdomain\fR {domain\-name}

.RS 4

Requires that no resource record of any type exists with name

.PP

The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.

.SH "COPYRIGHT"

.br

Copyright \(co 2000\-2003 Internet Software Consortium.

.br

/*

* Copyright (C) 2000-2003 Internet Software Consortium.

*

* Permission to use, copy, modify, and/or distribute this software for any

* PERFORMANCE OF THIS SOFTWARE.

*/

/*! \file */

#include <isc/log.h>

#include <isc/mem.h>

#include <isc/parseint.h>

#include <isc/random.h>

#include <isc/region.h>

#include <isc/sockaddr.h>

#ifdef GSSAPI

static dns_fixedname_t fkname;

static isc_sockaddr_t *kserver = NULL;

static char servicename[DNS_NAME_FORMATSIZE];

static dns_name_t *keyname;

typedef struct nsu_gssinfo {

debug("keycreate");

result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,

if (result != ISC_R_SUCCESS)

fprintf(stderr, "could not create key from %s: %s\n",

keystr, dns_result_totext(result));

isc_mem_free(mctx, secret);

}

static void

setup_keyfile(void) {

dst_key_t *dstkey = NULL;

debug("Creating key...");

result = dst_key_fromnamedfile(keyfile,

DST_TYPE_PRIVATE | DST_TYPE_KEY, mctx,

&dstkey);

if (result != ISC_R_SUCCESS) {

return;

}

switch (dst_key_alg(dstkey)) {

hmacname, dstkey, ISC_FALSE,

NULL, 0, 0, mctx, NULL,

&tsigkey);

if (result != ISC_R_SUCCESS) {

fprintf(stderr, "could not create key from %s: %s\n",

keyfile, isc_result_totext(result));

return;

}

} else

}

static void

if (tsigkey != NULL)

dns_tsigkey_detach(&tsigkey);

result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,

&tsigkey);

isc_mem_free(mctx, secret);

if (result != ISC_R_SUCCESS) {

}

static isc_uint16_t

evaluate_ttl(char *cmdline) {

char *word;

isc_result_t result;

usegsstsig = ISC_FALSE;

return (evaluate_key(cmdline));

}

if (strcasecmp(word, "gsstsig") == 0) {

#ifdef GSSAPI

usegsstsig = ISC_TRUE;

fprintf(stderr, "Sending update to %s\n", addrbuf);

}

result = dns_request_createvia3(requestmgr, updatemsg, srcaddr,

master, options, tsigkey, timeout,

udp_timeout, udp_retries, global_task,

servname = dns_fixedname_name(&fname);

result = isc_string_printf(servicename, sizeof(servicename),

if (result != ISC_R_SUCCESS)

fatal("isc_string_printf(servicename) failed: %s",

isc_result_totext(result));

isc_result_totext(result));

/* Build first request. */

context = GSS_C_NO_CONTEXT;

result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0,

&context, use_win2k_gsstsig);

dns_name_init(name, NULL);

dns_name_clone(userzone, name);

} else {

result = dns_message_firstname(updatemsg, section);

if (result == ISC_R_NOMORE) {

section = DNS_SECTION_PREREQUISITE;

dns_message_currentname(updatemsg, section, &firstname);

dns_name_init(name, NULL);

dns_name_clone(firstname, name);

}

ISC_LIST_INIT(name->list);

isc_mem_put(mctx, kserver, sizeof(isc_sockaddr_t));

kserver = NULL;

}

#endif

ddebug("Shutting down task manager");

"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

[<!ENTITY mdash "&#8212;">]>

<!--

- Copyright (C) 2000-2003 Internet Software Consortium.

-

- Permission to use, copy, modify, and/or distribute this software for any

- PERFORMANCE OF THIS SOFTWARE.

-->

<refentry id="man.nsupdate">

<refentryinfo>

<date>Jun 30, 2000</date>

<year>2007</year>

<year>2008</year>

<year>2009</year>

<holder>Internet Systems Consortium, Inc. ("ISC")</holder>

</copyright>

<copyright>

<varlistentry>

<term>

<command>prereq nxdomain</command>

<arg choice="req">domain-name</arg>

</term>

<!--

- Copyright (C) 2000-2003 Internet Software Consortium.

-

- Permission to use, copy, modify, and/or distribute this software for any

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

<html>

<head>

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<div class="cmdsynopsis"><p><code class="command">nsupdate</code> [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] | [<code class="option">-o</code>] | [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] | [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">nsupdate</strong></span>

is used to submit Dynamic DNS Update requests as defined in RFC2136

to a name server.

</p>

</div>

<div class="refsect1" lang="en">

<p><span><strong class="command">nsupdate</strong></span>

reads input from

<em class="parameter"><code>filename</code></em>

<code class="option">-y</code> or <code class="option">-k</code>.

</p></dd>

<dt><span class="term">

<span><strong class="command">prereq nxdomain</strong></span>

{domain-name}

</span></dt>

</p>

</div>

<div class="refsect1" lang="en">

<p>

The examples below show how

<span><strong class="command">nsupdate</strong></span>

</p>

</div>

<div class="refsect1" lang="en">

<div class="variablelist"><dl>

<dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>

<dd><p>

</dl></div>

</div>

<div class="refsect1" lang="en">

<p><span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,

<span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,

<span class="citerefentry"><span class="refentrytitle">RFC2104</span></span>,

</p>

</div>

<div class="refsect1" lang="en">

<p>

The TSIG key is redundantly stored in two separate files.

This is a consequence of nsupdate using the DST library