head 1.18; access; symbols perseant-exfatfs-base-20250801:1.18 perseant-exfatfs-base-20240630:1.18 perseant-exfatfs:1.18.0.6 perseant-exfatfs-base:1.18 netbsd-8-3-RELEASE:1.14.4.1 cjep_sun2x:1.18.0.4 cjep_sun2x-base:1.18 cjep_staticlib_x-base1:1.18 cjep_staticlib_x:1.18.0.2 cjep_staticlib_x-base:1.18 phil-wifi-20200421:1.18 phil-wifi-20200411:1.18 phil-wifi-20200406:1.18 netbsd-8-2-RELEASE:1.14.4.1 netbsd-8-1-RELEASE:1.14.4.1 netbsd-8-1-RC1:1.14.4.1 pgoyette-compat-merge-20190127:1.16.4.1 pgoyette-compat-20190127:1.17 pgoyette-compat-20190118:1.17 pgoyette-compat-1226:1.17 pgoyette-compat-1126:1.17 pgoyette-compat-1020:1.17 pgoyette-compat-0930:1.17 pgoyette-compat-0906:1.17 netbsd-7-2-RELEASE:1.1.1.15.2.13 pgoyette-compat-0728:1.17 netbsd-8-0-RELEASE:1.14.4.1 phil-wifi:1.17.0.2 phil-wifi-base:1.17 pgoyette-compat-0625:1.17 netbsd-8-0-RC2:1.14.4.1 pgoyette-compat-0521:1.17 pgoyette-compat-0502:1.17 pgoyette-compat-0422:1.17 netbsd-8-0-RC1:1.14.4.1 pgoyette-compat-0415:1.17 bind-9-10-7:1.1.1.32 pgoyette-compat-0407:1.16 pgoyette-compat-0330:1.16 pgoyette-compat-0322:1.16 pgoyette-compat-0315:1.16 netbsd-7-1-2-RELEASE:1.1.1.15.2.10.2.3 pgoyette-compat:1.16.0.4 pgoyette-compat-base:1.16 netbsd-7-1-1-RELEASE:1.1.1.15.2.10.2.3 matt-nb8-mediatek:1.14.4.1.0.2 matt-nb8-mediatek-base:1.14.4.1 perseant-stdc-iso10646:1.16.0.2 perseant-stdc-iso10646-base:1.16 bind-9-10-5-P2:1.1.1.31 bind-9-10-5-P1:1.1.1.30 netbsd-8:1.14.0.4 netbsd-8-base:1.14 prg-localcount2-base3:1.14 prg-localcount2-base2:1.14 prg-localcount2-base1:1.14 prg-localcount2:1.14.0.2 prg-localcount2-base:1.14 pgoyette-localcount-20170426:1.14 bouyer-socketcan-base1:1.14 bind-9-10-4-P8:1.1.1.29 pgoyette-localcount-20170320:1.13 netbsd-7-1:1.1.1.15.2.10.0.2 netbsd-7-1-RELEASE:1.1.1.15.2.10 netbsd-7-1-RC2:1.1.1.15.2.10 bind-9-10-4-P6:1.1.1.28 netbsd-7-nhusb-base-20170116:1.1.1.15.2.9 bouyer-socketcan:1.12.0.2 bouyer-socketcan-base:1.12 bind-9-10-4-P5:1.1.1.27 pgoyette-localcount-20170107:1.11 netbsd-7-1-RC1:1.1.1.15.2.8 pgoyette-localcount-20161104:1.11 bind-9-10-4-P4:1.1.1.26 netbsd-7-0-2-RELEASE:1.1.1.15.2.5.2.2 bind-9-10-4-P3:1.1.1.25 localcount-20160914:1.9 netbsd-7-nhusb:1.1.1.15.2.6.0.2 netbsd-7-nhusb-base:1.1.1.15.2.6 pgoyette-localcount-20160806:1.9 pgoyette-localcount-20160726:1.9 pgoyette-localcount:1.9.0.2 pgoyette-localcount-base:1.9 bind-9-10-4-P1:1.1.1.24 netbsd-7-0-1-RELEASE:1.1.1.15.2.5.2.1 bind-9-10-3-P4:1.1.1.23 bind-9-10-3-P3:1.1.1.22 bind-9-10-3-P2:1.1.1.21 netbsd-7-0:1.1.1.15.2.5.0.2 netbsd-7-0-RELEASE:1.1.1.15.2.5 bind-9-10-2-P4:1.1.1.20 netbsd-7-0-RC3:1.1.1.15.2.4 bind-9-10-2-P3:1.1.1.19 netbsd-7-0-RC2:1.1.1.15.2.3 bind-9-10-2-P2:1.1.1.18 netbsd-7-0-RC1:1.1.1.15.2.2 bind-9-10-1-P1:1.1.1.17 netbsd-6-0-6-RELEASE:1.1.1.9.4.1 netbsd-6-1-5-RELEASE:1.1.1.9.4.2 netbsd-7:1.1.1.15.0.2 netbsd-7-base:1.1.1.15 bind-9-10-0-P2:1.1.1.15 yamt-pagecache-base9:1.1.1.14 yamt-pagecache-tag8:1.1.1.9.2.2 netbsd-6-1-4-RELEASE:1.1.1.9.4.2 netbsd-6-0-5-RELEASE:1.1.1.9.4.1 tls-earlyentropy:1.1.1.14.0.2 tls-earlyentropy-base:1.1.1.15 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.14 riastradh-drm2-base3:1.1.1.14 bind-9-10-0b1:1.1.1.14 netbsd-6-1-3-RELEASE:1.1.1.9.4.2 netbsd-6-0-4-RELEASE:1.1.1.9.4.1 bind-9-9-5b1:1.1.1.13 netbsd-6-1-2-RELEASE:1.1.1.9.4.2 netbsd-6-0-3-RELEASE:1.1.1.9.4.1 netbsd-6-1-1-RELEASE:1.1.1.9.4.2 bind-9-9-3-P2:1.1.1.12 riastradh-drm2-base2:1.1.1.11 riastradh-drm2-base1:1.1.1.11 riastradh-drm2:1.1.1.11.0.2 riastradh-drm2-base:1.1.1.11 netbsd-6-1:1.1.1.9.4.2.0.2 netbsd-6-0-2-RELEASE:1.1.1.9.4.1 netbsd-6-1-RELEASE:1.1.1.9.4.2 khorben-n900:1.1.1.11.0.6 netbsd-6-1-RC4:1.1.1.9.4.2 netbsd-6-1-RC3:1.1.1.9.4.2 agc-symver:1.1.1.11.0.4 agc-symver-base:1.1.1.11 netbsd-6-1-RC2:1.1.1.9.4.2 netbsd-6-1-RC1:1.1.1.9.4.2 yamt-pagecache-base8:1.1.1.11 netbsd-6-0-1-RELEASE:1.1.1.9.4.1 yamt-pagecache-base7:1.1.1.11 bind-9-9-2-P1:1.1.1.11 matt-nb6-plus-nbase:1.1.1.9.4.1 yamt-pagecache-base6:1.1.1.10 netbsd-6-0:1.1.1.9.4.1.0.4 netbsd-6-0-RELEASE:1.1.1.9.4.1 netbsd-6-0-RC2:1.1.1.9.4.1 tls-maxphys:1.1.1.10.0.2 tls-maxphys-base:1.1.1.15 matt-nb6-plus:1.1.1.9.4.1.0.2 matt-nb6-plus-base:1.1.1.9.4.1 netbsd-6-0-RC1:1.1.1.9.4.1 bind-9-9-1-P1:1.1.1.10 yamt-pagecache-base5:1.1.1.9 yamt-pagecache-base4:1.1.1.9 netbsd-6:1.1.1.9.0.4 netbsd-6-base:1.1.1.9 yamt-pagecache-base3:1.1.1.9 yamt-pagecache-base2:1.1.1.9 yamt-pagecache:1.1.1.9.0.2 yamt-pagecache-base:1.1.1.9 bind-9-9-0a1:1.1.1.9 bind-9-8-0-P4:1.1.1.8 cherry-xenmp:1.1.1.7.0.2 cherry-xenmp-base:1.1.1.7 bind-9-8-0-P2:1.1.1.7 bind9-8-0rc1:1.1.1.7 bouyer-quota2-nbase:1.1.1.7 bouyer-quota2:1.1.1.6.0.2 bouyer-quota2-base:1.1.1.7 matt-mips64-premerge-20101231:1.1.1.6 bind-9-7-2-P3:1.1.1.6 bind-9-7-2b1:1.1.1.5 bind-9-7-0rc1:1.1.1.4 matt-premerge-20091211:1.1.1.3 bind-9-7-0-b1:1.1.1.3 bind-9-6-1-P1:1.1.1.2 jym-xensuspend-base:1.1.1.1 jym-xensuspend:1.1.1.1.0.2 jym-xensuspend-nbase:1.1.1.1 bind9-6-1b1:1.1.1.1 ISC:1.1.1; locks; strict; comment @# @; 1.18 date 2019.05.10.09.14.36; author wiz; state dead; branches; next 1.17; commitid SEgY3sFTlDvvDDmB; 1.17 date 2018.04.07.22.23.19; author christos; state Exp; branches 1.17.2.1; next 1.16; commitid 5GaleBSBFwaSNyxA; 1.16 date 2017.06.30.11.32.33; author christos; state Exp; branches 1.16.4.1; next 1.15; commitid 2TmD50Q8l2JAeoXz; 1.15 date 2017.06.15.15.59.39; author christos; state Exp; branches; next 1.14; commitid wt108Um8MxE5cuVz; 1.14 date 2017.04.13.19.11.20; author christos; state Exp; branches 1.14.4.1; next 1.13; commitid 4qIQYyuXEnswhpNz; 1.13 date 2017.02.09.00.23.27; author christos; state Exp; branches; next 1.12; commitid ZmFyuz7uZAt24dFz; 1.12 date 2017.01.12.08.21.32; author spz; state Exp; branches 1.12.2.1; next 1.11; commitid JCWB65ZetvpzBEBz; 1.11 date 2016.11.01.21.55.51; author christos; state Exp; branches; next 1.10; commitid 5JdVkpeiiMrQqtsz; 1.10 date 2016.10.04.23.46.01; author christos; state Exp; branches; next 1.9; commitid 6Xr85bjqiSijWSoz; 1.9 date 2016.05.26.16.49.58; author christos; state Exp; branches 1.9.2.1; next 1.8; commitid lGMmrjHFK8yFQ08z; 1.8 date 2016.03.10.04.01.34; author christos; state Exp; branches; next 1.7; commitid 0Q0r7S4TMFoz43Yy; 1.7 date 2016.01.20.02.14.02; author christos; state Exp; branches; next 1.6; commitid SQLoZQCAPY9c5CRy; 1.6 date 2015.12.17.04.00.43; author christos; state Exp; branches; next 1.5; commitid fAgnGC4vrUcFLfNy; 1.5 date 2015.09.03.07.33.34; author christos; state Exp; branches; next 1.4; commitid xT2c1Uh1JjzOjMzy; 1.4 date 2015.07.28.18.55.16; author christos; state Exp; branches; next 1.3; commitid SVZRLqMaEIlph5vy; 1.3 date 2015.07.08.17.28.58; author christos; state Exp; branches; next 1.2; commitid 5OH9r1R5FykCrvsy; 1.2 date 2015.02.21.20.19.22; author spz; state Exp; branches; next 1.1; commitid uDGxTelChQxiMUay; 1.1 date 2009.03.22.14.58.46; author christos; state Exp; branches 1.1.1.1; next ; 1.17.2.1 date 2019.06.10.21.44.12; author christos; state dead; branches; next ; commitid jtc8rnCzWiEEHGqB; 1.16.4.1 date 2018.04.16.01.57.53; author pgoyette; state Exp; branches; next ; commitid qk3nktk0szmTIByA; 1.14.4.1 date 2017.06.21.18.03.40; author snj; state Exp; branches; next ; commitid jnXpTnVXWnBaGgWz; 1.12.2.1 date 2017.04.21.16.51.19; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.9.2.1 date 2016.11.04.14.42.43; author pgoyette; state Exp; branches; next 1.9.2.2; commitid 2m1JRwYmpwPkOOsz; 1.9.2.2 date 2017.03.20.06.52.15; author pgoyette; state Exp; branches; next 1.9.2.3; commitid jjw7cAwgyKq7RfKz; 1.9.2.3 date 2017.04.26.02.52.20; author pgoyette; state Exp; branches; next ; commitid ojV02aOSdzvBqZOz; 1.1.1.1 date 2009.03.22.14.58.46; author christos; state Exp; branches 1.1.1.1.2.1; next 1.1.1.2; 1.1.1.2 date 2009.07.28.21.10.48; author christos; state Exp; branches; next 1.1.1.3; 1.1.1.3 date 2009.10.25.00.01.58; author christos; state Exp; branches; next 1.1.1.4; 1.1.1.4 date 2009.12.26.22.22.16; author christos; state Exp; branches; next 1.1.1.5; 1.1.1.5 date 2010.08.05.20.02.42; author christos; state Exp; branches; next 1.1.1.6; 1.1.1.6 date 2010.12.02.14.22.56; author christos; state Exp; branches 1.1.1.6.2.1; next 1.1.1.7; 1.1.1.7 date 2011.02.15.19.33.55; author christos; state Exp; branches; next 1.1.1.8; 1.1.1.8 date 2011.07.05.21.26.48; author spz; state Exp; branches; next 1.1.1.9; 1.1.1.9 date 2011.09.11.17.15.30; author christos; state Exp; branches 1.1.1.9.2.1 1.1.1.9.4.1; next 1.1.1.10; 1.1.1.10 date 2012.06.04.17.55.39; author christos; state Exp; branches 1.1.1.10.2.1; next 1.1.1.11; 1.1.1.11 date 2012.12.04.19.24.19; author spz; state Exp; branches; next 1.1.1.12; 1.1.1.12 date 2013.07.27.15.23.05; author christos; state Exp; branches; next 1.1.1.13; commitid KW6nDynUiY0uB7Zw; 1.1.1.13 date 2013.12.31.20.10.54; author christos; state Exp; branches; next 1.1.1.14; commitid SZa7JvkZZNe59kjx; 1.1.1.14 date 2014.02.28.17.40.11; author christos; state Exp; branches 1.1.1.14.2.1; next 1.1.1.15; commitid F63APPkuuRyMpTqx; 1.1.1.15 date 2014.07.08.04.48.00; author spz; state Exp; branches 1.1.1.15.2.1; next 1.1.1.16; commitid Mcep1OIjY5QWWwHx; 1.1.1.16 date 2014.12.10.02.25.24; author christos; state Exp; branches; next 1.1.1.17; commitid ZA8gmIRTml5lcr1y; 1.1.1.17 date 2014.12.10.03.31.27; author christos; state Exp; branches; next 1.1.1.18; commitid Kjjxv3fot5DZyr1y; 1.1.1.18 date 2015.07.08.15.37.57; author christos; state Exp; branches; next 1.1.1.19; commitid aKYk6ihcIShEPusy; 1.1.1.19 date 2015.07.28.18.48.09; author christos; state Exp; branches; next 1.1.1.20; commitid CyRG3YiTxwd7f5vy; 1.1.1.20 date 2015.09.03.07.21.33; author christos; state Exp; branches; next 1.1.1.21; commitid xugQabanQmbQfMzy; 1.1.1.21 date 2015.12.17.03.22.03; author christos; state Exp; branches; next 1.1.1.22; commitid n7czvJ5cDpJpyfNy; 1.1.1.22 date 2016.01.20.01.52.14; author christos; state Exp; branches; next 1.1.1.23; commitid ycf2hRIQff0TXBRy; 1.1.1.23 date 2016.03.10.03.22.32; author christos; state Exp; branches; next 1.1.1.24; commitid 6AgpAoqlmtfXQ2Yy; 1.1.1.24 date 2016.05.26.15.45.48; author christos; state Exp; branches; next 1.1.1.25; commitid rNgyUOhc6UpKu08z; 1.1.1.25 date 2016.10.04.23.33.56; author christos; state Exp; branches; next 1.1.1.26; commitid rptSGtBwBubhSSoz; 1.1.1.26 date 2016.11.01.20.45.40; author christos; state Exp; branches; next 1.1.1.27; commitid FuwE2IH0AB1A2tsz; 1.1.1.27 date 2017.01.12.07.31.10; author spz; state Exp; branches; next 1.1.1.28; commitid g6t23B0LUkG6jEBz; 1.1.1.28 date 2017.02.09.00.18.54; author christos; state Exp; branches; next 1.1.1.29; commitid 4lWdZfOmaghy2dFz; 1.1.1.29 date 2017.04.13.18.55.22; author christos; state Exp; branches; next 1.1.1.30; commitid OCC4x2DOPl1EbpNz; 1.1.1.30 date 2017.06.15.15.22.45; author christos; state Exp; branches; next 1.1.1.31; commitid AgIo44k7APizZtVz; 1.1.1.31 date 2017.06.30.11.21.59; author christos; state Exp; branches; next 1.1.1.32; commitid SsZyvso5Jth5aoXz; 1.1.1.32 date 2018.04.07.21.44.03; author christos; state Exp; branches; next ; commitid oNwftHLrbKKUxyxA; 1.1.1.1.2.1 date 2009.03.22.14.58.46; author jym; state dead; branches; next 1.1.1.1.2.2; 1.1.1.1.2.2 date 2009.05.13.18.50.48; author jym; state Exp; branches; next ; 1.1.1.6.2.1 date 2011.02.17.11.58.33; author bouyer; state Exp; branches; next ; 1.1.1.9.2.1 date 2012.10.30.18.52.20; author yamt; state Exp; branches; next 1.1.1.9.2.2; 1.1.1.9.2.2 date 2013.01.16.05.27.05; author yamt; state Exp; branches; next 1.1.1.9.2.3; 1.1.1.9.2.3 date 2014.05.22.15.43.14; author yamt; state Exp; branches; next ; commitid qlg4WCl9yarq6yBx; 1.1.1.9.4.1 date 2012.06.06.18.18.12; author bouyer; state Exp; branches 1.1.1.9.4.1.4.1; next 1.1.1.9.4.2; 1.1.1.9.4.2 date 2012.12.15.05.39.53; author riz; state Exp; branches 1.1.1.9.4.2.2.1; next 1.1.1.9.4.3; 1.1.1.9.4.3 date 2014.12.25.17.54.24; author msaitoh; state Exp; branches; next 1.1.1.9.4.4; commitid DOs7YhzjNdulQr3y; 1.1.1.9.4.4 date 2015.02.23.06.59.54; author msaitoh; state Exp; branches; next 1.1.1.9.4.5; commitid prepkJ2JBCDBi6by; 1.1.1.9.4.5 date 2015.11.15.19.09.16; author bouyer; state Exp; branches; next 1.1.1.9.4.6; commitid EmOoJ1f52nv1OdJy; 1.1.1.9.4.6 date 2017.04.25.19.54.25; author snj; state Exp; branches; next ; commitid tS2hfyOu155P7XOz; 1.1.1.9.4.1.4.1 date 2014.12.31.11.58.56; author msaitoh; state Exp; branches; next 1.1.1.9.4.1.4.2; commitid UwPiTbNnARsHGb4y; 1.1.1.9.4.1.4.2 date 2015.02.23.07.24.42; author msaitoh; state Exp; branches; next 1.1.1.9.4.1.4.3; commitid Kn7v4maRmAIhr6by; 1.1.1.9.4.1.4.3 date 2015.11.15.19.12.50; author bouyer; state Exp; branches; next 1.1.1.9.4.1.4.4; commitid WfUayjhhxBgiOdJy; 1.1.1.9.4.1.4.4 date 2015.11.17.19.31.14; author bouyer; state Exp; branches; next 1.1.1.9.4.1.4.5; commitid KIr4IScjEO4GRtJy; 1.1.1.9.4.1.4.5 date 2017.04.25.22.01.48; author snj; state Exp; branches; next ; commitid Mh89qlSRw0ICPXOz; 1.1.1.9.4.2.2.1 date 2014.12.26.03.08.31; author msaitoh; state Exp; branches; next 1.1.1.9.4.2.2.2; commitid yqTOlsoWsWVLUu3y; 1.1.1.9.4.2.2.2 date 2015.02.23.07.19.43; author msaitoh; state Exp; branches; next 1.1.1.9.4.2.2.3; commitid 13exx7UfaYDGp6by; 1.1.1.9.4.2.2.3 date 2015.11.15.19.17.59; author bouyer; state Exp; branches; next 1.1.1.9.4.2.2.4; commitid btJp16NJO8JiOdJy; 1.1.1.9.4.2.2.4 date 2015.11.17.19.55.08; author bouyer; state Exp; branches; next 1.1.1.9.4.2.2.5; commitid MyeWyeBI3AV00uJy; 1.1.1.9.4.2.2.5 date 2017.04.25.20.53.46; author snj; state Exp; branches; next ; commitid w3an9o5yFMZisXOz; 1.1.1.10.2.1 date 2013.02.25.00.25.34; author tls; state Exp; branches; next 1.1.1.10.2.2; 1.1.1.10.2.2 date 2014.08.19.23.46.27; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.14.2.1 date 2014.08.10.07.06.41; author tls; state Exp; branches; next ; commitid vuZWZSMzG2mZFMLx; 1.1.1.15.2.1 date 2014.12.22.03.28.44; author msaitoh; state Exp; branches; next 1.1.1.15.2.2; commitid s9mHA4qvt0AE9Z2y; 1.1.1.15.2.2 date 2015.02.23.05.43.17; author msaitoh; state Exp; branches; next 1.1.1.15.2.3; commitid jwEURkHWE8QPS5by; 1.1.1.15.2.3 date 2015.07.17.04.31.31; author snj; state Exp; branches; next 1.1.1.15.2.4; commitid h3aoDlALvq5EQAty; 1.1.1.15.2.4 date 2015.07.31.16.59.43; author snj; state Exp; branches; next 1.1.1.15.2.5; commitid F3o1Qi5wYRsRxsvy; 1.1.1.15.2.5 date 2015.09.09.08.10.02; author martin; state Exp; branches 1.1.1.15.2.5.2.1; next 1.1.1.15.2.6; commitid TqHgIYuvACzRjyAy; 1.1.1.15.2.6 date 2016.03.13.08.06.11; author martin; state Exp; branches 1.1.1.15.2.6.2.1; next 1.1.1.15.2.7; commitid 2s8YJQQnhGEXjsYy; 1.1.1.15.2.7 date 2016.10.14.12.01.25; author martin; state Exp; branches; next 1.1.1.15.2.8; commitid cv7oxX6XYIZfG6qz; 1.1.1.15.2.8 date 2016.11.05.17.54.07; author martin; state Exp; branches; next 1.1.1.15.2.9; commitid P3JEaDTSpc4yWXsz; 1.1.1.15.2.9 date 2017.01.16.11.54.44; author martin; state Exp; branches; next 1.1.1.15.2.10; commitid hC7pBBaRQjdYEbCz; 1.1.1.15.2.10 date 2017.02.20.15.48.22; author sborrill; state Exp; branches 1.1.1.15.2.10.2.1; next 1.1.1.15.2.11; commitid udMX9Pbx5ntYOHGz; 1.1.1.15.2.11 date 2017.04.21.05.23.18; author snj; state Exp; branches; next 1.1.1.15.2.12; commitid ZQ4axnZtmV6qrmOz; 1.1.1.15.2.12 date 2017.06.20.17.09.47; author snj; state Exp; branches; next 1.1.1.15.2.13; commitid 9D6h68tqKy82q8Wz; 1.1.1.15.2.13 date 2017.08.12.05.20.25; author snj; state Exp; branches; next ; commitid CdmFieGyMVDeNS2A; 1.1.1.15.2.5.2.1 date 2016.03.13.08.00.33; author martin; state Exp; branches; next 1.1.1.15.2.5.2.2; commitid AzVvUNsV24ghisYy; 1.1.1.15.2.5.2.2 date 2016.10.14.11.42.43; author martin; state Exp; branches; next 1.1.1.15.2.5.2.3; commitid 0Q0oidhFkBBMz6qz; 1.1.1.15.2.5.2.3 date 2016.11.05.17.47.31; author martin; state Exp; branches; next 1.1.1.15.2.5.2.4; commitid rj0D2T80hTutVXsz; 1.1.1.15.2.5.2.4 date 2017.01.16.11.56.43; author martin; state Exp; branches; next 1.1.1.15.2.5.2.5; commitid pmUABP4tjUeJFbCz; 1.1.1.15.2.5.2.5 date 2017.02.20.16.27.15; author sborrill; state Exp; branches; next 1.1.1.15.2.5.2.6; commitid JZgxN0T3lFEx2IGz; 1.1.1.15.2.5.2.6 date 2017.04.21.05.16.40; author snj; state Exp; branches; next 1.1.1.15.2.5.2.7; commitid 6QhsY821kmQ8omOz; 1.1.1.15.2.5.2.7 date 2017.06.20.16.40.16; author snj; state Exp; branches; next 1.1.1.15.2.5.2.8; commitid 3tX9hN0zVj6Ff8Wz; 1.1.1.15.2.5.2.8 date 2017.08.12.05.16.37; author snj; state Exp; branches; next ; commitid WSUEyZcbcmSZLS2A; 1.1.1.15.2.6.2.1 date 2017.01.18.08.46.08; author skrll; state Exp; branches; next 1.1.1.15.2.6.2.2; commitid M6f3RyDtiAR3wqCz; 1.1.1.15.2.6.2.2 date 2017.03.13.07.41.10; author skrll; state Exp; branches; next ; commitid vH6VFbpxnMy7rmJz; 1.1.1.15.2.10.2.1 date 2017.04.21.05.21.04; author snj; state Exp; branches; next 1.1.1.15.2.10.2.2; commitid OxgBLKTcJaxUpmOz; 1.1.1.15.2.10.2.2 date 2017.06.20.17.02.18; author snj; state Exp; branches; next 1.1.1.15.2.10.2.3; commitid GxuFZUGrvwdun8Wz; 1.1.1.15.2.10.2.3 date 2017.08.12.05.19.35; author snj; state Exp; branches; next ; commitid 8HKSLtsL5AKQMS2A; desc @@ 1.18 log @Remove src/external/bsd/bind - latest version is in src/external/mpl/bind This directory was already unhooked from the build (in August 2018). ok christos@@ @ text @
Table of Contents
This document summarizes changes since the last production
release on the BIND 9.10 branch.
Please see the CHANGES file for a further
list of bug fixes and other changes.
The latest versions of BIND 9 software can always be found at http://www.isc.org/downloads/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems.
ICANN is in the process of introducing a new Key Signing Key (KSK) for the global root zone. BIND has multiple methods for managing DNSSEC trust anchors, with somewhat different behaviors. If the root key is configured using the managed-keys statement, or if the pre-configured root key is enabled by using dnssec-validation auto, then BIND can keep keys up to date automatically. Servers configured in this way should have begun the process of rolling to the new key when it was published in the root zone in July 2017. However, keys configured using the trusted-keys statement are not automatically maintained. If your server is performing DNSSEC validation and is configured using trusted-keys, you are advised to change your configuration before the root zone begins signing with the new KSK. This is currently scheduled for October 11, 2017.
This release includes an updated version of the
bind.keys file containing the new root
key. This file can also be downloaded from
https://www.isc.org/bind-keys
.
As of BIND 9.10.6, Windows XP and Windows 2003 are no longer supported platforms for BIND; "XP" binaries are no longer available for download from ISC.
An error in TSIG handling could permit unauthorized zone transfers or zone updates. These flaws are disclosed in CVE-2017-3142 and CVE-2017-3143. [RT #45383]
The BIND installer on Windows used an unquoted service path, which can enable privilege escalation. This flaw is disclosed in CVE-2017-3141. [RT #45229]
With certain RPZ configurations, a response with TTL 0 could cause named to go into an infinite query loop. This flaw is disclosed in CVE-2017-3140. [RT #45181]
Addresses could be referenced after being freed during resolver processing, causing an assertion failure. The chances of this happening were remote, but the introduction of a delay in resolution increased them. This bug is disclosed in CVE-2017-3145. [RT #46839]
update-policy rules that otherwise ignore the name field now require that it be set to "." to ensure that any type list present is properly interpreted. If the name field was omitted from the rule declaration and a type list was present it wouldn't be interpreted as expected.
The ISC DNSSEC Lookaside Validation (DLV) service has
been shut down; all DLV records in the dlv.isc.org zone
have been removed. References to the service have been
removed from BIND documentation. Lookaside validation
is no longer used by default by delv.
The DLV key has been removed from bind.keys.
Setting dnssec-lookaside to
auto or to use dlv.isc.org as a trust
anchor results in a warning being issued.
named will now log a warning if the old root DNSSEC key is explicitly configured and has not been updated. [RT #43670]
BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC signing algorithms described in RFC 8080. Note, however, that these algorithms must be supported in OpenSSL; currently they are only available in the development branch of OpenSSL at https://github.com/openssl/openssl. [RT #44696]
When parsing DNS messages, EDNS KEY TAG options are checked for correctness. When printing messages (for example, in dig), EDNS KEY TAG options are printed in readable format.
named will no longer start or accept reconfiguration if managed-keys or dnssec-validation auto are in use and the managed-keys directory (specified by managed-keys-directory, and defaulting to the working directory if not specified), is not writable by the effective user ID. [RT #46077]
Previously, update-policy local; accepted updates from any source so long as they were signed by the locally-generated session key. This has been further restricted; updates are now only accepted from locally configured addresses. [RT #45492]
dig +ednsopt now accepts the names for EDNS options in addition to numeric values. For example, an EDNS Client-Subnet option could be sent using dig +ednsopt=ecs:.... Thanks to John Worley of Secure64 for the contribution. [RT #44461]
Threads in named are now set to human-readable names to assist debugging on operating systems that support that. Threads will have names such as "isc-timer", "isc-sockmgr", "isc-worker0001", and so on. This will affect the reporting of subsidiary thread names in ps and top, but not the main thread. [RT #43234]
DiG now warns about .local queries which are reserved for Multicast DNS. [RT #44783]
Attempting to validate improperly unsigned CNAME responses from secure zones could cause a validator loop. This caused a delay in returning SERVFAIL and also increased the chances of encountering the crash bug described in CVE-2017-3145. [RT #46839]
When named was reconfigured, failure of some zones to load correctly could leave the system in an inconsistent state; while generally harmless, this could lead to a crash later when using rndc addzone. Reconfiguration changes are now fully rolled back in the event of failure. [RT #45841]
Fixed a bug that was introduced in an earlier development release which caused multi-packet AXFR and IXFR messages to fail validation if not all packets contained TSIG records; this caused interoperability problems with some other DNS implementations. [RT #45509]
Semicolons are no longer escaped when printing CAA and URI records. This may break applications that depend on the presence of the backslash before the semicolon. [RT #45216]
AD could be set on truncated answer with no records present in the answer and authority sections. [RT #45140]
Some header files included <isc/util.h> incorrectly as it pollutes with namespace with non ISC_ macros and this should only be done by explicitly including <isc/util.h>. This has been corrected. Some code may depend on <isc/util.h> being implicitly included via other header files. Such code should explicitly include <isc/util.h>.
Zones created with rndc addzone could
temporarily fail to inherit the allow-transfer
ACL set in the options section of
named.conf. [RT #46603]
named failed to properly determine whether there were active KSK and ZSK keys for an algorithm when update-check-ksk was true (which is the default setting). This could leave records unsigned when rolling keys. [RT #46743] [RT #46754] [RT #46774]
The end of life for BIND 9.10 is yet to be determined but will not be before BIND 9.12.0 has been released for 6 months. https://www.isc.org/downloads/software-support-policy/
Thank you to everyone who assisted us in making this release possible. If you would like to contribute to ISC to assist us in continuing to make quality open source software, please visit our donations page at http://www.isc.org/donate/.
BIND 9.10.7
@ 1.17 log @merge 9.7.10 @ text @@ 1.17.2.1 log @Sync with HEAD @ text @@ 1.16 log @merge conflicts @ text @d3 1 a3 1 - Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") d48 1 a48 1BIND 9.10.5-P1 addresses the security issues described in CVE-2017-3140 and CVE-2017-3141.
BIND 9.11.1-P2 addresses the security issues described in CVE-2017-3142 and CVE-2017-3143. It also includes an update to the address of the B root server. a78 1 d100 4 a103 4 dnssec-validation auto, then BIND can keep keys up to date automatically. Servers configured in this way will roll seamlessly to the new key when it is published in the root zone. However, keys configured using the d105 4 a108 5 maintained. If your server is performing DNSSEC validation and is configured using trusted-keys, you are advised to change your configuration before the root zone begins signing with the new KSK. This is currently scheduled for October 11, 2017. d122 10 d156 198 d397 1 a397 1
BIND 9.10.5-P2
@ 1.16.4.1 log @Sync with HEAD, resolve some conflicts @ text @d3 1 a3 1 - Copyright (C) 2004-2018 Internet Systems Consortium, Inc. ("ISC") d48 1 a48 1CHANGES file for a further
list of bug fixes and other changes.
d80 1
d102 4
a105 4
dnssec-validation auto, then BIND can keep keys up
to date automatically. Servers configured in this way should have
begun the process of rolling to the new key when it was published in
the root zone in July 2017. However, keys configured using the
d107 5
a111 4
maintained. If your server is performing DNSSEC validation and is
configured using trusted-keys, you are advised to
change your configuration before the root zone begins signing with
the new KSK. This is currently scheduled for October 11, 2017.
a124 10
Legacy Windows No Longer Supported
As of BIND 9.10.6, Windows XP and Windows 2003 are no longer supported platforms for BIND; "XP" binaries are no longer available for download from ISC.
Addresses could be referenced after being freed during resolver processing, causing an assertion failure. The chances of this happening were remote, but the introduction of a delay in resolution increased them. This bug is disclosed in CVE-2017-3145. [RT #46839]
update-policy rules that otherwise ignore the name field now require that it be set to "." to ensure that any type list present is properly interpreted. If the name field was omitted from the rule declaration and a type list was present it wouldn't be interpreted as expected.
The ISC DNSSEC Lookaside Validation (DLV) service has
been shut down; all DLV records in the dlv.isc.org zone
have been removed. References to the service have been
removed from BIND documentation. Lookaside validation
is no longer used by default by delv.
The DLV key has been removed from bind.keys.
Setting dnssec-lookaside to
auto or to use dlv.isc.org as a trust
anchor results in a warning being issued.
named will now log a warning if the old root DNSSEC key is explicitly configured and has not been updated. [RT #43670]
BIND can now use the Ed25519 and Ed448 Edwards Curve DNSSEC signing algorithms described in RFC 8080. Note, however, that these algorithms must be supported in OpenSSL; currently they are only available in the development branch of OpenSSL at https://github.com/openssl/openssl. [RT #44696]
When parsing DNS messages, EDNS KEY TAG options are checked for correctness. When printing messages (for example, in dig), EDNS KEY TAG options are printed in readable format.
named will no longer start or accept reconfiguration if managed-keys or dnssec-validation auto are in use and the managed-keys directory (specified by managed-keys-directory, and defaulting to the working directory if not specified), is not writable by the effective user ID. [RT #46077]
Previously, update-policy local; accepted updates from any source so long as they were signed by the locally-generated session key. This has been further restricted; updates are now only accepted from locally configured addresses. [RT #45492]
dig +ednsopt now accepts the names for EDNS options in addition to numeric values. For example, an EDNS Client-Subnet option could be sent using dig +ednsopt=ecs:.... Thanks to John Worley of Secure64 for the contribution. [RT #44461]
Threads in named are now set to human-readable names to assist debugging on operating systems that support that. Threads will have names such as "isc-timer", "isc-sockmgr", "isc-worker0001", and so on. This will affect the reporting of subsidiary thread names in ps and top, but not the main thread. [RT #43234]
DiG now warns about .local queries which are reserved for Multicast DNS. [RT #44783]
Attempting to validate improperly unsigned CNAME responses from secure zones could cause a validator loop. This caused a delay in returning SERVFAIL and also increased the chances of encountering the crash bug described in CVE-2017-3145. [RT #46839]
When named was reconfigured, failure of some zones to load correctly could leave the system in an inconsistent state; while generally harmless, this could lead to a crash later when using rndc addzone. Reconfiguration changes are now fully rolled back in the event of failure. [RT #45841]
Fixed a bug that was introduced in an earlier development release which caused multi-packet AXFR and IXFR messages to fail validation if not all packets contained TSIG records; this caused interoperability problems with some other DNS implementations. [RT #45509]
Semicolons are no longer escaped when printing CAA and URI records. This may break applications that depend on the presence of the backslash before the semicolon. [RT #45216]
AD could be set on truncated answer with no records present in the answer and authority sections. [RT #45140]
Some header files included <isc/util.h> incorrectly as it pollutes with namespace with non ISC_ macros and this should only be done by explicitly including <isc/util.h>. This has been corrected. Some code may depend on <isc/util.h> being implicitly included via other header files. Such code should explicitly include <isc/util.h>.
Zones created with rndc addzone could
temporarily fail to inherit the allow-transfer
ACL set in the options section of
named.conf. [RT #46603]
named failed to properly determine whether there were active KSK and ZSK keys for an algorithm when update-check-ksk was true (which is the default setting). This could leave records unsigned when rolling keys. [RT #46743] [RT #46754] [RT #46774]
BIND 9.10.7
@ 1.15 log @Merge conflicts; bugs fixed since the last import: 4632. [security] The BIND installer on Windows used an unquoted service path, which can enable privilege escalation. (CVE-2017-3141) [RT #45229] 4631. [security] Some RPZ configurations could go into an infinite query loop when encountering responses with TTL=0. (CVE-2017-3140) [RT #45181] 4582. [security] 'rndc ""' could trigger a assertion failure in named. (CVE-2017-3138) [RT #44924] 4581. [port] Linux: Add getpid and getrandom to the list of system calls named uses for seccomp. [RT #44883] 4580. [bug] 4578 introduced a regression when handling CNAME to referral below the current domain. [RT #44850] 4578. [security] Some chaining (CNAME or DNAME) responses to upstream queries could trigger assertion failures. (CVE-2017-3137) [RT #44734] 4575. [security] DNS64 with "break-dnssec yes;" can result in an assertion failure. (CVE-2017-3136) [RT #44653] 4571. [bug] Out-of-tree builds of backtrace_test failed. 4570. [cleanup] named did not correctly fall back to the built-in initializing keys if the bind.keys file was present but empty. [RT #44531] 4568. [contrib] Added a --with-bind option to the dnsperf configure script to specify BIND prefix path. 4567. [port] Call getprotobyname and getservbyname prior to calling chroot so that shared libraries get loaded. [RT #44537] 4564. [maint] Update the built in managed keys to include the upcoming root KSK. [RT #44579] 4563. [bug] Modified zones would occasionally fail to reload. [RT #39424] 4561. [port] Silence a warning in strict C99 compilers. [RT #44414] 4560. [bug] mdig: add -m option to enable memory debugging rather than having it on all the time. [RT #44509] 4559. [bug] openssl_link.c didn't compile if ISC_MEM_TRACKLINES was turned off. [RT #44509] 4554. [bug] Remove double unlock in dns_dispatchmgr_setudp. [RT #44336] 4553. [bug] Named could deadlock there were multiple changes to NSEC/NSEC3 parameters for a zone being processed at the same time. [RT #42770] 4552. [bug] Named could trigger a assertion when sending notify messages. [RT #44019] 4551. [test] Add system tests for integrity checks of MX and SRV records. [RT #43953] 4550. [cleanup] Increased the number of available master file output style flags from 32 to 64. [RT #44043] 4547. [port] Add support for --enable-native-pkcs11 on the AEP Keyper HSM. [RT #42463] 4543. [bug] dns_client_startupdate now delays sending the update request until isc_app_ctxrun has been called. [RT #43976] 4541. [bug] rndc addzone should properly reject non master/slave zones. [RT #43665] 4539. [bug] Referencing a nonexistent zone with RPZ could lead to a assertion failure when configuring. [RT #43787] 4538. [bug] Call dns_client_startresolve from client->task. [RT #43896] 4537. [bug] Handle timeouts better in dig/host/nslookup. [RT #43576] 4536. [bug] ISC_SOCKEVENTATTR_USEMINMTU was not being cleared when reusing the event structure. [RT #43885] 4535. [bug] Address race condition in setting / testing of DNS_REQUEST_F_SENDING. [RT #43889] 4534. [bug] Only set RD, RA and CD in QUERY responses. [RT #43879] 4533. [bug] dns_client_update should terminate on prerequisite failures (NXDOMAIN, YXDOMAIN, NXRRSET, YXRRSET) and also on BADZONE. [RT #43865] 4532. [contrib] Make gen-data-queryperf.py python 3 compatible. [RT #43836] 4529. [cleanup] Silence noisy log warning when DSCP probe fails due to firewall rules. [RT #43847] 4527. [doc] Support DocBook XSL Stylesheets v1.79.1. [RT #43831] 4526. [doc] Corrected errors and improved formatting of grammar definitions in the ARM. [RT #43739] 4525. [doc] Fixed outdated documentation on managed-keys. [RT #43810] 4524. [bug] The net zero test was broken causing IPv4 servers with addresses ending in .0 to be rejected. [RT #43776] 4523. [doc] Expand config doc forBIND 9.10.5-P1
@ 1.14 log @merge conflicts. @ text @d1 1 d3 1 a3 1 - Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC") d18 1 a18 1 d48 1 a48 1This document summarizes changes since BIND 9.10.4: d69 8 a76 35
BIND 9.10.4-P7 addresses the security issue described in CVE-2017-3136, and updates the built in trusted keys for the root zone.
BIND 9.10.4-P6 addresses the security issue described in CVE-2017-3135, and fixes a regression introduced in a prior security release.
BIND 9.10.4-P5 addresses the security issues described in CVE-2016-9131, CVE-2016-9147, CVE-2016-9444 and CVE-2016-9778.
BIND 9.10.4-P4 addresses the security issue described in CVE-2016-8864.
BIND 9.10.4-P3 addresses the security issue described in CVE-2016-2776 and addresses an interoperability issue with ECS clients.
BIND 9.10.4-P2 addresses the security issue described in CVE-2016-2775.
BIND 9.10.4-P1 addresses Windows installation issues, the %z modifier is not supported under Windows and a race condition in the rbt/rbtdb implementation resulting in named exiting due to assertion failures being detected.
d86 3 a88 2
d108 1 a108 1
d116 3 a118 2
'rndc ""' could trigger a assertion failure in named. This flaw is disclosed in (CVE-2017-3138). [RT #44924]
Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could trigger assertion failures. This flaw is disclosed in CVE-2017-3137. [RT #44734]
dns64 with break-dnssec yes; can result in an assertion failure. This flaw is disclosed in CVE-2017-3136. [RT #44653]
If a server is configured with a response policy zone (RPZ) that rewrites an answer with local data, and is also configured for DNS64 address mapping, a NULL pointer can be read triggering a server crash. This flaw is disclosed in CVE-2017-3135. [RT #44434]
named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]
named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. This flaw is disclosed in CVE-2016-9147. [RT #43548]
named incorrectly tried to cache TKEY records which could trigger an assertion failure when there was a class mismatch. This flaw is disclosed in CVE-2016-9131. [RT #43522]
It was possible to trigger assertions when processing responses containing answers of type DNAME. This flaw is disclosed in CVE-2016-8864. [RT #43465]
It was possible to trigger a assertion when rendering a message using a specially crafted request. This flaw is disclosed in CVE-2016-2776. [RT #43139]
Calling getrrsetbyname() with a non
absolute name could trigger an infinite recursion bug in
lwresd or named with
lwres configured if, when combined with
a search list entry from resolv.conf,
the resulting name is too long. This flaw is disclosed in
CVE-2016-2775. [RT #42694]
A synthesized CNAME record appearing in a response before the associated DNAME could be cached, when it should not have been. This was a regression introduced while addressing CVE-2016-8864. [RT #44318]
Fixed a crash when calling rndc stats on some Windows builds: some Visual Studio compilers generate code that crashes when the "%z" printf() format specifier is used. [RT #42380]
ECS clients with the option set to 0.0.0.0/0/0 or ::/0/0 were incorrectly getting a FORMERR response.
Windows installs were failing due to triggering UAC without the installation binary being signed.
A race condition in rbt/rbtdb was leading to INSISTs being triggered.
d148 3 a150 2
d159 1 d161 1 a161 2
BIND 9.10.4-P8
@ 1.14.4.1 log @Pull up following revision(s) (requested by spz in ticket #47): doc/3RDPARTY: 1.1452 distrib/sets/lists/base/shl.mi: 1.818 distrib/sets/lists/debug/shl.mi: 1.177 external/bsd/bind/dist/CHANGES: up to 1.27 external/bsd/bind/dist/FAQ.xml: up to 1.1.1.12 external/bsd/bind/dist/Makefile.in: up to 1.4 external/bsd/bind/dist/README: up to 1.15 external/bsd/bind/dist/acconfig.h: up to 1.10 external/bsd/bind/dist/bin/check/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/check/named-checkconf.8: up to 1.8 external/bsd/bind/dist/bin/check/named-checkconf.c: up to 1.14 external/bsd/bind/dist/bin/check/named-checkconf.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/check/named-checkconf.html: up to 1.1.1.10 external/bsd/bind/dist/bin/check/named-checkzone.8: up to 1.9 external/bsd/bind/dist/bin/check/named-checkzone.docbook: up to 1.1.1.11 external/bsd/bind/dist/bin/check/named-checkzone.html: up to 1.1.1.11 external/bsd/bind/dist/bin/check/win32/checkconf.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/check/win32/checkconf.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/check/win32/checkconf.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/check/win32/checktool.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/check/win32/checktool.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/check/win32/checkzone.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/check/win32/checkzone.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/check/win32/checkzone.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/confgen/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/confgen/ddns-confgen.8: up to 1.7 external/bsd/bind/dist/bin/confgen/ddns-confgen.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/confgen/ddns-confgen.html: up to 1.1.1.7 external/bsd/bind/dist/bin/confgen/keygen.c: up to 1.8 external/bsd/bind/dist/bin/confgen/rndc-confgen.8: up to 1.8 external/bsd/bind/dist/bin/confgen/rndc-confgen.c: up to 1.9 external/bsd/bind/dist/bin/confgen/rndc-confgen.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/confgen/rndc-confgen.html: up to 1.1.1.8 external/bsd/bind/dist/bin/delv/Makefile.in: up to 1.1.1.3 external/bsd/bind/dist/bin/delv/delv.1: up to 1.1.1.5 external/bsd/bind/dist/bin/delv/delv.c: up to 1.6 external/bsd/bind/dist/bin/delv/delv.docbook: up to 1.1.1.3 external/bsd/bind/dist/bin/delv/delv.html: up to 1.1.1.4 external/bsd/bind/dist/bin/delv/win32/delv.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/bin/delv/win32/delv.mak.in: up to 1.1.1.2 external/bsd/bind/dist/bin/delv/win32/delv.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/Makefile.in: up to 1.1.1.11 external/bsd/bind/dist/bin/dig/dig.1: up to 1.13 external/bsd/bind/dist/bin/dig/dig.c: up to 1.13 external/bsd/bind/dist/bin/dig/dig.docbook: up to 1.1.1.14 external/bsd/bind/dist/bin/dig/dig.html: up to 1.1.1.14 external/bsd/bind/dist/bin/dig/dighost.c: up to 1.19 external/bsd/bind/dist/bin/dig/host.1: up to 1.7 external/bsd/bind/dist/bin/dig/host.c: up to 1.12 external/bsd/bind/dist/bin/dig/host.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/dig/host.html: up to 1.1.1.8 external/bsd/bind/dist/bin/dig/include/dig/dig.h: up to 1.13 external/bsd/bind/dist/bin/dig/nslookup.c: up to 1.13 external/bsd/bind/dist/bin/dig/nslookup.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/dig/nslookup.html: up to 1.1.1.11 external/bsd/bind/dist/bin/dig/win32/dig.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/dig.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/dig.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dig/win32/dighost.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/dighost.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dig/win32/host.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/host.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/host.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dig/win32/nslookup.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/nslookup.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dig/win32/nslookup.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/Makefile.in: up to 1.1.1.11 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8: up to 1.10 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook: up to 1.1.1.11 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html: up to 1.1.1.12 external/bsd/bind/dist/bin/dnssec/dnssec-importkey.8: up to 1.6 external/bsd/bind/dist/bin/dnssec/dnssec-importkey.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/dnssec/dnssec-importkey.html: up to 1.1.1.5 external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8: up to 1.11 external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c: up to 1.15 external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.docbook: up to 1.1.1.14 external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.html: up to 1.1.1.14 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8: up to 1.11 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c: up to 1.18 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.docbook: up to 1.1.1.14 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.html: up to 1.1.1.14 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.8: up to 1.8 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.html: up to 1.1.1.10 external/bsd/bind/dist/bin/dnssec/dnssec-settime.8: up to 1.10 external/bsd/bind/dist/bin/dnssec/dnssec-settime.c: up to 1.15 external/bsd/bind/dist/bin/dnssec/dnssec-settime.docbook: up to 1.1.1.13 external/bsd/bind/dist/bin/dnssec/dnssec-settime.html: up to 1.1.1.13 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8: up to 1.10 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c: up to 1.18 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.docbook: up to 1.1.1.13 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.html: up to 1.1.1.13 external/bsd/bind/dist/bin/dnssec/dnssec-verify.8: up to 1.7 external/bsd/bind/dist/bin/dnssec/dnssec-verify.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/dnssec/dnssec-verify.html: up to 1.1.1.7 external/bsd/bind/dist/bin/dnssec/dnssectool.c: up to 1.10 external/bsd/bind/dist/bin/dnssec/dnssectool.h: up to 1.8 external/bsd/bind/dist/bin/dnssec/win32/dnssectool.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/dnssectool.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/dsfromkey.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/dsfromkey.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/dsfromkey.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/importkey.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/importkey.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/importkey.vcxproj.in: up to 1.1.1.5 external/bsd/bind/dist/bin/dnssec/win32/keyfromlabel.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/keyfromlabel.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/keyfromlabel.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/keygen.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/keygen.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/keygen.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/revoke.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/revoke.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/revoke.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/settime.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/settime.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/settime.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/signzone.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/signzone.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/signzone.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/dnssec/win32/verify.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/verify.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/dnssec/win32/verify.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/named/Makefile.in: up to 1.1.1.14 external/bsd/bind/dist/bin/named/client.c: up to 1.17 external/bsd/bind/dist/bin/named/config.c: up to 1.14 external/bsd/bind/dist/bin/named/control.c: up to 1.12 external/bsd/bind/dist/bin/named/geoip.c: up to 1.1.1.4 external/bsd/bind/dist/bin/named/include/named/config.h: up to 1.6 external/bsd/bind/dist/bin/named/include/named/globals.h: up to 1.10 external/bsd/bind/dist/bin/named/include/named/seccomp.h: up to 1.1.1.4 external/bsd/bind/dist/bin/named/include/named/server.h: up to 1.12 external/bsd/bind/dist/bin/named/logconf.c: up to 1.9 external/bsd/bind/dist/bin/named/lwresd.8: up to 1.7 external/bsd/bind/dist/bin/named/lwresd.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/named/lwresd.html: up to 1.1.1.8 external/bsd/bind/dist/bin/named/lwsearch.c: up to 1.5 external/bsd/bind/dist/bin/named/main.c: up to 1.21 external/bsd/bind/dist/bin/named/named.8: up to 1.10 external/bsd/bind/dist/bin/named/named.conf.5: up to 1.15 external/bsd/bind/dist/bin/named/named.conf.docbook: up to 1.14 external/bsd/bind/dist/bin/named/named.conf.html: up to 1.15 external/bsd/bind/dist/bin/named/named.docbook: up to 1.1.1.10 external/bsd/bind/dist/bin/named/named.html: up to 1.1.1.11 external/bsd/bind/dist/bin/named/query.c: up to 1.25 external/bsd/bind/dist/bin/named/server.c: up to 1.22 external/bsd/bind/dist/bin/named/unix/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/named/unix/os.c: up to 1.10 external/bsd/bind/dist/bin/named/update.c: up to 1.13 external/bsd/bind/dist/bin/named/xfrout.c: up to 1.13 external/bsd/bind/dist/bin/named/zoneconf.c: up to 1.10 external/bsd/bind/dist/bin/nsupdate/Makefile.in: up to 1.1.1.11 external/bsd/bind/dist/bin/nsupdate/nsupdate.1: up to 1.9 external/bsd/bind/dist/bin/nsupdate/nsupdate.c: up to 1.16 external/bsd/bind/dist/bin/nsupdate/nsupdate.docbook: up to 1.1.1.10 external/bsd/bind/dist/bin/nsupdate/nsupdate.html: up to 1.1.1.12 external/bsd/bind/dist/bin/nsupdate/win32/nsupdate.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/nsupdate/win32/nsupdate.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/nsupdate/win32/nsupdate.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/pkcs11/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1q-patch: delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1t-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.2f-patch: delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.2h-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.8: up to 1.7 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.html: up to 1.1.1.6 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.8: up to 1.7 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.html: up to 1.1.1.6 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.8: up to 1.6 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.html: up to 1.1.1.5 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.8: up to 1.1.1.5 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.c: up to 1.1.1.6 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.docbook: up to 1.1.1.5 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.html: up to 1.1.1.3 external/bsd/bind/dist/bin/pkcs11/win32/pk11destroy.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/pkcs11/win32/pk11tokens.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/python/Makefile.in: up to 1.1.1.5 external/bsd/bind/dist/bin/python/dnssec-checkds.8: up to 1.7 external/bsd/bind/dist/bin/python/dnssec-checkds.docbook: up to 1.6 external/bsd/bind/dist/bin/python/dnssec-checkds.html: up to 1.1.1.6 external/bsd/bind/dist/bin/python/dnssec-checkds.py.in: up to 1.1.1.6 external/bsd/bind/dist/bin/python/dnssec-coverage.8: up to 1.1.1.8 external/bsd/bind/dist/bin/python/dnssec-coverage.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/python/dnssec-coverage.html: up to 1.1.1.5 external/bsd/bind/dist/bin/python/dnssec-coverage.py.in: up to 1.1.1.8 external/bsd/bind/dist/bin/python/isc/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/__init__.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/checkds.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/coverage.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/dnskey.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/eventlist.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/keydict.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/keyevent.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/keyzone.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/tests/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/tests/dnskey_test.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/tests/testdata/Kexample.com.+007+35529.key: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/tests/testdata/Kexample.com.+007+35529.private: up to 1.1.1.1 external/bsd/bind/dist/bin/python/isc/utils.py.in: up to 1.1.1.1 external/bsd/bind/dist/bin/python/setup.py: up to 1.1.1.1 external/bsd/bind/dist/bin/rndc/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/rndc/rndc.8: up to 1.10 external/bsd/bind/dist/bin/rndc/rndc.c: up to 1.15 external/bsd/bind/dist/bin/rndc/rndc.conf.5: up to 1.8 external/bsd/bind/dist/bin/rndc/rndc.conf.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/rndc/rndc.conf.html: up to 1.1.1.9 external/bsd/bind/dist/bin/rndc/rndc.docbook: up to 1.1.1.10 external/bsd/bind/dist/bin/rndc/rndc.html: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/Makefile.in: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/atomic/t_atomic.c: up to 1.7 external/bsd/bind/dist/bin/tests/byname_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/db/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/db/win32/t_db.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/db/win32/t_db.mak.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/db/win32/t_db.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/dst/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/dst/t_dst.c: up to 1.11 external/bsd/bind/dist/bin/tests/hash_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/hashes/Makefile.in: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/hashes/t_hashes.c: up to 1.6 external/bsd/bind/dist/bin/tests/hashes/win32/t_hashes.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/hashes/win32/t_hashes.mak.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/hashes/win32/t_hashes.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/master/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/master/win32/t_master.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/master/win32/t_master.mak.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/master/win32/t_master.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/mdig.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/pkcs11/README: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/create.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/find.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/genrsa.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/login.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/privrsa.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/pubrsa.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/random.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/session.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sha1.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sign.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/verify.c: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/rdata_test.c: up to 1.10 external/bsd/bind/dist/bin/tests/resolver/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/resolver/win32/t_resolver.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/resolver/win32/t_resolver.mak.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/resolver/win32/t_resolver.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/Makefile.in: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/system/acl/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/additional/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/addzone/ns2/hints.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/addzone/ns2/redirect.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/addzone/tests.sh: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/system/allow_query/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/autosign/ns1/keygen.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/autosign/ns2/keygen.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/autosign/ns3/keygen.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/autosign/tests.sh: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/system/builtin/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/builtin/gethostname.c: delete external/bsd/bind/dist/bin/tests/system/builtin/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/cacheclean/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/case/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/checkconf/bad-options-also-notify.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-acl.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-all-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-errors-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-ipv4-prefix-length.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-ipv6-prefix-length.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-max-table-size.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-nodata-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-nxdomains-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-qps-scale.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-referrals-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-responses-per-second.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-slip.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rate-limit-window.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-rpz-zone.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/bad-view-also-notify.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/good-acl.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/checkconf/good-options-also-notify.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/good-view-also-notify.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkconf/good.conf: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/checkconf/tests.sh: up to 1.1.1.14 external/bsd/bind/dist/bin/tests/system/checkds/dig.bat: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkds/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/checknames/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/checkzone/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/checkzone/zones/crashzone.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/conf.sh.in: up to 1.1.1.18 external/bsd/bind/dist/bin/tests/system/conf.sh.win32: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/coverage/03-ksk-unpublished/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/04-zsk-unpublished/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/05-ksk-unpub-active/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/06-zsk-unpub-active/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/07-ksk-ttl/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/08-zsk-ttl/expect: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/coverage/clean.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/coverage/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/database/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/dialup/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/digcomp.pl: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/digdelv/clean.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/digdelv/ns2/example.db: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/digdelv/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/dlv/ns3/sign.sh: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/dlv/tests.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/dlvauto/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/dlz/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/dlzexternal/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dlzexternal/dlopen.c: delete external/bsd/bind/dist/bin/tests/system/dlzexternal/prereq.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/dlzexternal/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dname/ns2/example.db: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/dname/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dns64/ns1/example.db: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/dns64/ns2/named.conf: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/dns64/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/dnssec/ns1/named.conf: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/dnssec/ns1/sign.sh: up to 1.1.1.14 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/sign.sh: up to 1.1.1.18 external/bsd/bind/dist/bin/tests/system/dnssec/ns3/sign.sh: up to 1.1.1.18 external/bsd/bind/dist/bin/tests/system/dnssec/ns6/named.args: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh: up to 1.1.1.18 external/bsd/bind/dist/bin/tests/system/dscp/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/dsdigest/ns1/sign.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/dsdigest/ns2/sign.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/dsdigest/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/ecdsa/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/ednscompliance/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/emptyzones/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/feature-test.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/fetchlimit/fetchlimit.c: delete external/bsd/bind/dist/bin/tests/system/fetchlimit/prereq.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/fetchlimit/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/filter-aaaa/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c: delete external/bsd/bind/dist/bin/tests/system/filter-aaaa/prereq.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/filter-aaaa/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/formerr/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/forward/tests.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/geoip/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/geoip/geoip.c: delete external/bsd/bind/dist/bin/tests/system/geoip/prereq.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/geoip/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/glue/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/gost/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/ifconfig.bat: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ifconfig.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/inline/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/integrity/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/integrity/ns1/mx-cname.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/integrity/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/integrity/ns1/srv-cname.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/integrity/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ixfr/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/legacy/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/limits/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/logfileconfig/clean.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/logfileconfig/ns1/named.unlimited: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/logfileconfig/ns1/named.versconf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/logfileconfig/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/lwresd/clean.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/lwresd/lwresd1/nosearch.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c: up to 1.10 external/bsd/bind/dist/bin/tests/system/lwresd/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/masterformat/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/metadata/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/notify/ns2/named.conf: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/notify/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/nslookup/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/nsupdate/clean.sh: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/nsupdate/ns1/named.conf: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/nsupdate/ns1/sample.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/ns2/named.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/nsupdate/ns2/sample.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/ns3/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/nsupdate/ns3/too-big.test.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/setup.sh: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/nsupdate/tests.sh: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/pending/ns1/sign.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/pending/ns2/named.conf: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/pending/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/pkcs11/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/pkcs11ssl/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/reclimit/ans2/ans.pl: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/reclimit/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/redirect/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/resolver/clean.sh: up to 1.1.1.11 external/bsd/bind/dist/bin/tests/system/resolver/ns4/root.db: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/ns5/named.conf: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/resolver/ns6/ds.example.net.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/resolver/ns6/example.net.db.in: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/ns6/keygen.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/ns6/named.conf: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/resolver/tests.sh: up to 1.1.1.15 external/bsd/bind/dist/bin/tests/system/rndc/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/rpz/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/rpz/rpz.c: delete external/bsd/bind/dist/bin/tests/system/rpz/setup.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/rpz/tests.sh: up to 1.1.1.14 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.clientip21: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/prereq.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rpzrecurse/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/rrchecker/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/rrl/clean.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/rrl/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/rrsetorder/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/rsabigexponent/clean.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/rsabigexponent/ns1/sign.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/rsabigexponent/prereq.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/rsabigexponent/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/run.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/sit/tests.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/smartsign/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/sortlist/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/spf/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/start.pl: up to 1.1.1.14 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/sign.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/staticstub/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/statistics/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/statistics/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/statistics/xmlstats.c: delete external/bsd/bind/dist/bin/tests/system/statschannel/ns2/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statschannel/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/stop.pl: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/stress/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/stub/tests.sh: up to 1.5 external/bsd/bind/dist/bin/tests/system/tcp/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns3/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/ns4/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tcp/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tkey/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c: up to 1.9 external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/tkey/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/tsig/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/tsig/setup.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/tsig/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/tsiggss/Makefile.in: delete external/bsd/bind/dist/bin/tests/system/tsiggss/gssapi_krb.c: delete external/bsd/bind/dist/bin/tests/system/tsiggss/prereq.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/tsiggss/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/unknown/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/upforwd/setup.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/upforwd/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/v6synth/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/verify/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/verify/zones/unsigned.db: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/views/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/wildcard/ns1/sign.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/wildcard/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/win32/bigkey.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/bigkey.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/bigkey.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/bigkey.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/bigkey.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/bigkey.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/feature-test.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keycreate.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/keydelete.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/win32/lwtest.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/xfer/clean.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/xfer/ns1/axfr-too-big.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/xfer/ns1/ixfr-too-big.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/xfer/ns1/named.conf: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/xfer/ns6/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/xfer/setup.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/xfer/tests.sh: up to 1.1.1.12 external/bsd/bind/dist/bin/tests/system/xferquota/ns1/named.conf: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/xferquota/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/zero/ans5/ans.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/zero/ns1/root.db: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/zero/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/zonechecks/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/zonechecks/setup.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/zonechecks/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/timers/win32/t_timers.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/win32/makejournal.dsp.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/win32/makejournal.dsw: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/win32/makejournal.mak.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/win32/makejournal.vcxproj.filters.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/win32/makejournal.vcxproj.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/win32/makejournal.vcxproj.user: up to 1.1.1.1 external/bsd/bind/dist/bin/tools/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/tools/arpaname.1: up to 1.7 external/bsd/bind/dist/bin/tools/arpaname.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/tools/arpaname.html: up to 1.1.1.8 external/bsd/bind/dist/bin/tools/genrandom.8: up to 1.8 external/bsd/bind/dist/bin/tools/genrandom.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/tools/genrandom.html: up to 1.1.1.9 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.8: up to 1.8 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c: up to 1.9 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.docbook: up to 1.1.1.7 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.html: up to 1.1.1.8 external/bsd/bind/dist/bin/tools/named-journalprint.8: up to 1.7 external/bsd/bind/dist/bin/tools/named-journalprint.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/tools/named-journalprint.html: up to 1.1.1.8 external/bsd/bind/dist/bin/tools/named-rrchecker.1: up to 1.1.1.6 external/bsd/bind/dist/bin/tools/named-rrchecker.docbook: up to 1.1.1.4 external/bsd/bind/dist/bin/tools/named-rrchecker.html: up to 1.1.1.5 external/bsd/bind/dist/bin/tools/nsec3hash.8: up to 1.7 external/bsd/bind/dist/bin/tools/nsec3hash.docbook: up to 1.1.1.6 external/bsd/bind/dist/bin/tools/nsec3hash.html: up to 1.1.1.8 external/bsd/bind/dist/bin/tools/win32/ischmacfixup.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tools/win32/ischmacfixup.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tools/win32/ischmacfixup.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/tools/win32/nsec3hash.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tools/win32/nsec3hash.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tools/win32/nsec3hash.vcxproj.in: up to 1.1.1.4 external/bsd/bind/dist/bin/win32/BINDInstall/BINDInstallDlg.cpp: up to 1.1.1.12 external/bsd/bind/dist/bind.keys: up to 1.1.1.7 external/bsd/bind/dist/bind.keys.h: up to 1.1.1.5 external/bsd/bind/dist/config.h.in: up to 1.14 external/bsd/bind/dist/configure: up to 1.8 external/bsd/bind/dist/configure.in: up to 1.10 external/bsd/bind/dist/contrib/dlz/modules/filesystem/dlz_filesystem_dynamic.c: up to 1.1.1.5 external/bsd/bind/dist/contrib/dnsperf-2.1.0.0-1/configure: up to 1.1.1.2 external/bsd/bind/dist/contrib/dnsperf-2.1.0.0-1/configure.in: up to 1.1.1.2 external/bsd/bind/dist/contrib/queryperf/utils/gen-data-queryperf.py: up to 1.1.1.4 external/bsd/bind/dist/contrib/sdb/ldap/zone2ldap.c: up to 1.6 external/bsd/bind/dist/doc/arm/Bv9ARM-book.xml: up to 1.1.1.21 external/bsd/bind/dist/doc/arm/Bv9ARM.ch01.html: up to 1.1.1.25 external/bsd/bind/dist/doc/arm/Bv9ARM.ch02.html: up to 1.1.1.22 external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html: up to 1.1.1.27 external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch05.html: up to 1.1.1.28 external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch10.html: up to 1.1.1.24 external/bsd/bind/dist/doc/arm/Bv9ARM.ch11.html: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/Bv9ARM.ch12.html: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/Bv9ARM.ch13.html: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/Bv9ARM.html: up to 1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.pdf: up to 1.20 external/bsd/bind/dist/doc/arm/dlz.xml: up to 1.1.1.4 external/bsd/bind/dist/doc/arm/dnssec.xml: up to 1.1.1.8 external/bsd/bind/dist/doc/arm/libdns.xml: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/logging-categories.xml: up to 1.1.1.2 external/bsd/bind/dist/doc/arm/man.arpaname.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.ddns-confgen.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.delv.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dig.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-settime.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.dnssec-verify.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.genrandom.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.host.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.lwresd.html: up to 1.1.1.7 external/bsd/bind/dist/doc/arm/man.named-checkconf.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.named-checkzone.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.named-journalprint.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.named-rrchecker.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.named.conf.html: up to 1.1.1.7 external/bsd/bind/dist/doc/arm/man.named.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.nsec3hash.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.nsupdate.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.rndc-confgen.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.rndc.conf.html: up to 1.15 external/bsd/bind/dist/doc/arm/man.rndc.html: up to 1.15 external/bsd/bind/dist/doc/arm/managed-keys.xml: up to 1.1.1.5 external/bsd/bind/dist/doc/arm/notes-wrapper.xml: up to 1.1.1.3 external/bsd/bind/dist/doc/arm/notes.html: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/notes.pdf: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/notes.xml: up to 1.1.1.13 external/bsd/bind/dist/doc/arm/pkcs11.xml: up to 1.1.1.10 external/bsd/bind/dist/doc/misc/options: up to 1.9 external/bsd/bind/dist/doc/misc/sort-options.pl: up to 1.1.1.5 external/bsd/bind/dist/doc/xsl/copyright.xsl: up to 1.1.1.6 external/bsd/bind/dist/doc/xsl/isc-docbook-chunk.xsl.in: up to 1.1.1.7 external/bsd/bind/dist/doc/xsl/isc-docbook-html.xsl.in: up to 1.1.1.7 external/bsd/bind/dist/isc-config.sh.1: up to 1.7 external/bsd/bind/dist/isc-config.sh.docbook: up to 1.1.1.7 external/bsd/bind/dist/isc-config.sh.html: up to 1.1.1.9 external/bsd/bind/dist/lib/Atffile: up to 1.1.1.3 external/bsd/bind/dist/lib/bind9/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/bind9/api: up to 1.1.1.19 external/bsd/bind/dist/lib/bind9/check.c: up to 1.15 external/bsd/bind/dist/lib/bind9/include/bind9/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/Makefile.in: up to 1.1.1.15 external/bsd/bind/dist/lib/dns/acl.c: up to 1.8 external/bsd/bind/dist/lib/dns/adb.c: up to 1.13 external/bsd/bind/dist/lib/dns/api: up to 1.15 external/bsd/bind/dist/lib/dns/client.c: up to 1.13 external/bsd/bind/dist/lib/dns/db.c: up to 1.9 external/bsd/bind/dist/lib/dns/dbtable.c: up to 1.6 external/bsd/bind/dist/lib/dns/dispatch.c: up to 1.12 external/bsd/bind/dist/lib/dns/dnssec.c: up to 1.13 external/bsd/bind/dist/lib/dns/dst_api.c: up to 1.14 external/bsd/bind/dist/lib/dns/dst_gost.h: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/dst_internal.h: up to 1.11 external/bsd/bind/dist/lib/dns/dst_openssl.h: up to 1.10 external/bsd/bind/dist/lib/dns/dst_parse.c: up to 1.10 external/bsd/bind/dist/lib/dns/ecdb.c: up to 1.10 external/bsd/bind/dist/lib/dns/gssapictx.c: up to 1.10 external/bsd/bind/dist/lib/dns/hmac_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/dns/include/dns/db.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/events.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dns/keytable.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dns/masterdump.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/message.h: up to 1.11 external/bsd/bind/dist/lib/dns/include/dns/peer.h: up to 1.6 external/bsd/bind/dist/lib/dns/include/dns/rbt.h: up to 1.13 external/bsd/bind/dist/lib/dns/include/dns/rdata.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/rdataslab.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dns/result.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/rrl.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dns/tsig.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dns/types.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/view.h: up to 1.12 external/bsd/bind/dist/lib/dns/include/dns/zone.h: up to 1.18 external/bsd/bind/dist/lib/dns/include/dns/zt.h: up to 1.5 external/bsd/bind/dist/lib/dns/include/dst/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/include/dst/gssapi.h: up to 1.6 external/bsd/bind/dist/lib/dns/iptable.c: up to 1.6 external/bsd/bind/dist/lib/dns/keytable.c: up to 1.12 external/bsd/bind/dist/lib/dns/masterdump.c: up to 1.12 external/bsd/bind/dist/lib/dns/message.c: up to 1.23 external/bsd/bind/dist/lib/dns/name.c: up to 1.14 external/bsd/bind/dist/lib/dns/ncache.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssl_link.c: up to 1.14 external/bsd/bind/dist/lib/dns/openssldh_link.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssldsa_link.c: up to 1.13 external/bsd/bind/dist/lib/dns/opensslecdsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslgost_link.c: up to 1.12 external/bsd/bind/dist/lib/dns/opensslrsa_link.c: up to 1.13 external/bsd/bind/dist/lib/dns/peer.c: up to 1.8 external/bsd/bind/dist/lib/dns/pkcs11dh_link.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/pkcs11dsa_link.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/pkcs11ecdsa_link.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/pkcs11gost_link.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/pkcs11rsa_link.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/rbt.c: up to 1.13 external/bsd/bind/dist/lib/dns/rbtdb.c: up to 1.24 external/bsd/bind/dist/lib/dns/rcode.c: up to 1.11 external/bsd/bind/dist/lib/dns/rdata.c: up to 1.15 external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c: up to 1.12 external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdataset.c: up to 1.11 external/bsd/bind/dist/lib/dns/rdataslab.c: up to 1.12 external/bsd/bind/dist/lib/dns/request.c: up to 1.11 external/bsd/bind/dist/lib/dns/resolver.c: up to 1.31 external/bsd/bind/dist/lib/dns/result.c: up to 1.8 external/bsd/bind/dist/lib/dns/rootns.c: up to 1.12 external/bsd/bind/dist/lib/dns/rpz.c: up to 1.11 external/bsd/bind/dist/lib/dns/sdb.c: up to 1.11 external/bsd/bind/dist/lib/dns/sdlz.c: up to 1.11 external/bsd/bind/dist/lib/dns/spnego.c: up to 1.11 external/bsd/bind/dist/lib/dns/tests/Krsa.+005+29235.key: up to 1.1.1.1 external/bsd/bind/dist/lib/dns/tests/Makefile.in: up to 1.9 external/bsd/bind/dist/lib/dns/tests/acl_test.c: up to 1.1.1.1 external/bsd/bind/dist/lib/dns/tests/dh_test.c: up to 1.1.1.2 external/bsd/bind/dist/lib/dns/tests/nsec3_test.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/tests/rsa_test.c: up to 1.1.1.1 external/bsd/bind/dist/lib/dns/tkey.c: up to 1.12 external/bsd/bind/dist/lib/dns/tsec.c: up to 1.5 external/bsd/bind/dist/lib/dns/tsig.c: up to 1.10 external/bsd/bind/dist/lib/dns/view.c: up to 1.13 external/bsd/bind/dist/lib/dns/win32/libdns.def.in: up to 1.1.1.9 external/bsd/bind/dist/lib/dns/xfrin.c: up to 1.14 external/bsd/bind/dist/lib/dns/zone.c: up to 1.17 external/bsd/bind/dist/lib/dns/zt.c: up to 1.9 external/bsd/bind/dist/lib/irs/Atffile: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/lib/irs/api: up to 1.1.1.10 external/bsd/bind/dist/lib/irs/getaddrinfo.c: up to 1.9 external/bsd/bind/dist/lib/irs/include/irs/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/lib/irs/resconf.c: up to 1.10 external/bsd/bind/dist/lib/irs/tests/Atffile: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/resconf_test.c: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/domain.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/nameserver-v4.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/nameserver-v6.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/options-debug.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/options-ndots.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/options-timeout.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/options-unknown.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/options.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/port.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/resolv.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/search.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/sortlist-v4.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/timeout.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/irs/tests/testdata/unknown.conf: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/Makefile.in: up to 1.1.1.15 external/bsd/bind/dist/lib/isc/aes.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/alpha/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/api: up to 1.1.1.22 external/bsd/bind/dist/lib/isc/backtrace-emptytbl.c: up to 1.5 external/bsd/bind/dist/lib/isc/hash.c: up to 1.11 external/bsd/bind/dist/lib/isc/hmacmd5.c: up to 1.10 external/bsd/bind/dist/lib/isc/hmacsha.c: up to 1.11 external/bsd/bind/dist/lib/isc/ia64/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/include/isc/Makefile.in: up to 1.1.1.12 external/bsd/bind/dist/lib/isc/include/isc/backtrace.h: up to 1.5 external/bsd/bind/dist/lib/isc/include/isc/errno.h: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/include/isc/event.h: up to 1.7 external/bsd/bind/dist/lib/isc/include/isc/hmacmd5.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/hmacsha.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/lex.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/md5.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/netaddr.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/platform.h.in: up to 1.1.1.12 external/bsd/bind/dist/lib/isc/include/isc/sha1.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/sha2.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/sockaddr.h: up to 1.7 external/bsd/bind/dist/lib/isc/include/isc/socket.h: up to 1.11 external/bsd/bind/dist/lib/isc/include/isc/types.h: up to 1.9 external/bsd/bind/dist/lib/isc/include/pk11/Makefile.in: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/pk11/README.site: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/include/pk11/pk11.h: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/include/pk11/site.h: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/include/pkcs11/Makefile.in: up to 1.1.1.3 external/bsd/bind/dist/lib/isc/include/pkcs11/pkcs11.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/pkcs11/pkcs11f.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/pkcs11/pkcs11t.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/lex.c: up to 1.9 external/bsd/bind/dist/lib/isc/log.c: up to 1.9 external/bsd/bind/dist/lib/isc/md5.c: up to 1.9 external/bsd/bind/dist/lib/isc/mips/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/mips/include/isc/atomic.h: up to 1.6 external/bsd/bind/dist/lib/isc/netaddr.c: up to 1.9 external/bsd/bind/dist/lib/isc/noatomic/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/nothreads/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/pk11.c: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/powerpc/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/print.c: up to 1.7 external/bsd/bind/dist/lib/isc/pthreads/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/radix.c: up to 1.9 external/bsd/bind/dist/lib/isc/random.c: up to 1.6 external/bsd/bind/dist/lib/isc/ratelimiter.c: up to 1.7 external/bsd/bind/dist/lib/isc/sha1.c: up to 1.9 external/bsd/bind/dist/lib/isc/sha2.c: up to 1.11 external/bsd/bind/dist/lib/isc/task.c: up to 1.14 external/bsd/bind/dist/lib/isc/tests/Makefile.in: up to 1.1.1.12 external/bsd/bind/dist/lib/isc/tests/errno_test.c: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/tests/hash_test.c: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/tests/netaddr_test.c: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/tests/print_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/unix/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/unix/dir.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/errno.c: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/unix/errno2result.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/errno2result.h: up to 1.5 external/bsd/bind/dist/lib/isc/unix/file.c: up to 1.12 external/bsd/bind/dist/lib/isc/unix/include/isc/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/unix/include/isc/net.h: up to 1.7 external/bsd/bind/dist/lib/isc/unix/include/isc/offset.h: up to 1.6 external/bsd/bind/dist/lib/isc/unix/include/pkcs11/Makefile.in: up to 1.1.1.2 external/bsd/bind/dist/lib/isc/unix/net.c: up to 1.11 external/bsd/bind/dist/lib/isc/unix/pk11_api.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/unix/socket.c: up to 1.21 external/bsd/bind/dist/lib/isc/unix/stdio.c: up to 1.8 external/bsd/bind/dist/lib/isc/win32/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/win32/app.c: up to 1.7 external/bsd/bind/dist/lib/isc/win32/condition.c: up to 1.5 external/bsd/bind/dist/lib/isc/win32/errno.c: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/win32/errno2result.c: up to 1.6 external/bsd/bind/dist/lib/isc/win32/errno2result.h: up to 1.5 external/bsd/bind/dist/lib/isc/win32/include/isc/ipv6.h: up to 1.7 external/bsd/bind/dist/lib/isc/win32/include/isc/offset.h: up to 1.5 external/bsd/bind/dist/lib/isc/win32/interfaceiter.c: up to 1.8 external/bsd/bind/dist/lib/isc/win32/libisc.def.in: up to 1.1.1.9 external/bsd/bind/dist/lib/isc/win32/libisc.dsp.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/libisc.mak.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.filters.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.in: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/win32/pk11_api.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/win32/socket.c: up to 1.13 external/bsd/bind/dist/lib/isc/win32/stdio.c: up to 1.6 external/bsd/bind/dist/lib/isc/x86_32/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/x86_64/include/isc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isccc/Makefile.in: up to 1.1.1.12 external/bsd/bind/dist/lib/isccc/api: up to 1.1.1.12 external/bsd/bind/dist/lib/isccc/cc.c: up to 1.12 external/bsd/bind/dist/lib/isccc/include/isccc/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isccc/win32/libisccc.def: up to 1.1.1.2 external/bsd/bind/dist/lib/isccfg/Makefile.in: up to 1.1.1.13 external/bsd/bind/dist/lib/isccfg/aclconf.c: up to 1.10 external/bsd/bind/dist/lib/isccfg/api: up to 1.1.1.19 external/bsd/bind/dist/lib/isccfg/include/isccfg/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h: up to 1.7 external/bsd/bind/dist/lib/isccfg/namedconf.c: up to 1.14 external/bsd/bind/dist/lib/isccfg/parser.c: up to 1.12 external/bsd/bind/dist/lib/isccfg/win32/libisccfg.def: up to 1.1.1.9 external/bsd/bind/dist/lib/lwres/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/api: up to 1.1.1.15 external/bsd/bind/dist/lib/lwres/include/lwres/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/lwres_grbn.c: up to 1.6 external/bsd/bind/dist/lib/lwres/man/Makefile.in: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres.docbook: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/man/lwres.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_buffer.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_buffer.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_buffer.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_config.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_config.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_config.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_context.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_context.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_context.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_gabn.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_gabn.docbook: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/man/lwres_gabn.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_gai_strerror.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_gai_strerror.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_gai_strerror.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_getaddrinfo.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_getaddrinfo.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_getaddrinfo.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_gethostent.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_gethostent.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_gethostent.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_getipnode.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_getipnode.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_getipnode.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_getnameinfo.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_getnameinfo.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_getnameinfo.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_getrrsetbyname.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_getrrsetbyname.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_getrrsetbyname.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_gnba.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_gnba.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_gnba.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_hstrerror.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_hstrerror.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_hstrerror.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_inetntop.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_inetntop.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_inetntop.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_noop.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_noop.docbook: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/man/lwres_noop.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_packet.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_packet.docbook: up to 1.1.1.6 external/bsd/bind/dist/lib/lwres/man/lwres_packet.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/man/lwres_resutil.3: up to 1.7 external/bsd/bind/dist/lib/lwres/man/lwres_resutil.docbook: up to 1.1.1.7 external/bsd/bind/dist/lib/lwres/man/lwres_resutil.html: up to 1.1.1.12 external/bsd/bind/dist/lib/lwres/unix/include/lwres/Makefile.in: up to 1.1.1.5 external/bsd/bind/dist/lib/lwres/win32/liblwres.def: up to 1.1.1.3 external/bsd/bind/dist/lib/samples/Makefile.in: up to 1.1.1.4 external/bsd/bind/dist/lib/samples/resolve.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/sample-request.c: up to 1.1.1.7 external/bsd/bind/dist/lib/samples/sample-update.c: up to 1.1.1.7 external/bsd/bind/dist/lib/samples/win32/async.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/async.mak.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/async.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/lib/samples/win32/nsprobe.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/nsprobe.mak.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/nsprobe.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/lib/samples/win32/request.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/request.mak.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/request.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/lib/samples/win32/resolve.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/resolve.mak.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/resolve.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/lib/samples/win32/update.dsp.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/update.mak.in: up to 1.1.1.2 external/bsd/bind/dist/lib/samples/win32/update.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/lib/tests/t_api.c: up to 1.8 external/bsd/bind/dist/make/rules.in: up to 1.8 external/bsd/bind/dist/srcid: up to 1.21 external/bsd/bind/dist/util/bindkeys.pl: up to 1.1.1.2 external/bsd/bind/dist/version: up to 1.25 external/bsd/bind/dist/win32utils/Configure: up to 1.1.1.7 external/bsd/bind/dist/win32utils/bind9.sln.in: up to 1.1.1.4 external/bsd/bind/dist/win32utils/build.txt: up to 1.1.1.5 external/bsd/bind/dist/win32utils/legacy/BINDBuild.dsw.in: up to 1.5 external/bsd/bind/dist/win32utils/legacy/BuildAll.bat.in: up to 1.1.1.4 external/bsd/bind/dist/win32utils/legacy/BuildPost.bat.in: up to 1.1.1.3 external/bsd/bind/dist/win32utils/readme1st.txt: up to 1.1.1.8 external/bsd/bind/include/config.h: up to 1.21 external/bsd/bind/include/dns/code.h: up to 1.13 external/bsd/bind/include/dns/enumclass.h: up to 1.9 external/bsd/bind/include/dns/enumtype.h: up to 1.13 external/bsd/bind/include/dns/rdatastruct.h: up to 1.13 external/bsd/bind/include/isc/platform.h: up to 1.23 external/bsd/bind/lib/libbind9/shlib_version: up to 1.17 external/bsd/bind/lib/libdns/shlib_version: up to 1.19 external/bsd/bind/lib/libirs/shlib_version: up to 1.6 external/bsd/bind/lib/libisc/shlib_version: up to 1.19 external/bsd/bind/lib/libisccc/shlib_version: up to 1.17 external/bsd/bind/lib/libisccfg/shlib_version: up to 1.17 external/bsd/bind/lib/liblwres/shlib_version: up to 1.17 Update BIND to 9.10.5-P1. @ text @a0 1 d2 1 a2 1 - Copyright (C) 2004-2016 Internet Systems Consortium, Inc. ("ISC") d17 1 a17 1 d47 1 a47 1This document summarizes changes since BIND 9.10.5: d71 35 a105 8
BIND 9.10.5-P1 addresses the security issues described in CVE-2017-3140 and CVE-2017-3141.
d115 2 a116 3
d136 1 a136 1
d144 2 a145 3
The BIND installer on Windows used an unquoted service path, which can enable privilege escalation. This flaw is disclosed in CVE-2017-3141. [RT #45229]
With certain RPZ configurations, a response with TTL 0 could cause named to go into an infinite query loop. This flaw is disclosed in CVE-2017-3140. [RT #45181]
d266 2 a267 3
a275 1
BIND 9.10.5-P1
@ 1.13 log @Merge 9.10.4-P6 4558. [bug] Synthesised CNAME before matching DNAME was still being cached when it should have been. [RT #44318] 4557. [security] Combining dns64 and rpz can result in dereferencing a NULL pointer (read). (CVE-2017-3135) [RT#44434] @ text @d47 1 a47 1BIND 9.10.4-P6
@ 1.12 log @merge bind-9.10.4-P5 @ text @d47 1 a47 1BIND 9.10.4-P5
@ 1.12.2.1 log @Sync with HEAD @ text @d47 1 a47 1BIND 9.10.4-P6 addresses the security issue described in CVE-2017-3135, and fixes a regression introduced in a prior security release.
d72 1 a72 1 CVE-2016-9131, CVE-2016-9147, CVE-2016-9444 and CVE-2016-9778. a106 29 New DNSSEC Root Key
ICANN is in the process of introducing a new Key Signing Key (KSK) for the global root zone. BIND has multiple methods for managing DNSSEC trust anchors, with somewhat different behaviors. If the root key is configured using the managed-keys statement, or if the pre-configured root key is enabled by using dnssec-validation auto, then BIND can keep keys up to date automatically. Servers configured in this way will roll seamlessly to the new key when it is published in the root zone. However, keys configured using the trusted-keys statement are not automatically maintained. If your server is performing DNSSEC validation and is configured using trusted-keys, you are advised to change your configuration before the root zone begins signing with the new KSK. This is currently scheduled for October 11, 2017.
This release includes an updated version of the
bind.keys file containing the new root
key. This file can also be downloaded from
https://www.isc.org/bind-keys
.
Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could trigger assertion failures. This flaw is disclosed in CVE-2017-3137. [RT #44734] d115 4 a118 3 dns64 with break-dnssec yes; can result in an assertion failure. This flaw is disclosed in CVE-2017-3136. [RT #44653] d121 3 a123 22 If a server is configured with a response policy zone (RPZ) that rewrites an answer with local data, and is also configured for DNS64 address mapping, a NULL pointer can be read triggering a server crash. This flaw is disclosed in CVE-2017-3135. [RT #44434]
named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]
named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. This flaw is disclosed in CVE-2016-9147. [RT #43548]
named incorrectly tried to cache TKEY
records which could trigger an assertion failure when there was
a class mismatch. This flaw is disclosed in CVE-2016-9131.
[RT #43522]
d127 1
a127 2
responses containing answers of type DNAME. This flaw is
disclosed in CVE-2016-8864. [RT #43465]
d135 5
a139 7
Calling getrrsetbyname() with a non
absolute name could trigger an infinite recursion bug in
lwresd or named with
lwres configured if, when combined with
a search list entry from resolv.conf,
the resulting name is too long. This flaw is disclosed in
CVE-2016-2775. [RT #42694]
a168 11
A synthesized CNAME record appearing in a response before the
associated DNAME could be cached, when it should not have been.
This was a regression introduced while addressing CVE-2016-8864.
[RT #44318]
Fixed a crash when calling rndc stats on some Windows builds: some Visual Studio compilers generate code that crashes when the "%z" printf() format specifier is used. [RT #42380]
d170 1 a170 1 were incorrectly getting a FORMERR response. d221 1 a221 1
BIND 9.10.4-P8
@ 1.11 log @merge conflicts @ text @d47 1 a47 1BIND 9.10.4-P4
@ 1.10 log @Merge conflicts. @ text @d47 1 a47 1BIND 9.10.4-P3
@ 1.9 log @merge conflicts @ text @d47 1 a47 1None.
BIND 9.10.4-P1
@ 1.9.2.1 log @Sync with HEAD @ text @d47 1 a47 1BIND 9.10.4-P3 addresses the security issue described in CVE-2016-2776 and addresses an interoperability issue with ECS clients.
BIND 9.10.4-P2 addresses the security issue described in CVE-2016-2775.
d91 3 a93 18
It was possible to trigger assertions when processing a response. This flaw is disclosed in CVE-2016-8864. [RT #43465]
It was possible to trigger a assertion when rendering a message using a specially crafted request. This flaw is disclosed in CVE-2016-2776. [RT #43139]
getrrsetbyname with a non absolute name could trigger an infinite recursion bug in lwresd and named with lwres configured if when combined with a search list entry the resulting name is too long. This flaw is disclosed in CVE-2016-2775. [RT #42694]
d169 1 a169 1
BIND 9.10.4-P4
@ 1.9.2.2 log @Sync with HEAD @ text @d47 1 a47 1BIND 9.10.4-P5 addresses the security issues described in CVE-2016-9131, CVE-2016-9147, CVE-2016-9444 and CVE-2016-9778.
a105 24 If a server is configured with a response policy zone (RPZ) that rewrites an answer with local data, and is also configured for DNS64 address mapping, a NULL pointer can be read triggering a server crash. This flaw is disclosed in CVE-2017-3135. [RT #44434]
named could mishandle authority sections with missing RRSIGs, triggering an assertion failure. This flaw is disclosed in CVE-2016-9444. [RT #43632]
named mishandled some responses where covering RRSIG records were returned without the requested data, resulting in an assertion failure. This flaw is disclosed in CVE-2016-9147. [RT #43548]
named incorrectly tried to cache TKEY records which could trigger an assertion failure when there was a class mismatch. This flaw is disclosed in CVE-2016-9131. [RT #43522]
d107 1
a107 2
responses containing answers of type DNAME. This flaw is
disclosed in CVE-2016-8864. [RT #43465]
d115 5
a119 7
Calling getrrsetbyname() with a non
absolute name could trigger an infinite recursion bug in
lwresd or named with
lwres configured if, when combined with
a search list entry from resolv.conf,
the resulting name is too long. This flaw is disclosed in
CVE-2016-2775. [RT #42694]
a148 11
A synthesized CNAME record appearing in a response before the
associated DNAME could be cached, when it should not have been.
This was a regression introduced while addressing CVE-2016-8864.
[RT #44318]
Fixed a crash when calling rndc stats on some Windows builds: some Visual Studio compilers generate code that crashes when the "%z" printf() format specifier is used. [RT #42380]
d150 1 a150 1 were incorrectly getting a FORMERR response. d201 1 a201 1
BIND 9.10.4-P6
@ 1.9.2.3 log @Sync with HEAD @ text @d47 1 a47 1ICANN is in the process of introducing a new Key Signing Key (KSK) for the global root zone. BIND has multiple methods for managing DNSSEC trust anchors, with somewhat different behaviors. If the root key is configured using the managed-keys statement, or if the pre-configured root key is enabled by using dnssec-validation auto, then BIND can keep keys up to date automatically. Servers configured in this way will roll seamlessly to the new key when it is published in the root zone. However, keys configured using the trusted-keys statement are not automatically maintained. If your server is performing DNSSEC validation and is configured using trusted-keys, you are advised to change your configuration before the root zone begins signing with the new KSK. This is currently scheduled for October 11, 2017.
This release includes an updated version of the
bind.keys file containing the new root
key. This file can also be downloaded from
https://www.isc.org/bind-keys
.
Some chaining (i.e., type CNAME or DNAME) responses to upstream queries could trigger assertion failures. This flaw is disclosed in CVE-2017-3137. [RT #44734]
dns64 with break-dnssec yes; can result in an assertion failure. This flaw is disclosed in CVE-2017-3136. [RT #44653]
d248 1 a248 1
BIND 9.10.4-P8
@ 1.8 log @merge conflicts @ text @a16 1 d21 2 a22 2 d41 3 a43 3BIND 9.10.3-P3 addresses the security issues described in CVE-2015-8704 and CVE-2015-8705. It also fixes a serious regression in authoritative server selection that was introduced in BIND 9.10.3.
BIND 9.10.3-P2 addresses the security issues described in CVE-2015-3193 (OpenSSL), CVE-2015-8000 and CVE-2015-8461.
BIND 9.10.3-P1 was incomplete and was withdrawn prior to publication. d77 1 a77 1
Duplicate EDNS COOKIE options in a response could trigger an assertion failure. This flaw is disclosed in CVE-2016-2088. [RT #41809]
The resolver could abort with an assertion failure due to improper DNAME handling when parsing fetch reply messages. This flaw is disclosed in CVE-2016-1286. [RT #41753]
Malformed control messages can trigger assertions in named and rndc. This flaw is disclosed in CVE-2016-1285. [RT #41666]
Certain errors that could be encountered when printing out or logging an OPT record containing a CLIENT-SUBNET option could be mishandled, resulting in an assertion failure. This flaw is disclosed in CVE-2015-8705. [RT #41397]
Specific APL data could trigger an INSIST. This flaw is disclosed in CVE-2015-8704. [RT #41396]
Named is potentially vulnerable to the OpenSSL vulnerability described in CVE-2015-3193.
Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
Insufficient testing when parsing a message allowed records with an incorrect class to be be accepted, triggering a REQUIRE failure when those records were subsequently cached. This flaw is disclosed in CVE-2015-8000. [RT #40987]
d102 1 a102 1
Updated the compiled in addresses for H.ROOT-SERVERS.NET. d116 1 a116 1
Authoritative servers that were marked as bogus (e.g. blackholed in configuration or with invalid addresses) were being queried anyway. [RT #41321]
BIND 9.10.3-P4
@ 1.7 log @Merge 9.10.3-P3: 4288. [bug] Fixed a regression in resolver.c:possibly_mark() which caused known-bogus servers to be queried anyway. [RT #41321] 4286. [security] render_ecs errors were mishandled when printing out a OPT record resulting in a assertion failure. (CVE-2015-8705) [RT #41397] 4285. [security] Specific APL data could trigger a INSIST. (CVE-2015-8704) [RT #41396] @ text @d17 1 a17 1 d48 1 a48 1Incorrect reference counting could result in an INSIST failure if a socket error occurred while performing a lookup. This flaw is disclosed in CVE-2015-8461. [RT#40945]
BIND 9.10.3-P3
@ 1.6 log @merge conflicts @ text @d17 1 a17 1 d48 1 a48 1d122 5 d147 4 a150 2 None.
BIND 9.10.3-P2
@ 1.5 log @Changes for 9.10.2-P4: 4170. [security] An incorrect boundary check in the OPENPGPKEY rdatatype could trigger an assertion failure. (CVE-2015-5986) [RT #40286] 4168. [security] A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys. (CVE-2015-5722) [RT #40212] @ text @d17 1 a17 1 d48 1 a48 1BIND 9.10.2-P2 addresses a security issue described in CVE-2015-4620.
BIND 9.10.2-P1 addressed several bugs that have been identified in the BIND 9.10 implementation of response-policy zones (RPZ). The bugs are in code which optimizes searching through multiple policy zones. In some cases, they can cause RPZ to behave inefficiently by searching for query matches in more policy zones than are strictly necessary, or to behave unpredictably by failing to search a policy zone that should have been searched. In the worst case, they can lead to assertion failures, terminating named. d94 14 a107 3 An incorrect boundary check in the OPENPGPKEY rdatatype could trigger an assertion failure. This flaw is disclosed in CVE-2015-5986. [RT #40286] a108 31
A buffer accounting error could trigger an assertion failure when parsing certain malformed DNSSEC keys.
This flaw was discovered by Hanno B쎶eck of the Fuzzing Project, and is disclosed in CVE-2015-5722. [RT #40212]
A specially crafted query could trigger an assertion failure in message.c.
This flaw was discovered by Jonathan Foote, and is disclosed in CVE-2015-5477. [RT #39795]
On servers configured to perform DNSSEC validation, an assertion failure could be triggered on answers from a specially configured server.
This flaw was discovered by Breno Silveira Soares, and is disclosed in CVE-2015-4620. [RT #39795]
None
None
Asynchronous zone loads were not handled correctly when the zone load was already in progress; this could trigger a crash in zt.c. [RT #37573]
Several bugs have been fixed in the RPZ implementation:
Policy zones that did not specifically require recursion could be treated as if they did; consequently, setting qname-wait-recurse no; was sometimes ineffective. This has been corrected. In most configurations, behavioral changes due to this fix will not be noticeable. [RT #39229]
The server could crash if policy zones were updated (e.g. via rndc reload or an incoming zone transfer) while RPZ processing was still ongoing for an active query. [RT #39415]
On servers with one or more policy zones configured as slaves, if a policy zone updated during regular operation (rather than at startup) using a full zone reload, such as via AXFR, a bug could allow the RPZ summary data to fall out of sync, potentially leading to an assertion failure in rpz.c when further incremental updates were made to the zone, such as via IXFR. [RT #39567]
The server could match a shorter prefix than what was available in CLIENT-IP policy triggers, and so, an unexpected action could be taken. This has been corrected. [RT #39481]
The server could crash if a reload of an RPZ zone was initiated while another reload of the same zone was already in progress. [RT #39649]
BIND 9.10.2-P4
@ 1.4 log @merge conflicts for bind-9.10.2-P3 to address CVE-2015-5477. @ text @d17 1 a17 1 d48 1 a48 1BIND 9.10.2-P3
@ 1.3 log @Merge changes. @ text @d17 1 a17 1 d48 1 a48 1BIND 9.10.2-P2
@ 1.2 log @security patch for bind from ISC (to 9.10.1-P2). Only the change to lib/dns/zone.c is security relevant Upstream changelog: --- 9.10.1-P2 released --- 4053. [security] Revoking a managed trust anchor and supplying an untrusted replacement could cause named to crash with an assertion failure. (CVE-2015-1349) [RT #38344] 4027. [port] Net::DNS 0.81 compatibility. [RT #38165] @ text @d2 1 a2 1 - Copyright (C) 2004-2014 Internet Systems Consortium, Inc. ("ISC") d17 1 a17 1 d21 1 a21 1BIND versions 4.9 and 4.9.1 were released by Digital Equipment Corporation (now Compaq Computer Corporation). Paul Vixie, then a DEC employee, became BIND's primary caretaker. He was assisted by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan Beecher, Andrew Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe Wolfhugel, and others.
In 1994, BIND version 4.9.2 was sponsored by Vixie Enterprises. Paul Vixie became BIND's principal architect/programmer.
BIND versions from 4.9.3 onward have been developed and maintained by the Internet Systems Consortium and its predecessor, the Internet Software Consortium, with support being provided by ISC's sponsors.
As co-architects/programmers, Bob Halley and Paul Vixie released the first production-ready version of BIND version 8 in May 1997.
BIND version 9 was released in September 2000 and is a major rewrite of nearly all aspects of the underlying BIND architecture.
BIND versions 4 and 8 are officially deprecated. No additional development is done on BIND version 4 or BIND version 8.
BIND development work is made possible today by the sponsorship of several corporations, and by the tireless work efforts of numerous individuals.
a85 4 d90 6 a95 53 IPv6 addresses are 128-bit identifiers for interfaces and sets of interfaces which were introduced in the DNS to facilitate scalable Internet routing. There are three types of addresses: Unicast, an identifier for a single interface; Anycast, an identifier for a set of interfaces; and Multicast, an identifier for a set of interfaces. Here we describe the global Unicast address scheme. For more information, see RFC 3587, "Global Unicast Address Format."IPv6 unicast addresses consist of a global routing prefix, a subnet identifier, and an interface identifier.
The global routing prefix is provided by the upstream provider or ISP, and (roughly) corresponds to the IPv4 network section of the address range. The subnet identifier is for local subnetting, much the same as subnetting an IPv4 /16 network into /24 subnets. The interface identifier is the address of an individual interface on a given network; in IPv6, addresses belong to interfaces rather than to machines.
The subnetting capability of IPv6 is much more flexible than that of IPv4: subnetting can be carried out on bit boundaries, in much the same way as Classless InterDomain Routing (CIDR), and the DNS PTR representation ("nibble" format) makes setting up reverse zones easier.
The Interface Identifier must be unique on the local link, and is usually generated automatically by the IPv6 implementation, although it is usually possible to override the default setting if necessary. A typical IPv6 address might look like: 2001:db8:201:9:a00:20ff:fe81:2b32
IPv6 address specifications often contain long strings of zeros, so the architects have included a shorthand for specifying them. The double colon (`::') indicates the longest possible string of zeros that can fit, and can be used only once in an address.
a96 4Specification documents for the Internet protocol suite, including the DNS, are published as part of the Request for Comments (RFCs) series of technical notes. The standards themselves are defined by the Internet Engineering Task Force (IETF) and the Internet Engineering Steering Group (IESG). RFCs can be obtained online via FTP at:
ftp://www.isi.edu/in-notes/RFCxxxx.txt
(where xxxx is
the number of the RFC). RFCs are also available via the Web at:
Internet Drafts (IDs) are rough-draft working documents of the Internet Engineering Task Force. They are, in essence, RFCs in the preliminary stages of development. Implementors are cautioned not to regard IDs as archival, and they should not be quoted or cited in any formal documents unless accompanied by the disclaimer that they are "works in progress." IDs have a lifespan of six months after which they are deleted unless updated by their authors.
This version of BIND 9 "exports" its internal libraries so that they can be used by third-party applications more easily (we call them "export" libraries in this document). In addition to all major DNS-related APIs BIND 9 is currently using, the export libraries provide the following features:
The newly created "DNS client" module. This is a higher level API that provides an interface to name resolution, single DNS transaction with a particular server, and dynamic update. Regarding name resolution, it supports advanced features such as DNSSEC validation and caching. This module supports both synchronous and asynchronous mode.
The new "IRS" (Information Retrieval System) library. It provides an interface to parse the traditional resolv.conf file and more advanced, DNS-specific configuration file for the rest of this package (see the description for the dns.conf file below).
As part of the IRS library, newly implemented standard address-name mapping functions, getaddrinfo() and getnameinfo(), are provided. They use the DNSSEC-aware validating resolver backend, and could use other advanced features of the BIND 9 libraries such as caching. The getaddrinfo() function resolves both A and AAAA RRs concurrently (when the address family is unspecified).
An experimental framework to support other event libraries than BIND 9's internal event task system.
GNU make is required to build the export libraries (other part of BIND 9 can still be built with other types of make). In the reminder of this document, "make" means GNU make. Note that in some platforms you may need to invoke a different command name than "make" (e.g. "gmake") to indicate it's GNU make.
d114 2 a115 12 Compilation$./configure --enable-exportlib$[other flags]make
This will create (in addition to usual BIND 9 programs) and a
separate set of libraries under the lib/export directory. For
example, lib/export/dns/libdns.a is the archive file of the
export version of the BIND 9 DNS library. Sample application
programs using the libraries will also be built under the
lib/export/samples directory (see below).
$cd lib/export$make install
This will install library object files under the directory specified by the --with-export-libdir configure option (default: EPREFIX/lib/bind9), and header files under the directory specified by the --with-export-includedir configure option (default: PREFIX/include/bind9). Root privilege is normally required. "make install" at the top directory will do the same.
To see how to build your own
application after the installation, see
lib/export/samples/Makefile-postinstall.in.
Currently, win32 is not supported for the export library. (Normal BIND 9 application can be built as before).
The "fixed" RRset order is not (currently) supported in the export library. If you want to use "fixed" RRset order for, e.g. named while still building the export library even without the fixed order support, build them separately:
$d133 38 a170 1 a171 14./configure --enable-fixed-rrset$[other flags, but not --enable-exportlib]make$./configure --enable-exportlib$[other flags, but not --enable-fixed-rrset]cd lib/export$make
The client module and the IRS library currently do not support DNSSEC validation using DLV (the underlying modules can handle it, but there is no tunable interface to enable the feature).
RFC 5011 is not supported in the validating stub resolver of the export library. In fact, it is not clear whether it should: trust anchors would be a system-wide configuration which would be managed by an administrator, while the stub resolver will be used by ordinary applications run by a normal user.
Not all common /etc/resolv.conf
options are supported
in the IRS library. The only available options in this
version are "debug" and "ndots".
The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
resolv.conf file.
Specifically, it is intended to provide DNSSEC related
configuration parameters. By default the path to this
configuration file is /etc/dns.conf.
This module is very
experimental and the configuration syntax or library interfaces
may change in future versions. Currently, only the
trusted-keys
statement is supported, whose syntax is the same as the same name
of statement for named.conf. (See
the section called “trusted-keys Statement Grammar” for details.)
Some sample application programs using this API are provided for reference. The following is a brief description of these applications.
Usage: sample [options] server_address hostname
Options and Arguments:
specify the RR type of the query. The default is the A RR.
specify a command-line DNS key to validate the answer. For example, to specify the following DNSKEY of example.com:
example.com. 3600 IN DNSKEY 257 3 5 xxx
specify the options as follows:
-e -k example.com -K "xxx"
-e means that this key is a zone's "key signing key" (as known as "secure Entry point"). When -a is omitted rsasha1 will be used by default.
specify a separate recursive server address for the specific "domain". Example: -s example.com:2001:db8::1234
an IP(v4/v6) address of the recursive server to which queries are sent.
the domain name for the query
Similar to "sample", but accepts a list of (query) domain names as a separate file and resolves the names asynchronously.
Usage: sample-async [-s server_address] [-t RR_type] input_file
Options and Arguments:
www.example.com
mx.example.net
ns.xxx.example
It sends a query to a specified server, and prints the response with minimal processing. It doesn't act as a "stub resolver": it stops the processing once it gets any response from the server, whether it's a referral or an alias (CNAME or DNAME) that would require further queries to get the ultimate answer. In other words, this utility acts as a very simplified dig.
Usage: sample-request [-t RRtype] server_address hostname
Options and Arguments:
specify the RR type of the queries. The default is the A RR.
an IP(v4/v6) address of the recursive server to which the query is sent.
the domain name for the query
This is a test program to check getaddrinfo() and getnameinfo() behavior. It takes a host name as an argument, calls getaddrinfo() with the given host name, and calls getnameinfo() with the resulting IP addresses returned by getaddrinfo(). If the dns.conf file exists and defines a trust anchor, the underlying resolver will act as a validating resolver, and getaddrinfo()/getnameinfo() will fail with an EAI_INSECUREDATA error when DNSSEC validation fails.
Usage: sample-gai hostname
It accepts a single update command as a command-line argument, sends an update request message to the authoritative server, and shows the response from the server. In other words, this is a simplified nsupdate.
Usage: sample-update [options] (add|delete) "update data"
Options and Arguments:
An IP address of the authoritative server that has authority for the zone containing the update name. This should normally be the primary authoritative server that accepts dynamic updates. It can also be a secondary server that is configured to forward update requests to the primary server.
A TSIG key file to secure the update transaction. The keyfile format is the same as that for the nsupdate utility.
A prerequisite for the update (only one prerequisite can be specified). The prerequisite format is the same as that is accepted by the nsupdate utility.
An IP address of a recursive server that this utility will use. A recursive server may be necessary to identify the authoritative server address to which the update request is sent.
The domain name of the zone that contains
Specify the type of update operation. Either "add" or "delete" must be specified.
Specify the data to be updated. A typical example of the data would look like "name TTL RRtype RDATA".
Examples: assuming the primary authoritative server of the dynamic.example.com zone has an IPv6 address 2001:db8::1234,
$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"
adds an A RR for foo.dynamic.example.com using the given key.
$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"
removes all A RRs for foo.dynamic.example.com using the given key.
$ sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"
removes all RRs for foo.dynamic.example.com using the given key.
It checks a set of domains to see the name servers of the domains behave correctly in terms of RFC 4074. This is included in the set of sample programs to show how the export library can be used in a DNS-related application.
Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
Options
run in the "debug" mode. with this option nsprobe will dump every RRs it receives.
increase verbosity of other normal log messages. This can be specified multiple times
specify an IP address of a recursive (caching) name server. nsprobe uses this server to get the NS RRset of each domain and the A and/or AAAA RRsets for the name servers. The default value is 127.0.0.1.
a file name containing a list of domain (zone) names to be probed. when omitted the standard input will be used. Each line of the input file specifies a single domain name such as "example.com". In general this domain name must be the apex name of some DNS zone (unlike normal "host names" such as "www.example.com"). nsprobe first identifies the NS RRsets for the given domain name, and sends A and AAAA queries to these servers for some "widely used" names under the zone; specifically, adding "www" and "ftp" to the zone name.
As of this writing, there is no formal "manual" of the libraries, except this document, header files (some of them provide pretty detailed explanations), and sample application programs.
d208 2 a209 1BIND Version 9.10
@ 1.1 log @Initial revision @ text @d2 1 a2 1 - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC") d5 1 a5 1 - Permission to use, copy, modify, and distribute this software for any d17 1 a17 1 d48 1 a48 1[RFC974] Mail Routing and the Domain System. January 1986.
d270 1 a270 1[RFC1034] Domain Names — Concepts and Facilities. November 1987.
d273 1 a273 1[RFC1035] Domain Names — Implementation and
d281 1
a281 1
[RFC2181] Clarifications to the DNS
d285 1
a285 1
[RFC2308] Negative Caching of DNS
d289 1
a289 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d325 1
a325 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d345 1
a345 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d349 1
a349 1
[RFC1536] Common DNS Implementation
d353 1
a353 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d363 1
a363 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d373 1
a373 1
[RFC1876] A Means for Expressing Location Information in the
d378 1
a378 1
[RFC2052] A DNS RR for Specifying the
d383 1
a383 1
[RFC2163] Using the Internet DNS to
d388 1
a388 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d422 1
a422 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d433 1
a433 1
[RFC1123] Requirements for Internet Hosts - Application and
d437 1
a437 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d460 1
a460 1
[RFC1912] Common DNS Operational and
d464 1
a464 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d474 1
a474 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d478 1
a478 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d500 1
a500 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d504 1
a504 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d511 1
a511 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d527 1
a527 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d537 1
a537 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d554 1
a554 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d567 1
a567 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d586 1
a586 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d273 1
a273 1
[RFC2181] Clarifications to the DNS
d277 1
a277 1
[RFC2308] Negative Caching of DNS
d281 1
a281 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d317 1
a317 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d337 1
a337 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d341 1
a341 1
[RFC1536] Common DNS Implementation
d345 1
a345 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d355 1
a355 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d365 1
a365 1
[RFC1876] A Means for Expressing Location Information in the
d370 1
a370 1
[RFC2052] A DNS RR for Specifying the
d375 1
a375 1
[RFC2163] Using the Internet DNS to
d380 1
a380 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d414 1
a414 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d425 1
a425 1
[RFC1123] Requirements for Internet Hosts - Application and
d429 1
a429 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d452 1
a452 1
[RFC1912] Common DNS Operational and
d456 1
a456 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d466 1
a466 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d470 1
a470 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d492 1
a492 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d496 1
a496 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d503 1
a503 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d519 1
a519 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d529 1
a529 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d546 1
a546 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d559 1
a559 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d578 1
a578 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d271 1
a271 1
[RFC2181] Clarifications to the DNS
d275 1
a275 1
[RFC2308] Negative Caching of DNS
d279 1
a279 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d315 1
a315 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d335 1
a335 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d339 1
a339 1
[RFC1536] Common DNS Implementation
d343 1
a343 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d353 1
a353 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d363 1
a363 1
[RFC1876] A Means for Expressing Location Information in the
d368 1
a368 1
[RFC2052] A DNS RR for Specifying the
d373 1
a373 1
[RFC2163] Using the Internet DNS to
d378 1
a378 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d412 1
a412 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d423 1
a423 1
[RFC1123] Requirements for Internet Hosts - Application and
d427 1
a427 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d450 1
a450 1
[RFC1912] Common DNS Operational and
d454 1
a454 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d464 1
a464 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d468 1
a468 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d490 1
a490 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d494 1
a494 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d501 1
a501 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d517 1
a517 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d527 1
a527 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d544 1
a544 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d557 1
a557 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d576 1
a576 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d271 1
a271 1
[RFC2181] Clarifications to the DNS
d275 1
a275 1
[RFC2308] Negative Caching of DNS
d279 1
a279 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d315 1
a315 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d335 1
a335 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d339 1
a339 1
[RFC1536] Common DNS Implementation
d343 1
a343 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d353 1
a353 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d363 1
a363 1
[RFC1876] A Means for Expressing Location Information in the
d368 1
a368 1
[RFC2052] A DNS RR for Specifying the
d373 1
a373 1
[RFC2163] Using the Internet DNS to
d378 1
a378 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d412 1
a412 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d423 1
a423 1
[RFC1123] Requirements for Internet Hosts - Application and
d427 1
a427 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d450 1
a450 1
[RFC1912] Common DNS Operational and
d454 1
a454 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d464 1
a464 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d468 1
a468 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d490 1
a490 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d494 1
a494 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d501 1
a501 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d517 1
a517 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d527 1
a527 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d544 1
a544 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d557 1
a557 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d576 1
a576 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates.
[RFC974] Mail Routing and the Domain System. January 1986.
d260 1 a260 1[RFC1034] Domain Names — Concepts and Facilities. November 1987.
d263 1 a263 1[RFC1035] Domain Names — Implementation and
d271 1
a271 1
[RFC2181] Clarifications to the DNS
d275 1
a275 1
[RFC2308] Negative Caching of DNS
d279 1
a279 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d315 1
a315 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d335 1
a335 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d339 1
a339 1
[RFC1536] Common DNS Implementation
d343 1
a343 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d353 1
a353 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d363 1
a363 1
[RFC1876] A Means for Expressing Location Information in the
d368 1
a368 1
[RFC2052] A DNS RR for Specifying the
d373 1
a373 1
[RFC2163] Using the Internet DNS to
d378 1
a378 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d412 1
a412 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d423 1
a423 1
[RFC1123] Requirements for Internet Hosts - Application and
d427 1
a427 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d450 1
a450 1
[RFC1912] Common DNS Operational and
d454 1
a454 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d464 1
a464 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d468 1
a468 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d490 1
a490 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d494 1
a494 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d501 1
a501 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d517 1
a517 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d527 1
a527 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d544 1
a544 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d557 1
a557 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d576 1
a576 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. This version of BIND 9 "exports" its internal libraries so
that they can be used by third-party applications more easily (we
call them "export" libraries in this document). In addition to
all major DNS-related APIs BIND 9 is currently using, the export
libraries provide the following features: The newly created "DNS client" module. This is a higher
level API that provides an interface to name resolution,
single DNS transaction with a particular server, and dynamic
update. Regarding name resolution, it supports advanced
features such as DNSSEC validation and caching. This module
supports both synchronous and asynchronous mode. The new "IRS" (Information Retrieval System) library.
It provides an interface to parse the traditional resolv.conf
file and more advanced, DNS-specific configuration file for
the rest of this package (see the description for the
dns.conf file below). As part of the IRS library, newly implemented standard
address-name mapping functions, getaddrinfo() and
getnameinfo(), are provided. They use the DNSSEC-aware
validating resolver backend, and could use other advanced
features of the BIND 9 libraries such as caching. The
getaddrinfo() function resolves both A and AAAA RRs
concurrently (when the address family is unspecified). An experimental framework to support other event
libraries than BIND 9's internal event task system. GNU make is required to build the export libraries (other
part of BIND 9 can still be built with other types of make). In
the reminder of this document, "make" means GNU make. Note that
in some platforms you may need to invoke a different command name
than "make" (e.g. "gmake") to indicate it's GNU make.
This will create (in addition to usual BIND 9 programs) and a
separate set of libraries under the lib/export directory. For
example,
This will install library object files under the directory
specified by the --with-export-libdir configure option (default:
EPREFIX/lib/bind9), and header files under the directory
specified by the --with-export-includedir configure option
(default: PREFIX/include/bind9).
Root privilege is normally required.
"make install" at the top directory will do the
same.
To see how to build your own
application after the installation, see
Currently, win32 is not supported for the export
library. (Normal BIND 9 application can be built as
before). The "fixed" RRset order is not (currently) supported in
the export library. If you want to use "fixed" RRset order
for, e.g. named while still building the
export library even without the fixed order support, build
them separately:
The client module and the IRS library currently do not
support DNSSEC validation using DLV (the underlying modules
can handle it, but there is no tunable interface to enable
the feature). RFC 5011 is not supported in the validating stub
resolver of the export library. In fact, it is not clear
whether it should: trust anchors would be a system-wide
configuration which would be managed by an administrator,
while the stub resolver will be used by ordinary applications
run by a normal user. Not all common The IRS library supports an "advanced" configuration file
related to the DNS library for configuration parameters that
would be beyond the capability of the
Some sample application programs using this API are
provided for reference. The following is a brief description of
these applications.
It sends a query of a given name (of a given optional RR type) to a
specified recursive server, and prints the result as a list of
RRs. It can also act as a validating stub resolver if a trust
anchor is given via a set of command line options.
Usage: sample [options] server_address hostname
Options and Arguments:
specify the RR type of the query. The default is the A RR.
specify a command-line DNS key to validate the answer. For
example, to specify the following DNSKEY of example.com:
specify the options as follows:
-e means that this key is a zone's "key signing key" (as known
as "secure Entry point").
When -a is omitted rsasha1 will be used by default.
specify a separate recursive server address for the specific
"domain". Example: -s example.com:2001:db8::1234
an IP(v4/v6) address of the recursive server to which queries
are sent.
the domain name for the query
Similar to "sample", but accepts a list
of (query) domain names as a separate file and resolves the names
asynchronously.
Usage: sample-async [-s server_address] [-t RR_type] input_file
Options and Arguments:
It sends a query to a specified server, and
prints the response with minimal processing. It doesn't act as a
"stub resolver": it stops the processing once it gets any
response from the server, whether it's a referral or an alias
(CNAME or DNAME) that would require further queries to get the
ultimate answer. In other words, this utility acts as a very
simplified dig.
Usage: sample-request [-t RRtype] server_address hostname
Options and Arguments:
specify the RR type of
the queries. The default is the A RR.
an IP(v4/v6)
address of the recursive server to which the query is sent.
the domain name for the query
This is a test program
to check getaddrinfo() and getnameinfo() behavior. It takes a
host name as an argument, calls getaddrinfo() with the given host
name, and calls getnameinfo() with the resulting IP addresses
returned by getaddrinfo(). If the dns.conf file exists and
defines a trust anchor, the underlying resolver will act as a
validating resolver, and getaddrinfo()/getnameinfo() will fail
with an EAI_INSECUREDATA error when DNSSEC validation fails.
Usage: sample-gai hostname
It accepts a single update command as a
command-line argument, sends an update request message to the
authoritative server, and shows the response from the server. In
other words, this is a simplified nsupdate.
Usage: sample-update [options] (add|delete) "update data"
Options and Arguments:
An IP address of the authoritative server that has authority
for the zone containing the update name. This should normally
be the primary authoritative server that accepts dynamic
updates. It can also be a secondary server that is configured
to forward update requests to the primary server.
A TSIG key file to secure the update transaction. The keyfile
format is the same as that for the nsupdate utility.
A prerequisite for the update (only one prerequisite can be
specified). The prerequisite format is the same as that is
accepted by the nsupdate utility.
An IP address of a recursive server that this utility will
use. A recursive server may be necessary to identify the
authoritative server address to which the update request is
sent.
The domain name of the zone that contains
Specify the type of update operation. Either "add" or "delete"
must be specified.
Specify the data to be updated. A typical example of the data
would look like "name TTL RRtype RDATA".
Examples: assuming the primary authoritative server of the
dynamic.example.com zone has an IPv6 address 2001:db8::1234,
adds an A RR for foo.dynamic.example.com using the given key.
removes all A RRs for foo.dynamic.example.com using the given key.
removes all RRs for foo.dynamic.example.com using the given key.
It checks a set
of domains to see the name servers of the domains behave
correctly in terms of RFC 4074. This is included in the set of
sample programs to show how the export library can be used in a
DNS-related application.
Usage: nsprobe [-d] [-v [-v...]] [-c cache_address] [input_file]
Options
run in the "debug" mode. with this option nsprobe will dump
every RRs it receives.
increase verbosity of other normal log messages. This can be
specified multiple times
specify an IP address of a recursive (caching) name server.
nsprobe uses this server to get the NS RRset of each domain and
the A and/or AAAA RRsets for the name servers. The default
value is 127.0.0.1.
a file name containing a list of domain (zone) names to be
probed. when omitted the standard input will be used. Each
line of the input file specifies a single domain name such as
"example.com". In general this domain name must be the apex
name of some DNS zone (unlike normal "host names" such as
"www.example.com"). nsprobe first identifies the NS RRsets for
the given domain name, and sends A and AAAA queries to these
servers for some "widely used" names under the zone;
specifically, adding "www" and "ftp" to the zone name.
As of this writing, there is no formal "manual" of the
libraries, except this document, header files (some of them
provide pretty detailed explanations), and sample application
programs. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d281 1
a281 1
[RFC2181] Clarifications to the DNS
d285 1
a285 1
[RFC2308] Negative Caching of DNS
d289 1
a289 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d325 1
a325 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d345 1
a345 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d349 1
a349 1
[RFC1536] Common DNS Implementation
d353 1
a353 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d363 1
a363 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d373 1
a373 1
[RFC1876] A Means for Expressing Location Information in the
d378 1
a378 1
[RFC2052] A DNS RR for Specifying the
d383 1
a383 1
[RFC2163] Using the Internet DNS to
d388 1
a388 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d422 1
a422 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d433 1
a433 1
[RFC1123] Requirements for Internet Hosts - Application and
d437 1
a437 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d460 1
a460 1
[RFC1912] Common DNS Operational and
d464 1
a464 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d474 1
a474 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d478 1
a478 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d500 1
a500 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d504 1
a504 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d511 1
a511 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d527 1
a527 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d537 1
a537 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d554 1
a554 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d567 1
a567 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d586 1
a586 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d281 1
a281 1
[RFC2181] Clarifications to the DNS
d285 1
a285 1
[RFC2308] Negative Caching of DNS
d289 1
a289 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d325 1
a325 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d345 1
a345 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d349 1
a349 1
[RFC1536] Common DNS Implementation
d353 1
a353 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d363 1
a363 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d373 1
a373 1
[RFC1876] A Means for Expressing Location Information in the
d378 1
a378 1
[RFC2052] A DNS RR for Specifying the
d383 1
a383 1
[RFC2163] Using the Internet DNS to
d388 1
a388 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d422 1
a422 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d433 1
a433 1
[RFC1123] Requirements for Internet Hosts - Application and
d437 1
a437 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d460 1
a460 1
[RFC1912] Common DNS Operational and
d464 1
a464 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d474 1
a474 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d478 1
a478 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d500 1
a500 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d504 1
a504 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d511 1
a511 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d527 1
a527 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d537 1
a537 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d554 1
a554 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d567 1
a567 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d586 1
a586 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d281 1
a281 1
[RFC2181] Clarifications to the DNS
d285 1
a285 1
[RFC2308] Negative Caching of DNS
d289 1
a289 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d325 1
a325 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d345 1
a345 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d349 1
a349 1
[RFC1536] Common DNS Implementation
d353 1
a353 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d363 1
a363 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d373 1
a373 1
[RFC1876] A Means for Expressing Location Information in the
d378 1
a378 1
[RFC2052] A DNS RR for Specifying the
d383 1
a383 1
[RFC2163] Using the Internet DNS to
d388 1
a388 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d422 1
a422 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d433 1
a433 1
[RFC1123] Requirements for Internet Hosts - Application and
d437 1
a437 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d460 1
a460 1
[RFC1912] Common DNS Operational and
d464 1
a464 1
[RFC2010] Operational Criteria for Root Name Servers.. October 1996. [RFC2219] Use of DNS Aliases for
d474 1
a474 1
[RFC2825] A Tangled Web: Issues of I18N, Domain Names,
d478 1
a478 1
[RFC3490] Internationalizing Domain Names in Applications (IDNA). March 2003. [RFC3491] Nameprep: A Stringprep Profile for Internationalized Domain Names. March 2003. [RFC3492] Punycode: A Bootstring encoding of Unicode
d500 1
a500 1
[RFC1464] Using the Domain Name System To Store Arbitrary String
d504 1
a504 1
[RFC1713] Tools for DNS Debugging. November 1994. [RFC1794] DNS Support for Load
d511 1
a511 1
[RFC2240] A Legal Basis for Domain Name Allocation. November 1997. [RFC2345] Domain Names and Company Name Retrieval. May 1998. [RFC2352] A Convention For Using Legal Names as Domain Names. May 1998. [RFC3071] Reflections on the DNS, RFC 1591, and Categories of Domains. February 2001. [RFC3258] Distributing Authoritative Name Servers via
d527 1
a527 1
[RFC3901] DNS IPv6 Transport Operational Guidelines. September 2004. [RFC1712] DNS Encoding of Geographical
d537 1
a537 1
[RFC2673] Binary Labels in the Domain Name System. August 1999. [RFC2874] DNS Extensions to Support IPv6 Address Aggregation
d554 1
a554 1
[RFC2065] Domain Name System Security Extensions. January 1997. [RFC2137] Secure Domain Name System Dynamic Update. April 1997. [RFC2535] Domain Name System Security Extensions. March 1999. [RFC3008] Domain Name System Security (DNSSEC)
d567 1
a567 1
[RFC3090] DNS Security Extension Clarification on Zone Status. March 2001. [RFC3445] Limiting the Scope of the KEY Resource Record (RR). December 2002. [RFC3655] Redefinition of DNS Authenticated Data (AD) bit. November 2003. [RFC3658] Delegation Signer (DS) Resource Record (RR). December 2003. [RFC3755] Legacy Resolver Compatibility for Delegation Signer (DS). May 2004. [RFC3757] Domain Name System KEY (DNSKEY) Resource Record
d586 1
a586 1
[RFC3845] DNS Security (DNSSEC) NextSECure (NSEC) RDATA Format. August 2004. DNS and BIND. Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. [RFC974] Mail Routing and the Domain System. January 1986. [RFC1034] Domain Names — Concepts and Facilities. November 1987. [RFC1035] Domain Names — Implementation and
d281 1
a281 1
[RFC2181] Clarifications to the DNS
d285 1
a285 1
[RFC2308] Negative Caching of DNS
d289 1
a289 1
[RFC1995] Incremental Zone Transfer in DNS. August 1996. [RFC1996] A Mechanism for Prompt Notification of Zone Changes. August 1996. [RFC2136] Dynamic Updates in the Domain Name System. April 1997. [RFC2671] Extension Mechanisms for DNS (EDNS0). August 1997. [RFC2672] Non-Terminal DNS Name Redirection. August 1999. [RFC2845] Secret Key Transaction Authentication for DNS (TSIG). May 2000. [RFC2930] Secret Key Establishment for DNS (TKEY RR). September 2000. [RFC2931] DNS Request and Transaction Signatures (SIG(0)s). September 2000. [RFC3007] Secure Domain Name System (DNS) Dynamic Update. November 2000. [RFC3645] Generic Security Service Algorithm for Secret
d325 1
a325 1
[RFC3225] Indicating Resolver Support of DNSSEC. December 2001. [RFC3833] Threat Analysis of the Domain Name System (DNS). August 2004. [RFC4033] DNS Security Introduction and Requirements. March 2005. [RFC4034] Resource Records for the DNS Security Extensions. March 2005. [RFC4035] Protocol Modifications for the DNS
d345 1
a345 1
[RFC1535] A Security Problem and Proposed Correction With Widely
d349 1
a349 1
[RFC1536] Common DNS Implementation
d353 1
a353 1
[RFC1982] Serial Number Arithmetic. August 1996. [RFC4074] Common Misbehaviour Against DNS
d363 1
a363 1
[RFC1183] New DNS RR Definitions. October 1990. [RFC1706] DNS NSAP Resource Records. October 1994. [RFC2168] Resolution of Uniform Resource Identifiers using
d373 1
a373 1
[RFC1876] A Means for Expressing Location Information in the
d378 1
a378 1
[RFC2052] A DNS RR for Specifying the
d383 1
a383 1
[RFC2163] Using the Internet DNS to
d388 1
a388 1
[RFC2230] Key Exchange Delegation Record for the DNS. October 1997. [RFC2536] DSA KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2537] RSA/MD5 KEYs and SIGs in the Domain Name System (DNS). March 1999. [RFC2538] Storing Certificates in the Domain Name System (DNS). March 1999. [RFC2539] Storage of Diffie-Hellman Keys in the Domain Name System (DNS). March 1999. [RFC2540] Detached Domain Name System (DNS) Information. March 1999. [RFC2782] A DNS RR for specifying the location of services (DNS SRV). February 2000. [RFC2915] The Naming Authority Pointer (NAPTR) DNS Resource Record. September 2000. [RFC3110] RSA/SHA-1 SIGs and RSA KEYs in the Domain Name System (DNS). May 2001. [RFC3123] A DNS RR Type for Lists of Address Prefixes (APL RR). June 2001. [RFC3596] DNS Extensions to support IP
d422 1
a422 1
[RFC3597] Handling of Unknown DNS Resource Record (RR) Types. September 2003. [RFC1101] DNS Encoding of Network Names
d433 1
a433 1
[RFC1123] Requirements for Internet Hosts - Application and
d437 1
a437 1
[RFC1591] Domain Name System Structure and Delegation. March 1994. [RFC2317] Classless IN-ADDR.ARPA Delegation. March 1998. [RFC2826] IAB Technical Comment on the Unique DNS Root. May 2000. [RFC2929] Domain Name System (DNS) IANA Considerations. September 2000. [RFC1033] Domain administrators operations guide.. November 1987. [RFC1537] Common DNS Data File
d460 1
a460 1
[RFC1912] Common DNS Operational and
d464 1
a464 1
[RFC2010]
$
./configure --enable-exportlib
$ [other flags]make
lib/export/dns/libdns.a is the archive file of the
export version of the BIND 9 DNS library. Sample application
programs using the libraries will also be built under the
lib/export/samples directory (see below).
$
cd lib/export
$ make install
lib/export/samples/Makefile-postinstall.in.
$
./configure --enable-fixed-rrset
$ [other flags, but not --enable-exportlib]make
$ ./configure --enable-exportlib
$ [other flags, but not --enable-fixed-rrset]cd lib/export
$ make
/etc/resolv.conf
options are supported
in the IRS library. The only available options in this
version are "debug" and "ndots".resolv.conf file.
Specifically, it is intended to provide DNSSEC related
configuration parameters. By default the path to this
configuration file is /etc/dns.conf.
This module is very
experimental and the configuration syntax or library interfaces
may change in future versions. Currently, only the
trusted-keys
statement is supported, whose syntax is the same as the same name
of statement for named.conf. (See
the section called “trusted-keys Statement Grammar” for details.)
example.com. 3600 IN DNSKEY 257 3 5 xxx
-e -k example.com -K "xxx"
www.example.com
mx.examle.net
ns.xxx.example
Note
In practice, either -a or -r must be specified. Others can
be optional; the underlying library routine tries to identify the
appropriate server and the zone name for the update.
$
sample-update -a sample-update -k Kxxx.+nnn+mmmm.key add "foo.dynamic.example.com 30 IN A 192.168.2.1"
$
sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com 30 IN A"
$
sample-update -a sample-update -k Kxxx.+nnn+mmmm.key delete "foo.dynamic.example.com"