regen master

bin/check/named-checkconf.8

@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-hjvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -74,6 +74,11 @@ Print the usage summary and exit\&.
 When loading a zonefile read the journal if it exists\&.
 .RE
 .PP
+\-l
+.RS 4
+List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
+.RE
+.PP
 \-p
 .RS 4
 Print out the

bin/check/named-checkconf.html

@@ -20,7 +20,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjvz</code>] [<code class="option">-p</code>
+<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjlvz</code>] [<code class="option">-p</code>
 	 [<code class="option">-x</code>
       ]] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename}</p></div>
 </div>
@@ -55,6 +55,12 @@
 <dd><p>
             When loading a zonefile read the journal if it exists.
           </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+            List all the configured zones. Each line of output
+            contains the zone name, class (e.g. IN), view, and type
+            (e.g. master or slave).
+          </p></dd>
 <dt><span class="term">-p</span></dt>
 <dd><p>
 	    Print out the <code class="filename">named.conf</code> and included files

bin/named/named.conf.5

@@ -369,6 +369,7 @@ options {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
@@ -556,6 +557,7 @@ view \fIstring\fR \fIoptional_class\fR {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
@@ -650,6 +652,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;

bin/named/named.conf.html

@@ -320,6 +320,7 @@ options
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>
@@ -523,6 +524,7 @@ view
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>
@@ -623,6 +625,7 @@ zone
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>

doc/arm/Bv9ARM.ch06.html

@@ -2402,6 +2402,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     [<span class="optional"> use-queryport-pool <em class="replaceable"><code>yes_or_no</code></em>; </span>]
     [<span class="optional"> queryport-pool-ports <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> queryport-pool-updateinterval <em class="replaceable"><code>number</code></em>; </span>]
+    [<span class="optional"> max-records <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-time-in <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-time-out <em class="replaceable"><code>number</code></em>; </span>]
     [<span class="optional"> max-transfer-idle-in <em class="replaceable"><code>number</code></em>; </span>]
@@ -5594,6 +5595,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
                   means 2 gigabytes.
                   This may also be set on a per-zone basis.
                 </p></dd>
+<dt><span class="term"><span class="command"><strong>max-records</strong></span></span></dt>
+<dd><p>
+                  The maximum number of records permitted in a zone.
+                  The default is zero which means unlimited.
+                </p></dd>
 <dt><span class="term"><span class="command"><strong>host-statistics-max</strong></span></span></dt>
 <dd><p>
                   In BIND 8, specifies the maximum number of host statistics
@@ -9171,6 +9177,11 @@ zone <em class="replaceable"><code>zone_name</code></em> [<span class="optional"
                     See the description of
                     <span class="command"><strong>max-journal-size</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called &#8220;Server  Resource Limits&#8221;</a>.
                   </p></dd>
+<dt><span class="term"><span class="command"><strong>max-records</strong></span></span></dt>
+<dd><p>
+                    See the description of
+                    <span class="command"><strong>max-records</strong></span> in <a class="xref" href="Bv9ARM.ch06.html#server_resource_limits" title="Server Resource Limits">the section called &#8220;Server  Resource Limits&#8221;</a>.
+                  </p></dd>
 <dt><span class="term"><span class="command"><strong>max-transfer-time-in</strong></span></span></dt>
 <dd><p>
                     See the description of

doc/arm/Bv9ARM.ch09.html

@@ -108,6 +108,13 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+	  Added the ability to specify the maximum number of records
+	  permitted in a zone (max-records #;).  This provides a mechanism
+	  to block overly large zone transfers, which is a potential risk
+	  with slave zones from other parties, as described in CVE-2016-6170.
+	  [RT #42143]
+	</p></li>
 <li class="listitem"><p>
 	  It was possible to trigger a assertion when rendering a
 	  message using a specially crafted request. This flaw is

doc/arm/man.named-checkconf.html

@@ -38,7 +38,7 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjvz</code>] [<code class="option">-p</code>
+<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-hjlvz</code>] [<code class="option">-p</code>
 	 [<code class="option">-x</code>
       ]] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename}</p></div>
 </div>
@@ -73,6 +73,12 @@
 <dd><p>
             When loading a zonefile read the journal if it exists.
           </p></dd>
+<dt><span class="term">-l</span></dt>
+<dd><p>
+            List all the configured zones. Each line of output
+            contains the zone name, class (e.g. IN), view, and type
+            (e.g. master or slave).
+          </p></dd>
 <dt><span class="term">-p</span></dt>
 <dd><p>
 	    Print out the <code class="filename">named.conf</code> and included files

doc/arm/man.named.conf.html

@@ -338,6 +338,7 @@ options
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>
@@ -541,6 +542,7 @@ view
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>
@@ -641,6 +643,7 @@ zone
 	};<br>
 <br>
 	max-journal-size<em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out<em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in<em class="replaceable"><code>integer</code></em>;<br>

doc/arm/notes.html

@@ -69,6 +69,13 @@
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
 <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem"><p>
+	  Added the ability to specify the maximum number of records
+	  permitted in a zone (max-records #;).  This provides a mechanism
+	  to block overly large zone transfers, which is a potential risk
+	  with slave zones from other parties, as described in CVE-2016-6170.
+	  [RT #42143]
+	</p></li>
 <li class="listitem"><p>
 	  It was possible to trigger a assertion when rendering a
 	  message using a specially crafted request. This flaw is

doc/misc/options

@@ -217,6 +217,7 @@ options {
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
         max-ncache-ttl <integer>;
+        max-records <integer>;
         max-recursion-depth <integer>;
         max-recursion-queries <integer>;
         max-refresh-time <integer>;
@@ -521,6 +522,7 @@ view <string> [ <class> ] {
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
         max-ncache-ttl <integer>;
+        max-records <integer>;
         max-recursion-depth <integer>;
         max-recursion-queries <integer>;
         max-refresh-time <integer>;
@@ -703,6 +705,7 @@ view <string> [ <class> ] {
                 max-ixfr-log-size ( unlimited | default |
                     <sizeval> ); // obsolete
                 max-journal-size ( unlimited | <sizeval> );
+                max-records <integer>;
                 max-refresh-time <integer>;
                 max-retry-time <integer>;
                 max-transfer-idle-in <integer>;
@@ -806,6 +809,7 @@ zone <string> [ <class> ] {
             <integer> ] ) [ key <string> ]; ... };
         max-ixfr-log-size ( unlimited | default | <sizeval> ); // obsolete
         max-journal-size ( unlimited | <sizeval> );
+        max-records <integer>;
         max-refresh-time <integer>;
         max-retry-time <integer>;
         max-transfer-idle-in <integer>;