Adding upstream version 1:9.16.44.upstream/1%9.16.44upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 432 insertions, 0 deletions

diff --git a/doc/arm/general.rst b/doc/arm/general.rst
new file mode 100644
index 0000000..c4af278
--- /dev/null
+++ b/doc/arm/general.rst
@@ -0,0 +1,432 @@
+.. Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+..
+.. SPDX-License-Identifier: MPL-2.0
+..
+.. This Source Code Form is subject to the terms of the Mozilla Public
+.. License, v. 2.0.  If a copy of the MPL was not distributed with this
+.. file, you can obtain one at https://mozilla.org/MPL/2.0/.
+..
+.. See the COPYRIGHT file distributed with this work for additional
+.. information regarding copyright ownership.
+
+.. General:
+
+General DNS Reference Information
+=================================
+
+.. _rfcs:
+
+Requests for Comment (RFCs)
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Specification documents for the Internet protocol suite, including the
+DNS, are published as part of the `Request for Comments`_ (RFCs) series
+of technical notes. The standards themselves are defined by the
+`Internet Engineering Task Force`_ (IETF) and the `Internet Engineering
+Steering Group`_ (IESG). RFCs can be viewed online at:
+https://www.rfc-editor.org/.
+
+While reading RFCs, please keep in mind that :rfc:`not all RFCs are
+standards <1796>`, and also that the validity of documents does change
+over time. Every RFC needs to be interpreted in the context of other
+documents.
+
+BIND 9 strives for strict compliance with IETF standards. To the best
+of our knowledge, BIND 9 complies with the following RFCs, with
+the caveats and exceptions listed in the numbered notes below. Many
+of these RFCs were written by current or former ISC staff members.
+The list is non-exhaustive.
+
+.. _Internet Engineering Steering Group: https://www.ietf.org/about/groups/iesg/
+.. _Internet Engineering Task Force: https://www.ietf.org/about/
+.. _Request for Comments: https://www.ietf.org/standards/rfcs/
+
+Some of these RFCs, though DNS-related, are not concerned with implementing
+software.
+
+Protocol Specifications
+-----------------------
+
+:rfc:`1034` - P. Mockapetris. *Domain Names — Concepts and Facilities.* November
+1987.
+
+:rfc:`1035` - P. Mockapetris. *Domain Names — Implementation and Specification.*
+November 1987. [#rfc1035_1]_ [#rfc1035_2]_
+
+:rfc:`1183` - C. F. Everhart, L. A. Mamakos, R. Ullmann, P. Mockapetris. *New DNS RR
+Definitions.* October 1990.
+
+:rfc:`1706` - B. Manning and R. Colella. *DNS NSAP Resource Records.* October 1994.
+
+:rfc:`1712` - C. Farrell, M. Schulze, S. Pleitner, and D. Baldoni. *DNS Encoding of
+Geographical Location.* November 1994.
+
+:rfc:`1876` - C. Davis, P. Vixie, T. Goodwin, and I. Dickinson. *A Means for Expressing
+Location Information in the Domain Name System.* January 1996.
+
+:rfc:`1982` - R. Elz and R. Bush. *Serial Number Arithmetic.* August 1996.
+
+:rfc:`1995` - M. Ohta. *Incremental Zone Transfer in DNS.* August 1996.
+
+:rfc:`1996` - P. Vixie. *A Mechanism for Prompt Notification of Zone Changes (DNS NOTIFY).*
+August 1996.
+
+:rfc:`2136` - P. Vixie, S. Thomson, Y. Rekhter, and J. Bound. *Dynamic Updates in the
+Domain Name System (DNS UPDATE).* April 1997.
+
+:rfc:`2163` - A. Allocchio. *Using the Internet DNS to Distribute MIXER
+Conformant Global Address Mapping (MCGAM).* January 1998.
+
+:rfc:`2181` - R. Elz and R. Bush. *Clarifications to the DNS Specification.* July 1997.
+
+:rfc:`2230` - R. Atkinson. *Key Exchange Delegation Record for the DNS.* November
+1997.
+
+:rfc:`2308` - M. Andrews. *Negative Caching of DNS Queries (DNS NCACHE).* March 1998.
+
+:rfc:`2539` - D. Eastlake, 3rd. *Storage of Diffie-Hellman Keys in the Domain Name
+System (DNS).* March 1999.
+
+:rfc:`2782` - A. Gulbrandsen, P. Vixie, and L. Esibov. *A DNS RR for Specifying the
+Location of Services (DNS SRV).* February 2000.
+
+:rfc:`2930` - D. Eastlake, 3rd. *Secret Key Establishment for DNS (TKEY RR).*
+September 2000.
+
+:rfc:`2931` - D. Eastlake, 3rd. *DNS Request and Transaction Signatures (SIG(0)s).*
+September 2000. [#rfc2931]_
+
+:rfc:`3007` - B. Wellington. *Secure Domain Name System (DNS) Dynamic Update.*
+November 2000.
+
+:rfc:`3110` - D. Eastlake, 3rd. *RSA/SHA-1 SIGs and RSA KEYs in the Domain Name
+System (DNS).* May 2001.
+
+:rfc:`3123` - P. Koch. *A DNS RR Type for Lists of Address Prefixes (APL RR).* June
+2001.
+
+:rfc:`3225` - D. Conrad. *Indicating Resolver Support of DNSSEC.* December 2001.
+
+:rfc:`3226` - O. Gudmundsson. *DNSSEC and IPv6 A6 Aware Server/Resolver
+Message Size Requirements.* December 2001.
+
+:rfc:`3363` - R. Bush, A. Durand, B. Fink, O. Gudmundsson, and T. Hain.
+*Representing Internet Protocol Version 6 (IPv6) Addresses in the Domain Name
+System (DNS).* August 2002. [#rfc3363]_
+
+:rfc:`3403` - M. Mealling.
+*Dynamic Delegation Discovery System (DDDS). Part Three: The Domain Name System
+(DNS) Database.*
+October 2002.
+
+:rfc:`3492` - A. Costello. *Punycode: A Bootstring Encoding of Unicode for
+Internationalized Domain Names in Applications (IDNA).* March 2003.
+
+:rfc:`3493` - R. Gilligan, S. Thomson, J. Bound, J. McCann, and W. Stevens.
+*Basic Socket Interface Extensions for IPv6.* March 2003.
+
+:rfc:`3496` - A. G. Malis and T. Hsiao. *Protocol Extension for Support of
+Asynchronous Transfer Mode (ATM) Service Class-aware Multiprotocol Label
+Switching (MPLS) Traffic Engineering.* March 2003.
+
+:rfc:`3596` - S. Thomson, C. Huitema, V. Ksinant, and M. Souissi. *DNS Extensions to
+Support IP Version 6.* October 2003.
+
+:rfc:`3597` - A. Gustafsson. *Handling of Unknown DNS Resource Record (RR) Types.*
+September 2003.
+
+:rfc:`3645` - S. Kwan, P. Garg, J. Gilroy, L. Esibov, J. Westhead, and R. Hall. *Generic
+Security Service Algorithm for Secret Key Transaction Authentication for
+DNS (GSS-TSIG).* October 2003.
+
+:rfc:`4025` - M. Richardson. *A Method for Storing IPsec Keying Material in
+DNS.* March 2005.
+
+:rfc:`4033` - R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. *DNS Security
+Introduction and Requirements.* March 2005.
+
+:rfc:`4034` - R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. *Resource Records for
+the DNS Security Extensions.* March 2005.
+
+:rfc:`4035` - R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. *Protocol
+Modifications for the DNS Security Extensions.* March 2005.
+
+:rfc:`4255` - J. Schlyter and W. Griffin. *Using DNS to Securely Publish Secure
+Shell (SSH) Key Fingerprints.* January 2006.
+
+:rfc:`4343` - D. Eastlake, 3rd. *Domain Name System (DNS) Case Insensitivity
+Clarification.* January 2006.
+
+:rfc:`4398` - S. Josefsson. *Storing Certificates in the Domain Name System (DNS).* March 2006.
+
+:rfc:`4470` - S. Weiler and J. Ihren. *Minimally covering NSEC Records and
+DNSSEC On-line Signing.* April 2006. [#rfc4470]_
+
+:rfc:`4509` - W. Hardaker. *Use of SHA-256 in DNSSEC Delegation Signer
+(DS) Resource Records (RRs).* May 2006.
+
+:rfc:`4592` - E. Lewis. *The Role of Wildcards in the Domain Name System.* July 2006.
+
+:rfc:`4635` - D. Eastlake, 3rd. *HMAC SHA (Hashed Message Authentication
+Code, Secure Hash Algorithm) TSIG Algorithm Identifiers.* August 2006.
+
+:rfc:`4701` - M. Stapp, T. Lemon, and A. Gustafsson. *A DNS Resource Record
+(RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID
+RR).* October 2006.
+
+:rfc:`4955` - D. Blacka. *DNS Security (DNSSEC) Experiments.* July 2007. [#rfc4955]_
+
+:rfc:`5001` - R. Austein. *DNS Name Server Identifier (NSID) Option.* August 2007.
+
+:rfc:`5011` - M. StJohns. *Automated Updates of DNS Security (DNSSEC) Trust Anchors.*
+
+:rfc:`5155` - B. Laurie, G. Sisson, R. Arends, and D. Blacka. *DNS Security
+(DNSSEC) Hashed Authenticated Denial of Existence.* March 2008.
+
+:rfc:`5205` - P. Nikander and J. Laganier. *Host Identity Protocol (HIP)
+Domain Name System (DNS) Extension.* April 2008.
+
+:rfc:`5452` - A. Hubert and R. van Mook. *Measures for Making DNS More
+Resilient Against Forged Answers.* January 2009. [#rfc5452]_
+
+:rfc:`5702` - J. Jansen. *Use of SHA-2 Algorithms with RSA in DNSKEY and
+RRSIG Resource Records for DNSSEC.* October 2009.
+
+:rfc:`5891` - J. Klensin.
+*Internationalized Domain Names in Applications (IDNA): Protocol.*
+August 2010
+
+:rfc:`5936` - E. Lewis and A. Hoenes, Ed. *DNS Zone Transfer Protocol (AXFR).*
+June 2010.
+
+:rfc:`5952` - S. Kawamura and M. Kawashima. *A Recommendation for IPv6 Address
+Text Representation.* August 2010.
+
+:rfc:`6052` - C. Bao, C. Huitema, M. Bagnulo, M. Boucadair, and X. Li. *IPv6
+Addressing of IPv4/IPv6 Translators.* October 2010.
+
+:rfc:`6147` - M. Bagnulo, A. Sullivan, P. Matthews, and I. van Beijnum.
+*DNS64: DNS Extensions for Network Address Translation from IPv6 Clients to
+IPv4 Servers.* April 2011. [#rfc6147]_
+
+:rfc:`6604` - D. Eastlake, 3rd. *xNAME RCODE and Status Bits Clarification.*
+April 2012.
+
+:rfc:`6605` - P. Hoffman and W. C. A. Wijngaards. *Elliptic Curve Digital
+Signature Algorithm (DSA) for DNSSEC.* April 2012. [#rfc6605]_
+
+:rfc:`6672` - S. Rose and W. Wijngaards. *DNAME Redirection in the DNS.*
+June 2012.
+
+:rfc:`6698` - P. Hoffman and J. Schlyter. *The DNS-Based Authentication of
+Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA.*
+August 2012.
+
+:rfc:`6725` - S. Rose. *DNS Security (DNSSEC) DNSKEY Algorithm IANA Registry
+Updates.* August 2012. [#rfc6725]_
+
+:rfc:`6742` - RJ Atkinson, SN Bhatti, U. St. Andrews, and S. Rose. *DNS
+Resource Records for the Identifier-Locator Network Protocol (ILNP).*
+November 2012.
+
+:rfc:`6840` - S. Weiler, Ed., and D. Blacka, Ed. *Clarifications and
+Implementation Notes for DNS Security (DNSSEC).* February 2013. [#rfc6840]_
+
+:rfc:`6891` - J. Damas, M. Graff, and P. Vixie. *Extension Mechanisms for DNS
+(EDNS(0)).* April 2013.
+
+:rfc:`7043` - J. Abley. *Resource Records for EUI-48 and EUI-64 Addresses
+in the DNS.* October 2013.
+
+:rfc:`7208` - S. Kitterman.
+*Sender Policy Framework (SPF) for Authorizing Use of Domains in Email,
+Version 1.*
+April 2014.
+
+:rfc:`7314` - M. Andrews. *Extension Mechanisms for DNS (EDNS) EXPIRE Option.*
+July 2014.
+
+:rfc:`7344` - W. Kumari, O. Gudmundsson, and G. Barwood. *Automating DNSSEC
+Delegation Trust Maintenance.* September 2014. [#rfc7344]_
+
+:rfc:`7477` - W. Hardaker. *Child-to-Parent Synchronization in DNS.* March
+2015.
+
+:rfc:`7553` - P. Faltstrom and O. Kolkman. *The Uniform Resource Identifier
+(URI) DNS Resource Record.* June 2015.
+
+:rfc:`7583` - S. Morris, J. Ihren, J. Dickinson, and W. Mekking. *DNSSEC Key
+Rollover Timing Considerations.* October 2015.
+
+:rfc:`7766` - J. Dickinson, S. Dickinson, R. Bellis, A. Mankin, and D.
+Wessels. *DNS Transport over TCP - Implementation Requirements.* March 2016.
+
+:rfc:`7828` - P. Wouters, J. Abley, S. Dickinson, and R. Bellis.
+*The edns-tcp-keepalive EDNS0 Option.* April 2016.
+
+:rfc:`7830` - A. Mayrhofer. *The EDNS(0) Padding Option.* May 2016. [#rfc7830]_
+
+:rfc:`7929` - P. Wouters. *DNS-Based Authentication of Named Entities (DANE)
+Bindings for OpenPGP.* August 2016.
+
+:rfc:`8078` - O. Gudmundsson and P. Wouters. *Managing DS Records from the
+Parent via CDS/CDNSKEY.* March 2017. [#rfc8078]_
+
+:rfc:`8080` - O. Sury and R. Edmonds. *Edwards-Curve Digital Security Algorithm
+(EdDSA) for DNSSEC.* February 2017.
+
+:rfc:`8624` - P. Wouters and O. Sury. *Algorithm Implementation Requirements
+and Usage Guidance for DNSSEC.* June 2019.
+
+:rfc:`8659` - P. Hallam-Baker, R. Stradling, and J. Hoffman-Andrews.
+*DNS Certification Authority Authorization (CAA) Resource Record.*
+November 2019.
+
+:rfc:`8945` - F. Dupont, S. Morris, P. Vixie, D. Eastlake 3rd, O. Gudmundsson,
+and B. Wellington.
+*Secret Key Transaction Authentication for DNS (TSIG).*
+November 2020.
+
+Best Current Practice RFCs
+--------------------------
+
+:rfc:`2219` - M. Hamilton and R. Wright. *Use of DNS Aliases for Network Services.*
+October 1997.
+
+:rfc:`2317` - H. Eidnes, G. de Groot, and P. Vixie. *Classless IN-ADDR.ARPA Delegation.*
+March 1998.
+
+:rfc:`2606` - D. Eastlake, 3rd and A. Panitz. *Reserved Top Level DNS Names.* June
+1999. [#rfc2606]_
+
+:rfc:`3901` - A. Durand and J. Ihren. *DNS IPv6 Transport Operational Guidelines.*
+September 2004.
+
+:rfc:`5625` - R. Bellis. *DNS Proxy Implementation Guidelines.* August 2009.
+
+:rfc:`6303` - M. Andrews. *Locally Served DNS Zones.* July 2011.
+
+:rfc:`7793` - M. Andrews. *Adding 100.64.0.0/10 Prefixes to the IPv4
+Locally-Served DNS Zones Registry.* May 2016.
+
+:rfc:`8906` - M. Andrews and R. Bellis. *A Common Operational Problem in DNS
+Servers: Failure to Communicate.* September 2020.
+
+For Your Information
+--------------------
+
+:rfc:`1101` - P. Mockapetris. *DNS Encoding of Network Names and Other Types.*
+April 1989.
+
+:rfc:`1123` - R. Braden. *Requirements for Internet Hosts - Application and
+Support.* October 1989.
+
+:rfc:`1535` - E. Gavron. *A Security Problem and Proposed Correction With Widely
+Deployed DNS Software.* October 1993.
+
+:rfc:`1536` - A. Kumar, J. Postel, C. Neuman, P. Danzig, and S. Miller. *Common DNS
+Implementation Errors and Suggested Fixes.* October 1993.
+
+:rfc:`1912` - D. Barr. *Common DNS Operational and Configuration Errors.* February
+1996.
+
+:rfc:`2874` - M. Crawford and C. Huitema. *DNS Extensions to Support IPv6 Address
+Aggregation and Renumbering.* July 2000. [#rfc2874]_
+
+:rfc:`3833` - D. Atkins and R. Austein. *Threat Analysis of the Domain Name System
+(DNS).* August 2004.
+
+:rfc:`4074` - Y. Morishita and T. Jinmei. *Common Misbehavior Against DNS Queries for
+IPv6 Addresses.* June 2005.
+
+:rfc:`4431` - M. Andrews and S. Weiler. *The DNSSEC Lookaside Validation
+(DLV) DNS Resource Record.* February 2006. [#rfc4431]_
+
+:rfc:`4892` - S. Woolf and D. Conrad. *Requirements for a Mechanism
+Identifying a Name Server Instance.* June 2007.
+
+:rfc:`6781` - O. Kolkman, W. Mekking, and R. Gieben. *DNSSEC Operational
+Practices, Version 2.* December 2012.
+
+:rfc:`7129` - R. Gieben and W. Mekking. *Authenticated Denial of Existence
+in the DNS.* February 2014.
+
+:rfc:`8749` - W. Mekking and D. Mahoney. *Moving DNSSEC Lookaside Validation
+(DLV) to Historic Status.* March 2020.
+
+Notes
+~~~~~
+
+.. [#rfc1035_1] Queries to zones that have failed to load return SERVFAIL rather
+   than a non-authoritative response. This is considered a feature.
+
+.. [#rfc1035_2] CLASS ANY queries are not supported. This is considered a
+   feature.
+
+.. [#rfc2931] When receiving a query signed with a SIG(0), the server is
+   only able to verify the signature if it has the key in its local
+   authoritative data; it cannot do recursion or validation to
+   retrieve unknown keys.
+
+.. [#rfc2874] Compliance is with loading and serving of A6 records only.
+   A6 records were moved to the experimental category by :rfc:`3363`.
+
+.. [#rfc4431] Compliance is with loading and serving of DLV records only.
+   DLV records were moved to the historic category by :rfc:`8749`.
+
+.. [#rfc4470] Minimally Covering NSEC records are accepted but not generated.
+
+.. [#rfc4955] BIND 9 interoperates with correctly designed experiments.
+
+.. [#rfc5452] ``named`` only uses ports to extend the ID space; addresses are not
+   used.
+
+.. [#rfc6147] Section 5.5 does not match reality. ``named`` uses the presence
+   of DO=1 to detect if validation may be occurring. CD has no bearing
+   on whether validation occurs.
+
+.. [#rfc6605] Compliance is conditional on the OpenSSL library being linked against
+   a supporting ECDSA.
+
+.. [#rfc6725] RSAMD5 support has been removed. See :rfc:`8624`.
+
+.. [#rfc6840] Section 5.9 - Always set CD=1 on queries. This is *not* done, as
+   it prevents DNSSEC from working correctly through another recursive server.
+
+   When talking to a recursive server, the best algorithm is to send
+   CD=0 and then send CD=1 iff SERVFAIL is returned, in case the recursive
+   server has a bad clock and/or bad trust anchor. Alternatively, one
+   can send CD=1 then CD=0 on validation failure, in case the recursive
+   server is under attack or there is stale/bogus authoritative data.
+
+.. [#rfc7344] Updating of parent zones is not yet implemented.
+
+.. [#rfc7830] ``named`` does not currently encrypt DNS requests, so the PAD option
+   is accepted but not returned in responses.
+
+.. [#rfc3363] Section 4 is ignored.
+
+.. [#rfc2606] This does not apply to DNS server implementations.
+
+.. [#rfc1521] Only the Base 64 encoding specification is supported.
+
+.. [#idna] BIND 9 requires ``--with-libidn2`` to enable entry of IDN labels within
+   dig, host, and nslookup at compile time.  ACE labels are supported
+   everywhere with or without ``--with-libidn2``.
+
+.. [#rfc4294] Section 5.1 - DNAME records are fully supported.
+
+.. [#rfc8078] Updating of parent zones is not yet implemented.
+
+.. _internet_drafts:
+
+Internet Drafts
+~~~~~~~~~~~~~~~
+
+Internet Drafts (IDs) are rough-draft working documents of the Internet
+Engineering Task Force (IETF). They are, in essence, RFCs in the preliminary
+stages of development. Implementors are cautioned not to regard IDs as
+archival, and they should not be quoted or cited in any formal documents
+unless accompanied by the disclaimer that they are "works in progress."
+IDs have a lifespan of six months, after which they are deleted unless
+updated by their authors.