Adding upstream version 1:9.18.19.upstream/1%9.18.19upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 296 insertions, 0 deletions

diff --git a/doc/man/dnssec-settime.1in b/doc/man/dnssec-settime.1in
new file mode 100644
index 0000000..b0862d9
--- /dev/null
+++ b/doc/man/dnssec-settime.1in
@@ -0,0 +1,296 @@
+.\" Man page generated from reStructuredText.
+.
+.
+.nr rst2man-indent-level 0
+.
+.de1 rstReportMargin
+\\$1 \\n[an-margin]
+level \\n[rst2man-indent-level]
+level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
+-
+\\n[rst2man-indent0]
+\\n[rst2man-indent1]
+\\n[rst2man-indent2]
+..
+.de1 INDENT
+.\" .rstReportMargin pre:
+. RS \\$1
+. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
+. nr rst2man-indent-level +1
+.\" .rstReportMargin post:
+..
+.de UNINDENT
+. RE
+.\" indent \\n[an-margin]
+.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
+.nr rst2man-indent-level -1
+.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
+.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
+..
+.TH "DNSSEC-SETTIME" "1" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9"
+.SH NAME
+dnssec-settime \- set the key timing metadata for a DNSSEC key
+.SH SYNOPSIS
+.sp
+\fBdnssec\-settime\fP [\fB\-f\fP] [\fB\-K\fP directory] [\fB\-L\fP ttl] [\fB\-P\fP date/offset] [\fB\-P\fP ds date/offset] [\fB\-P\fP sync date/offset] [\fB\-A\fP date/offset] [\fB\-R\fP date/offset] [\fB\-I\fP date/offset] [\fB\-D\fP date/offset] [\fB\-D\fP ds date/offset] [\fB\-D\fP sync date/offset] [\fB\-S\fP key] [\fB\-i\fP interval] [\fB\-h\fP] [\fB\-V\fP] [\fB\-v\fP level] [\fB\-E\fP engine] {keyfile} [\fB\-s\fP] [\fB\-g\fP state] [\fB\-d\fP state date/offset] [\fB\-k\fP state date/offset] [\fB\-r\fP state date/offset] [\fB\-z\fP state date/offset]
+.SH DESCRIPTION
+.sp
+\fBdnssec\-settime\fP reads a DNSSEC private key file and sets the key
+timing metadata as specified by the \fI\%\-P\fP, \fI\%\-A\fP, \fI\%\-R\fP,
+\fI\%\-I\fP, and \fI\%\-D\fP options. The metadata can then be used by
+\fI\%dnssec\-signzone\fP or other signing software to determine when a key is
+to be published, whether it should be used for signing a zone, etc.
+.sp
+If none of these options is set on the command line,
+\fBdnssec\-settime\fP simply prints the key timing metadata already stored
+in the key.
+.sp
+When key metadata fields are changed, both files of a key pair
+(\fBKnnnn.+aaa+iiiii.key\fP and \fBKnnnn.+aaa+iiiii.private\fP) are
+regenerated.
+.sp
+Metadata fields are stored in the private file. A
+human\-readable description of the metadata is also placed in comments in
+the key file. The private file\(aqs permissions are always set to be
+inaccessible to anyone other than the owner (mode 0600).
+.sp
+When working with state files, it is possible to update the timing metadata in
+those files as well with \fI\%\-s\fP\&.  With this option, it is also possible
+to update key states with \fI\%\-d\fP (DS), \fI\%\-k\fP (DNSKEY), \fI\%\-r\fP
+(RRSIG of KSK), or \fI\%\-z\fP (RRSIG of ZSK). Allowed states are HIDDEN,
+RUMOURED, OMNIPRESENT, and UNRETENTIVE.
+.sp
+The goal state of the key can also be set with \fI\%\-g\fP\&. This should be either
+HIDDEN or OMNIPRESENT, representing whether the key should be removed from the
+zone or published.
+.sp
+It is NOT RECOMMENDED to manipulate state files manually, except for testing
+purposes.
+.SH OPTIONS
+.INDENT 0.0
+.TP
+.B \-f
+This option forces an update of an old\-format key with no metadata fields. Without
+this option, \fBdnssec\-settime\fP fails when attempting to update a
+legacy key. With this option, the key is recreated in the new
+format, but with the original key data retained. The key\(aqs creation
+date is set to the present time. If no other values are
+specified, then the key\(aqs publication and activation dates are also
+set to the present time.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-K directory
+This option sets the directory in which the key files are to reside.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-L ttl
+This option sets the default TTL to use for this key when it is converted into a
+DNSKEY RR. This is the TTL used when the key is imported into a zone,
+unless there was already a DNSKEY RRset in
+place, in which case the existing TTL takes precedence. If this
+value is not set and there is no existing DNSKEY RRset, the TTL
+defaults to the SOA TTL. Setting the default TTL to \fB0\fP or \fBnone\fP
+removes it from the key.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-h
+This option emits a usage message and exits.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-V
+This option prints version information.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-v level
+This option sets the debugging level.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-E engine
+This option specifies the cryptographic hardware to use, when applicable.
+.sp
+When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+engine identifier that drives the cryptographic accelerator or
+hardware service module (usually \fBpkcs11\fP).
+.UNINDENT
+.SH TIMING OPTIONS
+.sp
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS
+(which is the format used inside key files),
+or \(aqDay Mon DD HH:MM:SS YYYY\(aq (as printed by \fBdnssec\-settime \-p\fP),
+or UNIX epoch time (as printed by \fBdnssec\-settime \-up\fP),
+or the literal \fBnow\fP\&.
+.sp
+The argument can be followed by \fB+\fP or \fB\-\fP and an offset from the
+given time. The literal \fBnow\fP can be omitted before an offset. The
+offset can be followed by one of the suffixes \fBy\fP, \fBmo\fP, \fBw\fP,
+\fBd\fP, \fBh\fP, or \fBmi\fP, so that it is computed in years (defined as
+365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour
+days), weeks, days, hours, or minutes, respectively. Without a suffix,
+the offset is computed in seconds.
+.sp
+To unset a date, use \fBnone\fP, \fBnever\fP, or \fBunset\fP\&.
+.sp
+All these formats are case\-insensitive.
+.INDENT 0.0
+.TP
+.B \-P date/offset
+This option sets the date on which a key is to be published to the zone. After
+that date, the key is included in the zone but is not used
+to sign it.
+.INDENT 7.0
+.TP
+.B ds date/offset
+This option sets the date on which DS records that match this key have been
+seen in the parent zone.
+.UNINDENT
+.INDENT 7.0
+.TP
+.B sync date/offset
+This option sets the date on which CDS and CDNSKEY records that match this key
+are to be published to the zone.
+.UNINDENT
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-A date/offset
+This option sets the date on which the key is to be activated. After that date,
+the key is included in the zone and used to sign it.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-R date/offset
+This option sets the date on which the key is to be revoked. After that date, the
+key is flagged as revoked. It is included in the zone and
+is used to sign it.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-I date/offset
+This option sets the date on which the key is to be retired. After that date, the
+key is still included in the zone, but it is not used to
+sign it.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-D date/offset
+This option sets the date on which the key is to be deleted. After that date, the
+key is no longer included in the zone. (However, it may remain in the key
+repository.)
+.INDENT 7.0
+.TP
+.B ds date/offset
+This option sets the date on which the DS records that match this key have
+been seen removed from the parent zone.
+.UNINDENT
+.INDENT 7.0
+.TP
+.B sync date/offset
+This option sets the date on which the CDS and CDNSKEY records that match this
+key are to be deleted.
+.UNINDENT
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-S predecessor key
+This option selects a key for which the key being modified is an explicit
+successor. The name, algorithm, size, and type of the predecessor key
+must exactly match those of the key being modified. The activation
+date of the successor key is set to the inactivation date of the
+predecessor. The publication date is set to the activation date
+minus the prepublication interval, which defaults to 30 days.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-i interval
+This option sets the prepublication interval for a key. If set, then the
+publication and activation dates must be separated by at least this
+much time. If the activation date is specified but the publication
+date is not, the publication date defaults to this much time
+before the activation date; conversely, if the publication date is
+specified but not the activation date, activation is set to
+this much time after publication.
+.sp
+If the key is being created as an explicit successor to another key,
+then the default prepublication interval is 30 days; otherwise it is
+zero.
+.sp
+As with date offsets, if the argument is followed by one of the
+suffixes \fBy\fP, \fBmo\fP, \fBw\fP, \fBd\fP, \fBh\fP, or \fBmi\fP, the interval is
+measured in years, months, weeks, days, hours, or minutes,
+respectively. Without a suffix, the interval is measured in seconds.
+.UNINDENT
+.SH KEY STATE OPTIONS
+.sp
+To test dnssec\-policy it may be necessary to construct keys with artificial
+state information; these options are used by the testing framework for that
+purpose, but should never be used in production.
+.sp
+Known key states are HIDDEN, RUMOURED, OMNIPRESENT, and UNRETENTIVE.
+.INDENT 0.0
+.TP
+.B \-s
+This option indicates that when setting key timing data, the state file should also be updated.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-g state
+This option sets the goal state for this key. Must be HIDDEN or OMNIPRESENT.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-d state date/offset
+This option sets the DS state for this key as of the specified date, offset from the current date.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-k state date/offset
+This option sets the DNSKEY state for this key as of the specified date, offset from the current date.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-r state date/offset
+This option sets the RRSIG (KSK) state for this key as of the specified date, offset from the current date.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-z state date/offset
+This option sets the RRSIG (ZSK) state for this key as of the specified date, offset from the current date.
+.UNINDENT
+.SH PRINTING OPTIONS
+.sp
+\fBdnssec\-settime\fP can also be used to print the timing metadata
+associated with a key.
+.INDENT 0.0
+.TP
+.B \-u
+This option indicates that times should be printed in Unix epoch format.
+.UNINDENT
+.INDENT 0.0
+.TP
+.B \-p C/P/Pds/Psync/A/R/I/D/Dds/Dsync/all
+This option prints a specific metadata value or set of metadata values.
+The \fI\%\-p\fP option may be followed by one or more of the following letters or
+strings to indicate which value or values to print: \fBC\fP for the
+creation date, \fBP\fP for the publication date, \fBPds\(ga for the DS publication
+date, \(ga\(gaPsync\fP for the CDS and CDNSKEY publication date, \fBA\fP for the
+activation date, \fBR\fP for the revocation date, \fBI\fP for the inactivation
+date, \fBD\fP for the deletion date, \fBDds\fP for the DS deletion date,
+and \fBDsync\fP for the CDS and CDNSKEY deletion date. To print all of the
+metadata, use \fBall\fP\&.
+.UNINDENT
+.SH SEE ALSO
+.sp
+\fI\%dnssec\-keygen(8)\fP, \fI\%dnssec\-signzone(8)\fP, BIND 9 Administrator Reference Manual,
+\fI\%RFC 5011\fP\&.
+.SH AUTHOR
+Internet Systems Consortium
+.SH COPYRIGHT
+2023, Internet Systems Consortium
+.\" Generated by docutils manpage writer.
+.