Commit 78f6cd57 authored by treysis's avatar treysis
Browse files

Add filter-a plugin for IPv6-dominant environments

parent 8d8373c2
......@@ -7,6 +7,9 @@ AM_CPPFLAGS += \
$(LIBISCCFG_CFLAGS)
pkglib_LTLIBRARIES = filter-aaaa.la
pkglib_LTLIBRARIES += filter-a.la
filter_aaaa_la_SOURCES = filter-aaaa.c
filter_a_la_SOURCES = filter-a.c
filter_aaaa_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
filter_a_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
This diff is collapsed.
..
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, you can obtain one at https://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
..
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
.. highlight: console
.. _man_filter-a:
filter-a.so - filter A in DNS responses when AAAA is present
---------------------------------------------------------------
Synopsis
~~~~~~~~
:program:`plugin query` "filter-a.so" [{ parameters }];
Description
~~~~~~~~~~~
``filter-a.so`` is a query plugin module for ``named``, enabling
``named`` to omit some IPv4 addresses when responding to clients.
For example:
::
plugin query "/usr/local/lib/filter-a.so" {
filter-a-on-v6 yes;
filter-a-on-v4 yes;
filter-a { 192.0.2.1; 2001:db8:2::1; };
};
This module is intended to aid transition from IPv4 to IPv6 by
withholding IPv4 addresses from DNS clients which are not connected to
the IPv4 Internet, when the name being looked up has an IPv6 address
available. Use of this module is not recommended unless absolutely
necessary.
Note: This mechanism can erroneously cause other servers not to give
A records to their clients. If a recursing server with both IPv6 and
IPv4 network connections queries an authoritative server using this
mechanism via IPv6, it is denied A records even if its client is
using IPv4.
Options
~~~~~~~
``filter-a``
This option specifies a list of client addresses for which A filtering is to
be applied. The default is ``any``.
``filter-a-on-v6``
If set to ``yes``, this option indicates that the DNS client is at an IPv6 address, in
``filter-a``. If the response does not include DNSSEC
signatures, then all A records are deleted from the response. This
filtering applies to all responses, not only authoritative
ones.
If set to ``break-dnssec``, then A records are deleted even when
DNSSEC is enabled. As suggested by the name, this causes the response
to fail to verify, because the DNSSEC protocol is designed to detect
deletions.
This mechanism can erroneously cause other servers not to give A
records to their clients. If a recursing server with both IPv6 and IPv4
network connections queries an authoritative server using this
mechanism via IPv6, it is denied A records even if its client is
using IPv4.
``filter-a-on-v4``
This option is identical to ``filter-a-on-v6``, except that it filters A responses
to queries from IPv4 clients instead of IPv6 clients. To filter all
responses, set both options to ``yes``.
See Also
~~~~~~~~
BIND 9 Administrator Reference Manual.
......@@ -17,6 +17,7 @@ MANPAGES_RST = \
dnssec-verify.rst \
dnstap-read.rst \
filter-aaaa.rst \
filter-a.rst \
host.rst \
index.rst \
mdig.rst \
......@@ -62,6 +63,7 @@ MANPAGES_RST = \
../../bin/pkcs11/pkcs11-list.rst \
../../bin/pkcs11/pkcs11-tokens.rst \
../../bin/plugins/filter-aaaa.rst \
../../bin/plugins/filter-a.rst \
../../bin/rndc/rndc.conf.rst \
../../bin/rndc/rndc.rst \
../../bin/tools/arpaname.rst \
......@@ -96,6 +98,7 @@ man_MANS = \
dnssec-signzone.1 \
dnssec-verify.1 \
filter-aaaa.8 \
filter-a.8 \
named-checkconf.1 \
named-checkzone.1 \
named-journalprint.1 \
......
......@@ -74,6 +74,7 @@ man_pages = [
('dnssec-verify', 'dnssec-verify', 'DNSSEC zone verification tool', author, 1),
('dnstap-read', 'dnstap-read', 'print dnstap data in human-readable form', author, 1),
('filter-aaaa', 'filter-aaaa', 'filter AAAA in DNS responses when A is present', author, 8),
('filter-a', 'filter-a', 'filter A in DNS responses when AAAA is present', author, 8),
('host', 'host', 'DNS lookup utility', author, 1),
('mdig', 'mdig', 'DNS pipelined lookup utility', author, 1),
('named-checkconf', 'named-checkconf', 'named configuration file syntax checking tool', author, 1),
......
.\" Man page generated from reStructuredText.
.
.TH "FILTER-A" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
.SH NAME
filter-a \- filter A in DNS responses when AAAA is present
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.SH SYNOPSIS
.sp
\fBplugin query\fP "filter\-a.so" [{ parameters }];
.SH DESCRIPTION
.sp
\fBfilter\-a.so\fP is a query plugin module for \fBnamed\fP, enabling
\fBnamed\fP to omit some IPv4 addresses when responding to clients.
.sp
This plugin uses the reverse functionality of \fBfilter\-aaaa\fP plugin. Likewise,
options can be passed as parameters to the \fBfilter\-a.so\fP plugin,
for example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
plugin query "/usr/local/lib/filter\-a.so" {
filter\-a\-on\-v4 yes;
filter\-a\-on\-v6 yes;
filter\-a { 192.0.2.1; 2001:db8:2::1; };
};
.ft P
.fi
.UNINDENT
.UNINDENT
.sp
This module is intended to aid transition from IPv4 to IPv6 by
withholding IPv4 addresses from DNS clients which are not connected to
the IPv4 Internet, when the name being looked up has an IPv6 address
available. Use of this module is not recommended unless absolutely
necessary.
.sp
Note: This mechanism can erroneously cause other servers not to give
A records to their clients. If a recursing server with both IPv6 and
IPv4 network connections queries an authoritative server using this
mechanism via IPv6, it is denied A records even if its client is
using IPv4.
.SH OPTIONS
.INDENT 0.0
.TP
.B \fBfilter\-a\fP
This option specifies a list of client addresses for which A filtering is to
be applied. The default is \fBany\fP\&.
.TP
.B \fBfilter\-a\-on\-v4\fP
If set to \fByes\fP, this option indicates that the DNS client is at an IPv4 address, in
\fBfilter\-aaaa\fP\&. If the response does not include DNSSEC
signatures, then all A records are deleted from the response. This
filtering applies to all responses, not only authoritative
ones.
.sp
If set to \fBbreak\-dnssec\fP, then A records are deleted even when
DNSSEC is enabled. As suggested by the name, this causes the response
to fail to verify, because the DNSSEC protocol is designed to detect
deletions.
.sp
This mechanism can erroneously cause other servers not to give A
records to their clients. If a recursing server with both IPv6 and IPv4
network connections queries an authoritative server using this
mechanism via IPv6, it is denied A records even if its client is
using IPv4.
.TP
.B \fBfilter\-a\-on\-v6\fP
This option is identical to \fBfilter\-a\-on\-v4\fP, except that it filters A responses
to queries from IPv6 clients instead of IPv4 clients. To filter all
responses, set both options to \fByes\fP\&.
.UNINDENT
.SH SEE ALSO
.sp
BIND 9 Administrator Reference Manual.
.SH AUTHOR
Internet Systems Consortium
.SH COPYRIGHT
2021, Internet Systems Consortium
.\" Generated by docutils manpage writer.
.
..
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, you can obtain one at https://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
:orphan:
.. include:: ../../bin/plugins/filter-a.rst
\ No newline at end of file
......@@ -193,6 +193,8 @@
./bin/pkcs11/win32/pk11tokens.vcxproj.user X 2014,2018,2019,2020,2021
./bin/plugins/filter-aaaa.c C 2018,2019,2020,2021
./bin/plugins/filter-aaaa.rst RST 2020,2021
./bin/plugins/filter-a.c C 2018,2019,2020,2021
./bin/plugins/filter-a.rst RST 2020,2021
./bin/rndc/rndc.c C 2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018,2019,2020,2021
./bin/rndc/rndc.conf.rst RST 2020,2021
./bin/rndc/rndc.rst RST 2020,2021
......@@ -1239,6 +1241,7 @@
./doc/man/dnssec-verify.rst RST 2020,2021
./doc/man/dnstap-read.rst RST 2020,2021
./doc/man/filter-aaaa.rst RST 2020,2021
./doc/man/filter-a.rst RST 2020,2021
./doc/man/host.rst RST 2020,2021
./doc/man/index.rst RST 2020,2021
./doc/man/mdig.rst RST 2020,2021
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment