filter-aaaa.so — filter AAAA in DNS responses when A is present
+hook query "filter-aaaa.so" [{ parameters }];
+
+ filter-aaaa.so is a query hook module for + named, enabling named + to omit some IPv6 addresses when responding to clients. +
+
+ Until BIND 9.12, this feature was implemented natively in
+ named and enabled with the
+ filter-aaaa ACL and the
+ filter-aaaa-on-v4 and
+ filter-aaaa-on-v6 options. These options are
+ now deprecated in named.conf, but can be
+ passed as parameters to the filter-aaaa.so
+ hook module, for example:
+
+hook query "/usr/local/lib/filter-aaaa.so" {
+ filter-aaaa-on-v4 yes;
+ filter-aaaa-on-v6 yes;
+ filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+
++ This module is intended to aid transition from IPv4 to IPv6 by + withholding IPv6 addresses from DNS clients which are not connected + to the IPv6 Internet, when the name being looked up has an IPv4 + address available. Use of this module is not recommended unless + absolutely necessary. +
++ Note: This mechanism can erroneously cause other servers not to + give AAAA records to their clients. If a recursing server with + both IPv6 and IPv4 network connections queries an authoritative + server using this mechanism via IPv4, it will be denied AAAA + records even if its client is using IPv6. +
+
+ Specifies a list of client addresses for which AAAA
+ filtering is to be applied. The default is
+ any.
+
+ If set to yes, the DNS client is
+ at an IPv4 address, in filter-aaaa,
+ and if the response does not include DNSSEC signatures,
+ then all AAAA records are deleted from the response.
+ This filtering applies to all responses and not only
+ authoritative responses.
+
+ If set to break-dnssec,
+ then AAAA records are deleted even when DNSSEC is
+ enabled. As suggested by the name, this causes the
+ response to fail to verify, because the DNSSEC protocol is
+ designed to detect deletions.
+
+ This mechanism can erroneously cause other servers not to + give AAAA records to their clients. A recursing server with + both IPv6 and IPv4 network connections that queries an + authoritative server using this mechanism via IPv4 will be + denied AAAA records even if its client is using IPv6. +
+
+ Identical to filter-aaaa-on-v4,
+ except it filters AAAA responses to queries from IPv6
+ clients instead of IPv4 clients. To filter all
+ responses, set both options to yes.
+
filter-aaaa.so — filter AAAA in DNS responses when A is present
+hook query "filter-aaaa.so" [{ parameters }];
+
+ filter-aaaa.so is a query hook module for + named, enabling named + to omit some IPv6 addresses when responding to clients. +
+
+ Until BIND 9.12, this feature was impleented natively in
+ named and enabled with the
+ filter-aaaa ACL and the
+ filter-aaaa-on-v4 and
+ filter-aaaa-on-v6 options. These options are
+ now deprecated in named.conf, but can be
+ passed as parameters to the filter-aaaa.so
+ hook module, for example:
+
+hook query "/usr/local/lib/filter-aaaa.so" {
+ filter-aaaa-on-v4 yes;
+ filter-aaaa-on-v6 yes;
+ filter-aaaa { 192.0.2.1; 2001:db8:2::1; };
+};
+
++ This module is intended to aid transition from IPv4 to IPv6 by + withholding IPv6 addresses from DNS clients which are not connected + to the IPv6 Internet, when the name being looked up has an IPv4 + address available. Use of this module is not recommended unless + absolutely necessary. +
++ Note: This mechanism can erroneously cause other servers not to + give AAAA records to their clients. If a recursing server with + both IPv6 and IPv4 network connections queries an authoritative + server using this mechanism via IPv4, it will be denied AAAA + records even if its client is using IPv6. +
+
+ Specifies a list of client addresses for which AAAA
+ filtering is to be applied. The default is
+ any.
+
+ If set to yes, the DNS client is
+ at an IPv4 address, in filter-aaaa,
+ and if the response does not include DNSSEC signatures,
+ then all AAAA records are deleted from the response.
+ This filtering applies to all responses and not only
+ authoritative responses.
+
+ If set to break-dnssec,
+ then AAAA records are deleted even when DNSSEC is
+ enabled. As suggested by the name, this causes the
+ response to fail to verify, because the DNSSEC protocol is
+ designed to detect deletions.
+
+ This mechanism can erroneously cause other servers not to + give AAAA records to their clients. A recursing server with + both IPv6 and IPv4 network connections that queries an + authoritative server using this mechanism via IPv4 will be + denied AAAA records even if its client is using IPv6. +
+
+ Identical to filter-aaaa-on-v4,
+ except it filters AAAA responses to queries from IPv6
+ clients instead of IPv4 clients. To filter all
+ responses, set both options to yes.
+
BIND 9.13.2 (Development Release)
+ + diff --git a/lib/ns/Makefile.in b/lib/ns/Makefile.in index ede65f8674..e785969b51 100644 --- a/lib/ns/Makefile.in +++ b/lib/ns/Makefile.in @@ -54,8 +54,7 @@ SRCS = client.c hooks.c interfacemgr.c lib.c listenlist.c \ SUBDIRS = include TESTDIRS = @UNITTESTS@ -SO_TARGETS = filter-aaaa.@SO@ -TARGETS = timestamp @SO_TARGETS@ +TARGETS = timestamp SO_CFLAGS = @CFLAGS@ @SO_CFLAGS@ SO_LDFLAGS = @LDFLAGS@ @SO_LDFLAGS@ @@ -84,14 +83,6 @@ libns.la: ${OBJS} timestamp: libns.@A@ touch timestamp -filter-aaaa.@O@: filter-aaaa.c - ${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} ${SO_CFLAGS} \ - -c ${srcdir}/filter-aaaa.c - -filter-aaaa.@SO@: filter-aaaa.o libns.@A@ - ${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ filter-aaaa.o \ - ${ISCLIBS} ${DNSLIBS} libns.@A@ ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${DNSLIBS} ${LIBS} - installdirs: $(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${libdir} @@ -103,4 +94,4 @@ uninstall:: ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${libdir}/libns.@A@ clean distclean:: - rm -f libns.@A@ timestamp filter-aaaa.@O@ filter-aaaa.@SO@ + rm -f libns.@A@ timestamp