diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 15:59:48 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 15:59:48 +0000 |
commit | 3b9b6d0b8e7f798023c9d109c490449d528fde80 (patch) | |
tree | 2e1c188dd7b8d7475cd163de9ae02c428343669b /doc/man/filter-aaaa.8in | |
parent | Initial commit. (diff) | |
download | bind9-3b9b6d0b8e7f798023c9d109c490449d528fde80.tar.xz bind9-3b9b6d0b8e7f798023c9d109c490449d528fde80.zip |
Adding upstream version 1:9.18.19.upstream/1%9.18.19upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | doc/man/filter-aaaa.8in | 110 |
1 files changed, 110 insertions, 0 deletions
diff --git a/doc/man/filter-aaaa.8in b/doc/man/filter-aaaa.8in new file mode 100644 index 0000000..ad6269a --- /dev/null +++ b/doc/man/filter-aaaa.8in @@ -0,0 +1,110 @@ +.\" Man page generated from reStructuredText. +. +. +.nr rst2man-indent-level 0 +. +.de1 rstReportMargin +\\$1 \\n[an-margin] +level \\n[rst2man-indent-level] +level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] +- +\\n[rst2man-indent0] +\\n[rst2man-indent1] +\\n[rst2man-indent2] +.. +.de1 INDENT +.\" .rstReportMargin pre: +. RS \\$1 +. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin] +. nr rst2man-indent-level +1 +.\" .rstReportMargin post: +.. +.de UNINDENT +. RE +.\" indent \\n[an-margin] +.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]] +.nr rst2man-indent-level -1 +.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] +.in \\n[rst2man-indent\\n[rst2man-indent-level]]u +.. +.TH "FILTER-AAAA" "8" "@RELEASE_DATE@" "@PACKAGE_VERSION@" "BIND 9" +.SH NAME +filter-aaaa \- filter AAAA in DNS responses when A is present +.SH SYNOPSIS +.sp +\fBplugin query\fP \(dqfilter\-aaaa.so\(dq [{ parameters }]; +.SH DESCRIPTION +.sp +\fBfilter\-aaaa.so\fP is a query plugin module for \fI\%named\fP, enabling +\fI\%named\fP to omit some IPv6 addresses when responding to clients. +.sp +Until BIND 9.12, this feature was implemented natively in \fI\%named\fP and +enabled with the \fBfilter\-aaaa\fP ACL and the \fBfilter\-aaaa\-on\-v4\fP and +\fBfilter\-aaaa\-on\-v6\fP options. These options are now deprecated in +\fI\%named.conf\fP but can be passed as parameters to the +\fBfilter\-aaaa.so\fP plugin, for example: +.INDENT 0.0 +.INDENT 3.5 +.sp +.nf +.ft C +plugin query \(dqfilter\-aaaa.so\(dq { + filter\-aaaa\-on\-v4 yes; + filter\-aaaa\-on\-v6 yes; + filter\-aaaa { 192.0.2.1; 2001:db8:2::1; }; +}; +.ft P +.fi +.UNINDENT +.UNINDENT +.sp +This module is intended to aid transition from IPv4 to IPv6 by +withholding IPv6 addresses from DNS clients which are not connected to +the IPv6 Internet, when the name being looked up has an IPv4 address +available. Use of this module is not recommended unless absolutely +necessary. +.sp +Note: This mechanism can erroneously cause other servers not to give +AAAA records to their clients. If a recursing server with both IPv6 and +IPv4 network connections queries an authoritative server using this +mechanism via IPv4, it is denied AAAA records even if its client is +using IPv6. +.SH OPTIONS +.INDENT 0.0 +.TP +.B \fBfilter\-aaaa\fP +This option specifies a list of client addresses for which AAAA filtering is to +be applied. The default is \fBany\fP\&. +.TP +.B \fBfilter\-aaaa\-on\-v4\fP +If set to \fByes\fP, this option indicates that the DNS client is at an IPv4 address, in +\fBfilter\-aaaa\fP\&. If the response does not include DNSSEC +signatures, then all AAAA records are deleted from the response. This +filtering applies to all responses, not only authoritative +ones. +.sp +If set to \fBbreak\-dnssec\fP, then AAAA records are deleted even when +DNSSEC is enabled. As suggested by the name, this causes the response +to fail to verify, because the DNSSEC protocol is designed to detect +deletions. +.sp +This mechanism can erroneously cause other servers not to give AAAA +records to their clients. If a recursing server with both IPv6 and IPv4 +network connections queries an authoritative server using this +mechanism via IPv4, it is denied AAAA records even if its client is +using IPv6. +.TP +.B \fBfilter\-aaaa\-on\-v6\fP +This option is identical to \fBfilter\-aaaa\-on\-v4\fP, except that it filters AAAA responses +to queries from IPv6 clients instead of IPv4 clients. To filter all +responses, set both options to \fByes\fP\&. +.UNINDENT +.SH SEE ALSO +.sp +BIND 9 Administrator Reference Manual. +.SH AUTHOR +Internet Systems Consortium +.SH COPYRIGHT +2023, Internet Systems Consortium +.\" Generated by docutils manpage writer. +. |