mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-26 19:41:04 -05:00
1d239012a9
Commit070c5fff49updated the man pages to contents produced using: - Sphinx 4.0.2 - sphinx-rtd-theme 0.5.2 - docutils 0.17.1 However, sphinx-rtd-theme 0.5.2 is incompatible with versions 0.17+ of the docutils package. This problem was addressed in the Docker image used for building man pages by downgrading the docutils package to version 0.16. Regenerate the man pages again, this time using: - Sphinx 4.0.2 - sphinx-rtd-theme 0.5.2 - docutils 0.16 This is necessary to prevent the "docs" GitLab CI job from failing. (cherry picked from commit6a2daddf5b)
110 lines
3.5 KiB
Text
110 lines
3.5 KiB
Text
.\" Man page generated from reStructuredText.
|
|
.
|
|
.TH "FILTER-AAAA" "8" "@RELEASE_DATE@" "@BIND9_VERSION@" "BIND 9"
|
|
.SH NAME
|
|
filter-aaaa \- filter AAAA in DNS responses when A is present
|
|
.
|
|
.nr rst2man-indent-level 0
|
|
.
|
|
.de1 rstReportMargin
|
|
\\$1 \\n[an-margin]
|
|
level \\n[rst2man-indent-level]
|
|
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
-
|
|
\\n[rst2man-indent0]
|
|
\\n[rst2man-indent1]
|
|
\\n[rst2man-indent2]
|
|
..
|
|
.de1 INDENT
|
|
.\" .rstReportMargin pre:
|
|
. RS \\$1
|
|
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
. nr rst2man-indent-level +1
|
|
.\" .rstReportMargin post:
|
|
..
|
|
.de UNINDENT
|
|
. RE
|
|
.\" indent \\n[an-margin]
|
|
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.nr rst2man-indent-level -1
|
|
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
..
|
|
.SH SYNOPSIS
|
|
.sp
|
|
\fBplugin query\fP "filter\-aaaa.so" [{ parameters }];
|
|
.SH DESCRIPTION
|
|
.sp
|
|
\fBfilter\-aaaa.so\fP is a query plugin module for \fBnamed\fP, enabling
|
|
\fBnamed\fP to omit some IPv6 addresses when responding to clients.
|
|
.sp
|
|
Until BIND 9.12, this feature was implemented natively in \fBnamed\fP and
|
|
enabled with the \fBfilter\-aaaa\fP ACL and the \fBfilter\-aaaa\-on\-v4\fP and
|
|
\fBfilter\-aaaa\-on\-v6\fP options. These options are now deprecated in
|
|
\fBnamed.conf\fP but can be passed as parameters to the
|
|
\fBfilter\-aaaa.so\fP plugin, for example:
|
|
.INDENT 0.0
|
|
.INDENT 3.5
|
|
.sp
|
|
.nf
|
|
.ft C
|
|
plugin query "/usr/local/lib/filter\-aaaa.so" {
|
|
filter\-aaaa\-on\-v4 yes;
|
|
filter\-aaaa\-on\-v6 yes;
|
|
filter\-aaaa { 192.0.2.1; 2001:db8:2::1; };
|
|
};
|
|
.ft P
|
|
.fi
|
|
.UNINDENT
|
|
.UNINDENT
|
|
.sp
|
|
This module is intended to aid transition from IPv4 to IPv6 by
|
|
withholding IPv6 addresses from DNS clients which are not connected to
|
|
the IPv6 Internet, when the name being looked up has an IPv4 address
|
|
available. Use of this module is not recommended unless absolutely
|
|
necessary.
|
|
.sp
|
|
Note: This mechanism can erroneously cause other servers not to give
|
|
AAAA records to their clients. If a recursing server with both IPv6 and
|
|
IPv4 network connections queries an authoritative server using this
|
|
mechanism via IPv4, it is denied AAAA records even if its client is
|
|
using IPv6.
|
|
.SH OPTIONS
|
|
.INDENT 0.0
|
|
.TP
|
|
.B \fBfilter\-aaaa\fP
|
|
This option specifies a list of client addresses for which AAAA filtering is to
|
|
be applied. The default is \fBany\fP\&.
|
|
.TP
|
|
.B \fBfilter\-aaaa\-on\-v4\fP
|
|
If set to \fByes\fP, this option indicates that the DNS client is at an IPv4 address, in
|
|
\fBfilter\-aaaa\fP\&. If the response does not include DNSSEC
|
|
signatures, then all AAAA records are deleted from the response. This
|
|
filtering applies to all responses, not only authoritative
|
|
ones.
|
|
.sp
|
|
If set to \fBbreak\-dnssec\fP, then AAAA records are deleted even when
|
|
DNSSEC is enabled. As suggested by the name, this causes the response
|
|
to fail to verify, because the DNSSEC protocol is designed to detect
|
|
deletions.
|
|
.sp
|
|
This mechanism can erroneously cause other servers not to give AAAA
|
|
records to their clients. If a recursing server with both IPv6 and IPv4
|
|
network connections queries an authoritative server using this
|
|
mechanism via IPv4, it is denied AAAA records even if its client is
|
|
using IPv6.
|
|
.TP
|
|
.B \fBfilter\-aaaa\-on\-v6\fP
|
|
This option is identical to \fBfilter\-aaaa\-on\-v4\fP, except that it filters AAAA responses
|
|
to queries from IPv6 clients instead of IPv4 clients. To filter all
|
|
responses, set both options to \fByes\fP\&.
|
|
.UNINDENT
|
|
.SH SEE ALSO
|
|
.sp
|
|
BIND 9 Administrator Reference Manual.
|
|
.SH AUTHOR
|
|
Internet Systems Consortium
|
|
.SH COPYRIGHT
|
|
2021, Internet Systems Consortium
|
|
.\" Generated by docutils manpage writer.
|
|
.
|