> On Apr 14, 2019, at 5:35 PM, Carl Byington via bind-users
> wrote:
>
> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA512
>
> view "normal" {
>plugin query "filter-.so" {
>filter--on-v4 yes;
>filter- { "brokenv6"; };
>};
>
>
> named-checkconf likes that, but named gets a segfault in filter-.so.
> Anyone using filter-.so in a working configuation? The log shows:
>
Hi Carl,
I think I know what the problem is. We added a new ‘feature’ in BIND 9.14.0,
support for plug-in modules to modify query processing. The first module we
created was to support the filter- function.
As a result, you have to change the syntax for configuring this feature. This
was release-noted, but I see it was not clearly stated in the release note that
this is a non-backwards compatible change, and requires a configuration update.
5106. [experimental] A new "plugin" mechanism has been added to allow
extension of query processing functionality through
the use of dynamically loadable libraries. A
"filter-.so" plugin has been implemented,
replacing the filter- feature that was formerly
implemented as a native part of BIND.
The "filter-", "filter--on-v4" and
"filter--on-v6" options can no longer be
configured using native named.conf syntax. However,
loading the filter-.so plugin and setting its
parameters provides identical functionality.
Note that the plugin API is a work in progress and
is likely to evolve as further plugins are
implemented. [GL #15]
From the ARM:
DESCRIPTION
filter-.so is a query plugin module for named, enabling named to omit some
IPv6 addresses when responding to clients.
Until BIND 9.12, this feature was implemented natively in named and enabled
with the filter- ACL and the filter--on-v4 and filter--on-v6
options. These options are now depre- cated in named.conf, but can be passed as
parameters to the filter-.so plugin, for example:
This module is intended to aid transition from IPv4 to IPv6 by withholding IPv6
addresses from DNS clients which are not connected to the IPv6 Internet, when
the name being looked up has an IPv4 address available. Use of this module is
not recommended unless absolutely necessary.
Note: This mechanism can erroneously cause other servers not to give
records to their clients. If a recursing server with both IPv6 and IPv4 network
connections queries an authori- tative server using this mechanism via IPv4, it
will be denied records even if its client is using IPv6.
OPTIONS
filter-
Specifies a list of client addresses for which filtering is to be applied.
The default is any.
filter--on-v4
If set to yes, the DNS client is at an IPv4 address, in filter-, and if the
response does not include DNSSEC signatures, then all records are deleted
from the response. This filtering applies to all responses and not only
authoritative responses.
If set to break-dnssec, then records are deleted even when DNSSEC is
enabled. As suggested by the name, this causes the response to fail to verify,
because the DNSSEC protocol is designed to detect deletions.
This mechanism can erroneously cause other servers not to give records to
their clients. A recursing server with both IPv6 and IPv4 network connections
that queries an authoritative server using this mechanism via IPv4 will be
denied records even if its client is using IPv6.
filter--on-v6
Identical to filter--on-v4, except it filters responses to queries
from IPv6 clients instead of IPv4 clients. To filter all responses, set both
options to yes.
Victoria Risk
Product Manager
Internet Systems Consortium
vi...@isc.org
___
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
