upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of github.com:NLnetLabs/unbound

Browse source
This commit is contained in:
W.C.A. Wijngaards 2024-07-12 16:41:58 +02:00
commit b1e3319a11
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/Changelog
View file

@ -1,5 +1,7 @@
12 July 2024: Yorgos 12 July 2024: Yorgos
- Add RPZ tag tests in acl_interface.tdir. - Add RPZ tag tests in acl_interface.tdir.
- For #1102: clearer text for using interface-* options for the
loopback interface.
12 July 2024: Wouter 12 July 2024: Wouter
- Fix #1103: unbound 1.20.0 segmentation fault with nghttp2. - Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.

11
doc/unbound.conf.5.in
View file

@ -788,7 +788,8 @@ transports, regardless of the presence of an DNS Cookie and regardless of the
UDP queries without a DNS Cookie receive REFUSED responses with the TC flag set, UDP queries without a DNS Cookie receive REFUSED responses with the TC flag set,
that may trigger fall back to TCP for those clients. that may trigger fall back to TCP for those clients.
.IP .IP
By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd. By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
interface) is implicitly \fIallow\fRed, the rest is \fIrefuse\fRd.
The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
protocol is not designed to handle dropped packets due to policy, and protocol is not designed to handle dropped packets due to policy, and
dropping may result in (possibly excessive) retried queries. dropping may result in (possibly excessive) retried queries.
@ -824,8 +825,12 @@ Similar to \fBaccess\-control:\fR but for interfaces.
.IP .IP
The action is the same as the ones defined under \fBaccess\-control:\fR. The action is the same as the ones defined under \fBaccess\-control:\fR.
Interfaces are \fIrefuse\fRd by default. Interfaces are \fIrefuse\fRd by default.
By default only localhost (the IP netblock, not the loopback interface) is By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
\fIallow\fRed through the default \fBaccess\-control:\fR behavior. interface) is implicitly \fIallow\fRed through the default
\fBaccess\-control:\fR behavior.
This also means that any attempt to use the \fBinterface-*:\fR options for the
loopback interface will not work as they will be overridden by the implicit
default "\fBaccess\-control:\fR 127.0.0.0/8 allow" option.
.IP .IP
Note that the interface needs to be already specified with \fBinterface:\fR Note that the interface needs to be already specified with \fBinterface:\fR
and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR