mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-01-07 07:19:35 -05:00
- Use inclusive language in configuration
This commit is contained in:
Ralph Dolmans
parent
3527171397
commit
eb8ec9c18b
5 changed files with 2557 additions and 2507 deletions
|
|
@ -7,6 +7,7 @@
|
|||
23 September 2020: Ralph
|
||||
- Fix edns-client-tags get_option typo
|
||||
- Add edns-client-tag-opcode option
|
||||
- Use inclusive language in configuration
|
||||
|
||||
21 September 2020: Ralph
|
||||
- Fix #304: dnstap logging not recovering after dnstap process restarts
|
||||
|
|
|
|||
|
|
@ -431,8 +431,8 @@ server:
|
|||
|
||||
# Domains (and domains in them) without support for dns-0x20 and
|
||||
# the fallback fails because they keep sending different answers.
|
||||
# caps-whitelist: "licdn.com"
|
||||
# caps-whitelist: "senderbase.org"
|
||||
# caps-exempt: "licdn.com"
|
||||
# caps-exempt: "senderbase.org"
|
||||
|
||||
# Enforce privacy of these addresses. Strips them away from answers.
|
||||
# It may cause DNSSEC validation to additionally mark it as bogus.
|
||||
|
|
@ -861,9 +861,9 @@ server:
|
|||
# ipsecmod-ignore-bogus: no
|
||||
#
|
||||
# Domains for which ipsecmod will be triggered. If not defined (default)
|
||||
# all domains are treated as being whitelisted.
|
||||
# ipsecmod-whitelist: "example.com"
|
||||
# ipsecmod-whitelist: "nlnetlabs.nl"
|
||||
# all domains are treated as being allowed.
|
||||
# ipsecmod-allow: "example.com"
|
||||
# ipsecmod-allow: "nlnetlabs.nl"
|
||||
|
||||
|
||||
# Python config section. To enable:
|
||||
|
|
@ -961,27 +961,27 @@ remote-control:
|
|||
# upstream (which saves a lookup to the upstream). The first example
|
||||
# has a copy of the root for local usage. The second serves example.org
|
||||
# authoritatively. zonefile: reads from file (and writes to it if you also
|
||||
# download it), master: fetches with AXFR and IXFR, or url to zonefile.
|
||||
# With allow-notify: you can give additional (apart from masters) sources of
|
||||
# download it), primary: fetches with AXFR and IXFR, or url to zonefile.
|
||||
# With allow-notify: you can give additional (apart from primaries) sources of
|
||||
# notifies.
|
||||
# auth-zone:
|
||||
# name: "."
|
||||
# master: 199.9.14.201 # b.root-servers.net
|
||||
# master: 192.33.4.12 # c.root-servers.net
|
||||
# master: 199.7.91.13 # d.root-servers.net
|
||||
# master: 192.5.5.241 # f.root-servers.net
|
||||
# master: 192.112.36.4 # g.root-servers.net
|
||||
# master: 193.0.14.129 # k.root-servers.net
|
||||
# master: 192.0.47.132 # xfr.cjr.dns.icann.org
|
||||
# master: 192.0.32.132 # xfr.lax.dns.icann.org
|
||||
# master: 2001:500:200::b # b.root-servers.net
|
||||
# master: 2001:500:2::c # c.root-servers.net
|
||||
# master: 2001:500:2d::d # d.root-servers.net
|
||||
# master: 2001:500:2f::f # f.root-servers.net
|
||||
# master: 2001:500:12::d0d # g.root-servers.net
|
||||
# master: 2001:7fd::1 # k.root-servers.net
|
||||
# master: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
|
||||
# master: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
|
||||
# primary: 199.9.14.201 # b.root-servers.net
|
||||
# primary: 192.33.4.12 # c.root-servers.net
|
||||
# primary: 199.7.91.13 # d.root-servers.net
|
||||
# primary: 192.5.5.241 # f.root-servers.net
|
||||
# primary: 192.112.36.4 # g.root-servers.net
|
||||
# primary: 193.0.14.129 # k.root-servers.net
|
||||
# primary: 192.0.47.132 # xfr.cjr.dns.icann.org
|
||||
# primary: 192.0.32.132 # xfr.lax.dns.icann.org
|
||||
# primary: 2001:500:200::b # b.root-servers.net
|
||||
# primary: 2001:500:2::c # c.root-servers.net
|
||||
# primary: 2001:500:2d::d # d.root-servers.net
|
||||
# primary: 2001:500:2f::f # f.root-servers.net
|
||||
# primary: 2001:500:12::d0d # g.root-servers.net
|
||||
# primary: 2001:7fd::1 # k.root-servers.net
|
||||
# primary: 2620:0:2830:202::132 # xfr.cjr.dns.icann.org
|
||||
# primary: 2620:0:2d0:202::132 # xfr.lax.dns.icann.org
|
||||
# fallback-enabled: yes
|
||||
# for-downstream: no
|
||||
# for-upstream: yes
|
||||
|
|
@ -1101,7 +1101,7 @@ remote-control:
|
|||
# rpz:
|
||||
# name: "rpz.example.com"
|
||||
# zonefile: "rpz.example.com"
|
||||
# master: 192.0.2.0
|
||||
# primary: 192.0.2.0
|
||||
# allow-notify: 192.0.2.0/32
|
||||
# url: http://www.example.com/rpz.example.org.zone
|
||||
# rpz-action-override: cname
|
||||
|
|
|
|||
|
|
@ -884,12 +884,15 @@ authority servers and checks if the reply still has the correct casing.
|
|||
Disabled by default.
|
||||
This feature is an experimental implementation of draft dns\-0x20.
|
||||
.TP
|
||||
.B caps\-whitelist: \fI<domain>
|
||||
Whitelist the domain so that it does not receive caps\-for\-id perturbed
|
||||
.B caps\-exempt: \fI<domain>
|
||||
Exempt the domain so that it does not receive caps\-for\-id perturbed
|
||||
queries. For domains that do not support 0x20 and also fail with fallback
|
||||
because they keep sending different answers, like some load balancers.
|
||||
Can be given multiple times, for different domains.
|
||||
.TP
|
||||
.B caps\-whitelist: \fI<yes or no>
|
||||
Alternate syntax for \fBcaps\-exempt\fR.
|
||||
.TP
|
||||
.B qname\-minimisation: \fI<yes or no>
|
||||
Send minimum amount of information to upstream servers to enhance privacy.
|
||||
Only send minimum required labels of the QNAME and set QTYPE to A when
|
||||
|
|
@ -1744,16 +1747,16 @@ uses the SOA timer values and performs SOA UDP queries to detect zone changes.
|
|||
If the update fetch fails, the timers in the SOA record are used to time
|
||||
another fetch attempt. Until the SOA expiry timer is reached. Then the
|
||||
zone is expired. When a zone is expired, queries are SERVFAIL, and
|
||||
any new serial number is accepted from the master (even if older), and if
|
||||
any new serial number is accepted from the primary (even if older), and if
|
||||
fallback is enabled, the fallback activates to fetch from the upstream instead
|
||||
of the SERVFAIL.
|
||||
.TP
|
||||
.B name: \fI<zone name>
|
||||
Name of the authority zone.
|
||||
.TP
|
||||
.B master: \fI<IP address or host name>
|
||||
.B primary: \fI<IP address or host name>
|
||||
Where to download a copy of the zone from, with AXFR and IXFR. Multiple
|
||||
masters can be specified. They are all tried if one fails.
|
||||
primaries can be specified. They are all tried if one fails.
|
||||
With the "ip#name" notation a AXFR over TLS can be used.
|
||||
If you point it at another Unbound instance, it would not work because
|
||||
that does not support AXFR/IXFR for the zone, but if you used \fBurl:\fR to download
|
||||
|
|
@ -1762,27 +1765,31 @@ If you specify the hostname, you cannot use the domain from the zonefile,
|
|||
because it may not have that when retrieving that data, instead use a plain
|
||||
IP address to avoid a circular dependency on retrieving that IP address.
|
||||
.TP
|
||||
.B master: \fI<IP address or host name>
|
||||
Alternate syntax for \fBprimary\fR.
|
||||
.TP
|
||||
.B url: \fI<url to zonefile>
|
||||
Where to download a zonefile for the zone. With http or https. An example
|
||||
for the url is "http://www.example.com/example.org.zone". Multiple url
|
||||
statements can be given, they are tried in turn. If only urls are given
|
||||
the SOA refresh timer is used to wait for making new downloads. If also
|
||||
masters are listed, the masters are first probed with UDP SOA queries to
|
||||
primaries are listed, the primaries are first probed with UDP SOA queries to
|
||||
see if the SOA serial number has changed, reducing the number of downloads.
|
||||
If none of the urls work, the masters are tried with IXFR and AXFR.
|
||||
If none of the urls work, the primaries are tried with IXFR and AXFR.
|
||||
For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
|
||||
to authenticate the connection.
|
||||
If you specify a hostname in the URL, you cannot use the domain from the
|
||||
zonefile, because it may not have that when retrieving that data, instead
|
||||
use a plain IP address to avoid a circular dependency on retrieving that IP
|
||||
address. Avoid dependencies on name lookups by using a notation like "http://192.0.2.1/unbound-master/example.com.zone", with an explicit IP address.
|
||||
address. Avoid dependencies on name lookups by using a notation like
|
||||
"http://192.0.2.1/unbound-primaries/example.com.zone", with an explicit IP address.
|
||||
.TP
|
||||
.B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
|
||||
With allow\-notify you can specify additional sources of notifies.
|
||||
When notified, the server attempts to first probe and then zone transfer.
|
||||
If the notify is from a master, it first attempts that master. Otherwise
|
||||
other masters are attempted. If there are no masters, but only urls, the
|
||||
file is downloaded when notified. The masters from master: statements are
|
||||
If the notify is from a primary, it first attempts that primary. Otherwise
|
||||
other primaries are attempted. If there are no primaries, but only urls, the
|
||||
file is downloaded when notified. The primaries from primary: statements are
|
||||
allowed notify by default.
|
||||
.TP
|
||||
.B fallback\-enabled: \fI<yes or no>
|
||||
|
|
@ -1810,7 +1817,7 @@ downstream clients, and use the zone data as a local copy to speed up lookups.
|
|||
.B zonefile: \fI<filename>
|
||||
The filename where the zone is stored. If not given then no zonefile is used.
|
||||
If the file does not exist or is empty, unbound will attempt to fetch zone
|
||||
data (eg. from the master servers).
|
||||
data (eg. from the primary servers).
|
||||
.SS "View Options"
|
||||
.LP
|
||||
There may be multiple
|
||||
|
|
@ -1977,14 +1984,16 @@ The ECS module must be configured in the \fBmodule\-config:\fR "subnetcache
|
|||
validator iterator" directive and be compiled into the daemon to be
|
||||
enabled. These settings go in the \fBserver:\fR section.
|
||||
.LP
|
||||
If the destination address is whitelisted with Unbound will add the EDNS0
|
||||
option to the query containing the relevant part of the client's address. When
|
||||
an answer contains the ECS option the response and the option are placed in a
|
||||
specialized cache. If the authority indicated no support, the response is
|
||||
If the destination address is allowed in the configuration Unbound will add the
|
||||
EDNS0 option to the query containing the relevant part of the client's address.
|
||||
When an answer contains the ECS option the response and the option are placed in
|
||||
a specialized cache. If the authority indicated no support, the response is
|
||||
stored in the regular cache.
|
||||
.LP
|
||||
Additionally, when a client includes the option in its queries, Unbound will
|
||||
forward the option to the authority if present in the whitelist, or
|
||||
forward the option when sending the query to addresses that are explicitly
|
||||
allowed in the configuration using \fBsend\-client\-subnet\fR. The option will
|
||||
always be forwarded, regardless the allowed addresses, if
|
||||
\fBclient\-subnet\-always\-forward\fR is set to yes. In this case the lookup in
|
||||
the regular cache is skipped.
|
||||
.LP
|
||||
|
|
@ -2005,11 +2014,11 @@ given multiple times. Zones not listed will not receive edns-subnet information,
|
|||
unless hosted by authority specified in \fBsend\-client\-subnet\fR.
|
||||
.TP
|
||||
.B client\-subnet\-always\-forward: \fI<yes or no>\fR
|
||||
Specify whether the ECS whitelist check (configured using
|
||||
Specify whether the ECS address check (configured using
|
||||
\fBsend\-client\-subnet\fR) is applied for all queries, even if the triggering
|
||||
query contains an ECS record, or only for queries for which the ECS record is
|
||||
generated using the querier address (and therefore did not contain ECS data in
|
||||
the client query). If enabled, the whitelist check is skipped when the client
|
||||
the client query). If enabled, the address check is skipped when the client
|
||||
query contains an ECS record. Default is no.
|
||||
.TP
|
||||
.B max\-client\-subnet\-ipv6: \fI<number>\fR
|
||||
|
|
@ -2099,10 +2108,13 @@ to yes, the hook will be called and the A/AAAA answer will be returned to the
|
|||
client. If set to no, the hook will not be called and the answer to the
|
||||
A/AAAA query will be SERVFAIL. Mainly used for testing. Defaults to no.
|
||||
.TP
|
||||
.B ipsecmod\-whitelist: \fI<domain>\fR
|
||||
Whitelist the domain so that the module logic will be executed. Can
|
||||
be given multiple times, for different domains. If the option is not
|
||||
specified, all domains are treated as being whitelisted (default).
|
||||
.B ipsecmod\-allow: \fI<domain>\fR
|
||||
Allow the ipsecmod functionality for the domain so that the module logic will be
|
||||
executed. Can be given multiple times, for different domains. If the option is
|
||||
not specified, all domains are treated as being allowed (default).
|
||||
.TP
|
||||
.B ipsecmod\-whitelist: \fI<yes or no>
|
||||
Alternate syntax for \fBipsecmod\-allow\fR.
|
||||
.SS "Cache DB Module Options"
|
||||
.LP
|
||||
The Cache DB module must be configured in the \fBmodule\-config:\fR
|
||||
|
|
@ -2299,33 +2311,36 @@ are applied after
|
|||
.B name: \fI<zone name>
|
||||
Name of the authority zone.
|
||||
.TP
|
||||
.B master: \fI<IP address or host name>
|
||||
.B primary: \fI<IP address or host name>
|
||||
Where to download a copy of the zone from, with AXFR and IXFR. Multiple
|
||||
masters can be specified. They are all tried if one fails.
|
||||
primaries can be specified. They are all tried if one fails.
|
||||
.TP
|
||||
.B master: \fI<IP address or host name>
|
||||
Alternate syntax for \fBprimary\fR.
|
||||
.TP
|
||||
.B url: \fI<url to zonefile>
|
||||
Where to download a zonefile for the zone. With http or https. An example
|
||||
for the url is "http://www.example.com/example.org.zone". Multiple url
|
||||
statements can be given, they are tried in turn. If only urls are given
|
||||
the SOA refresh timer is used to wait for making new downloads. If also
|
||||
masters are listed, the masters are first probed with UDP SOA queries to
|
||||
primaries are listed, the primaries are first probed with UDP SOA queries to
|
||||
see if the SOA serial number has changed, reducing the number of downloads.
|
||||
If none of the urls work, the masters are tried with IXFR and AXFR.
|
||||
If none of the urls work, the primaries are tried with IXFR and AXFR.
|
||||
For https, the \fBtls\-cert\-bundle\fR and the hostname from the url are used
|
||||
to authenticate the connection.
|
||||
.TP
|
||||
.B allow\-notify: \fI<IP address or host name or netblockIP/prefix>
|
||||
With allow\-notify you can specify additional sources of notifies.
|
||||
When notified, the server attempts to first probe and then zone transfer.
|
||||
If the notify is from a master, it first attempts that master. Otherwise
|
||||
other masters are attempted. If there are no masters, but only urls, the
|
||||
file is downloaded when notified. The masters from master: statements are
|
||||
If the notify is from a primary, it first attempts that primary. Otherwise
|
||||
other primaries are attempted. If there are no primaries, but only urls, the
|
||||
file is downloaded when notified. The primaries from primary: statements are
|
||||
allowed notify by default.
|
||||
.TP
|
||||
.B zonefile: \fI<filename>
|
||||
The filename where the zone is stored. If not given then no zonefile is used.
|
||||
If the file does not exist or is empty, unbound will attempt to fetch zone
|
||||
data (eg. from the master servers).
|
||||
data (eg. from the primary servers).
|
||||
.TP
|
||||
.B rpz\-action\-override: \fI<action>
|
||||
Always use this RPZ action for matching triggers from this zone. Possible action
|
||||
|
|
|
|||
4935
util/configlexer.c
4935
util/configlexer.c
File diff suppressed because it is too large
Load diff
|
|
@ -309,6 +309,7 @@ harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
|
|||
harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
|
||||
use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
|
||||
caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) }
|
||||
caps-exempt{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) }
|
||||
unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
|
||||
private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) }
|
||||
private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) }
|
||||
|
|
@ -340,6 +341,7 @@ rpz-log{COLON} { YDVAR(1, VAR_RPZ_LOG) }
|
|||
rpz-log-name{COLON} { YDVAR(1, VAR_RPZ_LOG_NAME) }
|
||||
zonefile{COLON} { YDVAR(1, VAR_ZONEFILE) }
|
||||
master{COLON} { YDVAR(1, VAR_MASTER) }
|
||||
primary{COLON} { YDVAR(1, VAR_MASTER) }
|
||||
url{COLON} { YDVAR(1, VAR_URL) }
|
||||
allow-notify{COLON} { YDVAR(1, VAR_ALLOW_NOTIFY) }
|
||||
for-downstream{COLON} { YDVAR(1, VAR_FOR_DOWNSTREAM) }
|
||||
|
|
@ -510,6 +512,7 @@ ipsecmod-ignore-bogus{COLON} { YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) }
|
|||
ipsecmod-hook{COLON} { YDVAR(1, VAR_IPSECMOD_HOOK) }
|
||||
ipsecmod-max-ttl{COLON} { YDVAR(1, VAR_IPSECMOD_MAX_TTL) }
|
||||
ipsecmod-whitelist{COLON} { YDVAR(1, VAR_IPSECMOD_WHITELIST) }
|
||||
ipsecmod-allow{COLON} { YDVAR(1, VAR_IPSECMOD_WHITELIST) }
|
||||
ipsecmod-strict{COLON} { YDVAR(1, VAR_IPSECMOD_STRICT) }
|
||||
cachedb{COLON} { YDVAR(0, VAR_CACHEDB) }
|
||||
backend{COLON} { YDVAR(1, VAR_CACHEDB_BACKEND) }
|
||||
|
|
|
|||
Loading…
Reference in a new issue