NLnetLabs / unbound

Unbound is a validating, recursive, and caching DNS resolver.
https://nlnetlabs.nl/unbound
BSD 3-Clause "New" or "Revised" License
3.13k stars 359 forks source link

`auth-zone` log floods when `prefer-ip4: yes` and `prefer-ip6: no` #338

Open EricLuehrsen opened 4 years ago

EricLuehrsen commented 4 years ago

This is related to #224 and openwrt/packages#11904 with hopefully more specific use case to test.

It appears that auth-zone: will ignore the prefer-ip4: and prefer-ip6: settings. This can cause a mass flood in syslog when the ISP has no IPv6, but the local network does. This can also flood when 6in4 tunnels are used which may be slow to bring up on boot. auth-zone: also appears to ignore do-not-query-address: which should work on the AXFR at least (i.e. port 53), but doesn't. There is no way to stop this bad behavior unless do-ip6: no which may not be desired by client configuration on the local network. Consider the following configuration file fragment with no ISP IPv6 and LAN IPv6 happily operating in fd00::/16 local admin address range.

server:
  interface-automatic: yes
  port: 53
  outgoing-port-permit: 10240-65535
  do-ip4: yes
  do-ip6: yes
  prefer-ip4: yes
  prefer-ip6: no
  ...
  ..
  .

auth-zone:
  name: .
  master: lax.xfr.dns.icann.org
  master: iad.xfr.dns.icann.org
  url: https://www.internic.net/domain/root.zone
  fallback-enabled: yes
  for-downstream: no
  for-upstream: yes
  zonefile: root.zone

auth-zone:
  name: arpa.
  master: lax.xfr.dns.icann.org
  master: iad.xfr.dns.icann.org
  url: https://www.internic.net/domain/arpa.zone
  fallback-enabled: yes
  for-downstream: no
  for-upstream: yes
  zonefile: arpa.zone

auth-zone:
  name: in-addr.arpa.
  master: lax.xfr.dns.icann.org
  master: iad.xfr.dns.icann.org
  url: https://www.internic.net/domain/in-addr.arpa.zone
  fallback-enabled: yes
  for-downstream: no
  for-upstream: yes
  zonefile: in-addr.arpa.zone

auth-zone:
  name: ip6.arpa.
  master: lax.xfr.dns.icann.org
  master: iad.xfr.dns.icann.org
  url: https://www.internic.net/domain/ip6.arpa.zone
  fallback-enabled: yes
  for-downstream: no
  for-upstream: yes
  zonefile: ip6.arpa.zone
ghost commented 4 years ago

That been the reason I initially suggested https://github.com/NLnetLabs/unbound/issues/34