- Set default for harden-unknown-additional to no. So that it does

  not hamper future protocol developments.

diff --git a/doc/Changelog b/doc/Changelog
index 2de00f017053bf785c09683f5ada66184965fa44..33450ab93a44577d5e7fb7d26cb0edde34bad001 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -5,9 +5,11 @@
          resolvers. The new choice, down from 4096 means it is harder to get
          large responses from Unbound. Thanks to Xiang Li, from NISL Lab,
          Tsinghua University.
-       - Add harden-unknown-additional option. Default on and it removes
+       - Add harden-unknown-additional option. It removes
          unknown records from the authority section and additional section.
          Thanks to Xiang Li, from NISL Lab, Tsinghua University.
+       - Set default for harden-unknown-additional to no. So that it does
+         not hamper future protocol developments.
 
 18 January 2023: Wouter
        - Fix not following cleared RD flags potentially enables amplification

diff --git a/doc/example.conf.in b/doc/example.conf.in
index ca8f95a5e6d8375195510f5249d456d8c678bc0b..8d8a057ad6b718916c626f276b5f6576c99258c4 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -505,7 +505,7 @@ server:
 
        # Harden against unknown records in the authority section and the
        # additional section.
-       # harden-unknown-additional: yes
+       # harden-unknown-additional: no
 
        # Sent minimum amount of information to upstream servers to enhance
        # privacy. Only sent minimum required labels of the QNAME and set QTYPE

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 075f4b28e33b847612b1fc34dd803bb2e2f4d8e2..93150aea3e4ecc67822efed91d803fbe7f700050 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -1022,8 +1022,9 @@ this option off avoids that validation failure.
 .TP
 .B harden\-unknown\-additional: \fI<yes or no>
 Harden against unknown records in the authority section and additional
-section. Default is yes. If no, such records are copied from the upstream
-and presented to the client together with the answer.
+section. Default is no. If no, such records are copied from the upstream
+and presented to the client together with the answer. If yes, it could
+hamper future protocol developments that want to add records.
 .TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.

diff --git a/util/config_file.c b/util/config_file.c
index 5f605c5b1d2765ce289e58ec0158b0b9a19eb3e1..b41e66468700a6404f05adee288a9b830d375276 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -233,7 +233,7 @@ config_create(void)
        cfg->harden_below_nxdomain = 1;
        cfg->harden_referral_path = 0;
        cfg->harden_algo_downgrade = 0;
-       cfg->harden_unknown_additional = 1;
+       cfg->harden_unknown_additional = 0;
        cfg->use_caps_bits_for_id = 0;
        cfg->caps_whitelist = NULL;
        cfg->private_address = NULL;