Misleading error message on default access control causing refuse

When a server on example IP 192.0.2.3 has `access-control` defined e.g. like this:

```
192.0.2.0/24 allow
```

and it receives a query from a different address, say 198.51.100.15, unbound will log:

```
unbound: [607563:0] debug: refused query from 198.51.100.15 port 9987 because of 192.0.2.3/32 refuse
```

This is misleading. The true reason is "because the default access control rule is to refuse".

If I add

```
0.0.0.0/0 refuse
```

after the above `allow`, then the log is correct:

```
unbound: [607563:0] debug: refused query from 198.51.100.15 port 9987 because of 0.0.0.0/0 refuse
```

**System:**
 - Unbound version: 1.17.1
 - OS: Debian stable
 - `unbound -V` output:
```
Configure line: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking --with-pythonmodule --with-pyunbound --enable-subnet --enable-dnstap --enable-systemd --with-libnghttp2 --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --disable-rpath --with-pidfile=/run/unbound.pid --with-libevent --enable-tfo-client --with-rootkey-file=/usr/share/dns/root.key --enable-tfo-server
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.15 3 Sep 2024
Linked modules: dns64 python subnetcache respip validator iterator
TCP Fastopen feature available
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Misleading error message on default access control causing refuse #1213

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Misleading error message on default access control causing refuse #1213

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions