mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-22 18:19:42 +00:00
Code Issues Releases Wiki Activity

Disable lame-ttl cache

Browse Source 
The lame-ttl cache is implemented in ADB as per-server locked
linked-list "indexed" with <qname,qtype>.  This list has to be walked
every time there's a new query or new record added into the lame cache.
Determined attacker can use this to degrade performance of the resolver.

Resolver testing has shown that disabling the lame cache has little
impact on the resolver performance and it's a minimal viable defense
against this kind of attack.
This commit is contained in:
Ondřej Surý 2021-09-24 09:35:11 +02:00 committed by Michał Kępień
parent 02940b71a3
commit 011e9418ce
3 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bin/named/config.c
View File

@ -151,7 +151,7 @@ options {\n\
fetches-per-server 0;\n\
fetches-per-zone 0;\n\
glue-cache yes;\n\
lame-ttl 600;\n"
lame-ttl 0;\n"
#ifdef HAVE_LMDB
" lmdb-mapsize 32M;\n"
#endif /* ifdef HAVE_LMDB */

7
bin/named/server.c
View File

@ -4806,8 +4806,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
result = named_config_get(maps, "lame-ttl", &obj);
INSIST(result == ISC_R_SUCCESS);
lame_ttl = cfg_obj_asduration(obj);
if (lame_ttl > 1800) {
lame_ttl = 1800;
if (lame_ttl > 0) {
cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
"disabling lame cache despite lame-ttl > 0 as it "
"may cause performance issues");
lame_ttl = 0;
}
dns_resolver_setlamettl(view->resolver, lame_ttl);

6
doc/arm/reference.rst
View File

@ -3358,9 +3358,9 @@ Tuning
^^^^^^
``lame-ttl``
This sets the number of seconds to cache a lame server indication. 0
disables caching. (This is **NOT** recommended.) The default is
``600`` (10 minutes) and the maximum value is ``1800`` (30 minutes).
This is always set to 0. More information is available in the
`security advisory for CVE-2021-25219
<https://kb.isc.org/docs/cve-2021-25219>`_.
``servfail-ttl``
This sets the number of seconds to cache a SERVFAIL response due to DNSSEC