mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 22:45:39 +00:00
Code Issues Releases Wiki Activity

clarify slip doc

Browse Source 
3643.	[doc]		Clarify RRL "slip" documentation.
This commit is contained in:
Evan Hunt
2013-09-03 21:20:47 -07:00
parent 2634686b14
commit 2bae76022c
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
CHANGES
View File

@@ -1,3 +1,5 @@
3643. [doc] Clarify RRL "slip" documentation.
3642. [func] Allow externally generated DNSKEY to be imported 3642. [func] Allow externally generated DNSKEY to be imported
into the DNSKEY management framework. A new tool into the DNSKEY management framework. A new tool
dnssec-importkey is used to do this. [RT #34698] dnssec-importkey is used to do this. [RT #34698]

21
doc/arm/Bv9ARM-book.xml
View File

@@ -9818,13 +9818,30 @@ example.com CNAME rpz-tcp-only.
amplification, of "slipped" responses make them unattractive amplification, of "slipped" responses make them unattractive
for reflection DoS attacks. for reflection DoS attacks.
<command>slip</command> must be between 0 and 10. <command>slip</command> must be between 0 and 10.
A value of 0 does not "slip"; A value of 0 does not "slip":
no truncated responses are sent due to rate limiting. no truncated responses are sent due to rate limiting,
all responses are dropped.
A value of 1 causes every response to slip;
values between 2 and 10 cause every n'th response to slip.
Some error responses including REFUSED and SERVFAIL Some error responses including REFUSED and SERVFAIL
cannot be replaced with truncated responses and are instead cannot be replaced with truncated responses and are instead
leaked at the <command>slip</command> rate. leaked at the <command>slip</command> rate.
</para> </para>
<para>
(NOTE: Dropped responses from an authoritative server may
reduce the difficulty of a third party successfully forging
a response to a recursive resolver. The best security
against forged responses is for authoritative operators
to sign their zones using DNSSEC and for resolver operators
to validate the responses. When this is not an option,
operators who are more concerned with response integrity
than with flood mitigation may consider setting
<command>slip</command> to 1, causing all rate-limited
responses to be truncated rather than dropped. This reduces
the effectiveness of rate-limiting against reflection attacks.)
</para>
<para> <para>
When the approximate query per second rate exceeds When the approximate query per second rate exceeds
the <command>qps-scale</command> value, the <command>qps-scale</command> value,