From d8abf4f5b6e36f2feea608b509371f492aadc678 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 24 Oct 2019 12:41:28 +1100 Subject: [PATCH 1/6] arm: add default values for require-server-cookie and send-cookie options --- doc/arm/Bv9ARM-book.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 048a415339..32fd0991f1 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -6009,6 +6009,7 @@ options { response to a UDP request from a cookie aware client. BADCOOKIE is sent if there is a bad or no existent server cookie. + The default is no. @@ -6057,6 +6058,7 @@ options { do not send a correct COOKIE option may be limited to receiving smaller responses via the nocookie-udp-size option. + The default is yes. From 1ea6aadf6fe2c5047431546ea424f964e03ea121 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Thu, 24 Oct 2019 12:58:19 +1100 Subject: [PATCH 2/6] arm: document resolver-nonbackoff-tries and resolver-retry-interval --- doc/arm/Bv9ARM-book.xml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 32fd0991f1..3051411d74 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -8802,6 +8802,26 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; + + resolver-nonbackoff-tries + + + Specifies how many retries occur before exponential + backoff kicks in. The default is 3. + + + + + + resolver-retry-interval + + + The base retry interval in milliseconds. + The default is 800. + + + + sig-validity-interval From c5453ea3283d4326116955a24cc0cd18397a5ebb Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 25 Oct 2019 10:06:56 +1100 Subject: [PATCH 3/6] arm: add why when to set 'require-server-cookie yes;' --- doc/arm/Bv9ARM-book.xml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 3051411d74..c6f6ec1835 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -6011,6 +6011,12 @@ options { server cookie. The default is no. + + Set this to yes to test that DNS + COOKIE clients correctly handle BADCOOKIE or if you are + getting a lot of forged DNS requests with DNS COOKIES + present. + From c6f91f8bd0edb9be84995cda9392ee475c5cd925 Mon Sep 17 00:00:00 2001 From: Brian Conry Date: Wed, 30 Oct 2019 14:16:04 -0500 Subject: [PATCH 4/6] arm: Add an explanation on the effect of 'require-server-cookie yes;' --- doc/arm/Bv9ARM-book.xml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index c6f6ec1835..dc7c11e2db 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -6015,7 +6015,11 @@ options { Set this to yes to test that DNS COOKIE clients correctly handle BADCOOKIE or if you are getting a lot of forged DNS requests with DNS COOKIES - present. + present. Setting this to yes will + result in reduced amplification effect in a reflection + attack, as the BADCOOKIE response will be smaller than + a full response, while also requiring a legitimate client + to follow up with a second query with the new, valid, cookie. From f7eea400a8f1ae8b7112c0a79bf29a681cb1adc8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Wed, 30 Oct 2019 14:22:41 -0500 Subject: [PATCH 5/6] arm: Fix the default for the lock-file command, it's 'none' --- doc/arm/Bv9ARM-book.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index dc7c11e2db..e9d4e280c9 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -4790,7 +4790,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] the first time; if unsuccessful, the server will will terminate, under the assumption that another server is already running. If not specified, the default is - /var/run/named/named.lock. + none. Specifying lock-file none disables the From e0618174b6b84e8c82b9d50ff1ffa89d3277e3c0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Wed, 30 Oct 2019 14:38:17 -0500 Subject: [PATCH 6/6] arm: add more text describing interaction between automatic-interface-scan and interface-interval --- doc/arm/Bv9ARM-book.xml | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index e9d4e280c9..6be700c820 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -5441,15 +5441,21 @@ options { automatic-interface-scan - If yes and supported by the OS, - automatically rescan network interfaces when the interface - addresses are added or removed. The default is - yes. + If yes and supported by the operating + system, automatically rescan network interfaces when the + interface addresses are added or removed. The default is + yes. This configuration option does + not affect time based interface-interval + option, and it is recommended to set the time based + interface-interval to 0 when the operator + confirms that automatic interface scanning is supported by the + operating system. - Currently the OS needs to support routing sockets for - automatic-interface-scan to be - supported. + The automatic-interface-scan implementation + uses routing sockets for the network interface discovery, + and therefore the operating system has to support the routing + sockets for this feature to work. @@ -8443,10 +8449,11 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; minutes. The default is 60 minutes. The maximum value is 28 days (40320 minutes). If set to 0, interface scanning will only occur when - the configuration file is loaded. After the scan, the - server will - begin listening for queries on any newly discovered - interfaces (provided they are allowed by the + the configuration file is loaded, or when + automatic-interface-scan is enabled + and supported by the operating system. After the scan, the + server will begin listening for queries on any newly + discovered interfaces (provided they are allowed by the listen-on configuration), and will stop listening on interfaces that have gone away. For convenience, TTL-style time unit suffixes may be