]> git.ipfire.org Git - thirdparty/bind9.git/commit
[9.20] fix: usr: Prevent crafted queries from degrading RRL performance
authorOndřej Surý <ondrej@isc.org>
Tue, 5 May 2026 05:07:28 +0000 (07:07 +0200)
committerOndřej Surý <ondrej@isc.org>
Tue, 5 May 2026 05:07:28 +0000 (07:07 +0200)
commitbf4cdca7e92b46af9f263a539abc4e9418efa83c
treefefdfbf00b743707f47b896753a07ee7c5d6a884
parent93cfd196db094ac94481b411abd7b29c1a60747f
parent0f821104e0a7fddaa3f79eaf01f0dbd456edf295
[9.20] fix: usr: Prevent crafted queries from degrading RRL performance

With response rate limiting enabled, an attacker sending queries from many
spoofed source addresses could steer entries into the same slot of the
internal rate-limit table and slow down query processing on the affected
server. The table now uses a per-process keyed hash so the placement of
entries cannot be predicted or influenced from the network.

Closes #5906

Backport of MR !11950

Merge branch 'backport-5906-rrl-hash-collision-dos-9.20' into 'bind-9.20'

See merge request isc-projects/bind9!11952