Disable lame-ttl cache

The lame-ttl cache is implemented in ADB as per-server locked
linked-list "indexed" with <qname,qtype>.  This list has to be walked
every time there's a new query or new record added into the lame cache.
Determined attacker can use this to degrade performance of the resolver.

Resolver testing has shown that disabling the lame cache has little
impact on the resolver performance and it's a minimal viable defense
against this kind of attack.

diff --git a/bin/named/config.c b/bin/named/config.c
index 13da0ad16bc8c943b7da1b74e2be925953bb6ec0..4a5d9b592b3348b8260671ca6d34a40420725dad 100644 (file)
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -160,7 +160,7 @@ options {\n\
        fetches-per-server 0;\n\
        fetches-per-zone 0;\n\
        glue-cache yes;\n\
-       lame-ttl 600;\n"
+       lame-ttl 0;\n"
 #ifdef HAVE_LMDB
                            "   lmdb-mapsize 32M;\n"
 #endif /* ifdef HAVE_LMDB */

diff --git a/bin/named/server.c b/bin/named/server.c
index da5eed45b65e9fe929a9d8eebd007da0fd733892..860ccae8a1ac00474c9d57e4733c60c744c45042 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -4759,8 +4759,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
        result = named_config_get(maps, "lame-ttl", &obj);
        INSIST(result == ISC_R_SUCCESS);
        lame_ttl = cfg_obj_asduration(obj);
-       if (lame_ttl > 1800) {
-               lame_ttl = 1800;
+       if (lame_ttl > 0) {
+               cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
+                           "disabling lame cache despite lame-ttl > 0 as it "
+                           "may cause performance issues");
+               lame_ttl = 0;
        }
        dns_resolver_setlamettl(view->resolver, lame_ttl);
 

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 9b58e0a6990eb1fb4b5a3605203c3a90e93281eb..a474b1e7148fec0a05c15ab3c4c6a23ec1362a91 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -3350,9 +3350,9 @@ Tuning
 ^^^^^^
 
 ``lame-ttl``
-   This sets the number of seconds to cache a lame server indication. 0
-   disables caching. (This is **NOT** recommended.) The default is
-   ``600`` (10 minutes) and the maximum value is ``1800`` (30 minutes).
+   This is always set to 0. More information is available in the
+   `security advisory for CVE-2021-25219
+   <https://kb.isc.org/docs/cve-2021-25219>`_.
 
 ``servfail-ttl``
    This sets the number of seconds to cache a SERVFAIL response due to DNSSEC