- Fix #1263: Exempt loopback addresses from wait-limit.

diff --git a/doc/Changelog b/doc/Changelog
index 167a2ce42500e3990c43b441afa703a5c11182b3..80b6d24040778e8da4bbda44474c423d05bc9646 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+3 April 2025: Wouter
+       - Fix #1263: Exempt loopback addresses from wait-limit.
+
 2 April 2025: Yorgos
        - Merge #1262 from markyang92, fix build with
          'gcc-15 -Wbuiltin-declaration-mismatch' error in compat/malloc.c.

diff --git a/doc/example.conf.in b/doc/example.conf.in
index de73d00441eb8a515b3f5b4d5174fe9ea02f5788..7aa7bfa6c65d6d086b1c9494bf475d8a9d508aea 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -215,6 +215,12 @@ server:
        # Apart from the default, the wait limit with cookie can be adjusted.
        # wait-limit-cookie-netblock: 192.0.2.0/24 50000
 
+       # Defaults for loopback, it has no wait limit.
+       # wait-limit-netblock: 127.0.0.0/8 -1
+       # wait-limit-netblock: ::1/128 -1
+       # wait-limit-cookie-netblock: 127.0.0.0/8 -1
+       # wait-limit-cookie-netblock: ::1/128 -1
+
        # the amount of memory to use for the RRset cache.
        # plain value in bytes or you can append k, m or G. default is "4Mb".
        # rrset-cache-size: 4m

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 2e8c87e4043673f6536b1a2fc68b566069d9b8c9..1c0e26ce51c7b3a71a206ce9af540d7b92209936 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -326,11 +326,15 @@ The wait limit for the netblock. If not given the wait\-limit value is
 used. The most specific netblock is used to determine the limit. Useful for
 overriding the default for a specific, group or individual, server.
 The value -1 disables wait limits for the netblock.
+By default the loopback has a wait limit netblock of -1, it is not limited,
+because it is separated from the rest of network for spoofed packets.
+The loopback addresses 127.0.0.0/8 and ::1/128 are default at -1.
 .TP
 .B wait\-limit\-cookie\-netblock: \fI<netblock> <number>
 The wait limit for the netblock, when the query has a DNS cookie.
 If not given, the wait\-limit\-cookie value is used.
 The value -1 disables wait limits for the netblock.
+The loopback addresses 127.0.0.0/8 and ::1/128 are default at -1.
 .TP
 .B so\-rcvbuf: \fI<number>
 If not 0, then set the SO_RCVBUF socket option to get more buffer

diff --git a/services/cache/infra.c b/services/cache/infra.c
index 9c3e4de4382e289d5bb34b21e6b8b26ab6414909..cf999422d0028847014998905fd5fb752c56f5de 100644 (file)
--- a/services/cache/infra.c
+++ b/services/cache/infra.c
@@ -297,12 +297,43 @@ infra_wait_limit_netblock_insert(rbtree_type* wait_limits_netblock,
        return 1;
 }
 
+/** Add a default wait limit netblock */
+static int
+wait_limit_netblock_default(struct rbtree_type* tree, char* str, int limit)
+{
+       struct wait_limit_netblock_info* d;
+       d = wait_limit_netblock_findcreate(tree, str);
+       if(!d)
+               return 0;
+       d->limit = limit;
+       return 1;
+}
+
 int
 setup_wait_limits(rbtree_type* wait_limits_netblock,
        rbtree_type* wait_limits_cookie_netblock, struct config_file* cfg)
 {
        addr_tree_init(wait_limits_netblock);
        addr_tree_init(wait_limits_cookie_netblock);
+
+       /* Insert defaults */
+       /* The loopback address is separated from the rest of the network. */
+       /* wait-limit-netblock: 127.0.0.0/8 -1 */
+       if(!wait_limit_netblock_default(wait_limits_netblock, "127.0.0.0/8",
+               -1))
+               return 0;
+       /* wait-limit-netblock: ::1/128 -1 */
+       if(!wait_limit_netblock_default(wait_limits_netblock, "::1/128", -1))
+               return 0;
+       /* wait-limit-cookie-netblock: 127.0.0.0/8 -1 */
+       if(!wait_limit_netblock_default(wait_limits_cookie_netblock,
+               "127.0.0.0/8", -1))
+               return 0;
+       /* wait-limit-cookie-netblock: ::1/128 -1 */
+       if(!wait_limit_netblock_default(wait_limits_cookie_netblock,
+               "::1/128", -1))
+               return 0;
+
        if(!infra_wait_limit_netblock_insert(wait_limits_netblock,
                wait_limits_cookie_netblock, cfg))
                return 0;