]> git.ipfire.org Git - thirdparty/bind9.git/commit
Disable lame-ttl cache
authorOndřej Surý <ondrej@sury.org>
Fri, 24 Sep 2021 07:35:11 +0000 (09:35 +0200)
committerMichał Kępień <michal@isc.org>
Thu, 28 Oct 2021 10:05:58 +0000 (12:05 +0200)
commit011e9418ce9bb25675de6ac8d47536efedeeb312
tree51eba624939a9e4ae1e3b59c6f207b2847187fef
parent02940b71a39a5edf1e849f9f8d9bfca2e56daf8b
Disable lame-ttl cache

The lame-ttl cache is implemented in ADB as per-server locked
linked-list "indexed" with <qname,qtype>.  This list has to be walked
every time there's a new query or new record added into the lame cache.
Determined attacker can use this to degrade performance of the resolver.

Resolver testing has shown that disabling the lame cache has little
impact on the resolver performance and it's a minimal viable defense
against this kind of attack.
bin/named/config.c
bin/named/server.c
doc/arm/reference.rst