]> git.ipfire.org Git - thirdparty/bind9.git/commit
Disable lame-ttl cache
authorOndřej Surý <ondrej@sury.org>
Fri, 24 Sep 2021 07:35:11 +0000 (09:35 +0200)
committerMichał Kępień <michal@isc.org>
Mon, 11 Oct 2021 11:23:25 +0000 (13:23 +0200)
commit201f887065e34949fc9f72d5d41ae293cd299800
tree2936e5678f1ceff4b57088a846b9ee3a7fc7b2bd
parentab1bef0dfe0ca266890a4452edc5eaffecb4d075
Disable lame-ttl cache

The lame-ttl cache is implemented in ADB as per-server locked
linked-list "indexed" with <qname,qtype>.  This list has to be walked
every time there's a new query or new record added into the lame cache.
Determined attacker can use this to degrade performance of the resolver.

Resolver testing has shown that disabling the lame cache has little
impact on the resolver performance and it's a minimal viable defense
against this kind of attack.
bin/named/config.c
bin/named/server.c
doc/arm/Bv9ARM-book.xml