]> git.ipfire.org Git - thirdparty/bind9.git/commit
fix: usr: Separate DNSSEC validation from the long-running tasks
authorOndřej Surý <ondrej@isc.org>
Thu, 12 Sep 2024 14:35:08 +0000 (14:35 +0000)
committerOndřej Surý <ondrej@isc.org>
Thu, 12 Sep 2024 14:35:08 +0000 (14:35 +0000)
commit23b2ce56e5d907faf4d02b59e507a752d6e52f8b
treeb22fbf43397de1e72c5be020a2742a6840ca2b15
parent91bc0b439ad00a44deb26588d32cae734ba9ed81
parent8a96a3af6a36c0e1b324fe5a026f26ab4f12700b
fix: usr: Separate DNSSEC validation from the long-running tasks

As part of the KeyTrap \[CVE-2023-50387\] mitigation, the DNSSEC CPU-intensive operations were offloaded to a separate threadpool that we use to run other tasks that could affect the networking latency.

If that threadpool is running some long-running tasks like RPZ, catalog zone processing, or zone file operations, it would delay DNSSEC validations to a point where the resolving signed DNS records would fail.

Split the CPU-intensive and long-running tasks into separate threadpools in a way that the long-running tasks don't block the CPU-intensive operations.

Closes #4898

Merge branch '4898-move-offloaded-DNSSEC-to-own-threads' into 'main'

See merge request isc-projects/bind9!9473