From 011e9418ce9bb25675de6ac8d47536efedeeb312 Mon Sep 17 00:00:00 2001
|
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
|
Date: Fri, 24 Sep 2021 09:35:11 +0200
|
Subject: [PATCH] Disable lame-ttl cache
|
|
The lame-ttl cache is implemented in ADB as per-server locked
|
linked-list "indexed" with <qname,qtype>. This list has to be walked
|
every time there's a new query or new record added into the lame cache.
|
Determined attacker can use this to degrade performance of the resolver.
|
|
Resolver testing has shown that disabling the lame cache has little
|
impact on the resolver performance and it's a minimal viable defense
|
against this kind of attack.
|
|
CVE: CVE-2021-25219
|
|
Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/8fe18c0566c41228a568157287f5a44f96d37662]
|
|
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
|
---
|
bin/named/config.c | 2 +-
|
bin/named/server.c | 7 +++++--
|
doc/arm/reference.rst | 6 +++---
|
3 files changed, 9 insertions(+), 6 deletions(-)
|
|
diff --git a/bin/named/config.c b/bin/named/config.c
|
index fa8473db7c..b6453b814e 100644
|
--- a/bin/named/config.c
|
+++ b/bin/named/config.c
|
@@ -151,7 +151,7 @@ options {\n\
|
fetches-per-server 0;\n\
|
fetches-per-zone 0;\n\
|
glue-cache yes;\n\
|
- lame-ttl 600;\n"
|
+ lame-ttl 0;\n"
|
#ifdef HAVE_LMDB
|
" lmdb-mapsize 32M;\n"
|
#endif /* ifdef HAVE_LMDB */
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
index 638703e8c2..35ad6a0b7f 100644
|
--- a/bin/named/server.c
|
+++ b/bin/named/server.c
|
@@ -4806,8 +4806,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
|
result = named_config_get(maps, "lame-ttl", &obj);
|
INSIST(result == ISC_R_SUCCESS);
|
lame_ttl = cfg_obj_asduration(obj);
|
- if (lame_ttl > 1800) {
|
- lame_ttl = 1800;
|
+ if (lame_ttl > 0) {
|
+ cfg_obj_log(obj, named_g_lctx, ISC_LOG_WARNING,
|
+ "disabling lame cache despite lame-ttl > 0 as it "
|
+ "may cause performance issues");
|
+ lame_ttl = 0;
|
}
|
dns_resolver_setlamettl(view->resolver, lame_ttl);
|
|
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
|
index 3bc4439745..fea854f3d1 100644
|
--- a/doc/arm/reference.rst
|
+++ b/doc/arm/reference.rst
|
@@ -3358,9 +3358,9 @@ Tuning
|
^^^^^^
|
|
``lame-ttl``
|
- This sets the number of seconds to cache a lame server indication. 0
|
- disables caching. (This is **NOT** recommended.) The default is
|
- ``600`` (10 minutes) and the maximum value is ``1800`` (30 minutes).
|
+ This is always set to 0. More information is available in the
|
+ `security advisory for CVE-2021-25219
|
+ <https://kb.isc.org/docs/cve-2021-25219>`_.
|
|
``servfail-ttl``
|
This sets the number of seconds to cache a SERVFAIL response due to DNSSEC
|
--
|
2.17.1
|
