ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Implement sig0key-checks-limit and sig0message-checks-limit

Browse Source 
Previously a hard-coded limitation of maximum two key or message
verification checks were introduced when checking the message's
SIG(0) signature. It was done in order to protect against possible
DoS attacks. The logic behind choosing the number two was that more
than one key should only be required only during key rotations, and
in that case two keys are enough. But later it became apparent that
there are other use cases too where even more keys are required, see
issue number #5050 in GitLab.

This change introduces two new configuration options for the views,
sig0key-checks-limit and sig0message-checks-limit, which define how
many keys are allowed to be checked to find a matching key, and how
many message verifications are allowed to take place once a matching
key has been found. The latter protects against expensive cryptographic
operations when there are keys with colliding tags and algorithm
numbers, with default being 2, and the former protects against a bit
less expensive key parsing operations and defaults to 16.
This commit is contained in:
Aram Sargsyan
2025-01-21 13:20:12 +00:00
committed by Arаm Sаrgsyаn
parent 742d379d88
commit 716b936045
8 changed files with 62 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
doc/misc/options
View File

@@ -279,6 +279,8 @@ options {
sig-validity-interval <integer> [ <integer> ]; // obsolete
sig0checks-quota <integer>; // experimental
sig0checks-quota-exempt { <address_match_element>; ... }; // experimental
sig0key-checks-limit <integer>;
sig0message-checks-limit <integer>;
stale-answer-client-timeout ( disabled | off | <integer> );
stale-answer-enable <boolean>;
stale-answer-ttl <duration>;
@@ -573,6 +575,8 @@ view <string> [ <class> ] {
sig-signing-signatures <integer>;
sig-signing-type <integer>;
sig-validity-interval <integer> [ <integer> ]; // obsolete
sig0key-checks-limit <integer>;
sig0message-checks-limit <integer>;
stale-answer-client-timeout ( disabled | off | <integer> );
stale-answer-enable <boolean>;
stale-answer-ttl <duration>;