From b97004be30ecf69cc4e26bd72212f6259e05f4c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 28 Oct 2019 15:04:38 -0500 Subject: [PATCH 1/4] Disable NSEC Aggressive Cache (synth-from-dnssec) by default It was found that NSEC Aggressive Caching has a significant performance impact on BIND 9 when used as recursor. This commit disables the synth-from-dnssec configuration option by default to provide immediate remedy for people running BIND 9.12+. The NSEC Aggressive Cache will be enabled again after a proper fix will be prepared. (cherry picked from commit a20c42dca68737ca341bd24fff403cf5c7940aa1) --- bin/named/config.c | 2 +- doc/arm/Bv9ARM-book.xml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/bin/named/config.c b/bin/named/config.c index 706d4181d8..55b1e2dded 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -197,7 +197,7 @@ options {\n\ # sortlist \n\ stale-answer-enable false;\n\ stale-answer-ttl 1; /* 1 second */\n\ - synth-from-dnssec yes;\n\ + synth-from-dnssec no;\n\ # topology \n\ transfer-format many-answers;\n\ v6-bias 50;\n\ diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 1009d20354..46b96ad4b7 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -6812,7 +6812,9 @@ options { Synthesize answers from cached NSEC, NSEC3 and other RRsets that have been proved to be correct - using DNSSEC. The default is yes. + using DNSSEC. The default is no, + but it will become yes again + in the future releases. Note: From 56b6d8c6a77986fba79e15762528d91c3ffa5a48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 28 Oct 2019 17:53:37 -0500 Subject: [PATCH 2/4] Adjust synthfromdnssec system test to the changed defaults (cherry picked from commit 800d7843af8ee7dc0a5c4ac729762458ed310eb5) --- bin/tests/system/synthfromdnssec/tests.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bin/tests/system/synthfromdnssec/tests.sh b/bin/tests/system/synthfromdnssec/tests.sh index 1fa233f148..1d18d612e7 100644 --- a/bin/tests/system/synthfromdnssec/tests.sh +++ b/bin/tests/system/synthfromdnssec/tests.sh @@ -93,7 +93,7 @@ sleep 1 for ns in 2 4 5 do case $ns in - 2) synth=yes description="";; + 2) synth=no description="";; 4) synth=no description="no";; 5) synth=yes description="yes";; *) exit 1;; @@ -171,7 +171,7 @@ ret=0 dig_with_opts b.redirect. @10.53.0.3 a > dig.out.ns2.test$n || ret=1 grep "flags:[^;]* ad[ ;]" dig.out.ns2.test$n > /dev/null || ret=1 grep "status: NXDOMAIN," dig.out.ns2.test$n > /dev/null || ret=1 -grep "\..*3600.IN.SOA" dig.out.ns2.test$n > /dev/null && ret=1 +grep "\..*3600.IN.SOA" dig.out.ns2.test$n > /dev/null || ret=1 n=$((n+1)) if [ $ret != 0 ]; then echo_i "failed"; fi status=$((status+ret)) From 5eeaeb486f09eb3e2780604299def2f5262faf6a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 28 Oct 2019 15:07:43 -0500 Subject: [PATCH 3/4] Add release notes. (cherry picked from commit fce5a01a63f4bdcb65e9f8786702b5ae66a6d4d7) --- doc/arm/notes-feature-changes.xml | 23 +++++++++++++++++++++++ doc/arm/notes.xml | 1 + util/copyrights | 1 + 3 files changed, 25 insertions(+) create mode 100644 doc/arm/notes-feature-changes.xml diff --git a/doc/arm/notes-feature-changes.xml b/doc/arm/notes-feature-changes.xml new file mode 100644 index 0000000000..a84c27e498 --- /dev/null +++ b/doc/arm/notes-feature-changes.xml @@ -0,0 +1,23 @@ + + +
Feature Changes + + + + NSEC Aggressive Cache (synth-from-dnssec) has been disabled by default + because it was found to have a significant performance impact on the + recursive service. The NSEC Aggressive Cache will be enable by default + in the future releases. [GL #1265] + + + +
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 066002f9c5..ad151a9542 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -25,6 +25,7 @@ + diff --git a/util/copyrights b/util/copyrights index 115db94068..ea15d322b7 100644 --- a/util/copyrights +++ b/util/copyrights @@ -1525,6 +1525,7 @@ ./doc/arm/notes-bug-fixes.xml SGML 2019 ./doc/arm/notes-download.xml SGML 2019 ./doc/arm/notes-eol.xml SGML 2019 +./doc/arm/notes-feature-changes.xml SGML 2019 ./doc/arm/notes-intro.xml SGML 2019 ./doc/arm/notes-license.xml SGML 2019 ./doc/arm/notes-new-features.xml SGML 2019 From 41611a9bd9a89c7669e4cc22c2bba5690ee08e40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Mon, 28 Oct 2019 15:09:01 -0500 Subject: [PATCH 4/4] Add CHANGES note (cherry picked from commit 4a778cfa455a466fae5bb77d48c871b1b8b57c28) --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index a76cb358d2..7b91136a0d 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,8 @@ +5305. [bug] NSEC Aggressive Cache ("synth-from-dnssec") has been + disabled by default because it was found to have + a significant performance impact on the recursive + service. [GL #1265] + 5304. [bug] "dnskey-sig-validity 0;" was not being accepted. [GL #876]