ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add a quota for SIG(0) signature checks

Browse Source 
In order to protect from a malicious DNS client that sends many
queries with a SIG(0)-signed message, add a quota of simultaneously
running SIG(0) checks.

This protection can only help when named is using more than one worker
threads. For example, if named is running with the '-n 4' option, and
'sig0checks-quota 2;' is used, then named will make sure to not use
more than 2 workers for the SIG(0) signature checks in parallel, thus
leaving the other workers to serve the remaining clients which do not
use SIG(0)-signed messages.

That limitation is going to change when SIG(0) signature checks are
offloaded to "slow" threads in a future commit.

The 'sig0checks-quota-exempt' ACL option can be used to exempt certain
clients from the quota requirements using their IP or network addresses.

The 'sig0checks-quota-maxwait-ms' option is used to define a maximum
amount of time for named to wait for a quota to appear. If during that
time no new quota becomes available, named will answer to the client
with DNS_R_REFUSED.
This commit is contained in:
Aram Sargsyan
2024-03-25 11:07:47 +00:00
committed by Nicki Křížek
parent 24e8cc7b38
commit c7f79a0353
13 changed files with 339 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tests/libtest/ns.c
View File

@@ -57,12 +57,13 @@ ns_server_t *sctx = NULL;
static isc_result_t
matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
dns_view_t **viewp) {
dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
isc_result_t *sigresultp, dns_view_t **viewp) {
UNUSED(srcaddr);
UNUSED(destaddr);
UNUSED(message);
UNUSED(env);
UNUSED(lsctx);
UNUSED(sigresultp);
UNUSED(viewp);