MSVSphere Packaging Team
6 months ago
parent
5cf3fd24e7
commit
575a579c62
@ -0,0 +1,65 @@
|
|||||||
|
From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Mensik <pemensik@redhat.com>
|
||||||
|
Date: Mon, 9 Oct 2023 19:00:12 +0200
|
||||||
|
Subject: [PATCH] Do not keep stale records by default
|
||||||
|
|
||||||
|
By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
|
||||||
|
were enabled by mistake when backporting fix for CVE-2023-2828. It
|
||||||
|
causes increased cache usage on servers not wanting to serve stale
|
||||||
|
records. Fix that by setting smart defaults based on stale answers
|
||||||
|
enabled with possible manual tuning.
|
||||||
|
---
|
||||||
|
bin/named/server.c | 25 +++++++++++++++++++------
|
||||||
|
1 file changed, 19 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index 7af90d0..afdc4fa 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||||
|
size_t max_acache_size;
|
||||||
|
size_t max_adb_size;
|
||||||
|
uint32_t lame_ttl, fail_ttl;
|
||||||
|
- uint32_t max_stale_ttl;
|
||||||
|
+ uint32_t max_stale_ttl = 0;
|
||||||
|
dns_tsig_keyring_t *ring = NULL;
|
||||||
|
dns_view_t *pview = NULL; /* Production view */
|
||||||
|
isc_mem_t *cmctx = NULL, *hmctx = NULL;
|
||||||
|
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||||
|
if (view->maxncachettl > 7 * 24 * 3600)
|
||||||
|
view->maxncachettl = 7 * 24 * 3600;
|
||||||
|
|
||||||
|
- obj = NULL;
|
||||||
|
- result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||||
|
- INSIST(result == ISC_R_SUCCESS);
|
||||||
|
- max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
-
|
||||||
|
obj = NULL;
|
||||||
|
result = ns_config_get(maps, "stale-answer-enable", &obj);
|
||||||
|
INSIST(result == ISC_R_SUCCESS);
|
||||||
|
view->staleanswersenable = cfg_obj_asboolean(obj);
|
||||||
|
|
||||||
|
+ // RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
|
||||||
|
+ obj = NULL;
|
||||||
|
+ if (view->staleanswersenable) {
|
||||||
|
+ result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||||
|
+ INSIST(result == ISC_R_SUCCESS);
|
||||||
|
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
+ /*
|
||||||
|
+ * If 'stale-answer-enable' is false, max_stale_ttl is set
|
||||||
|
+ * to 0, meaning keeping stale RRsets in cache is disabled.
|
||||||
|
+ */
|
||||||
|
+ } else {
|
||||||
|
+ /* Do not use default value if stale is disabled,
|
||||||
|
+ * but allow manual overriding, like 'stale-cache-enable' */
|
||||||
|
+ result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
|
||||||
|
+ if (result == ISC_R_SUCCESS)
|
||||||
|
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
|
||||||
|
view->rdclass, &pview);
|
||||||
|
if (result == ISC_R_SUCCESS) {
|
||||||
|
--
|
||||||
|
2.41.0
|
||||||
|
|
||||||
@ -0,0 +1,31 @@
|
|||||||
|
From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Mark Andrews <marka@isc.org>
|
||||||
|
Date: Thu, 12 Oct 2023 10:19:38 +1100
|
||||||
|
Subject: [PATCH] Update b.root-servers.net IP addresses
|
||||||
|
|
||||||
|
This covers both root hints and the default primaries for the root
|
||||||
|
zone mirror. The official change date is Nov 27, 2023.
|
||||||
|
|
||||||
|
(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
|
||||||
|
---
|
||||||
|
lib/dns/rootns.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
|
||||||
|
index 9653f3b..d6ff76e 100644
|
||||||
|
--- a/lib/dns/rootns.c
|
||||||
|
+++ b/lib/dns/rootns.c
|
||||||
|
@@ -56,8 +56,8 @@ static char root_ns[] =
|
||||||
|
". 518400 IN NS M.ROOT-SERVERS.NET.\n"
|
||||||
|
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
|
||||||
|
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
|
||||||
|
-"B.ROOT-SERVERS.NET. 3600000 IN A 199.9.14.201\n"
|
||||||
|
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
|
||||||
|
+"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
|
||||||
|
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
|
||||||
|
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
|
||||||
|
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
|
||||||
|
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
||||||
Loading…
Reference in new issue