MSVSphere Packaging Team
6 months ago
parent
5cf3fd24e7
commit
575a579c62
@ -0,0 +1,65 @@
|
||||
From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
|
||||
From: Petr Mensik <pemensik@redhat.com>
|
||||
Date: Mon, 9 Oct 2023 19:00:12 +0200
|
||||
Subject: [PATCH] Do not keep stale records by default
|
||||
|
||||
By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
|
||||
were enabled by mistake when backporting fix for CVE-2023-2828. It
|
||||
causes increased cache usage on servers not wanting to serve stale
|
||||
records. Fix that by setting smart defaults based on stale answers
|
||||
enabled with possible manual tuning.
|
||||
---
|
||||
bin/named/server.c | 25 +++++++++++++++++++------
|
||||
1 file changed, 19 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||
index 7af90d0..afdc4fa 100644
|
||||
--- a/bin/named/server.c
|
||||
+++ b/bin/named/server.c
|
||||
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||
size_t max_acache_size;
|
||||
size_t max_adb_size;
|
||||
uint32_t lame_ttl, fail_ttl;
|
||||
- uint32_t max_stale_ttl;
|
||||
+ uint32_t max_stale_ttl = 0;
|
||||
dns_tsig_keyring_t *ring = NULL;
|
||||
dns_view_t *pview = NULL; /* Production view */
|
||||
isc_mem_t *cmctx = NULL, *hmctx = NULL;
|
||||
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||
if (view->maxncachettl > 7 * 24 * 3600)
|
||||
view->maxncachettl = 7 * 24 * 3600;
|
||||
|
||||
- obj = NULL;
|
||||
- result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||
- INSIST(result == ISC_R_SUCCESS);
|
||||
- max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
-
|
||||
obj = NULL;
|
||||
result = ns_config_get(maps, "stale-answer-enable", &obj);
|
||||
INSIST(result == ISC_R_SUCCESS);
|
||||
view->staleanswersenable = cfg_obj_asboolean(obj);
|
||||
|
||||
+ // RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
|
||||
+ obj = NULL;
|
||||
+ if (view->staleanswersenable) {
|
||||
+ result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||
+ INSIST(result == ISC_R_SUCCESS);
|
||||
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
+ /*
|
||||
+ * If 'stale-answer-enable' is false, max_stale_ttl is set
|
||||
+ * to 0, meaning keeping stale RRsets in cache is disabled.
|
||||
+ */
|
||||
+ } else {
|
||||
+ /* Do not use default value if stale is disabled,
|
||||
+ * but allow manual overriding, like 'stale-cache-enable' */
|
||||
+ result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
|
||||
+ if (result == ISC_R_SUCCESS)
|
||||
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||
+ }
|
||||
+
|
||||
result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
|
||||
view->rdclass, &pview);
|
||||
if (result == ISC_R_SUCCESS) {
|
||||
--
|
||||
2.41.0
|
||||
|
||||
@ -0,0 +1,31 @@
|
||||
From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Andrews <marka@isc.org>
|
||||
Date: Thu, 12 Oct 2023 10:19:38 +1100
|
||||
Subject: [PATCH] Update b.root-servers.net IP addresses
|
||||
|
||||
This covers both root hints and the default primaries for the root
|
||||
zone mirror. The official change date is Nov 27, 2023.
|
||||
|
||||
(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
|
||||
---
|
||||
lib/dns/rootns.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
|
||||
index 9653f3b..d6ff76e 100644
|
||||
--- a/lib/dns/rootns.c
|
||||
+++ b/lib/dns/rootns.c
|
||||
@@ -56,8 +56,8 @@ static char root_ns[] =
|
||||
". 518400 IN NS M.ROOT-SERVERS.NET.\n"
|
||||
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
|
||||
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
|
||||
-"B.ROOT-SERVERS.NET. 3600000 IN A 199.9.14.201\n"
|
||||
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
|
||||
+"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
|
||||
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
|
||||
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
|
||||
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
|
||||
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
|
||||
--
|
||||
2.43.0
|
||||
|
||||
Loading…
Reference in new issue