random init for DNS cookies fails. The data is only random
generated if cookies are enabled, and the random data
is necessary. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
so the internal messaging stays correct. Also it does
not exit the server if stats pipe communication fails.
Thanks to Qifan Zhang, Palo Alto Networks, for the report.
socket is not left to cause a read event loop. It uses
slow-accept to delay accepting new connections, if
that fails it drops the new connections. When the tcp
connection usage is full, it waits for 50msec, to allow
existing queries to be resolved. Thanks to Qifan Zhang,
Palo Alto Networks, for the report.
limit auth-zone and rpz transfer amount and time taken.
Default is disabled. This hardens against unbounded
transfers. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
and it checks that an owner name does not collide with BADRR
on the input, and changes verbosity on the log of failure in
rrset to string. Thanks to Qifan Zhang, Palo Alto Networks,
for the report.
- Introduce new 'tls-protocols' configuration option that specifies
which of the supported TLS protocols will be used.
This change invalidates some previous changes:
- TLSv1.2 is again enabled by default, but can be selectively turned off if
desired (related to #1303).
- The biefly introduced (not yet released) 'tls-use-system-versions'
configuration option, that addressed #1346, is reverted in favor of
'tls-protocols'.
- The briefly introduced (not yet released) '--enable-system-tls'
configure option, related to #1401, is no longer needed with the new
option and the current default.
- Review comment for checking out of memory condition
Co-authored-by: Wouter Wijngaards <wcawijngaards@users.noreply.github.com>
an overly large number of RRSIGs. It can be configured with
`iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
Tsinghua University for the report.
the global cache after a failed lookup, such as timeouts. A failure
entry is stored in the subnet cache, for the query name, for a
couple of seconds. Queries can continue to use the subnet cache
during that time.
* - stats-shm-volley, with mesh_time_median the additions add up to the correct
average that is used.
* - stats-shm-volley, the stat interval is selected with offset.
* - stats-shm-volley, stat totals in separate struct. The first thread zeroes
it, and the last thread copies it.
* - stats-shm-volley, the array is inited for a new round if one or more
* - stats-shm-volley, the array is inited for a new round if one or more
threads are not responsive for stat collection.
* - stats-shm-volley review, typos and slightly more detailed text for comments.
---------
Co-authored-by: Yorgos Thessalonikefs <yorgos@nlnetlabs.nl>
and to check the RR rdata field lengths when decompressing and
inserting RRs from an authority zone transfer. This stops
large memory use and heap buffer-overflow read errors. Thanks
to Haruto Kimura (Stella) for the report.
We want to use crypto-policy provided configuration always in our
builds. Allow changing the default of tls-use-system-policy-versions at
build time by a simple configure parameter.
W.C.A. Wijngaards