upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-02-27 03:51:16 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/lib/dns
History
Aram Sargsyan 3ad0f165ab Fix RRL responses-per-second bypass using wildcard names 
It is possible to bypass Response Rate Limiting (RRL)
`responses-per-second` limitation using specially crafted wildcard
names, because the current implementation, when encountering a found
DNS name generated from a wildcard record, just strips the leftmost
label of the name before making a key for the bucket.

While that technique helps with limiting random requests like
<random>.example.com (because all those requests will be accounted
as belonging to a bucket constructed from "example.com" name), it does
not help with random names like subdomain.<random>.example.com.

The best solution would have been to strip not just the leftmost
label, but as many labels as necessary until reaching the suffix part
of the wildcard record from which the found name is generated, however,
we do not have that information readily available in the context of RRL
processing code.

Fix the issue by interpreting all valid wildcard domain names as
the zone's origin name concatenated to the "*" name, so they all will
be put into the same bucket.

(cherry picked from commit baa9698c9d)
2022-09-08 09:41:15 +02:00
..
include Fix RRL responses-per-second bypass using wildcard names 2022-09-08 09:41:15 +02:00
rdata Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
tests Update clang to version 14 2022-06-16 18:11:03 +02:00
win32 Add new functions to lib/dns/win32/libdns.def.in 2022-05-16 18:31:55 +02:00
.gitignore 4394. [func] Add rndc command "dnstap-reopen" to close and 2016-06-24 09:37:04 +10:00
acl.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
adb.c Lock the address entry bucket when dumping ADB namehook 2022-08-12 17:17:43 -07:00
badcache.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
byaddr.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
cache.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
callbacks.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
catz.c Do not cancel processing record datasets in catalog zone after an error 2022-06-07 09:59:32 +00:00
client.c Consistenly use UNREACHABLE() instead of ISC_UNREACHABLE() 2022-03-28 23:28:05 +02:00
clientinfo.c allow dns_clientinfo to store client ECS data 2022-01-27 16:08:57 -08:00
compress.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
db.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
dbiterator.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dbtable.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
diff.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
dispatch.c Consistenly use UNREACHABLE() instead of ISC_UNREACHABLE() 2022-03-28 23:28:05 +02:00
dlz.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
dns64.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dnsrps.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
dnssec.c Update dns_dnssec_syncdelete() function 2022-04-13 15:13:12 +02:00
dnstap.c dnstap query_message field was erroneously set with responses 2022-08-31 15:49:25 -07:00
dnstap.proto Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
ds.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
dst_api.c Require valid key for dst_key functions 2022-05-23 12:31:23 +02:00
dst_internal.h Check if key metadata is modified before writing 2022-05-16 10:35:33 +02:00
dst_openssl.h Use autoconf check for BN_GENCB_new() 2022-03-02 09:34:29 +00:00
dst_parse.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dst_parse.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dst_pkcs11.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dst_result.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
dyndb.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
ecdb.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
ecs.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
fixedname.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
forward.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
gen-unix.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
gen-win32.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
gen.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
geoip2.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
gssapi_link.c Remove a redundant variable-length array 2022-03-18 17:21:57 +00:00
gssapictx.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
hmac_link.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
ipkeylist.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
iptable.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
journal.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
kasp.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
key.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
keydata.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
keymgr.c Check if key metadata is modified before writing 2022-05-16 10:35:33 +02:00
keytable.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
Kyuafile Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
lib.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
log.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
lookup.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
Makefile.in Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
mapapi increase MAPAPI 2021-08-28 07:45:39 -07:00
master.c Tighten $GENERATE directive parsing 2022-07-06 11:26:24 +10:00
masterdump.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
message.c Add missing INDENT call for UPDATE messages 2022-06-02 08:29:28 +10:00
name.c Remove workaround for ancient clang versions (<< 3.2 and << 4.0.1) 2022-03-25 09:37:22 +01:00
ncache.c Update the rdataset->trust field in ncache.c:rdataset_settrust 2022-04-19 09:45:16 +10:00
nsec.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
nsec3.c nsec3.c: Add a missing dns_db_detachnode() call 2022-08-23 12:05:38 +02:00
nta.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
openssl_link.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
openssldh_link.c Use autoconf check for BN_GENCB_new() 2022-03-02 09:34:29 +00:00
opensslecdsa_link.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
openssleddsa_link.c Add couple missing braces around single-line statements 2022-03-17 18:31:36 +01:00
opensslrsa_link.c Check that we can verify a signature at initialisation time 2022-07-25 11:37:49 -04:00
order.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
peer.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
pkcs11.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
pkcs11ecdsa_link.c Consistenly use UNREACHABLE() instead of ISC_UNREACHABLE() 2022-03-28 23:28:05 +02:00
pkcs11eddsa_link.c Consistenly use UNREACHABLE() instead of ISC_UNREACHABLE() 2022-03-28 23:28:05 +02:00
pkcs11rsa_link.c Consistenly use UNREACHABLE() instead of ISC_UNREACHABLE() 2022-03-28 23:28:05 +02:00
portlist.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
private.c Increase the BUFSIZ-long buffers 2022-07-15 21:21:03 +02:00
rbt.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
rbtdb.c Fix rndc dumpdb -expired for stuck cache contents 2022-07-26 10:02:15 +02:00
rbtdb.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rcode.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rdata.c Additional safety check for negative array index 2022-04-29 11:46:33 +10:00
rdatalist.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rdatalist_p.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rdataset.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
rdatasetiter.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rdataslab.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
request.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
resolver.c Improve fetch limit logging 2022-08-01 14:01:26 +00:00
result.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rootns.c Add FALLTHROUGH macro for __attribute__((fallthrough)) 2022-03-25 09:30:16 +01:00
rpz.c Allow DNS_RPZ_POLICY_ERROR to be converted to a string 2022-05-04 23:53:21 +10:00
rriterator.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
rrl.c Fix RRL responses-per-second bypass using wildcard names 2022-09-08 09:41:15 +02:00
sdb.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
sdlz.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
soa.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
ssu.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
ssu_external.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
stats.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
tcpmsg.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
time.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
timer.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
tkey.c Fix tkey.c:buildquery() function's error handling 2022-08-17 08:46:31 +00:00
tsec.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
tsig.c Remove workaround for ancient clang versions (<< 3.2 and << 4.0.1) 2022-03-25 09:37:22 +01:00
tsig_p.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
ttl.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
update.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
validator.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
version.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
view.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
xfrin.c Simplify way we tag unreachable code with only ISC_UNREACHABLE() 2022-03-25 09:33:51 +01:00
zone.c make the fix more complete 2022-06-14 12:07:39 +10:00
zone_p.h Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
zonekey.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00
zoneverify.c Remove use of the inline keyword used as suggestion to compiler 2022-03-25 09:37:18 +01:00
zt.c Update the copyright information in all files in the repository 2022-01-11 12:22:09 +01:00