upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 03:40:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix tcp-highwater initial value

Browse source 
During BIND startup it scans for network interfaces available, in this
process it ensures that for every interface it will bind and listen to,
at least one socket will be always available accepting connections on
that interface, this way avoiding some DOS attacks that could exploit
tcp quota on some interface and make others unavailable.

In the previous network implementation this initial "reserved" tcp-quota
used by BIND was already been added to the tcp-highwater stats, but with
the new network code it was necesary to add this workaround to ensure
tcp-highwater stats reflect the tcp-quota used by BIND after startup.
This commit is contained in:
Diego Fronza 2019-11-22 18:34:50 -03:00 committed by Evan Hunt
parent 74082abba0
commit ead7b3dc53
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
lib/ns/interfacemgr.c
View file

@ -28,6 +28,7 @@
#include <ns/log.h>
#include <ns/interfacemgr.h>
#include <ns/server.h>
#include <ns/stats.h>
#ifdef HAVE_NET_ROUTE_H
#include <net/route.h>
@ -458,6 +459,7 @@ ns_interface_listenudp(ns_interface_t *ifp) {
static isc_result_t
ns_interface_listentcp(ns_interface_t *ifp) {
unsigned int tcpquota;
isc_result_t result;
result = isc_nm_listentcpdns(ifp->mgr->nm,
@ -473,6 +475,16 @@ ns_interface_listentcp(ns_interface_t *ifp) {
isc_result_totext(result));
}
/*
* We update tcp-highwater stats here, since named itself adds to
* the TCP quota when starting, as it ensures that at least one
* client will be created for every interface it is listening to.
*/
tcpquota = isc_quota_getused(&ifp->mgr->sctx->tcpquota);
ns_stats_update_if_greater(ifp->mgr->sctx->nsstats,
ns_statscounter_tcphighwater,
tcpquota);
#if 0
#ifndef ISC_ALLOW_MAPPED
isc_socket_ipv6only(ifp->tcpsocket, true);