upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-21 17:41:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4
bind9/lib/isc
History
Ondřej Surý 11bca1051f
Switch UDP fetches to TCP on the first response with a wrong query id 
Until now, the dispatcher silently dropped UDP responses from the
expected peer that carried the wrong DNS message id and kept listening
for the correct id to arrive within the read timeout.  An off-path
attacker who knows the destination address and source port of an
outgoing fetch could exploit that quiet retry window to flood the
resolver with guessed responses; with a gigabit link the per-query
success probability grows linearly with the number of guesses that
arrive before the legitimate answer or the timeout.

Treat any such mismatch as a possible spoofing attempt and let the
resolver immediately retry the same query over TCP, the same control
path the truncation handler already uses.

Add a resolver statistics counter - exposed as 'queries retried over TCP
after a response with mismatched query id' in rndc stats and
'MismatchTCP' in the statistics channel

Assisted-by: Claude:claude-opus-4-7
2026-05-14 15:56:18 +02:00
..
crypto Remove OpenSSL memory tracking support from the ossl3.c module 2026-04-28 14:42:40 +00:00
include Switch UDP fetches to TCP on the first response with a wrong query id 2026-05-14 15:56:18 +02:00
netmgr Fix isc_buffer_init capacity mismatch in DoH data chunk callback 2026-03-18 11:39:01 +01:00
ossl_wrap don't set named curves explicitly in pre-3.0 libcrypto 2026-04-28 09:28:18 +03:00
.gitignore Add support for User Statically Defined Tracing (USDT) probes 2023-08-21 18:39:53 +02:00
ascii.c Consolidate some ASCII tables in isc/ascii and isc/hex 2022-09-12 12:18:57 +01:00
assertions.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
async.c Remove unused isc_mutexblock and isc_condition units 2025-03-01 07:33:09 +01:00
async_p.h Change the isc_async API to use cds_wfcqueue internally 2023-05-12 14:16:25 +02:00
backtrace.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
base32.c standardize CHECK and RETERR macros 2025-12-03 13:26:28 -08:00
base64.c Add enum for use with isc_base64_tobuffer and isc_hex_tobuffer 2026-01-27 23:57:34 +11:00
commandline.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
counter.c Cleanup the isc_counter unit 2025-02-21 09:51:42 +00:00
dir.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno2result.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
errno2result.h Remove C++ support from the public header 2024-12-18 13:10:39 +01:00
error.c Remove do-nothing header <isc/print.h> 2023-02-15 16:44:47 +00:00
file.c Stop isc_file_safecreate from following symlinks 2026-04-29 16:56:25 +02:00
getaddresses.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
hash.c Use arc4random for CSPRNG when available 2025-10-02 13:26:07 +02:00
hashmap.c Use arc4random for CSPRNG when available 2025-10-02 13:26:07 +02:00
heap.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
helper.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
hex.c Add enum for use with isc_base64_tobuffer and isc_hex_tobuffer 2026-01-27 23:57:34 +11:00
histo.c Use standard reference counting for isc_histomulti 2026-02-26 14:00:10 +00:00
ht.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
httpd.c Clear errno before calling strtol 2026-03-17 10:51:37 +11:00
interfaceiter.c use a standard CLEANUP macro 2025-12-03 13:45:43 -08:00
iterated_hash.c expose isc__crypto_md in isc/ossl_wrap.h 2026-02-02 11:50:14 +03:00
jemalloc_shim.h Provide more information when the memory allocation fails 2025-11-28 14:42:21 +01:00
job.c Use unique names for probes.d files 2025-09-24 13:18:13 +02:00
job_p.h Use proper padding instead of using alignas() 2024-02-08 10:54:35 +01:00
lex.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
lib.c Call rcu_barrier earlier in the destructor 2025-04-25 13:13:44 +02:00
log.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
loop.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
loop_p.h Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
managers.c Cleanup setting netmgr ports from isc_managers_create() 2026-02-20 16:37:44 +01:00
md.c expose isc__crypto_md in isc/ossl_wrap.h 2026-02-02 11:50:14 +03:00
mem.c Reduce memory footprint by enabling background page purging 2026-04-08 16:42:19 +02:00
mem_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
meminfo.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
meson.build Add low contention stats counter 2026-03-26 10:19:25 +01:00
mutex.c Move the library init and shutdown to executables 2025-02-22 16:19:00 +01:00
mutex_p.h Use library constructor to create default mutex attr once 2022-07-13 13:19:32 +02:00
net.c Rename isc_net_getudpportrange() to isc_net_getportrange() 2026-02-20 14:06:23 +01:00
netaddr.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
netscope.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
openssl_shim.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
openssl_shim.h switch isc_md_type_t to a proper enum 2026-02-02 11:12:55 +03:00
os.c Implement IP_LOCAL_PORT_RANGE socket option for Linux 2026-02-20 14:06:23 +01:00
os_p.h Update the copyright information in all files in the repository 2022-01-11 09:05:02 +01:00
parseint.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
picohttpparser.c Add and apply InsertBraces statement 2025-08-19 07:58:33 +02:00
picohttpparser.h Update picohttpparser.{c,h} with upstream repository 2024-12-08 11:14:37 +00:00
portset.c clean up uses of ISC_R_NOMEMORY 2025-01-23 15:54:57 -08:00
probes-isc.d Use unique names for probes.d files 2025-09-24 13:18:13 +02:00
proxy2.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
quota.c Fix isc_quota bug 2025-02-20 10:56:00 +00:00
radix.c Fix INSIST copy-paste error checking RADIX_V4 instead of RADIX_V6 2026-03-14 11:03:31 +01:00
random.c Use arc4random for CSPRNG when available 2025-10-02 13:26:07 +02:00
ratelimiter.c Dispatch ratelimiter events under the lock 2026-04-30 10:16:32 +02:00
regex.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
region.c Incrementally apply AXFR transfer 2024-11-22 15:00:55 +01:00
result.c Switch UDP fetches to TCP on the first response with a wrong query id 2026-05-14 15:56:18 +02:00
rwlock.c Use unique names for probes.d files 2025-09-24 13:18:13 +02:00
safe.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
serial.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
signal.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
sockaddr.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
stats.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
statsmulti.c Convert isc_statsmulti to use ISC_REFCOUNT_IMPL 2026-03-26 10:19:25 +01:00
stdio.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
stdtime.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
string.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
symtab.c Switch symtab to use fxhash hashing 2025-03-20 11:26:09 +01:00
syslog.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
tests Move all the unit tests to /tests/<libname>/ 2022-05-28 14:53:02 -07:00
thread.c Add support for setting thread stack size 2025-08-05 10:46:09 +02:00
thread_p.h Document the current default stack sizes on different systems 2025-08-05 10:46:09 +02:00
tid.c Add ISC_TID_MAX with default being 512 threads 2025-06-28 13:32:12 +02:00
time.c Simplify add/sub/mul overflow checks 2025-08-26 15:32:53 +02:00
timer.c Change the loopmgr to be singleton 2025-07-23 22:44:16 +02:00
tls.c OpenSSL 4 compatibility fix 2026-03-16 10:01:18 +00:00
tm.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
url.c switch to RETERR where it wasn't being used 2025-12-03 13:45:43 -08:00
utf8.c Remove redundant parentheses from the return statement 2024-11-19 12:27:22 +01:00
uv.c ensure file descriptors 0-2 are in use before using libuv 2025-08-28 08:16:06 +02:00
work.c Enforce isc_work enqueue loop affinity 2026-03-14 06:32:50 +01:00
xml.c Change the 'isc_g_mctx' to be always available 2025-08-04 11:29:50 +02:00