From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH 1/3 v3] Unbound: Enable DNS cache poisoning mitigation Date: Sun, 09 Sep 2018 17:46:40 +0100 Message-ID: <7fcfbe81aea43d98195484843a7737715cc301e6.camel@ipfire.org> In-Reply-To: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3649070758878574942==" List-Id: --===============3649070758878574942== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit This patchset does not apply. On Mon, 2018-08-27 at 17:29 +0200, Peter Müller wrote: > By default, Unbound neither keeps track of the number of unwanted > replies nor initiates countermeasures if they become too large (DNS > cache poisoning). > > This sets the maximum number of tolerated unwanted replies to > 1M, causing the cache to be flushed afterwards. (Upstream documentation > recommends 10M as a threshold, but this turned out to be ineffective > against attacks in the wild.) > > See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for > details. This version of the patch uses 1M as threshold instead of > 5M and supersedes the first version. > > Signed-off-by: Peter Müller > --- > config/unbound/unbound.conf | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf > index 3f724d8f7..fa2ca3fd4 100644 > --- a/config/unbound/unbound.conf > +++ b/config/unbound/unbound.conf > @@ -61,6 +61,9 @@ server: > harden-algo-downgrade: no > use-caps-for-id: no > > + # Harden against DNS cache poisoning > + unwanted-reply-threshold: 1000000 > + > # Listen on all interfaces > interface-automatic: yes > interface: 0.0.0.0 --===============3649070758878574942==--