From b5232b12f79b0365c99414f44c9df0c0f473936b Mon Sep 17 00:00:00 2001 From: Christopher Faulet Date: Tue, 29 Sep 2026 09:26:38 +0200 Subject: [PATCH] BUG/MINOR: resolvers: reject null "timeout resolve" and "timeout retry" values Both timeouts are parsed with parse_time_err() which accepts zero. But "timeout resolve" is the delay between two resolutions of a same name, so with a null value, a resolution is restarted as soon as it completes, from the same task wakeup, and the resolvers task spins at 100% CPU flooding the nameservers. With a null "timeout retry", all retries of a resolution are sent at once without waiting for any response, which defeats their purpose. This can be reproduced with "timeout resolve 0ms" (which doesn't even emit the "suspiciously small" warning thanks to the unit) and a server resolving a name answered by the nameserver: 68225 queries were sent in 2 seconds, versus 2 with "timeout resolve 1s". Let's reject null values for these two timeouts. This patch should be backported to all stable branches. --- src/resolvers.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/resolvers.c b/src/resolvers.c index a1cb92c5c..67726b035 100644 --- a/src/resolvers.c +++ b/src/resolvers.c @@ -4162,6 +4162,12 @@ int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm) err_code |= ERR_ALERT | ERR_FATAL; goto out; } + if (!tout) { + ha_alert("parsing [%s:%d]: <%s %s> must not be null.\n", + file, linenum, args[0], args[1]); + err_code |= ERR_ALERT | ERR_FATAL; + goto out; + } if (args[1][2] == 't') curr_resolvers->timeout.retry = tout; else { -- 2.47.3