diff --git a/bin/named/config.c b/bin/named/config.c index 040fde999c..26cc9f3d14 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -174,7 +174,8 @@ options {\n\ max-clients-per-query 100;\n\ max-ncache-ttl 10800; /* 3 hours */\n\ max-recursion-depth 7;\n\ - max-recursion-queries 32;\n\ + max-recursion-queries 50;\n\ + max-query-count 200;\n\ max-query-restarts 11;\n\ max-stale-ttl 86400; /* 1 day */\n\ message-compression yes;\n\ diff --git a/bin/named/server.c b/bin/named/server.c index d4862bae4b..a0a28c04a3 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -5678,6 +5678,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config, INSIST(result == ISC_R_SUCCESS); dns_view_setmaxrestarts(view, cfg_obj_asuint32(obj)); + obj = NULL; + result = named_config_get(maps, "max-query-count", &obj); + INSIST(result == ISC_R_SUCCESS); + dns_view_setmaxqueries(view, cfg_obj_asuint32(obj)); + obj = NULL; result = named_config_get(maps, "fetches-per-zone", &obj); INSIST(result == ISC_R_SUCCESS); @@ -7405,7 +7410,7 @@ tat_send(isc_task_t *task, isc_event_t *event) { if (result == ISC_R_SUCCESS) { result = dns_resolver_createfetch( tat->view->resolver, tatname, dns_rdatatype_null, - domain, &nameservers, NULL, NULL, 0, 0, 0, NULL, + domain, &nameservers, NULL, NULL, 0, 0, 0, NULL, NULL, tat->task, tat_done, tat, &tat->rdataset, &tat->sigrdataset, &tat->fetch); } diff --git a/bin/tests/system/Makefile.am b/bin/tests/system/Makefile.am index 446ece22c2..5dcd4975d3 100644 --- a/bin/tests/system/Makefile.am +++ b/bin/tests/system/Makefile.am @@ -99,6 +99,7 @@ TESTS = \ autosign \ builtin \ cacheclean \ + camp \ case \ catz \ cds \ diff --git a/bin/tests/system/camp/ns1/named.conf.in b/bin/tests/system/camp/ns1/named.conf.in new file mode 100644 index 0000000000..208a651b0c --- /dev/null +++ b/bin/tests/system/camp/ns1/named.conf.in @@ -0,0 +1,31 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS1 + +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + notify yes; +}; + +zone "." { + type primary; + file "root.db"; +}; diff --git a/bin/tests/system/camp/ns1/root.db b/bin/tests/system/camp/ns1/root.db new file mode 100644 index 0000000000..64c8ac5910 --- /dev/null +++ b/bin/tests/system/camp/ns1/root.db @@ -0,0 +1,51 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +. IN SOA gson.nominum.com. a.root.servers.nil. ( + 2000042100 ; serial + 600 ; refresh + 600 ; retry + 1200 ; expire + 600 ; minimum + ) +. NS a.root-servers.nil. +a.root-servers.nil. A 10.53.0.1 + +tld0. NS ns.tld0. +ns.tld0. A 10.53.0.2 + +tld1. NS ns.tld1. +ns.tld1. A 10.53.0.2 + +tld2. NS ns.tld2. +ns.tld2. A 10.53.0.2 + +tld3. NS ns.tld3. +ns.tld3. A 10.53.0.2 + +tld4. NS ns.tld4. +ns.tld4. A 10.53.0.2 + +tld5. NS ns.tld5. +ns.tld5. A 10.53.0.2 + +tld6. NS ns.tld6. +ns.tld6. A 10.53.0.2 + +tld7. NS ns.tld7. +ns.tld7. A 10.53.0.2 + +tld8. NS ns.tld8. +ns.tld8. A 10.53.0.2 + +tld9. NS ns.tld9. +ns.tld9. A 10.53.0.2 diff --git a/bin/tests/system/camp/ns2/named.conf.in b/bin/tests/system/camp/ns2/named.conf.in new file mode 100644 index 0000000000..52b20438a9 --- /dev/null +++ b/bin/tests/system/camp/ns2/named.conf.in @@ -0,0 +1,31 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS2 + +options { + query-source address 10.53.0.2; + notify-source 10.53.0.2; + transfer-source 10.53.0.2; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + notify yes; +}; + +zone "tld0" { + type primary; + file "tld0.db"; +}; diff --git a/bin/tests/system/camp/ns2/setup.sh b/bin/tests/system/camp/ns2/setup.sh new file mode 100644 index 0000000000..d75a190e0d --- /dev/null +++ b/bin/tests/system/camp/ns2/setup.sh @@ -0,0 +1,57 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../../conf.sh + +echo_i "ns2/setup.sh" + +cp template.db.in tld0.db +echo "final.tld0. IN NS ns.final.tld0." >>tld0.db +echo "ns.final.tld0. IN A 10.53.0.3" >>tld0.db + +DEPTH=5 + +tld=1 +while [ $tld -le $DEPTH ]; do + + cat >>"named.conf" <>tld${tld}.db + echo "ns.label${label}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db + echo "" >>tld${tld}.db + + label=$((label + 1)) + done + + tld=$((tld + 1)) +done + +goto=1 +tld=1 +while [ $goto -le $DEPTH ]; do + echo "goto${goto}.tld${tld}. IN NS ns.goto${goto}.tld${tld}." >>tld${tld}.db + echo "ns.goto${goto}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db + echo "" >>tld${tld}.db + + goto=$((goto + 1)) +done diff --git a/bin/tests/system/camp/ns2/template.db.in b/bin/tests/system/camp/ns2/template.db.in new file mode 100644 index 0000000000..278478e86c --- /dev/null +++ b/bin/tests/system/camp/ns2/template.db.in @@ -0,0 +1,26 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ IN SOA mname1. . ( + 1 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + + NS ns2 +ns2 A 10.53.0.2 + NS ns +ns A 10.53.0.2 + +; camp attack diff --git a/bin/tests/system/camp/ns3/named.conf.in b/bin/tests/system/camp/ns3/named.conf.in new file mode 100644 index 0000000000..958119bcae --- /dev/null +++ b/bin/tests/system/camp/ns3/named.conf.in @@ -0,0 +1,42 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS3 + +options { + query-source address 10.53.0.3; + notify-source 10.53.0.3; + transfer-source 10.53.0.3; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation no; + + max-query-count 150; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "final.tld0" { + type primary; + file "final.tld0.db"; +}; diff --git a/bin/tests/system/camp/ns3/setup.sh b/bin/tests/system/camp/ns3/setup.sh new file mode 100644 index 0000000000..79d1f6cb9c --- /dev/null +++ b/bin/tests/system/camp/ns3/setup.sh @@ -0,0 +1,79 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../../conf.sh + +echo_i "ns3/setup.sh" + +cp template.db.in final.tld0.db +echo "q.final.tld0. IN A 1.2.3.4" >>final.tld0.db + +DEPTH=5 + +tld=1 +while [ $tld -le $DEPTH ]; do + nexttld=$((tld + 1)) + + label=1 + while [ $label -le $DEPTH ]; do + nextlabel=$((label + 1)) + + cat >>"named.conf" <>label${label}.tld${tld}.db + elif [ $tld -eq $DEPTH ]; then + nextlabel=$((label + 1)) + echo "q.label${label}.tld${tld}. IN CNAME q.label${nextlabel}.tld1." >>label${label}.tld${tld}.db + else + echo "q.label${label}.tld${tld}. IN CNAME q.label${label}.tld${nexttld}." >>label${label}.tld${tld}.db + fi + + label=$nextlabel + done + + echo "" >>label${label}.tld${tld}.db + tld=$nexttld +done + +goto=1 +tld=1 +while [ $goto -le $DEPTH ]; do + nextgoto=$((goto + 1)) + + cat >>"named.conf" <>goto${goto}.tld${tld}.db + else + echo "q.goto${goto}.tld${tld}. IN CNAME q.goto${nextgoto}.tld${tld}." >>goto${goto}.tld${tld}.db + fi + + echo "" >>label${label}.tld${tld}.db + goto=$nextgoto +done diff --git a/bin/tests/system/camp/ns3/template.db.in b/bin/tests/system/camp/ns3/template.db.in new file mode 100644 index 0000000000..dc6bd9b045 --- /dev/null +++ b/bin/tests/system/camp/ns3/template.db.in @@ -0,0 +1,26 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ IN SOA mname1. . ( + 1 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + + NS ns + NS ns3 +ns A 10.53.0.3 +ns3 A 10.53.0.3 + +; camp attack diff --git a/bin/tests/system/camp/ns9/hints.db b/bin/tests/system/camp/ns9/hints.db new file mode 100644 index 0000000000..691e813076 --- /dev/null +++ b/bin/tests/system/camp/ns9/hints.db @@ -0,0 +1,13 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +. 60 IN NS a.root-servers.nil. +a.root-servers.nil. A 10.53.0.1 diff --git a/bin/tests/system/camp/ns9/named.conf.in b/bin/tests/system/camp/ns9/named.conf.in new file mode 100644 index 0000000000..89045ad092 --- /dev/null +++ b/bin/tests/system/camp/ns9/named.conf.in @@ -0,0 +1,41 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS9 + +options { + query-source address 10.53.0.9; + notify-source 10.53.0.9; + transfer-source 10.53.0.9; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.9; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation no; + + max-recursion-queries 50; + max-query-restarts 50; + max-query-count 100; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { type hint; file "hints.db"; }; diff --git a/bin/tests/system/camp/setup.sh b/bin/tests/system/camp/setup.sh new file mode 100644 index 0000000000..8d17ffc715 --- /dev/null +++ b/bin/tests/system/camp/setup.sh @@ -0,0 +1,32 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../conf.sh + +set -e + +copy_setports ns1/named.conf.in ns1/named.conf +copy_setports ns2/named.conf.in ns2/named.conf +copy_setports ns3/named.conf.in ns3/named.conf +copy_setports ns9/named.conf.in ns9/named.conf + +( + cd ns3 + $SHELL setup.sh +) + +( + cd ns2 + $SHELL setup.sh +) diff --git a/bin/tests/system/camp/tests.sh b/bin/tests/system/camp/tests.sh new file mode 100755 index 0000000000..3f831f45ea --- /dev/null +++ b/bin/tests/system/camp/tests.sh @@ -0,0 +1,36 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +set -e + +# shellcheck source=../conf.sh +. ../conf.sh + +dig_with_opts() { + "${DIG}" -p "${PORT}" "${@}" +} + +status=0 +n=0 + +n=$((n + 1)) +echo_i "checking max-query-count is in effect ($n)" +ret=0 +dig_with_opts q.label1.tld1. @10.53.0.9 a >dig.out.ns9.test${n} || ret=1 +grep "status: SERVFAIL" dig.out.ns9.test${n} >/dev/null || ret=1 +grep "exceeded global max queries resolving" ns9/named.run >/dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +echo_i "exit status: $status" +[ $status -eq 0 ] || exit 1 diff --git a/bin/tests/system/camp/tests_sh_camp.py b/bin/tests/system/camp/tests_sh_camp.py new file mode 100644 index 0000000000..177a0f2ae7 --- /dev/null +++ b/bin/tests/system/camp/tests_sh_camp.py @@ -0,0 +1,25 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +import pytest + +pytestmark = pytest.mark.extra_artifacts( + [ + "dig.out*", + "ans*/ans.run", + "ns*/*.jnl", + "ns*/*tld*.db", + ] +) + + +def test_camp(run_tests_sh): + run_tests_sh() diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf index da47e8880e..c5eeb0b18a 100644 --- a/bin/tests/system/checkconf/good.conf +++ b/bin/tests/system/checkconf/good.conf @@ -77,6 +77,7 @@ options { check-names primary warn; check-names secondary ignore; max-cache-size 20000000000000; + max-query-count 100; max-query-restarts 10; nta-lifetime 604800; nta-recheck 604800; diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst index b6356343cc..1e4867b9a6 100644 --- a/doc/arm/reference.rst +++ b/doc/arm/reference.rst @@ -4675,6 +4675,15 @@ Tuning format is more human-readable, and is thus suitable when a zone is to be edited by hand. The default is ``relative``. +.. namedconf:statement:: max-query-count + :tags: server, query + :short: Sets the maximum number of iterative queries while servicing a recursive query. + + This sets the maximum number of iterative queries that may be sent + by a resolver while looking up a single name. If more queries than this + need to be sent before an answer is reached, then recursion is terminated + and a SERVFAIL response is returned to the client. The default is ``200``. + .. namedconf:statement:: max-recursion-depth :tags: server :short: Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query. @@ -4695,7 +4704,7 @@ Tuning need to be sent before an answer is reached, then recursion is terminated and a SERVFAIL response is returned to the client. (Note: if the answer is a CNAME, then the subsequent lookup for the target of the CNAME is - counted separately.) The default is 32. + counted separately.) The default is 50. .. namedconf:statement:: max-query-restarts :tags: server, query diff --git a/doc/misc/options b/doc/misc/options index 8c01d57237..f8fdec6859 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -180,6 +180,7 @@ options { max-ixfr-ratio ( unlimited | ); max-journal-size ( default | unlimited | ); max-ncache-ttl ; + max-query-count ; max-query-restarts ; max-records ; max-records-per-type ; @@ -473,6 +474,7 @@ view [ ] { max-ixfr-ratio ( unlimited | ); max-journal-size ( default | unlimited | ); max-ncache-ttl ; + max-query-count ; max-query-restarts ; max-records ; max-records-per-type ; diff --git a/lib/dns/adb.c b/lib/dns/adb.c index 3a769af91b..8b6e153566 100644 --- a/lib/dns/adb.c +++ b/lib/dns/adb.c @@ -343,7 +343,7 @@ static isc_result_t dbfind_name(dns_adbname_t *, isc_stdtime_t, dns_rdatatype_t); static isc_result_t fetch_name(dns_adbname_t *, bool, unsigned int, isc_counter_t *qc, - dns_rdatatype_t); + isc_counter_t *gqc, dns_rdatatype_t); static void check_exit(dns_adb_t *); static void @@ -2903,7 +2903,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, void *arg, const dns_name_t *name, const dns_name_t *qname, dns_rdatatype_t qtype, unsigned int options, isc_stdtime_t now, dns_name_t *target, in_port_t port, - unsigned int depth, isc_counter_t *qc, + unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc, dns_adbfind_t **findp) { dns_adbfind_t *find = NULL; dns_adbname_t *adbname = NULL; @@ -3162,7 +3162,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, * Start V4. */ if (WANT_INET(wanted_fetches) && - fetch_name(adbname, start_at_zone, depth, qc, + fetch_name(adbname, start_at_zone, depth, qc, gqc, dns_rdatatype_a) == ISC_R_SUCCESS) { DP(DEF_LEVEL, @@ -3175,7 +3175,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, * Start V6. */ if (WANT_INET6(wanted_fetches) && - fetch_name(adbname, start_at_zone, depth, qc, + fetch_name(adbname, start_at_zone, depth, qc, gqc, dns_rdatatype_aaaa) == ISC_R_SUCCESS) { DP(DEF_LEVEL, @@ -4055,7 +4055,7 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) { static isc_result_t fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth, - isc_counter_t *qc, dns_rdatatype_t type) { + isc_counter_t *qc, isc_counter_t *gqc, dns_rdatatype_t type) { isc_result_t result; dns_adbfetch_t *fetch = NULL; dns_adb_t *adb; @@ -4105,8 +4105,8 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth, */ result = dns_resolver_createfetch( adb->view->resolver, &adbname->name, type, name, nameservers, - NULL, NULL, 0, options, depth, qc, adb->task, fetch_callback, - adbname, &fetch->rdataset, NULL, &fetch->fetch); + NULL, NULL, 0, options, depth, qc, gqc, adb->task, + fetch_callback, adbname, &fetch->rdataset, NULL, &fetch->fetch); if (result != ISC_R_SUCCESS) { DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s", isc_result_totext(result)); diff --git a/lib/dns/client.c b/lib/dns/client.c index a88eaa9412..636dca712f 100644 --- a/lib/dns/client.c +++ b/lib/dns/client.c @@ -554,7 +554,7 @@ start_fetch(resctx_t *rctx) { result = dns_resolver_createfetch( rctx->view->resolver, dns_fixedname_name(&rctx->name), - rctx->type, NULL, NULL, NULL, NULL, 0, fopts, 0, NULL, + rctx->type, NULL, NULL, NULL, NULL, 0, fopts, 0, NULL, NULL, rctx->task, fetch_done, rctx, rctx->rdataset, rctx->sigrdataset, &rctx->fetch); diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h index 4b81e5f2c1..7817c137b1 100644 --- a/lib/dns/include/dns/adb.h +++ b/lib/dns/include/dns/adb.h @@ -341,7 +341,8 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action, void *arg, const dns_name_t *name, const dns_name_t *qname, dns_rdatatype_t qtype, unsigned int options, isc_stdtime_t now, dns_name_t *target, in_port_t port, - unsigned int depth, isc_counter_t *qc, dns_adbfind_t **find); + unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc, + dns_adbfind_t **find); /*%< * Main interface for clients. The adb will look up the name given in * "name" and will build up a list of found addresses, and perhaps start diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h index 4de314c90d..d22b897b61 100644 --- a/lib/dns/include/dns/resolver.h +++ b/lib/dns/include/dns/resolver.h @@ -279,8 +279,8 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, dns_forwarders_t *forwarders, const isc_sockaddr_t *client, dns_messageid_t id, unsigned int options, unsigned int depth, - isc_counter_t *qc, isc_task_t *task, - isc_taskaction_t action, void *arg, + isc_counter_t *qc, isc_counter_t *gqc, + isc_task_t *task, isc_taskaction_t action, void *arg, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp); /*%< diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h index 2c758833f0..0c717f37c5 100644 --- a/lib/dns/include/dns/validator.h +++ b/lib/dns/include/dns/validator.h @@ -151,6 +151,7 @@ struct dns_validator { bool failed; isc_stdtime_t start; isc_counter_t *qc; + isc_counter_t *gqc; }; /*% @@ -168,7 +169,8 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_message_t *message, unsigned int options, isc_task_t *task, isc_taskaction_t action, void *arg, - isc_counter_t *qc, dns_validator_t **validatorp); + isc_counter_t *qc, isc_counter_t *gqc, + dns_validator_t **validatorp); /*%< * Start a DNSSEC validation. * diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h index f5e274ef3d..b7a4798703 100644 --- a/lib/dns/include/dns/view.h +++ b/lib/dns/include/dns/view.h @@ -193,6 +193,7 @@ struct dns_view { dns_badcache_t *failcache; uint32_t maxrrperset; uint32_t maxtypepername; + uint16_t max_queries; uint8_t max_restarts; /* @@ -1440,4 +1441,16 @@ dns_view_setmaxrestarts(dns_view_t *view, uint8_t max_restarts); *\li 'max_restarts' is greater than 0. */ +void +dns_view_setmaxqueries(dns_view_t *view, uint16_t max_queries); +/*% + * Set the number of permissible outgoing queries before we give up. + * This defaults to 200. + * + * Requires: + * + *\li 'view' is valid; + *\li 'max_queries' is greater than 0. + */ + ISC_LANG_ENDDECLS diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c index 6ccea3adec..4f5356d51a 100644 --- a/lib/dns/lookup.c +++ b/lib/dns/lookup.c @@ -85,7 +85,7 @@ start_fetch(dns_lookup_t *lookup) { result = dns_resolver_createfetch( lookup->view->resolver, dns_fixedname_name(&lookup->name), - lookup->type, NULL, NULL, NULL, NULL, 0, 0, 0, NULL, + lookup->type, NULL, NULL, NULL, NULL, 0, 0, 0, NULL, NULL, lookup->task, fetch_done, lookup, &lookup->rdataset, &lookup->sigrdataset, &lookup->fetch); diff --git a/lib/dns/nta.c b/lib/dns/nta.c index 60c08b4b6f..4e9a0c0ef7 100644 --- a/lib/dns/nta.c +++ b/lib/dns/nta.c @@ -263,8 +263,8 @@ checkbogus(isc_task_t *task, isc_event_t *event) { dns_view_weakattach(ntatable->view, &view); result = dns_resolver_createfetch( view->resolver, nta->name, dns_rdatatype_nsec, NULL, NULL, NULL, - NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, task, fetch_done, nta, - &nta->rdataset, &nta->sigrdataset, &nta->fetch); + NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, NULL, task, fetch_done, + nta, &nta->rdataset, &nta->sigrdataset, &nta->fetch); if (result != ISC_R_SUCCESS) { nta_detach(view->mctx, &nta); dns_view_weakdetach(&view); diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 1c3f0a36ff..332a82118f 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -380,6 +380,7 @@ struct fetchctx { bool ns_ttl_ok; uint32_t ns_ttl; isc_counter_t *qc; + isc_counter_t *gqc; bool minimized; unsigned int qmin_labels; isc_result_t qmin_warning; @@ -581,6 +582,7 @@ struct dns_resolver { unsigned int query_timeout; unsigned int maxdepth; unsigned int maxqueries; + unsigned int maxquerycount; isc_result_t quotaresp[2]; /* Additions for serve-stale feature. */ @@ -975,7 +977,8 @@ valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo, result = dns_validator_create(fctx->res->view, name, type, rdataset, sigrdataset, message, valoptions, task, - validated, valarg, fctx->qc, &validator); + validated, valarg, fctx->qc, fctx->gqc, + &validator); RUNTIME_CHECK(result == ISC_R_SUCCESS); if (result == ISC_R_SUCCESS) { inc_stats(fctx->res, dns_resstatscounter_val); @@ -3426,7 +3429,8 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port, result = dns_adb_createfind( fctx->adb, res->buckets[fctx->bucketnum].task, fctx_finddone, fctx, name, fctx->name, fctx->type, options, now, NULL, - res->view->dstport, fctx->depth + 1, fctx->qc, &find); + res->view->dstport, fctx->depth + 1, fctx->qc, fctx->gqc, + &find); isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), @@ -4136,6 +4140,9 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { unsigned int bucketnum; FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc)); + if (fctx->gqc != NULL) { + FCTXTRACE5("try", "fctx->gqc=", isc_counter_used(fctx->gqc)); + } REQUIRE(!ADDRWAIT(fctx)); @@ -4143,13 +4150,27 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { bucketnum = fctx->bucketnum; /* We've already exceeded maximum query count */ - if (isc_counter_used(fctx->qc) > res->maxqueries) { + if (isc_counter_used(fctx->qc) > isc_counter_getlimit(fctx->qc)) { + isc_log_write( + dns_lctx, DNS_LOGCATEGORY_RESOLVER, + DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), + "exceeded max queries resolving '%s' " + "(max-recursion-queries, querycount=%u, maxqueries=%u)", + fctx->info, isc_counter_used(fctx->qc), + isc_counter_getlimit(fctx->qc)); + fctx_done_detach(&fctx, DNS_R_SERVFAIL); + return; + } + + if (fctx->gqc != NULL && + isc_counter_used(fctx->gqc) > isc_counter_getlimit(fctx->gqc)) + { isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), - "exceeded max queries resolving '%s' " - "(querycount=%u, maxqueries=%u)", - fctx->info, isc_counter_used(fctx->qc), - res->maxqueries); + "exceeded global max queries resolving '%s' " + "(max-query-count, querycount=%u, maxqueries=%u)", + fctx->info, isc_counter_used(fctx->gqc), + isc_counter_getlimit(fctx->gqc)); fctx_done_detach(&fctx, DNS_R_SERVFAIL); return; } @@ -4255,8 +4276,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { result = dns_resolver_createfetch( fctx->res, fctx->qminname, fctx->qmintype, fctx->domain, &fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc, - task, resume_qmin, fctx, &fctx->qminrrset, NULL, - &fctx->qminfetch); + fctx->gqc, task, resume_qmin, fctx, &fctx->qminrrset, + NULL, &fctx->qminfetch); if (result != ISC_R_SUCCESS) { fctx_unref(fctx); fctx_done_detach(&fctx, DNS_R_SERVFAIL); @@ -4268,12 +4289,26 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) { if (result != ISC_R_SUCCESS) { isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), - "exceeded max queries resolving '%s'", - fctx->info); + "exceeded max queries resolving '%s' " + "(max-recursion-queries, querycount=%u)", + fctx->info, isc_counter_used(fctx->qc)); fctx_done_detach(&fctx, DNS_R_SERVFAIL); return; } + if (fctx->gqc != NULL) { + result = isc_counter_increment(fctx->gqc); + if (result != ISC_R_SUCCESS) { + isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, + DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), + "exceeded global max queries resolving " + "'%s' (max-query-count, querycount=%u)", + fctx->info, isc_counter_used(fctx->gqc)); + fctx_done_detach(&fctx, DNS_R_SERVFAIL); + return; + } + } + result = fctx_query(fctx, addrinfo, fctx->options); if (result != ISC_R_SUCCESS) { fctx_done_detach(&fctx, result); @@ -4512,6 +4547,9 @@ fctx_destroy(fetchctx_t *fctx, bool exiting) { } isc_counter_detach(&fctx->qc); + if (fctx->gqc != NULL) { + isc_counter_detach(&fctx->gqc); + } fcount_decr(fctx); dns_message_detach(&fctx->qmessage); if (dns_rdataset_isassociated(&fctx->nameservers)) { @@ -4784,7 +4822,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name, dns_rdatatype_t type, const dns_name_t *domain, dns_rdataset_t *nameservers, const isc_sockaddr_t *client, unsigned int options, unsigned int bucketnum, unsigned int depth, - isc_counter_t *qc, fetchctx_t **fctxp) { + isc_counter_t *qc, isc_counter_t *gqc, fetchctx_t **fctxp) { fetchctx_t *fctx = NULL; isc_result_t result; isc_result_t iresult; @@ -4848,6 +4886,15 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name, fctx->info, fctx->qc); } + if (gqc != NULL) { + isc_counter_attach(gqc, &fctx->gqc); + isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER, + DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9), + "fctx %p(%s): attached to counter %p (%d)", fctx, + fctx->info, fctx->gqc, + isc_counter_used(fctx->gqc)); + } + isc_refcount_init(&fctx->references, 1); ISC_LIST_INIT(fctx->queries); @@ -5104,6 +5151,9 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name, } isc_mem_free(res->mctx, fctx->info); isc_counter_detach(&fctx->qc); + if (fctx->gqc != NULL) { + isc_counter_detach(&fctx->gqc); + } cleanup_fetch: dns_resolver_detach(&fctx->res); @@ -7583,7 +7633,7 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) { options = fctx->options & ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT; result = dns_resolver_createfetch( res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset, - NULL, NULL, 0, options, 0, fctx->qc, task, + NULL, NULL, 0, options, 0, fctx->qc, fctx->gqc, task, resume_dslookup, fctx, &fctx->nsrrset, NULL, &fctx->nsfetch); if (result != ISC_R_SUCCESS) { @@ -9951,8 +10001,8 @@ rctx_chaseds(respctx_t *rctx, dns_message_t *message, options = fctx->options & ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT; result = dns_resolver_createfetch( fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL, - NULL, 0, options, 0, fctx->qc, task, resume_dslookup, fctx, - &fctx->nsrrset, NULL, &fctx->nsfetch); + NULL, 0, options, 0, fctx->qc, fctx->gqc, task, resume_dslookup, + fctx, &fctx->nsrrset, NULL, &fctx->nsfetch); if (result != ISC_R_SUCCESS) { if (result == DNS_R_DUPLICATE) { result = DNS_R_SERVFAIL; @@ -10655,7 +10705,7 @@ dns_resolver_prime(dns_resolver_t *res) { INSIST(res->primefetch == NULL); result = dns_resolver_createfetch( res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL, - NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, + NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, NULL, res->buckets[0].task, prime_done, res, rdataset, NULL, &res->primefetch); UNLOCK(&res->primelock); @@ -10933,8 +10983,8 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, dns_forwarders_t *forwarders, const isc_sockaddr_t *client, dns_messageid_t id, unsigned int options, unsigned int depth, - isc_counter_t *qc, isc_task_t *task, - isc_taskaction_t action, void *arg, + isc_counter_t *qc, isc_counter_t *gqc, + isc_task_t *task, isc_taskaction_t action, void *arg, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) { dns_fetch_t *fetch; @@ -11039,7 +11089,7 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name, if (fctx == NULL) { result = fctx_create(res, task, name, type, domain, nameservers, - client, options, bucketnum, depth, qc, + client, options, bucketnum, depth, qc, gqc, &fctx); if (result != ISC_R_SUCCESS) { goto unlock; diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 6123992a63..5f2eb9542c 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -1060,7 +1060,7 @@ create_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type, validator_logcreate(val, name, type, caller, "fetch"); return dns_resolver_createfetch( val->view->resolver, name, type, NULL, NULL, NULL, NULL, 0, - fopts, 0, NULL, val->event->ev_sender, callback, val, + fopts, 0, NULL, NULL, val->event->ev_sender, callback, val, &val->frdataset, &val->fsigrdataset, &val->fetch); } @@ -1092,7 +1092,7 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type, validator_logcreate(val, name, type, caller, "validator"); result = dns_validator_create(val->view, name, type, rdataset, sig, NULL, vopts, val->task, action, val, - val->qc, &val->subvalidator); + val->qc, val->gqc, &val->subvalidator); if (result == ISC_R_SUCCESS) { val->subvalidator->parent = val; val->subvalidator->depth = val->depth + 1; @@ -3153,7 +3153,8 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset, dns_message_t *message, unsigned int options, isc_task_t *task, isc_taskaction_t action, void *arg, - isc_counter_t *qc, dns_validator_t **validatorp) { + isc_counter_t *qc, isc_counter_t *gqc, + dns_validator_t **validatorp) { isc_result_t result = ISC_R_FAILURE; dns_validator_t *val; isc_task_t *tclone = NULL; @@ -3197,6 +3198,9 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type, if (qc != NULL) { isc_counter_attach(qc, &val->qc); } + if (gqc != NULL) { + isc_counter_attach(gqc, &val->gqc); + } val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name); dns_rdataset_init(&val->fdsset); @@ -3305,6 +3309,9 @@ destroy(dns_validator_t *val) { if (val->qc != NULL) { isc_counter_detach(&val->qc); } + if (val->gqc != NULL) { + isc_counter_detach(&val->gqc); + } isc_mutex_destroy(&val->lock); dns_view_weakdetach(&val->view); isc_mem_put(mctx, val, sizeof(*val)); diff --git a/lib/dns/view.c b/lib/dns/view.c index 33e229fbee..8f23d8a155 100644 --- a/lib/dns/view.c +++ b/lib/dns/view.c @@ -2806,3 +2806,11 @@ dns_view_setmaxrestarts(dns_view_t *view, uint8_t max_restarts) { view->max_restarts = max_restarts; } + +void +dns_view_setmaxqueries(dns_view_t *view, uint16_t max_queries) { + REQUIRE(DNS_VIEW_VALID(view)); + REQUIRE(max_queries > 0); + + view->max_queries = max_queries; +} diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 49e03fea5d..17faae7387 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -139,14 +139,14 @@ /*% * KASP flags */ -#define KASP_LOCK(k) \ - if ((k) != NULL) { \ - LOCK((&((k)->lock))); \ +#define KASP_LOCK(k) \ + if ((k) != NULL) { \ + LOCK(&((k)->lock)); \ } -#define KASP_UNLOCK(k) \ - if ((k) != NULL) { \ - UNLOCK((&((k)->lock))); \ +#define KASP_UNLOCK(k) \ + if ((k) != NULL) { \ + UNLOCK(&((k)->lock)); \ } /* @@ -11091,8 +11091,8 @@ do_keyfetch(isc_task_t *task, isc_event_t *event) { NULL, NULL, 0, DNS_FETCHOPT_NOVALIDATE | DNS_FETCHOPT_UNSHARED | DNS_FETCHOPT_NOCACHED, - 0, NULL, zone->task, keyfetch_done, kfetch, &kfetch->dnskeyset, - &kfetch->dnskeysigset, &kfetch->fetch); + 0, NULL, NULL, zone->task, keyfetch_done, kfetch, + &kfetch->dnskeyset, &kfetch->dnskeysigset, &kfetch->fetch); if (result != ISC_R_SUCCESS) { retry_keyfetch(kfetch, kname); @@ -12542,7 +12542,7 @@ notify_find_address(dns_notify_t *notify) { result = dns_adb_createfind( notify->zone->view->adb, notify->zone->task, process_adb_event, notify, ¬ify->ns, dns_rootname, 0, options, 0, NULL, - notify->zone->view->dstport, 0, NULL, ¬ify->find); + notify->zone->view->dstport, 0, NULL, NULL, ¬ify->find); /* Something failed? */ if (result != ISC_R_SUCCESS) { diff --git a/lib/isc/counter.c b/lib/isc/counter.c index 452ca10663..0c70c78d1a 100644 --- a/lib/isc/counter.c +++ b/lib/isc/counter.c @@ -80,6 +80,13 @@ isc_counter_setlimit(isc_counter_t *counter, int limit) { atomic_store(&counter->limit, limit); } +unsigned int +isc_counter_getlimit(isc_counter_t *counter) { + REQUIRE(VALID_COUNTER(counter)); + + return atomic_load_acquire(&counter->limit); +} + void isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp) { REQUIRE(VALID_COUNTER(source)); diff --git a/lib/isc/include/isc/counter.h b/lib/isc/include/isc/counter.h index 820e4a2f65..385b08cd4f 100644 --- a/lib/isc/include/isc/counter.h +++ b/lib/isc/include/isc/counter.h @@ -68,6 +68,12 @@ isc_counter_setlimit(isc_counter_t *counter, int limit); * Set the counter limit. */ +unsigned int +isc_counter_getlimit(isc_counter_t *counter); +/*%< + * Get the counter limit. + */ + void isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp); /*%< diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index f5afac4dcd..0c8bcb6c20 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -2110,6 +2110,7 @@ static cfg_clausedef_t view_clauses[] = { { "max-ncache-ttl", &cfg_type_duration, 0 }, { "max-recursion-depth", &cfg_type_uint32, 0 }, { "max-recursion-queries", &cfg_type_uint32, 0 }, + { "max-query-count", &cfg_type_uint32, 0 }, { "max-query-restarts", &cfg_type_uint32, 0 }, { "max-stale-ttl", &cfg_type_duration, 0 }, { "max-udp-size", &cfg_type_uint32, 0 }, diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h index 37e55671c2..c090754526 100644 --- a/lib/ns/include/ns/query.h +++ b/lib/ns/include/ns/query.h @@ -54,6 +54,7 @@ typedef struct ns_query_recparam { struct ns_query { unsigned int attributes; unsigned int restarts; + isc_counter_t *qc; bool timerset; dns_name_t *qname; dns_name_t *origqname; diff --git a/lib/ns/query.c b/lib/ns/query.c index 43142b6c8a..fd25dfb61e 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -18,6 +18,7 @@ #include #include +#include #include #include #include @@ -764,6 +765,9 @@ query_reset(ns_client_t *client, bool everything) { client->query.rpz_st = NULL; } } + if (client->query.qc != NULL) { + isc_counter_detach(&client->query.qc); + } client->query.origqname = NULL; client->query.dboptions = 0; client->query.fetchoptions = 0; @@ -2614,8 +2618,8 @@ query_prefetch(ns_client_t *client, dns_name_t *qname, options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH; result = dns_resolver_createfetch( client->view->resolver, qname, rdataset->type, NULL, NULL, NULL, - peeraddr, client->message->id, options, 0, NULL, client->task, - prefetch_done, client, tmprdataset, NULL, + peeraddr, client->message->id, options, 0, NULL, NULL, + client->task, prefetch_done, client, tmprdataset, NULL, &client->query.prefetch); if (result != ISC_R_SUCCESS) { if (client->recursionquota != NULL) { @@ -2838,7 +2842,7 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) { isc_nmhandle_attach(client->handle, &client->prefetchhandle); result = dns_resolver_createfetch( client->view->resolver, qname, type, NULL, NULL, NULL, peeraddr, - client->message->id, options, 0, NULL, client->task, + client->message->id, options, 0, NULL, NULL, client->task, prefetch_done, client, tmprdataset, NULL, &client->query.prefetch); if (result != ISC_R_SUCCESS) { @@ -6614,8 +6618,8 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname, result = dns_resolver_createfetch( client->view->resolver, qname, qtype, qdomain, nameservers, NULL, peeraddr, client->message->id, client->query.fetchoptions, - 0, NULL, client->task, fetch_callback, client, rdataset, - sigrdataset, &client->query.fetch); + 0, NULL, client->query.qc, client->task, fetch_callback, client, + rdataset, sigrdataset, &client->query.fetch); if (result != ISC_R_SUCCESS) { if (client->recursionquota != NULL) { isc_quota_detach(&client->recursionquota); @@ -12546,5 +12550,16 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) { message->flags |= DNS_MESSAGEFLAG_AD; } + /* + * Start global outgoing query count. + */ + result = isc_counter_create(client->manager->mctx, + client->view->max_queries, + &client->query.qc); + if (result != ISC_R_SUCCESS) { + query_next(client, result); + return; + } + (void)query_setup(client, qtype); }