From 5a806910a895e8403f3c8d6cbd2d1ee78356a48f Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Thu, 7 Nov 2024 10:52:19 +0100
Subject: [PATCH 1/5] Implement 'max-query-count'

Add another option to configure how many outgoing queries per
client request is allowed. The existing 'max-recursion-queries' is
per restart, this one is a global limit.

(cherry picked from commit bbc16cc8e6e852afd7cd95f1824429f81b7de222)
---
 bin/named/config.c                   |  1 +
 bin/named/server.c                   |  5 +++++
 bin/tests/system/checkconf/good.conf |  1 +
 doc/arm/reference.rst                |  9 +++++++++
 doc/misc/options                     |  2 ++
 lib/dns/include/dns/view.h           | 13 +++++++++++++
 lib/dns/resolver.c                   |  1 +
 lib/dns/view.c                       |  8 ++++++++
 lib/isccfg/namedconf.c               |  1 +
 9 files changed, 41 insertions(+)

diff --git a/bin/named/config.c b/bin/named/config.c
index 040fde999c..0f25033cc2 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -175,6 +175,7 @@ options {\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
 	max-recursion-queries 32;\n\
+	max-query-count 200;\n\
 	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
diff --git a/bin/named/server.c b/bin/named/server.c
index d4862bae4b..68b29d835f 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -5678,6 +5678,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	INSIST(result == ISC_R_SUCCESS);
 	dns_view_setmaxrestarts(view, cfg_obj_asuint32(obj));
 
+	obj = NULL;
+	result = named_config_get(maps, "max-query-count", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_view_setmaxqueries(view, cfg_obj_asuint32(obj));
+
 	obj = NULL;
 	result = named_config_get(maps, "fetches-per-zone", &obj);
 	INSIST(result == ISC_R_SUCCESS);
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
index da47e8880e..c5eeb0b18a 100644
--- a/bin/tests/system/checkconf/good.conf
+++ b/bin/tests/system/checkconf/good.conf
@@ -77,6 +77,7 @@ options {
 	check-names primary warn;
 	check-names secondary ignore;
 	max-cache-size 20000000000000;
+	max-query-count 100;
 	max-query-restarts 10;
 	nta-lifetime 604800;
 	nta-recheck 604800;
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index b6356343cc..3c9f144785 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -4675,6 +4675,15 @@ Tuning
    format is more human-readable, and is thus suitable when a zone is to
    be edited by hand. The default is ``relative``.
 
+.. namedconf:statement:: max-query-count
+   :tags: server, query
+   :short: Sets the maximum number of iterative queries while servicing a recursive query.
+
+   This sets the maximum number of iterative queries that may be sent
+   by a resolver while looking up a single name. If more queries than this
+   need to be sent before an answer is reached, then recursion is terminated
+   and a SERVFAIL response is returned to the client. The default is ``200``.
+
 .. namedconf:statement:: max-recursion-depth
    :tags: server
    :short: Sets the maximum number of levels of recursion permitted at any one time while servicing a recursive query.
diff --git a/doc/misc/options b/doc/misc/options
index 8c01d57237..f8fdec6859 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -180,6 +180,7 @@ options {
 	max-ixfr-ratio ( unlimited | <percentage> );
 	max-journal-size ( default | unlimited | <sizeval> );
 	max-ncache-ttl <duration>;
+	max-query-count <integer>;
 	max-query-restarts <integer>;
 	max-records <integer>;
 	max-records-per-type <integer>;
@@ -473,6 +474,7 @@ view <string> [ <class> ] {
 	max-ixfr-ratio ( unlimited | <percentage> );
 	max-journal-size ( default | unlimited | <sizeval> );
 	max-ncache-ttl <duration>;
+	max-query-count <integer>;
 	max-query-restarts <integer>;
 	max-records <integer>;
 	max-records-per-type <integer>;
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index f5e274ef3d..b7a4798703 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -193,6 +193,7 @@ struct dns_view {
 	dns_badcache_t	 *failcache;
 	uint32_t	  maxrrperset;
 	uint32_t	  maxtypepername;
+	uint16_t	  max_queries;
 	uint8_t		  max_restarts;
 
 	/*
@@ -1440,4 +1441,16 @@ dns_view_setmaxrestarts(dns_view_t *view, uint8_t max_restarts);
  *\li	'max_restarts' is greater than 0.
  */
 
+void
+dns_view_setmaxqueries(dns_view_t *view, uint16_t max_queries);
+/*%
+ * Set the number of permissible outgoing queries before we give up.
+ * This defaults to 200.
+ *
+ * Requires:
+ *
+ *\li	'view' is valid;
+ *\li	'max_queries' is greater than 0.
+ */
+
 ISC_LANG_ENDDECLS
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1c3f0a36ff..b8907b420e 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -581,6 +581,7 @@ struct dns_resolver {
 	unsigned int query_timeout;
 	unsigned int maxdepth;
 	unsigned int maxqueries;
+	unsigned int maxquerycount;
 	isc_result_t quotaresp[2];
 
 	/* Additions for serve-stale feature. */
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 33e229fbee..8f23d8a155 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -2806,3 +2806,11 @@ dns_view_setmaxrestarts(dns_view_t *view, uint8_t max_restarts) {
 
 	view->max_restarts = max_restarts;
 }
+
+void
+dns_view_setmaxqueries(dns_view_t *view, uint16_t max_queries) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	REQUIRE(max_queries > 0);
+
+	view->max_queries = max_queries;
+}
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index f5afac4dcd..0c8bcb6c20 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2110,6 +2110,7 @@ static cfg_clausedef_t view_clauses[] = {
 	{ "max-ncache-ttl", &cfg_type_duration, 0 },
 	{ "max-recursion-depth", &cfg_type_uint32, 0 },
 	{ "max-recursion-queries", &cfg_type_uint32, 0 },
+	{ "max-query-count", &cfg_type_uint32, 0 },
 	{ "max-query-restarts", &cfg_type_uint32, 0 },
 	{ "max-stale-ttl", &cfg_type_duration, 0 },
 	{ "max-udp-size", &cfg_type_uint32, 0 },

From 3d0559621bb44aa87ddb913cf827986f13a9ef80 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Fri, 29 Nov 2024 14:29:08 +0100
Subject: [PATCH 2/5] Implement getter function for counter limit

(cherry picked from commit ca7d487357a63e398e5094973518cdabd9f53fa0)
---
 lib/isc/counter.c             | 7 +++++++
 lib/isc/include/isc/counter.h | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/lib/isc/counter.c b/lib/isc/counter.c
index 452ca10663..5cfac452f7 100644
--- a/lib/isc/counter.c
+++ b/lib/isc/counter.c
@@ -80,6 +80,13 @@ isc_counter_setlimit(isc_counter_t *counter, int limit) {
 	atomic_store(&counter->limit, limit);
 }
 
+int
+isc_counter_getlimit(isc_counter_t *counter) {
+	REQUIRE(VALID_COUNTER(counter));
+
+	return atomic_load_acquire(&counter->limit);
+}
+
 void
 isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp) {
 	REQUIRE(VALID_COUNTER(source));
diff --git a/lib/isc/include/isc/counter.h b/lib/isc/include/isc/counter.h
index 820e4a2f65..30ae273ae0 100644
--- a/lib/isc/include/isc/counter.h
+++ b/lib/isc/include/isc/counter.h
@@ -68,6 +68,12 @@ isc_counter_setlimit(isc_counter_t *counter, int limit);
  * Set the counter limit.
  */
 
+int
+isc_counter_getlimit(isc_counter_t *counter);
+/*%<
+ * Get the counter limit.
+ */
+
 void
 isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp);
 /*%<

From a0ce89bc153f3a5b240a8a906a8a9b85f0c08c54 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 11 Nov 2024 11:01:50 +0100
Subject: [PATCH 3/5] Implement global limit for outgoing queries

This global limit is not reset on query restarts and is a hard limit
for any client request.

Note: This commit has been significantly modified because of many
merge conflicts due to the dns_resolver_createfetch api changes.

(cherry picked from commit 16b3bd1cc743d3519a91edae896f394a689b0f0f)
---
 bin/named/server.c              |  2 +-
 lib/dns/adb.c                   | 14 +++---
 lib/dns/client.c                |  2 +-
 lib/dns/include/dns/adb.h       |  3 +-
 lib/dns/include/dns/resolver.h  |  4 +-
 lib/dns/include/dns/validator.h |  4 +-
 lib/dns/lookup.c                |  2 +-
 lib/dns/nta.c                   |  4 +-
 lib/dns/resolver.c              | 87 ++++++++++++++++++++++++++-------
 lib/dns/validator.c             | 13 +++--
 lib/dns/zone.c                  | 18 +++----
 lib/isc/counter.c               |  2 +-
 lib/isc/include/isc/counter.h   |  2 +-
 lib/ns/include/ns/query.h       |  1 +
 lib/ns/query.c                  | 25 ++++++++--
 15 files changed, 129 insertions(+), 54 deletions(-)

diff --git a/bin/named/server.c b/bin/named/server.c
index 68b29d835f..a0a28c04a3 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -7410,7 +7410,7 @@ tat_send(isc_task_t *task, isc_event_t *event) {
 	if (result == ISC_R_SUCCESS) {
 		result = dns_resolver_createfetch(
 			tat->view->resolver, tatname, dns_rdatatype_null,
-			domain, &nameservers, NULL, NULL, 0, 0, 0, NULL,
+			domain, &nameservers, NULL, NULL, 0, 0, 0, NULL, NULL,
 			tat->task, tat_done, tat, &tat->rdataset,
 			&tat->sigrdataset, &tat->fetch);
 	}
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index 3a769af91b..8b6e153566 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -343,7 +343,7 @@ static isc_result_t
 dbfind_name(dns_adbname_t *, isc_stdtime_t, dns_rdatatype_t);
 static isc_result_t
 fetch_name(dns_adbname_t *, bool, unsigned int, isc_counter_t *qc,
-	   dns_rdatatype_t);
+	   isc_counter_t *gqc, dns_rdatatype_t);
 static void
 check_exit(dns_adb_t *);
 static void
@@ -2903,7 +2903,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		   void *arg, const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype, unsigned int options,
 		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
-		   unsigned int depth, isc_counter_t *qc,
+		   unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc,
 		   dns_adbfind_t **findp) {
 	dns_adbfind_t *find = NULL;
 	dns_adbname_t *adbname = NULL;
@@ -3162,7 +3162,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		 * Start V4.
 		 */
 		if (WANT_INET(wanted_fetches) &&
-		    fetch_name(adbname, start_at_zone, depth, qc,
+		    fetch_name(adbname, start_at_zone, depth, qc, gqc,
 			       dns_rdatatype_a) == ISC_R_SUCCESS)
 		{
 			DP(DEF_LEVEL,
@@ -3175,7 +3175,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		 * Start V6.
 		 */
 		if (WANT_INET6(wanted_fetches) &&
-		    fetch_name(adbname, start_at_zone, depth, qc,
+		    fetch_name(adbname, start_at_zone, depth, qc, gqc,
 			       dns_rdatatype_aaaa) == ISC_R_SUCCESS)
 		{
 			DP(DEF_LEVEL,
@@ -4055,7 +4055,7 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
 
 static isc_result_t
 fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
-	   isc_counter_t *qc, dns_rdatatype_t type) {
+	   isc_counter_t *qc, isc_counter_t *gqc, dns_rdatatype_t type) {
 	isc_result_t result;
 	dns_adbfetch_t *fetch = NULL;
 	dns_adb_t *adb;
@@ -4105,8 +4105,8 @@ fetch_name(dns_adbname_t *adbname, bool start_at_zone, unsigned int depth,
 	 */
 	result = dns_resolver_createfetch(
 		adb->view->resolver, &adbname->name, type, name, nameservers,
-		NULL, NULL, 0, options, depth, qc, adb->task, fetch_callback,
-		adbname, &fetch->rdataset, NULL, &fetch->fetch);
+		NULL, NULL, 0, options, depth, qc, gqc, adb->task,
+		fetch_callback, adbname, &fetch->rdataset, NULL, &fetch->fetch);
 	if (result != ISC_R_SUCCESS) {
 		DP(ENTER_LEVEL, "fetch_name: createfetch failed with %s",
 		   isc_result_totext(result));
diff --git a/lib/dns/client.c b/lib/dns/client.c
index a88eaa9412..636dca712f 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -554,7 +554,7 @@ start_fetch(resctx_t *rctx) {
 
 	result = dns_resolver_createfetch(
 		rctx->view->resolver, dns_fixedname_name(&rctx->name),
-		rctx->type, NULL, NULL, NULL, NULL, 0, fopts, 0, NULL,
+		rctx->type, NULL, NULL, NULL, NULL, 0, fopts, 0, NULL, NULL,
 		rctx->task, fetch_done, rctx, rctx->rdataset, rctx->sigrdataset,
 		&rctx->fetch);
 
diff --git a/lib/dns/include/dns/adb.h b/lib/dns/include/dns/adb.h
index 4b81e5f2c1..7817c137b1 100644
--- a/lib/dns/include/dns/adb.h
+++ b/lib/dns/include/dns/adb.h
@@ -341,7 +341,8 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		   void *arg, const dns_name_t *name, const dns_name_t *qname,
 		   dns_rdatatype_t qtype, unsigned int options,
 		   isc_stdtime_t now, dns_name_t *target, in_port_t port,
-		   unsigned int depth, isc_counter_t *qc, dns_adbfind_t **find);
+		   unsigned int depth, isc_counter_t *qc, isc_counter_t *gqc,
+		   dns_adbfind_t **find);
 /*%<
  * Main interface for clients. The adb will look up the name given in
  * "name" and will build up a list of found addresses, and perhaps start
diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
index 4de314c90d..d22b897b61 100644
--- a/lib/dns/include/dns/resolver.h
+++ b/lib/dns/include/dns/resolver.h
@@ -279,8 +279,8 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 			 dns_forwarders_t     *forwarders,
 			 const isc_sockaddr_t *client, dns_messageid_t id,
 			 unsigned int options, unsigned int depth,
-			 isc_counter_t *qc, isc_task_t *task,
-			 isc_taskaction_t action, void *arg,
+			 isc_counter_t *qc, isc_counter_t *gqc,
+			 isc_task_t *task, isc_taskaction_t action, void *arg,
 			 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 			 dns_fetch_t **fetchp);
 /*%<
diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
index 2c758833f0..0c717f37c5 100644
--- a/lib/dns/include/dns/validator.h
+++ b/lib/dns/include/dns/validator.h
@@ -151,6 +151,7 @@ struct dns_validator {
 	bool	       failed;
 	isc_stdtime_t  start;
 	isc_counter_t *qc;
+	isc_counter_t *gqc;
 };
 
 /*%
@@ -168,7 +169,8 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
 		     isc_task_t *task, isc_taskaction_t action, void *arg,
-		     isc_counter_t *qc, dns_validator_t **validatorp);
+		     isc_counter_t *qc, isc_counter_t *gqc,
+		     dns_validator_t **validatorp);
 /*%<
  * Start a DNSSEC validation.
  *
diff --git a/lib/dns/lookup.c b/lib/dns/lookup.c
index 6ccea3adec..4f5356d51a 100644
--- a/lib/dns/lookup.c
+++ b/lib/dns/lookup.c
@@ -85,7 +85,7 @@ start_fetch(dns_lookup_t *lookup) {
 
 	result = dns_resolver_createfetch(
 		lookup->view->resolver, dns_fixedname_name(&lookup->name),
-		lookup->type, NULL, NULL, NULL, NULL, 0, 0, 0, NULL,
+		lookup->type, NULL, NULL, NULL, NULL, 0, 0, 0, NULL, NULL,
 		lookup->task, fetch_done, lookup, &lookup->rdataset,
 		&lookup->sigrdataset, &lookup->fetch);
 
diff --git a/lib/dns/nta.c b/lib/dns/nta.c
index 60c08b4b6f..4e9a0c0ef7 100644
--- a/lib/dns/nta.c
+++ b/lib/dns/nta.c
@@ -263,8 +263,8 @@ checkbogus(isc_task_t *task, isc_event_t *event) {
 	dns_view_weakattach(ntatable->view, &view);
 	result = dns_resolver_createfetch(
 		view->resolver, nta->name, dns_rdatatype_nsec, NULL, NULL, NULL,
-		NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, task, fetch_done, nta,
-		&nta->rdataset, &nta->sigrdataset, &nta->fetch);
+		NULL, 0, DNS_FETCHOPT_NONTA, 0, NULL, NULL, task, fetch_done,
+		nta, &nta->rdataset, &nta->sigrdataset, &nta->fetch);
 	if (result != ISC_R_SUCCESS) {
 		nta_detach(view->mctx, &nta);
 		dns_view_weakdetach(&view);
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index b8907b420e..332a82118f 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -380,6 +380,7 @@ struct fetchctx {
 	bool ns_ttl_ok;
 	uint32_t ns_ttl;
 	isc_counter_t *qc;
+	isc_counter_t *gqc;
 	bool minimized;
 	unsigned int qmin_labels;
 	isc_result_t qmin_warning;
@@ -976,7 +977,8 @@ valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,
 
 	result = dns_validator_create(fctx->res->view, name, type, rdataset,
 				      sigrdataset, message, valoptions, task,
-				      validated, valarg, fctx->qc, &validator);
+				      validated, valarg, fctx->qc, fctx->gqc,
+				      &validator);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (result == ISC_R_SUCCESS) {
 		inc_stats(fctx->res, dns_resstatscounter_val);
@@ -3427,7 +3429,8 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 	result = dns_adb_createfind(
 		fctx->adb, res->buckets[fctx->bucketnum].task, fctx_finddone,
 		fctx, name, fctx->name, fctx->type, options, now, NULL,
-		res->view->dstport, fctx->depth + 1, fctx->qc, &find);
+		res->view->dstport, fctx->depth + 1, fctx->qc, fctx->gqc,
+		&find);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
@@ -4137,6 +4140,9 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 	unsigned int bucketnum;
 
 	FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc));
+	if (fctx->gqc != NULL) {
+		FCTXTRACE5("try", "fctx->gqc=", isc_counter_used(fctx->gqc));
+	}
 
 	REQUIRE(!ADDRWAIT(fctx));
 
@@ -4144,13 +4150,27 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 	bucketnum = fctx->bucketnum;
 
 	/* We've already exceeded maximum query count */
-	if (isc_counter_used(fctx->qc) > res->maxqueries) {
+	if (isc_counter_used(fctx->qc) > isc_counter_getlimit(fctx->qc)) {
+		isc_log_write(
+			dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+			"exceeded max queries resolving '%s' "
+			"(max-recursion-queries, querycount=%u, maxqueries=%u)",
+			fctx->info, isc_counter_used(fctx->qc),
+			isc_counter_getlimit(fctx->qc));
+		fctx_done_detach(&fctx, DNS_R_SERVFAIL);
+		return;
+	}
+
+	if (fctx->gqc != NULL &&
+	    isc_counter_used(fctx->gqc) > isc_counter_getlimit(fctx->gqc))
+	{
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
-			      "exceeded max queries resolving '%s' "
-			      "(querycount=%u, maxqueries=%u)",
-			      fctx->info, isc_counter_used(fctx->qc),
-			      res->maxqueries);
+			      "exceeded global max queries resolving '%s' "
+			      "(max-query-count, querycount=%u, maxqueries=%u)",
+			      fctx->info, isc_counter_used(fctx->gqc),
+			      isc_counter_getlimit(fctx->gqc));
 		fctx_done_detach(&fctx, DNS_R_SERVFAIL);
 		return;
 	}
@@ -4256,8 +4276,8 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 		result = dns_resolver_createfetch(
 			fctx->res, fctx->qminname, fctx->qmintype, fctx->domain,
 			&fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc,
-			task, resume_qmin, fctx, &fctx->qminrrset, NULL,
-			&fctx->qminfetch);
+			fctx->gqc, task, resume_qmin, fctx, &fctx->qminrrset,
+			NULL, &fctx->qminfetch);
 		if (result != ISC_R_SUCCESS) {
 			fctx_unref(fctx);
 			fctx_done_detach(&fctx, DNS_R_SERVFAIL);
@@ -4269,12 +4289,26 @@ fctx_try(fetchctx_t *fctx, bool retrying, bool badcache) {
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
-			      "exceeded max queries resolving '%s'",
-			      fctx->info);
+			      "exceeded max queries resolving '%s' "
+			      "(max-recursion-queries, querycount=%u)",
+			      fctx->info, isc_counter_used(fctx->qc));
 		fctx_done_detach(&fctx, DNS_R_SERVFAIL);
 		return;
 	}
 
+	if (fctx->gqc != NULL) {
+		result = isc_counter_increment(fctx->gqc);
+		if (result != ISC_R_SUCCESS) {
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+				      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+				      "exceeded global max queries resolving "
+				      "'%s' (max-query-count, querycount=%u)",
+				      fctx->info, isc_counter_used(fctx->gqc));
+			fctx_done_detach(&fctx, DNS_R_SERVFAIL);
+			return;
+		}
+	}
+
 	result = fctx_query(fctx, addrinfo, fctx->options);
 	if (result != ISC_R_SUCCESS) {
 		fctx_done_detach(&fctx, result);
@@ -4513,6 +4547,9 @@ fctx_destroy(fetchctx_t *fctx, bool exiting) {
 	}
 
 	isc_counter_detach(&fctx->qc);
+	if (fctx->gqc != NULL) {
+		isc_counter_detach(&fctx->gqc);
+	}
 	fcount_decr(fctx);
 	dns_message_detach(&fctx->qmessage);
 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
@@ -4785,7 +4822,7 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
 	    dns_rdatatype_t type, const dns_name_t *domain,
 	    dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
 	    unsigned int options, unsigned int bucketnum, unsigned int depth,
-	    isc_counter_t *qc, fetchctx_t **fctxp) {
+	    isc_counter_t *qc, isc_counter_t *gqc, fetchctx_t **fctxp) {
 	fetchctx_t *fctx = NULL;
 	isc_result_t result;
 	isc_result_t iresult;
@@ -4849,6 +4886,15 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
 			      fctx->info, fctx->qc);
 	}
 
+	if (gqc != NULL) {
+		isc_counter_attach(gqc, &fctx->gqc);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9),
+			      "fctx %p(%s): attached to counter %p (%d)", fctx,
+			      fctx->info, fctx->gqc,
+			      isc_counter_used(fctx->gqc));
+	}
+
 	isc_refcount_init(&fctx->references, 1);
 
 	ISC_LIST_INIT(fctx->queries);
@@ -5105,6 +5151,9 @@ fctx_create(dns_resolver_t *res, isc_task_t *task, const dns_name_t *name,
 	}
 	isc_mem_free(res->mctx, fctx->info);
 	isc_counter_detach(&fctx->qc);
+	if (fctx->gqc != NULL) {
+		isc_counter_detach(&fctx->gqc);
+	}
 
 cleanup_fetch:
 	dns_resolver_detach(&fctx->res);
@@ -7584,7 +7633,7 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
 		options = fctx->options & ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
 		result = dns_resolver_createfetch(
 			res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset,
-			NULL, NULL, 0, options, 0, fctx->qc, task,
+			NULL, NULL, 0, options, 0, fctx->qc, fctx->gqc, task,
 			resume_dslookup, fctx, &fctx->nsrrset, NULL,
 			&fctx->nsfetch);
 		if (result != ISC_R_SUCCESS) {
@@ -9952,8 +10001,8 @@ rctx_chaseds(respctx_t *rctx, dns_message_t *message,
 	options = fctx->options & ~DNS_FETCHOPT_TRYSTALE_ONTIMEOUT;
 	result = dns_resolver_createfetch(
 		fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL,
-		NULL, 0, options, 0, fctx->qc, task, resume_dslookup, fctx,
-		&fctx->nsrrset, NULL, &fctx->nsfetch);
+		NULL, 0, options, 0, fctx->qc, fctx->gqc, task, resume_dslookup,
+		fctx, &fctx->nsrrset, NULL, &fctx->nsfetch);
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_DUPLICATE) {
 			result = DNS_R_SERVFAIL;
@@ -10656,7 +10705,7 @@ dns_resolver_prime(dns_resolver_t *res) {
 		INSIST(res->primefetch == NULL);
 		result = dns_resolver_createfetch(
 			res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL,
-			NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL,
+			NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, NULL,
 			res->buckets[0].task, prime_done, res, rdataset, NULL,
 			&res->primefetch);
 		UNLOCK(&res->primelock);
@@ -10934,8 +10983,8 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 			 dns_forwarders_t *forwarders,
 			 const isc_sockaddr_t *client, dns_messageid_t id,
 			 unsigned int options, unsigned int depth,
-			 isc_counter_t *qc, isc_task_t *task,
-			 isc_taskaction_t action, void *arg,
+			 isc_counter_t *qc, isc_counter_t *gqc,
+			 isc_task_t *task, isc_taskaction_t action, void *arg,
 			 dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 			 dns_fetch_t **fetchp) {
 	dns_fetch_t *fetch;
@@ -11040,7 +11089,7 @@ dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
 
 	if (fctx == NULL) {
 		result = fctx_create(res, task, name, type, domain, nameservers,
-				     client, options, bucketnum, depth, qc,
+				     client, options, bucketnum, depth, qc, gqc,
 				     &fctx);
 		if (result != ISC_R_SUCCESS) {
 			goto unlock;
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 6123992a63..5f2eb9542c 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1060,7 +1060,7 @@ create_fetch(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 	validator_logcreate(val, name, type, caller, "fetch");
 	return dns_resolver_createfetch(
 		val->view->resolver, name, type, NULL, NULL, NULL, NULL, 0,
-		fopts, 0, NULL, val->event->ev_sender, callback, val,
+		fopts, 0, NULL, NULL, val->event->ev_sender, callback, val,
 		&val->frdataset, &val->fsigrdataset, &val->fetch);
 }
 
@@ -1092,7 +1092,7 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
 	validator_logcreate(val, name, type, caller, "validator");
 	result = dns_validator_create(val->view, name, type, rdataset, sig,
 				      NULL, vopts, val->task, action, val,
-				      val->qc, &val->subvalidator);
+				      val->qc, val->gqc, &val->subvalidator);
 	if (result == ISC_R_SUCCESS) {
 		val->subvalidator->parent = val;
 		val->subvalidator->depth = val->depth + 1;
@@ -3153,7 +3153,8 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 		     dns_message_t *message, unsigned int options,
 		     isc_task_t *task, isc_taskaction_t action, void *arg,
-		     isc_counter_t *qc, dns_validator_t **validatorp) {
+		     isc_counter_t *qc, isc_counter_t *gqc,
+		     dns_validator_t **validatorp) {
 	isc_result_t result = ISC_R_FAILURE;
 	dns_validator_t *val;
 	isc_task_t *tclone = NULL;
@@ -3197,6 +3198,9 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	if (qc != NULL) {
 		isc_counter_attach(qc, &val->qc);
 	}
+	if (gqc != NULL) {
+		isc_counter_attach(gqc, &val->gqc);
+	}
 
 	val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name);
 	dns_rdataset_init(&val->fdsset);
@@ -3305,6 +3309,9 @@ destroy(dns_validator_t *val) {
 	if (val->qc != NULL) {
 		isc_counter_detach(&val->qc);
 	}
+	if (val->gqc != NULL) {
+		isc_counter_detach(&val->gqc);
+	}
 	isc_mutex_destroy(&val->lock);
 	dns_view_weakdetach(&val->view);
 	isc_mem_put(mctx, val, sizeof(*val));
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 49e03fea5d..17faae7387 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -139,14 +139,14 @@
 /*%
  * KASP flags
  */
-#define KASP_LOCK(k)                  \
-	if ((k) != NULL) {            \
-		LOCK((&((k)->lock))); \
+#define KASP_LOCK(k)                \
+	if ((k) != NULL) {          \
+		LOCK(&((k)->lock)); \
 	}
 
-#define KASP_UNLOCK(k)                  \
-	if ((k) != NULL) {              \
-		UNLOCK((&((k)->lock))); \
+#define KASP_UNLOCK(k)                \
+	if ((k) != NULL) {            \
+		UNLOCK(&((k)->lock)); \
 	}
 
 /*
@@ -11091,8 +11091,8 @@ do_keyfetch(isc_task_t *task, isc_event_t *event) {
 		NULL, NULL, 0,
 		DNS_FETCHOPT_NOVALIDATE | DNS_FETCHOPT_UNSHARED |
 			DNS_FETCHOPT_NOCACHED,
-		0, NULL, zone->task, keyfetch_done, kfetch, &kfetch->dnskeyset,
-		&kfetch->dnskeysigset, &kfetch->fetch);
+		0, NULL, NULL, zone->task, keyfetch_done, kfetch,
+		&kfetch->dnskeyset, &kfetch->dnskeysigset, &kfetch->fetch);
 
 	if (result != ISC_R_SUCCESS) {
 		retry_keyfetch(kfetch, kname);
@@ -12542,7 +12542,7 @@ notify_find_address(dns_notify_t *notify) {
 	result = dns_adb_createfind(
 		notify->zone->view->adb, notify->zone->task, process_adb_event,
 		notify, &notify->ns, dns_rootname, 0, options, 0, NULL,
-		notify->zone->view->dstport, 0, NULL, &notify->find);
+		notify->zone->view->dstport, 0, NULL, NULL, &notify->find);
 
 	/* Something failed? */
 	if (result != ISC_R_SUCCESS) {
diff --git a/lib/isc/counter.c b/lib/isc/counter.c
index 5cfac452f7..0c70c78d1a 100644
--- a/lib/isc/counter.c
+++ b/lib/isc/counter.c
@@ -80,7 +80,7 @@ isc_counter_setlimit(isc_counter_t *counter, int limit) {
 	atomic_store(&counter->limit, limit);
 }
 
-int
+unsigned int
 isc_counter_getlimit(isc_counter_t *counter) {
 	REQUIRE(VALID_COUNTER(counter));
 
diff --git a/lib/isc/include/isc/counter.h b/lib/isc/include/isc/counter.h
index 30ae273ae0..385b08cd4f 100644
--- a/lib/isc/include/isc/counter.h
+++ b/lib/isc/include/isc/counter.h
@@ -68,7 +68,7 @@ isc_counter_setlimit(isc_counter_t *counter, int limit);
  * Set the counter limit.
  */
 
-int
+unsigned int
 isc_counter_getlimit(isc_counter_t *counter);
 /*%<
  * Get the counter limit.
diff --git a/lib/ns/include/ns/query.h b/lib/ns/include/ns/query.h
index 37e55671c2..c090754526 100644
--- a/lib/ns/include/ns/query.h
+++ b/lib/ns/include/ns/query.h
@@ -54,6 +54,7 @@ typedef struct ns_query_recparam {
 struct ns_query {
 	unsigned int	 attributes;
 	unsigned int	 restarts;
+	isc_counter_t	*qc;
 	bool		 timerset;
 	dns_name_t	*qname;
 	dns_name_t	*origqname;
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 43142b6c8a..fd25dfb61e 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -18,6 +18,7 @@
 #include <stdbool.h>
 #include <string.h>
 
+#include <isc/counter.h>
 #include <isc/hex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -764,6 +765,9 @@ query_reset(ns_client_t *client, bool everything) {
 			client->query.rpz_st = NULL;
 		}
 	}
+	if (client->query.qc != NULL) {
+		isc_counter_detach(&client->query.qc);
+	}
 	client->query.origqname = NULL;
 	client->query.dboptions = 0;
 	client->query.fetchoptions = 0;
@@ -2614,8 +2618,8 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, rdataset->type, NULL, NULL, NULL,
-		peeraddr, client->message->id, options, 0, NULL, client->task,
-		prefetch_done, client, tmprdataset, NULL,
+		peeraddr, client->message->id, options, 0, NULL, NULL,
+		client->task, prefetch_done, client, tmprdataset, NULL,
 		&client->query.prefetch);
 	if (result != ISC_R_SUCCESS) {
 		if (client->recursionquota != NULL) {
@@ -2838,7 +2842,7 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	isc_nmhandle_attach(client->handle, &client->prefetchhandle);
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, type, NULL, NULL, NULL, peeraddr,
-		client->message->id, options, 0, NULL, client->task,
+		client->message->id, options, 0, NULL, NULL, client->task,
 		prefetch_done, client, tmprdataset, NULL,
 		&client->query.prefetch);
 	if (result != ISC_R_SUCCESS) {
@@ -6614,8 +6618,8 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, qtype, qdomain, nameservers,
 		NULL, peeraddr, client->message->id, client->query.fetchoptions,
-		0, NULL, client->task, fetch_callback, client, rdataset,
-		sigrdataset, &client->query.fetch);
+		0, NULL, client->query.qc, client->task, fetch_callback, client,
+		rdataset, sigrdataset, &client->query.fetch);
 	if (result != ISC_R_SUCCESS) {
 		if (client->recursionquota != NULL) {
 			isc_quota_detach(&client->recursionquota);
@@ -12546,5 +12550,16 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 		message->flags |= DNS_MESSAGEFLAG_AD;
 	}
 
+	/*
+	 * Start global outgoing query count.
+	 */
+	result = isc_counter_create(client->manager->mctx,
+				    client->view->max_queries,
+				    &client->query.qc);
+	if (result != ISC_R_SUCCESS) {
+		query_next(client, result);
+		return;
+	}
+
 	(void)query_setup(client, qtype);
 }

From 69b2f99c00d6dffb271e33002df24ae7e4cd751a Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 25 Nov 2024 16:27:21 +0100
Subject: [PATCH 4/5] Add a CAMP test case

This adds a new test directory specifically for CAMP attacks. This first
test in this test directory follows multiple CNAME chains, restarting
the max-recursion-queries counter, but should bail when the global
maximum quota max-query-count is reached.

(cherry picked from commit 73eafaba14acff7a4e461c112dd747736814db6e)
---
 bin/tests/system/Makefile.am             |  1 +
 bin/tests/system/camp/ns1/named.conf.in  | 31 ++++++++++
 bin/tests/system/camp/ns1/root.db        | 51 +++++++++++++++
 bin/tests/system/camp/ns2/named.conf.in  | 31 ++++++++++
 bin/tests/system/camp/ns2/setup.sh       | 57 +++++++++++++++++
 bin/tests/system/camp/ns2/template.db.in | 26 ++++++++
 bin/tests/system/camp/ns3/named.conf.in  | 42 +++++++++++++
 bin/tests/system/camp/ns3/setup.sh       | 79 ++++++++++++++++++++++++
 bin/tests/system/camp/ns3/template.db.in | 26 ++++++++
 bin/tests/system/camp/ns9/hints.db       | 13 ++++
 bin/tests/system/camp/ns9/named.conf.in  | 41 ++++++++++++
 bin/tests/system/camp/setup.sh           | 32 ++++++++++
 bin/tests/system/camp/tests.sh           | 36 +++++++++++
 bin/tests/system/camp/tests_sh_camp.py   | 25 ++++++++
 14 files changed, 491 insertions(+)
 create mode 100644 bin/tests/system/camp/ns1/named.conf.in
 create mode 100644 bin/tests/system/camp/ns1/root.db
 create mode 100644 bin/tests/system/camp/ns2/named.conf.in
 create mode 100644 bin/tests/system/camp/ns2/setup.sh
 create mode 100644 bin/tests/system/camp/ns2/template.db.in
 create mode 100644 bin/tests/system/camp/ns3/named.conf.in
 create mode 100644 bin/tests/system/camp/ns3/setup.sh
 create mode 100644 bin/tests/system/camp/ns3/template.db.in
 create mode 100644 bin/tests/system/camp/ns9/hints.db
 create mode 100644 bin/tests/system/camp/ns9/named.conf.in
 create mode 100644 bin/tests/system/camp/setup.sh
 create mode 100755 bin/tests/system/camp/tests.sh
 create mode 100644 bin/tests/system/camp/tests_sh_camp.py

diff --git a/bin/tests/system/Makefile.am b/bin/tests/system/Makefile.am
index 446ece22c2..5dcd4975d3 100644
--- a/bin/tests/system/Makefile.am
+++ b/bin/tests/system/Makefile.am
@@ -99,6 +99,7 @@ TESTS =				\
 	autosign		\
 	builtin			\
 	cacheclean		\
+	camp			\
 	case			\
 	catz			\
 	cds			\
diff --git a/bin/tests/system/camp/ns1/named.conf.in b/bin/tests/system/camp/ns1/named.conf.in
new file mode 100644
index 0000000000..208a651b0c
--- /dev/null
+++ b/bin/tests/system/camp/ns1/named.conf.in
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS1
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+};
+
+zone "." {
+	type primary;
+	file "root.db";
+};
diff --git a/bin/tests/system/camp/ns1/root.db b/bin/tests/system/camp/ns1/root.db
new file mode 100644
index 0000000000..64c8ac5910
--- /dev/null
+++ b/bin/tests/system/camp/ns1/root.db
@@ -0,0 +1,51 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+.			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+
+tld0.			NS	ns.tld0.
+ns.tld0.		A	10.53.0.2
+
+tld1.			NS	ns.tld1.
+ns.tld1.		A	10.53.0.2
+
+tld2.			NS	ns.tld2.
+ns.tld2.		A	10.53.0.2
+
+tld3.			NS	ns.tld3.
+ns.tld3.		A	10.53.0.2
+
+tld4.			NS	ns.tld4.
+ns.tld4.		A	10.53.0.2
+
+tld5.			NS	ns.tld5.
+ns.tld5.		A	10.53.0.2
+
+tld6.			NS	ns.tld6.
+ns.tld6.		A	10.53.0.2
+
+tld7.			NS	ns.tld7.
+ns.tld7.		A	10.53.0.2
+
+tld8.			NS	ns.tld8.
+ns.tld8.		A	10.53.0.2
+
+tld9.			NS	ns.tld9.
+ns.tld9.		A	10.53.0.2
diff --git a/bin/tests/system/camp/ns2/named.conf.in b/bin/tests/system/camp/ns2/named.conf.in
new file mode 100644
index 0000000000..52b20438a9
--- /dev/null
+++ b/bin/tests/system/camp/ns2/named.conf.in
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+};
+
+zone "tld0" {
+	type primary;
+	file "tld0.db";
+};
diff --git a/bin/tests/system/camp/ns2/setup.sh b/bin/tests/system/camp/ns2/setup.sh
new file mode 100644
index 0000000000..d75a190e0d
--- /dev/null
+++ b/bin/tests/system/camp/ns2/setup.sh
@@ -0,0 +1,57 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+cp template.db.in tld0.db
+echo "final.tld0. IN NS ns.final.tld0." >>tld0.db
+echo "ns.final.tld0. IN A 10.53.0.3" >>tld0.db
+
+DEPTH=5
+
+tld=1
+while [ $tld -le $DEPTH ]; do
+
+  cat >>"named.conf" <<EOF
+zone "tld${tld}" {
+        type primary;
+        file "tld${tld}.db";
+};
+EOF
+
+  cp template.db.in tld${tld}.db
+
+  label=0
+  while [ $label -le $DEPTH ]; do
+    echo "label${label}.tld${tld}. IN NS ns.label${label}.tld${tld}." >>tld${tld}.db
+    echo "ns.label${label}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db
+    echo "" >>tld${tld}.db
+
+    label=$((label + 1))
+  done
+
+  tld=$((tld + 1))
+done
+
+goto=1
+tld=1
+while [ $goto -le $DEPTH ]; do
+  echo "goto${goto}.tld${tld}. IN NS ns.goto${goto}.tld${tld}." >>tld${tld}.db
+  echo "ns.goto${goto}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db
+  echo "" >>tld${tld}.db
+
+  goto=$((goto + 1))
+done
diff --git a/bin/tests/system/camp/ns2/template.db.in b/bin/tests/system/camp/ns2/template.db.in
new file mode 100644
index 0000000000..278478e86c
--- /dev/null
+++ b/bin/tests/system/camp/ns2/template.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns2
+ns2			A	10.53.0.2
+			NS	ns
+ns			A	10.53.0.2
+
+; camp attack
diff --git a/bin/tests/system/camp/ns3/named.conf.in b/bin/tests/system/camp/ns3/named.conf.in
new file mode 100644
index 0000000000..958119bcae
--- /dev/null
+++ b/bin/tests/system/camp/ns3/named.conf.in
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+options {
+	query-source address 10.53.0.3;
+	notify-source 10.53.0.3;
+	transfer-source 10.53.0.3;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+
+	max-query-count 150;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "final.tld0" {
+	type primary;
+	file "final.tld0.db";
+};
diff --git a/bin/tests/system/camp/ns3/setup.sh b/bin/tests/system/camp/ns3/setup.sh
new file mode 100644
index 0000000000..79d1f6cb9c
--- /dev/null
+++ b/bin/tests/system/camp/ns3/setup.sh
@@ -0,0 +1,79 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns3/setup.sh"
+
+cp template.db.in final.tld0.db
+echo "q.final.tld0. IN A 1.2.3.4" >>final.tld0.db
+
+DEPTH=5
+
+tld=1
+while [ $tld -le $DEPTH ]; do
+  nexttld=$((tld + 1))
+
+  label=1
+  while [ $label -le $DEPTH ]; do
+    nextlabel=$((label + 1))
+
+    cat >>"named.conf" <<EOF
+zone "label${label}.tld${tld}" {
+        type primary;
+        file "label${label}.tld${tld}.db";
+};
+EOF
+
+    cp template.db.in label${label}.tld${tld}.db
+
+    if [ $label -eq $DEPTH ] && [ $tld -eq $DEPTH ]; then
+      echo "q.label${label}.tld${tld}. IN CNAME q.goto1.tld1." >>label${label}.tld${tld}.db
+    elif [ $tld -eq $DEPTH ]; then
+      nextlabel=$((label + 1))
+      echo "q.label${label}.tld${tld}. IN CNAME q.label${nextlabel}.tld1." >>label${label}.tld${tld}.db
+    else
+      echo "q.label${label}.tld${tld}. IN CNAME q.label${label}.tld${nexttld}." >>label${label}.tld${tld}.db
+    fi
+
+    label=$nextlabel
+  done
+
+  echo "" >>label${label}.tld${tld}.db
+  tld=$nexttld
+done
+
+goto=1
+tld=1
+while [ $goto -le $DEPTH ]; do
+  nextgoto=$((goto + 1))
+
+  cat >>"named.conf" <<EOF
+zone "goto${goto}.tld${tld}" {
+        type primary;
+        file "goto${goto}.tld${tld}.db";
+};
+EOF
+
+  cp template.db.in goto${goto}.tld${tld}.db
+
+  if [ $goto -eq $DEPTH ]; then
+    echo "q.goto${goto}.tld${tld}. IN CNAME q.final.tld0." >>goto${goto}.tld${tld}.db
+  else
+    echo "q.goto${goto}.tld${tld}. IN CNAME q.goto${nextgoto}.tld${tld}." >>goto${goto}.tld${tld}.db
+  fi
+
+  echo "" >>label${label}.tld${tld}.db
+  goto=$nextgoto
+done
diff --git a/bin/tests/system/camp/ns3/template.db.in b/bin/tests/system/camp/ns3/template.db.in
new file mode 100644
index 0000000000..dc6bd9b045
--- /dev/null
+++ b/bin/tests/system/camp/ns3/template.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@		IN	SOA  mname1. . (
+			1       ; serial
+			20      ; refresh (20 seconds)
+			20      ; retry (20 seconds)
+			1814400 ; expire (3 weeks)
+			3600    ; minimum (1 hour)
+			)
+
+			NS	ns
+			NS	ns3
+ns			A	10.53.0.3
+ns3			A	10.53.0.3
+
+; camp attack
diff --git a/bin/tests/system/camp/ns9/hints.db b/bin/tests/system/camp/ns9/hints.db
new file mode 100644
index 0000000000..691e813076
--- /dev/null
+++ b/bin/tests/system/camp/ns9/hints.db
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 60 IN NS a.root-servers.nil.
+a.root-servers.nil.     A       10.53.0.1
diff --git a/bin/tests/system/camp/ns9/named.conf.in b/bin/tests/system/camp/ns9/named.conf.in
new file mode 100644
index 0000000000..89045ad092
--- /dev/null
+++ b/bin/tests/system/camp/ns9/named.conf.in
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS9
+
+options {
+	query-source address 10.53.0.9;
+	notify-source 10.53.0.9;
+	transfer-source 10.53.0.9;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.9; };
+	listen-on-v6 { none; };
+	recursion yes;
+	dnssec-validation no;
+
+	max-recursion-queries 50;
+	max-query-restarts 50;
+	max-query-count 100;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm @DEFAULT_HMAC@;
+};
+
+controls {
+	inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." { type hint; file "hints.db"; };
diff --git a/bin/tests/system/camp/setup.sh b/bin/tests/system/camp/setup.sh
new file mode 100644
index 0000000000..8d17ffc715
--- /dev/null
+++ b/bin/tests/system/camp/setup.sh
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
+
+(
+  cd ns3
+  $SHELL setup.sh
+)
+
+(
+  cd ns2
+  $SHELL setup.sh
+)
diff --git a/bin/tests/system/camp/tests.sh b/bin/tests/system/camp/tests.sh
new file mode 100755
index 0000000000..3f831f45ea
--- /dev/null
+++ b/bin/tests/system/camp/tests.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+# shellcheck source=../conf.sh
+. ../conf.sh
+
+dig_with_opts() {
+  "${DIG}" -p "${PORT}" "${@}"
+}
+
+status=0
+n=0
+
+n=$((n + 1))
+echo_i "checking max-query-count is in effect ($n)"
+ret=0
+dig_with_opts q.label1.tld1. @10.53.0.9 a >dig.out.ns9.test${n} || ret=1
+grep "status: SERVFAIL" dig.out.ns9.test${n} >/dev/null || ret=1
+grep "exceeded global max queries resolving" ns9/named.run >/dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/camp/tests_sh_camp.py b/bin/tests/system/camp/tests_sh_camp.py
new file mode 100644
index 0000000000..177a0f2ae7
--- /dev/null
+++ b/bin/tests/system/camp/tests_sh_camp.py
@@ -0,0 +1,25 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out*",
+        "ans*/ans.run",
+        "ns*/*.jnl",
+        "ns*/*tld*.db",
+    ]
+)
+
+
+def test_camp(run_tests_sh):
+    run_tests_sh()

From 84519c106ccadec10de28da31d8d0bbc939b0804 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Thu, 5 Dec 2024 09:52:38 +0100
Subject: [PATCH 5/5] Change default max-recursion-queries to 50

Changing the default for max-recursion-queries from 100 to 32 was too
strict in some cases, especially lookups in reverse IPv6 trees started
to fail more frequently. From issue #4921 it looks like 50 is a better
default.

Now that we have 'max-query-count' as a global limit of outgoing queries
per client request, we can increase the default for
'max-recursion-queries' again, as the number of recursive queries is
no longer bound by the multiple of 'max-recursion-queries' and
'max-query-restarts'.

(cherry picked from commit 84df920d9e1e256e5132b10db098b1abfdda301e)
---
 bin/named/config.c    | 2 +-
 doc/arm/reference.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/named/config.c b/bin/named/config.c
index 0f25033cc2..26cc9f3d14 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -174,7 +174,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 32;\n\
+	max-recursion-queries 50;\n\
 	max-query-count 200;\n\
 	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index 3c9f144785..1e4867b9a6 100644
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -4704,7 +4704,7 @@ Tuning
    need to be sent before an answer is reached, then recursion is terminated
    and a SERVFAIL response is returned to the client. (Note: if the answer
    is a CNAME, then the subsequent lookup for the target of the CNAME is
-   counted separately.) The default is 32.
+   counted separately.) The default is 50.
 
 .. namedconf:statement:: max-query-restarts
    :tags: server, query