mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

apply max-recursion-queries quota to validator queries

Browse Source 
previously, validator queries for DNSKEY and DS records were
not counted toward the quota for max-recursion-queries; they
are now.
This commit is contained in:
Evan Hunt
2024-05-22 15:17:47 -07:00
parent d3b7e92783
commit af7db89513
3 changed files with 22 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
lib/dns/include/dns/validator.h
View File

@@ -146,12 +146,13 @@ struct dns_validator {
unsigned int authfail; unsigned int authfail;
isc_stdtime_t start; isc_stdtime_t start;
bool digest_sha1; bool digest_sha1;
bool supported_algorithm; bool supported_algorithm;
dns_rdata_t rdata; dns_rdata_t rdata;
bool resume; bool resume;
uint32_t *nvalidations; uint32_t *nvalidations;
uint32_t *nfails; uint32_t *nfails;
isc_counter_t *qc;
}; };
/*% /*%
@@ -170,7 +171,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
dns_message_t *message, unsigned int options, dns_message_t *message, unsigned int options,
isc_loop_t *loop, isc_job_cb cb, void *arg, isc_loop_t *loop, isc_job_cb cb, void *arg,
uint32_t *nvalidations, uint32_t *nfails, uint32_t *nvalidations, uint32_t *nfails,
dns_validator_t **validatorp); isc_counter_t *qc, dns_validator_t **validatorp);
/*%< /*%<
* Start a DNSSEC validation. * Start a DNSSEC validation.
* *

2
lib/dns/resolver.c
View File

@@ -991,7 +991,7 @@ valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,
result = dns_validator_create( result = dns_validator_create(
fctx->res->view, name, type, rdataset, sigrdataset, message, fctx->res->view, name, type, rdataset, sigrdataset, message,
valoptions, fctx->loop, validated, valarg, &fctx->nvalidations, valoptions, fctx->loop, validated, valarg, &fctx->nvalidations,
&fctx->nfails, &validator); &fctx->nfails, fctx->qc, &validator);
RUNTIME_CHECK(result == ISC_R_SUCCESS); RUNTIME_CHECK(result == ISC_R_SUCCESS);
inc_stats(fctx->res, dns_resstatscounter_val); inc_stats(fctx->res, dns_resstatscounter_val);
if ((valoptions & DNS_VALIDATOR_DEFER) == 0) { if ((valoptions & DNS_VALIDATOR_DEFER) == 0) {

17
lib/dns/validator.c
View File

@@ -16,6 +16,7 @@
#include <isc/async.h> #include <isc/async.h>
#include <isc/base32.h> #include <isc/base32.h>
#include <isc/counter.h>
#include <isc/job.h> #include <isc/job.h>
#include <isc/md.h> #include <isc/md.h>
#include <isc/mem.h> #include <isc/mem.h>
@@ -974,9 +975,10 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
(DNS_VALIDATOR_NOCDFLAG | DNS_VALIDATOR_NONTA)); (DNS_VALIDATOR_NOCDFLAG | DNS_VALIDATOR_NONTA));
validator_logcreate(val, name, type, caller, "validator"); validator_logcreate(val, name, type, caller, "validator");
result = dns_validator_create( result = dns_validator_create(val->view, name, type, rdataset, sig,
val->view, name, type, rdataset, sig, NULL, vopts, val->loop, NULL, vopts, val->loop, cb, val,
cb, val, val->nvalidations, val->nfails, &val->subvalidator); val->nvalidations, val->nfails, val->qc,
&val->subvalidator);
if (result == ISC_R_SUCCESS) { if (result == ISC_R_SUCCESS) {
dns_validator_attach(val, &val->subvalidator->parent); dns_validator_attach(val, &val->subvalidator->parent);
val->subvalidator->depth = val->depth + 1; val->subvalidator->depth = val->depth + 1;
@@ -3355,7 +3357,7 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
dns_message_t *message, unsigned int options, dns_message_t *message, unsigned int options,
isc_loop_t *loop, isc_job_cb cb, void *arg, isc_loop_t *loop, isc_job_cb cb, void *arg,
uint32_t *nvalidations, uint32_t *nfails, uint32_t *nvalidations, uint32_t *nfails,
dns_validator_t **validatorp) { isc_counter_t *qc, dns_validator_t **validatorp) {
isc_result_t result = ISC_R_FAILURE; isc_result_t result = ISC_R_FAILURE;
dns_validator_t *val = NULL; dns_validator_t *val = NULL;
dns_keytable_t *kt = NULL; dns_keytable_t *kt = NULL;
@@ -3395,6 +3397,10 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
dns_message_attach(message, &val->message); dns_message_attach(message, &val->message);
} }
if (qc != NULL) {
isc_counter_attach(qc, &val->qc);
}
val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name); val->mustbesecure = dns_resolver_getmustbesecure(view->resolver, name);
dns_rdataset_init(&val->fdsset); dns_rdataset_init(&val->fdsset);
dns_rdataset_init(&val->frdataset); dns_rdataset_init(&val->frdataset);
@@ -3470,6 +3476,9 @@ destroy_validator(dns_validator_t *val) {
if (val->message != NULL) { if (val->message != NULL) {
dns_message_detach(&val->message); dns_message_detach(&val->message);
} }
if (val->qc != NULL) {
isc_counter_detach(&val->qc);
}
dns_view_detach(&val->view); dns_view_detach(&val->view);
isc_mem_put(mctx, val, sizeof(*val)); isc_mem_put(mctx, val, sizeof(*val));
} }