upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

[master] limit recursion depth and iterative queries

Browse source 
4006.	[security]	A flaw in delegation handling could be exploited
			to put named into an infinite loop.  This has
			been addressed by placing limits on the number
			of levels of recursion named will allow (default 7),
			and the number of iterative queries that it will
			send (default 50) before terminating a recursive
			query (CVE-2014-8500).

			The recursion depth limit is configured via the
			"max-recursion-depth" option.  [RT #35780]
This commit is contained in:
Evan Hunt 2014-11-17 23:24:44 -08:00
parent c325ff9c79
commit 3230429e17
20 changed files with 475 additions and 40 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
CHANGES
View file

@ -1,3 +1,14 @@
4006. [security] A flaw in delegation handling could be exploited
to put named into an infinite loop. This has
been addressed by placing limits on the number
of levels of recursion named will allow (default 7),
and the number of iterative queries that it will
send (default 50) before terminating a recursive
query (CVE-2014-8500).
The recursion depth limit is configured via the
"max-recursion-depth" option. [RT #35780]
4005. [func] The buffer used for returning text from rndc
commands is now dynamically resizable, allowing
arbitrarily large amounts of text to be sent back

3
bin/named/config.c
View file

@ -15,8 +15,6 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: config.c,v 1.123 2012/01/06 23:46:41 tbox Exp $ */
/*! \file */
#include <config.h>
@ -176,6 +174,7 @@ options {\n\
dnssec-accept-expired no;\n\
clients-per-query 10;\n\
max-clients-per-query 100;\n\
max-recursion-depth 7;\n\
zero-no-soa-ttl-cache no;\n\
nsec3-test-zone no;\n\
allow-new-zones no;\n\

2
bin/named/include/named/query.h
View file

@ -15,8 +15,6 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: query.h,v 1.45 2011/01/13 04:59:24 tbox Exp $ */
#ifndef NAMED_QUERY_H
#define NAMED_QUERY_H 1

16
bin/named/query.c
View file

@ -3905,12 +3905,13 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
peeraddr = NULL;
ns_client_attach(client, &dummy);
options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
result = dns_resolver_createfetch2(client->view->resolver,
result = dns_resolver_createfetch3(client->view->resolver,
qname, rdataset->type, NULL, NULL,
NULL, peeraddr, client->message->id,
options, client->task,
prefetch_done, client, tmprdataset,
NULL, &client->query.prefetch);
options, 0, client->task,
prefetch_done, client,
tmprdataset, NULL,
&client->query.prefetch);
if (result != ISC_R_SUCCESS) {
query_putrdataset(client, &tmprdataset);
ns_client_detach(&dummy);
@ -4025,12 +4026,11 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
peeraddr = &client->peeraddr;
else
peeraddr = NULL;
result = dns_resolver_createfetch2(client->view->resolver,
result = dns_resolver_createfetch3(client->view->resolver,
qname, qtype, qdomain, nameservers,
NULL, peeraddr, client->message->id,
client->query.fetchoptions,
client->task,
query_resume, client,
client->query.fetchoptions, 0,
client->task, query_resume, client,
rdataset, sigrdataset,
&client->query.fetch);

5
bin/named/server.c
View file

@ -3473,6 +3473,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
cfg_obj_asuint32(obj),
max_clients_per_query);
obj = NULL;
result = ns_config_get(maps, "max-recursion-depth", &obj);
INSIST(result == ISC_R_SUCCESS);
dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj));
#ifdef ALLOW_FILTER_AAAA
obj = NULL;
result = ns_config_get(maps, "filter-aaaa-on-v4", &obj);

7
bin/tests/system/many/clean.sh Normal file
View file

@ -0,0 +1,7 @@
rm -f ns1/[1-9]*example.tld?.db
rm -f ns2/[1-9]*example.tld?.db
rm -f ns1/zones.conf
rm -f ns2/zones.conf
rm -f */root.db
rm -f ns3/tld1.db
rm -f ns4/tld2.db

33
bin/tests/system/many/ns1/named.conf Normal file
View file

@ -0,0 +1,33 @@
/*
* Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
controls { /* empty */ };
options {
query-source address 10.53.0.1;
notify-source 10.53.0.1;
transfer-source 10.53.0.1;
port 5300;
pid-file "named.pid";
listen-on { 10.53.0.1; };
listen-on-v6 { none; };
recursion no;
};
include "zones.conf";
// zone "tld1" { type master; file "tld1.db"; };
// zone "tld2" { type master; file "tld2.db"; };

30
bin/tests/system/many/ns2/named.conf Normal file
View file

@ -0,0 +1,30 @@
/*
* Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
controls { /* empty */ };
options {
query-source address 10.53.0.2;
notify-source 10.53.0.2;
transfer-source 10.53.0.2;
port 5300;
pid-file "named.pid";
listen-on { 10.53.0.2; };
listen-on-v6 { none; };
recursion no;
};
include "zones.conf";

32
bin/tests/system/many/ns3/named.conf Normal file
View file

@ -0,0 +1,32 @@
/*
* Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
controls { /* empty */ };
options {
query-source address 10.53.0.3;
notify-source 10.53.0.3;
transfer-source 10.53.0.3;
port 5300;
pid-file "named.pid";
listen-on { 10.53.0.3; };
listen-on-v6 { none; };
recursion no;
};
zone "." { type master; file "root.db"; };
zone "tld1" { type master; file "tld1.db"; };

30
bin/tests/system/many/ns4/named.conf Normal file
View file

@ -0,0 +1,30 @@
/*
* Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
controls { /* empty */ };
options {
query-source address 10.53.0.4;
notify-source 10.53.0.4;
transfer-source 10.53.0.4;
port 5300;
pid-file "named.pid";
listen-on { 10.53.0.4; };
listen-on-v6 { none; };
recursion no;
};
zone "tld2" { type master; file "tld2.db"; };

2
bin/tests/system/many/ns5/hints.db Normal file
View file

@ -0,0 +1,2 @@
. 60 in ns ns.nil.
ns.nil. 60 in A 10.53.0.3

29
bin/tests/system/many/ns5/named.conf Normal file
View file

@ -0,0 +1,29 @@
/*
* Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
controls { /* empty */ };
options {
query-source address 10.53.0.5;
notify-source 10.53.0.5;
transfer-source 10.53.0.5;
port 5300;
pid-file "named.pid";
listen-on { 10.53.0.5; };
listen-on-v6 { none; };
};
zone "." { type hint; file "hints.db"; };

75
bin/tests/system/many/setup.sh Normal file
View file

@ -0,0 +1,75 @@
i=1
cat > ns3/root.db << EOF
. 60 in soa ns.nil. hostmaster.ns.nil. 1 0 0 0 0
. 60 in ns ns.nil.
ns.nil. 60 in a 10.53.0.3
tld1. 60 in ns ns.tld1.
ns.tld1. 60 in a 10.53.0.3
tld2. 60 in ns ns.tld2.
ns.tld2. 60 in a 10.53.0.4
EOF
cat > ns3/tld1.db << EOF
tld1. 60 in soa ns.tld1. hostmaster.ns.tld1. 1 0 0 0 0
tld1. 60 in ns ns.tld1.
ns.tld1. 60 in a 10.53.0.1
EOF
cat > ns4/tld2.db << EOF
tld2. 60 in soa ns.tld2. hostmaster.ns.tld4. 1 0 0 0 0
tld2. 60 in ns ns.tld2.
ns.tld2. 60 in a 10.53.0.1
EOF
: > ns1/zones.conf
: > ns2/zones.conf
while [ $i -lt 1000 ]
do
j=`expr $i + 1`
s=`expr $j % 2 + 1`
n=`expr $i % 2 + 1`
t=`expr $s + 2`
# i=1 j=2 s=1 n=2
# i=2 j=3 s=1 n=2
# i=3 j=4 s=1 n=2
cat > ns1/${i}example.tld${s}.db << EOF
${i}example.tld${s}. 60 in soa ns.${j}example.tld${n}. hostmaster 1 0 0 0 0
${i}example.tld${s}. 60 in ns ns.${j}example.tld${n}.
ns.${i}example.tld${s}. 60 in a 10.53.0.1
EOF
cat >> ns1/zones.conf << EOF
zone "${i}example.tld${s}" { type master; file "${i}example.tld${s}.db"; };
EOF
cat >> ns${t}/tld${s}.db << EOF
${i}example.tld${s}. 60 in ns ns.${j}example.tld${n}.
EOF
i=$j
done
j=`expr $i + 1`
s=`expr $j % 2 + 1`
n=`expr $s % 2 + 1`
t=`expr $s + 2`
cat > ns1/${i}example.tld${s}.db << EOF
${i}example.tld${s}. 60 in soa ns.${i}example.tld${s}. hostmaster 1 0 0 0 0
${i}example.tld${s}. 60 in ns ns.${i}example.tld${s}.
ns.${i}example.tld${s}. 60 in a 10.53.0.1
EOF
cat >> ns1/zones.conf << EOF
zone "${i}example.tld${s}" { type master; file "${i}example.tld${s}.db"; };
EOF
cat >> ns${t}/tld${s}.db << EOF
${i}example.tld${s}. 60 in ns ns.${i}example.tld${s}.
ns.${i}example.tld${s}. 60 in a 10.53.0.1
EOF

48
bin/tests/system/many/tests.sh Normal file
View file

@ -0,0 +1,48 @@
#!/bin/sh
#
# Copyright (C) 2014 Internet Systems Consortium, Inc. ("ISC")
#
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
status=0
n=0
n=`expr $n + 1`
echo "I: attempt lookup 1example.tld2 soa ($n)"
ret=0
$DIG +tcp 1example.tld1 soa @10.53.0.5 -p 5300 > dig.out.test$n
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I: attempt lookup 992example.tld2 soa ($n)"
ret=0
$DIG +tcp 992example.tld2 soa @10.53.0.5 -p 5300 > dig.out.test$n
grep "status: SERVFAIL" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I: attempt lookup 993example.tld1 soa ($n)"
ret=0
$DIG +tcp 993example.tld1 soa @10.53.0.5 -p 5300 > dig.out.test$n
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
exit $status

12
doc/arm/Bv9ARM-book.xml
View file

@ -4932,6 +4932,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
<optional> max-acache-size <replaceable>size_spec</replaceable> ; </optional>
<optional> clients-per-query <replaceable>number</replaceable> ; </optional>
<optional> max-clients-per-query <replaceable>number</replaceable> ; </optional>
<optional> max-recursion-depth <replaceable>number</replaceable> ; </optional>
<optional> masterfile-format
(<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional>
<optional> masterfile-style
@ -9093,6 +9094,17 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
</listitem>
</varlistentry>
<varlistentry id="max-recursion-depth">
<term><command>max-recursion-depth</command></term>
<listitem>
<para>
Sets the maximum number of levels of recursion
permitted at any one time while resolving a name.
The default is 7.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><command>notify-delay</command></term>
<listitem>

56
lib/dns/adb.c
View file

@ -199,6 +199,7 @@ struct dns_adbfetch {
unsigned int magic;
dns_fetch_t *fetch;
dns_rdataset_t rdataset;
unsigned int depth;
};
/*%
@ -313,7 +314,7 @@ static inline void violate_locking_hierarchy(isc_mutex_t *, isc_mutex_t *);
static isc_boolean_t clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *);
static void clean_target(dns_adb_t *, dns_name_t *);
static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t,
unsigned int);
isc_uint32_t, unsigned int);
static isc_boolean_t check_expire_namehooks(dns_adbname_t *, isc_stdtime_t);
static isc_boolean_t check_expire_entry(dns_adb_t *, dns_adbentry_t **,
isc_stdtime_t);
@ -321,7 +322,7 @@ static void cancel_fetches_at_name(dns_adbname_t *);
static isc_result_t dbfind_name(dns_adbname_t *, isc_stdtime_t,
dns_rdatatype_t);
static isc_result_t fetch_name(dns_adbname_t *, isc_boolean_t,
dns_rdatatype_t);
unsigned int, dns_rdatatype_t);
static inline void check_exit(dns_adb_t *);
static void destroy(dns_adb_t *);
static isc_boolean_t shutdown_names(dns_adb_t *);
@ -1024,7 +1025,7 @@ kill_name(dns_adbname_t **n, isc_eventtype_t ev) {
* Clean up the name's various lists. These two are destructive
* in that they will always empty the list.
*/
clean_finds_at_name(name, ev, DNS_ADBFIND_ADDRESSMASK);
clean_finds_at_name(name, ev, 0, DNS_ADBFIND_ADDRESSMASK);
result4 = clean_namehooks(adb, &name->v4);
result6 = clean_namehooks(adb, &name->v6);
clean_target(adb, &name->target);
@ -1449,7 +1450,7 @@ event_free(isc_event_t *event) {
*/
static void
clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
unsigned int addrs)
isc_uint32_t qtotal, unsigned int addrs)
{
isc_event_t *ev;
isc_task_t *task;
@ -1509,6 +1510,7 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
ev->ev_sender = find;
find->result_v4 = find_err_map[name->fetch_err];
find->result_v6 = find_err_map[name->fetch6_err];
find->qtotal += qtotal;
ev->ev_type = evtype;
ev->ev_destroy = event_free;
ev->ev_destroy_arg = find;
@ -1884,6 +1886,7 @@ new_adbfind(dns_adb_t *adb) {
h->flags = 0;
h->result_v4 = ISC_R_UNEXPECTED;
h->result_v6 = ISC_R_UNEXPECTED;
h->qtotal = 0;
ISC_LINK_INIT(h, publink);
ISC_LINK_INIT(h, plink);
ISC_LIST_INIT(h->list);
@ -2864,6 +2867,19 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
dns_rdatatype_t qtype, unsigned int options,
isc_stdtime_t now, dns_name_t *target,
in_port_t port, dns_adbfind_t **findp)
{
return (dns_adb_createfind2(adb, task, action, arg, name,
qname, qtype, options, now,
target, port, 0, findp));
}
isc_result_t
dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
void *arg, dns_name_t *name, dns_name_t *qname,
dns_rdatatype_t qtype, unsigned int options,
isc_stdtime_t now, dns_name_t *target,
in_port_t port, unsigned int depth,
dns_adbfind_t **findp)
{
dns_adbfind_t *find;
dns_adbname_t *adbname;
@ -3101,7 +3117,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
* Start V4.
*/
if (WANT_INET(wanted_fetches) &&
fetch_name(adbname, start_at_zone,
fetch_name(adbname, start_at_zone, depth,
dns_rdatatype_a) == ISC_R_SUCCESS) {
DP(DEF_LEVEL, "dns_adb_createfind: "
"started A fetch for name %s (%p)",
@ -3112,7 +3128,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
* Start V6.
*/
if (WANT_INET6(wanted_fetches) &&
fetch_name(adbname, start_at_zone,
fetch_name(adbname, start_at_zone, depth,
dns_rdatatype_aaaa) == ISC_R_SUCCESS) {
DP(DEF_LEVEL, "dns_adb_createfind: "
"started AAAA fetch for name %s (%p)",
@ -3744,6 +3760,7 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
isc_result_t result;
unsigned int address_type;
isc_boolean_t want_check_exit = ISC_FALSE;
isc_uint32_t qtotal = 0;
UNUSED(task);
@ -3754,6 +3771,8 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
adb = name->adb;
INSIST(DNS_ADB_VALID(adb));
qtotal = dev->qtotal;
bucket = name->lock_bucket;
LOCK(&adb->namelocks[bucket]);
@ -3871,6 +3890,12 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
DP(DEF_LEVEL, "adb: fetch of '%s' %s failed: %s",
buf, address_type == DNS_ADBFIND_INET ? "A" : "AAAA",
dns_result_totext(dev->result));
/*
* Don't record a failure unless this is the initial
* fetch of a chain.
*/
if (fetch->depth > 1)
goto out;
/* XXXMLG Don't pound on bad servers. */
if (address_type == DNS_ADBFIND_INET) {
name->expire_v4 = ISC_MIN(name->expire_v4, now + 300);
@ -3902,15 +3927,14 @@ fetch_callback(isc_task_t *task, isc_event_t *ev) {
free_adbfetch(adb, &fetch);
isc_event_free(&ev);
clean_finds_at_name(name, ev_status, address_type);
clean_finds_at_name(name, ev_status, qtotal, address_type);
UNLOCK(&adb->namelocks[bucket]);
}
static isc_result_t
fetch_name(dns_adbname_t *adbname,
isc_boolean_t start_at_zone,
dns_rdatatype_t type)
fetch_name(dns_adbname_t *adbname, isc_boolean_t start_at_zone,
unsigned int depth, dns_rdatatype_t type)
{
isc_result_t result;
dns_adbfetch_t *fetch = NULL;
@ -3955,12 +3979,14 @@ fetch_name(dns_adbname_t *adbname,
result = ISC_R_NOMEMORY;
goto cleanup;
}
fetch->depth = depth;
result = dns_resolver_createfetch(adb->view->resolver, &adbname->name,
type, name, nameservers, NULL,
options, adb->task, fetch_callback,
adbname, &fetch->rdataset, NULL,
&fetch->fetch);
result = dns_resolver_createfetch3(adb->view->resolver, &adbname->name,
type, name, nameservers, NULL,
NULL, 0, options, depth, adb->task,
fetch_callback, adbname,
&fetch->rdataset, NULL,
&fetch->fetch);
if (result != ISC_R_SUCCESS)
goto cleanup;

8
lib/dns/include/dns/adb.h
View file

@ -118,6 +118,8 @@ struct dns_adbfind {
isc_result_t result_v6; /*%< RO: v6 result */
ISC_LINK(dns_adbfind_t) publink; /*%< RW: client use */
isc_uint32_t qtotal;
/* Private */
isc_mutex_t lock; /* locks all below */
in_port_t port;
@ -336,6 +338,12 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
dns_rdatatype_t qtype, unsigned int options,
isc_stdtime_t now, dns_name_t *target,
in_port_t port, dns_adbfind_t **find);
isc_result_t
dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
void *arg, dns_name_t *name, dns_name_t *qname,
dns_rdatatype_t qtype, unsigned int options,
isc_stdtime_t now, dns_name_t *target, in_port_t port,
unsigned int depth, dns_adbfind_t **find);
/*%<
* Main interface for clients. The adb will look up the name given in
* "name" and will build up a list of found addresses, and perhaps start

25
lib/dns/include/dns/resolver.h
View file

@ -82,6 +82,7 @@ typedef struct dns_fetchevent {
isc_sockaddr_t * client;
dns_messageid_t id;
isc_result_t vresult;
isc_uint32_t qtotal;
} dns_fetchevent_t;
/*
@ -278,6 +279,18 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
dns_rdataset_t *rdataset,
dns_rdataset_t *sigrdataset,
dns_fetch_t **fetchp);
isc_result_t
dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name,
dns_rdatatype_t type,
dns_name_t *domain, dns_rdataset_t *nameservers,
dns_forwarders_t *forwarders,
isc_sockaddr_t *client, isc_uint16_t id,
unsigned int options, unsigned int depth,
isc_task_t *task,
isc_taskaction_t action, void *arg,
dns_rdataset_t *rdataset,
dns_rdataset_t *sigrdataset,
dns_fetch_t **fetchp);
/*%<
* Recurse to answer a question.
*
@ -629,6 +642,18 @@ dns_resolver_getquerydscp6(dns_resolver_t *resolver);
* \li resolver to be valid.
*/
void
dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth);
unsigned int
dns_resolver_getmaxdepth(dns_resolver_t *resolver);
/*%
* Get and set how many NS indirections will be followed when looking for
* nameserver addresses.
*
* Requires:
* \li resolver to be valid.
*/
ISC_LANG_ENDDECLS
#endif /* DNS_RESOLVER_H */

90
lib/dns/resolver.c
View file

@ -156,6 +156,16 @@
#define MAXIMUM_QUERY_TIMEOUT 30 /* The maximum time in seconds for the whole query to live. */
#endif
/* The default maximum number of recursions to follow before giving up. */
#ifndef DEFAULT_RECURSION_DEPTH
#define DEFAULT_RECURSION_DEPTH 7
#endif
/* The default maximum number of iterative queries to allow before giving up. */
#ifndef DEFAULT_MAX_QUERIES
#define DEFAULT_MAX_QUERIES 50
#endif
/*%
* Maximum EDNS0 input packet size.
*/
@ -334,6 +344,7 @@ struct fetchctx {
isc_uint64_t duration;
isc_boolean_t logged;
unsigned int querysent;
unsigned int totalqueries;
unsigned int referrals;
unsigned int lamecount;
unsigned int neterr;
@ -344,6 +355,7 @@ struct fetchctx {
isc_boolean_t timeout;
dns_adbaddrinfo_t *addrinfo;
isc_sockaddr_t *client;
unsigned int depth;
};
#define FCTX_MAGIC ISC_MAGIC('F', '!', '!', '!')
@ -447,6 +459,7 @@ struct dns_resolver {
isc_timer_t * spillattimer;
isc_boolean_t zero_no_soa_ttl;
unsigned int query_timeout;
unsigned int maxdepth;
/* Locked by lock. */
unsigned int references;
@ -1162,6 +1175,7 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result, int line) {
event->result == DNS_R_NCACHENXRRSET);
}
event->qtotal = fctx->totalqueries;
isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
count++;
}
@ -1626,7 +1640,9 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
if (result != ISC_R_SUCCESS)
goto cleanup_dispatch;
}
fctx->querysent++;
fctx->totalqueries++;
ISC_LIST_APPEND(fctx->queries, query, link);
query->fctx->nqueries++;
@ -2523,9 +2539,10 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
*/
INSIST(!SHUTTINGDOWN(fctx));
fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES)
if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) {
want_try = ISC_TRUE;
else {
fctx->totalqueries += find->qtotal;
} else {
fctx->findfail++;
if (fctx->pending == 0) {
/*
@ -2809,12 +2826,13 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,
* See what we know about this address.
*/
find = NULL;
result = dns_adb_createfind(fctx->adb,
res->buckets[fctx->bucketnum].task,
fctx_finddone, fctx, name,
&fctx->name, fctx->type,
options, now, NULL,
res->view->dstport, &find);
result = dns_adb_createfind2(fctx->adb,
res->buckets[fctx->bucketnum].task,
fctx_finddone, fctx, name,
&fctx->name, fctx->type,
options, now, NULL,
res->view->dstport,
fctx->depth + 1, &find);
if (result != ISC_R_SUCCESS) {
if (result == DNS_R_ALIAS) {
/*
@ -2922,6 +2940,11 @@ fctx_getaddresses(fetchctx_t *fctx, isc_boolean_t badcache) {
res = fctx->res;
if (fctx->depth > res->maxdepth) {
FCTXTRACE("too much NS indirection");
return (DNS_R_SERVFAIL);
}
/*
* Forwarders.
*/
@ -3359,6 +3382,9 @@ fctx_try(fetchctx_t *fctx, isc_boolean_t retrying, isc_boolean_t badcache) {
REQUIRE(!ADDRWAIT(fctx));
if (fctx->totalqueries > DEFAULT_MAX_QUERIES)
fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
addrinfo = fctx_nextaddress(fctx);
if (addrinfo == NULL) {
/*
@ -3721,6 +3747,7 @@ fctx_start(isc_task_t *task, isc_event_t *event) {
* Normal fctx startup.
*/
fctx->state = fetchstate_active;
fctx->totalqueries = 0;
/*
* Reset the control event for later use in shutting down
* the fctx.
@ -3790,6 +3817,7 @@ fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_sockaddr_t *client,
event->fetch = fetch;
event->client = client;
event->id = id;
event->qtotal = 0;
dns_fixedname_init(&event->foundname);
/*
@ -3826,7 +3854,8 @@ log_ns_ttl(fetchctx_t *fctx, const char *where) {
static isc_result_t
fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
dns_name_t *domain, dns_rdataset_t *nameservers,
unsigned int options, unsigned int bucketnum, fetchctx_t **fctxp)
unsigned int options, unsigned int bucketnum, unsigned int depth,
fetchctx_t **fctxp)
{
fetchctx_t *fctx;
isc_result_t result;
@ -3883,6 +3912,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
fctx->state = fetchstate_init;
fctx->want_shutdown = ISC_FALSE;
fctx->cloned = ISC_FALSE;
fctx->depth = depth;
ISC_LIST_INIT(fctx->queries);
ISC_LIST_INIT(fctx->finds);
ISC_LIST_INIT(fctx->altfinds);
@ -3901,6 +3931,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
fctx->pending = 0;
fctx->restarts = 0;
fctx->querysent = 0;
fctx->totalqueries = 0;
fctx->referrals = 0;
TIME_NOW(&fctx->start);
fctx->timeouts = 0;
@ -8302,6 +8333,7 @@ dns_resolver_create(dns_view_t *view,
res->spillattimer = NULL;
res->zero_no_soa_ttl = ISC_FALSE;
res->query_timeout = DEFAULT_QUERY_TIMEOUT;
res->maxdepth = DEFAULT_RECURSION_DEPTH;
res->nbuckets = ntasks;
if (view->resstats != NULL)
isc_stats_set(view->resstats, ntasks,
@ -8748,9 +8780,9 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
dns_rdataset_t *sigrdataset,
dns_fetch_t **fetchp)
{
return (dns_resolver_createfetch2(res, name, type, domain,
return (dns_resolver_createfetch3(res, name, type, domain,
nameservers, forwarders, NULL, 0,
options, task, action, arg,
options, 0, task, action, arg,
rdataset, sigrdataset, fetchp));
}
@ -8765,6 +8797,25 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
dns_rdataset_t *rdataset,
dns_rdataset_t *sigrdataset,
dns_fetch_t **fetchp)
{
return (dns_resolver_createfetch3(res, name, type, domain,
nameservers, forwarders, client, id,
options, 0, task, action, arg,
rdataset, sigrdataset, fetchp));
}
isc_result_t
dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name,
dns_rdatatype_t type,
dns_name_t *domain, dns_rdataset_t *nameservers,
dns_forwarders_t *forwarders,
isc_sockaddr_t *client, dns_messageid_t id,
unsigned int options, unsigned int depth,
isc_task_t *task,
isc_taskaction_t action, void *arg,
dns_rdataset_t *rdataset,
dns_rdataset_t *sigrdataset,
dns_fetch_t **fetchp)
{
dns_fetch_t *fetch;
fetchctx_t *fctx = NULL;
@ -8854,11 +8905,12 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
if (fctx == NULL) {
result = fctx_create(res, name, type, domain, nameservers,
options, bucketnum, &fctx);
options, bucketnum, depth, &fctx);
if (result != ISC_R_SUCCESS)
goto unlock;
new_fctx = ISC_TRUE;
}
} else if (fctx->depth > depth)
fctx->depth = depth;
result = fctx_join(fctx, task, client, id, action, arg,
rdataset, sigrdataset, fetch);
@ -9582,3 +9634,15 @@ dns_resolver_getquerydscp6(dns_resolver_t *resolver) {
return (resolver->querydscp6);
}
void
dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) {
REQUIRE(VALID_RESOLVER(resolver));
resolver->maxdepth = maxdepth;
}
unsigned int
dns_resolver_getmaxdepth(dns_resolver_t *resolver) {
REQUIRE(VALID_RESOLVER(resolver));
return (resolver->maxdepth);
}

1
lib/isccfg/namedconf.c
View file

@ -1520,6 +1520,7 @@ view_clauses[] = {
{ "max-cache-ttl", &cfg_type_uint32, 0 },
{ "max-clients-per-query", &cfg_type_uint32, 0 },
{ "max-ncache-ttl", &cfg_type_uint32, 0 },
{ "max-recursion-depth", &cfg_type_uint32, 0 },
{ "max-udp-size", &cfg_type_uint32, 0 },
{ "min-roots", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTIMP },
{ "minimal-responses", &cfg_type_boolean, 0 },