From 24cfee942fdf829914cdfbc77f9e2b8d323a64aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
Date: Tue, 11 Jun 2019 11:32:35 +0200
Subject: [PATCH 1/2] Make sure that recursclient gauge is calculated
 correctly.

We increase recursclients when we attach to recursion quota,
decrease when we detach. In some cases, when we hit soft
quota, we might attach to quota without increasing recursclients
gauge. We then decrease the gauge when we detach from quota,
and it causes the statistics to underflow.
Fix makes sure that we increase recursclients always when we
succesfully attach to recursion quota.
---
 lib/ns/query.c | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 06f2b2fb27..d990f4a150 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2487,12 +2487,18 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&client->sctx->recursionquota,
 					  &client->recursionquota);
-		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			ns_stats_increment(client->sctx->nsstats,
+					   ns_statscounter_recursclients);
+		}
+		if (result == ISC_R_SUCCESS && !client->mortal &&
+		    !TCP(client))
+		{
 			result = ns_client_replace(client);
-		if (result != ISC_R_SUCCESS)
+		}
+		if (result != ISC_R_SUCCESS) {
 			return;
-		ns_stats_increment(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
+		}
 	}
 
 	tmprdataset = ns_client_newrdataset(client);
@@ -2694,12 +2700,18 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&client->sctx->recursionquota,
 					  &client->recursionquota);
-		if (result == ISC_R_SUCCESS && !client->mortal && !TCP(client))
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			ns_stats_increment(client->sctx->nsstats,
+					   ns_statscounter_recursclients);
+		}
+		if (result == ISC_R_SUCCESS && !client->mortal &&
+		    !TCP(client))
+		{
 			result = ns_client_replace(client);
-		if (result != ISC_R_SUCCESS)
+		}
+		if (result != ISC_R_SUCCESS) {
 			return;
-		ns_stats_increment(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
+		}
 	}
 
 	tmprdataset = ns_client_newrdataset(client);
@@ -5720,9 +5732,10 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 	if (client->recursionquota == NULL) {
 		result = isc_quota_attach(&client->sctx->recursionquota,
 					  &client->recursionquota);
-
-		ns_stats_increment(client->sctx->nsstats,
-				   ns_statscounter_recursclients);
+		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
+			ns_stats_increment(client->sctx->nsstats,
+					   ns_statscounter_recursclients);
+		}
 
 		if  (result == ISC_R_SOFTQUOTA) {
 			static atomic_uint_fast32_t last = 0;

From c62a7c88b8298a3225ff90dfb4fbecc2788a7434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Witold=20Kr=C4=99cicki?= <wpk@isc.org>
Date: Tue, 11 Jun 2019 11:40:20 +0200
Subject: [PATCH 2/2] CHANGES note

---
 CHANGES | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGES b/CHANGES
index d9f060c3e2..4b93b761a0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+5249.	[bug]		Fix a possible underflow in recursion clients
+			statistics when hitting recursive clients
+			soft quota. [GL #1067]
+
 5248.	[func]		To clarify the configuration of DNSSEC keys,
 			the "managed-keys" and "trusted-keys" options
 			have both been deprecated.  The new "dnssec-keys"