mirror of
https://github.com/isc-projects/bind9.git
synced 2026-06-10 12:20:00 -04:00
0c007d8659
With the parent-centric resolver, dns_view_bestzonecut() consults the delegation DB (view->deleg) rather than the main cache for the closest zonecut. Root is never the target of a referral, so it never lands in delegdb; bestzonecut therefore falls through to the hints lookup on every query whose closest ancestor is root. prime_done() only called dns_root_checkhints(), which logs discrepancies but does not update any store bestzonecut looks at, so the fresh root NS records obtained by priming were never used and priming kept re-firing. Rename view->hints to view->rootdb and refresh it when a priming fetch completes: the '.' NS rdataset is replaced with the fetched one, and for each listed nameserver the matching A/AAAA glue is copied from the response's ADDITIONAL section. Only glue for names that actually appear as NS targets is accepted, so a hostile response cannot inject unrelated records. Glue the response did not carry is left untouched, so the hints-file records loaded at startup remain as a fallback. Each view gets its own rootdb: the previous shared named_g_server->in_roothints is gone, and configure_view() calls dns_rootns_create() per view when the class-IN defaults are needed. That keeps the priming writer one-per-DB, so concurrent priming in different views cannot race on the same zone-DB version. The rootdb refresh runs synchronously from the resolver response path, so records go straight from the wire into rootdb with no cache round trip and no dependency on DNSSEC validation state. A new DNS_FETCHOPT_PRIMING option marks the priming fetch; prime_done() itself is now pure cleanup. Track the rootdb freshness window in view->rootdb_expires and trigger re-priming lazily from dns_view_find() and bestzonecut_rootdb() only when the window has elapsed. Stale records are still served while the fresh priming fetch is in flight. Drop dns_root_checkhints() and its helpers; the rootdb is now the authoritative source the resolver consults. |
||
|---|---|---|
| .. | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns4 | ||
| ns5 | ||
| bad-fstrm-reopen-interval.conf | ||
| bad-fstrm-set-buffer-hint-max.conf | ||
| bad-fstrm-set-buffer-hint-min.conf | ||
| bad-fstrm-set-flush-timeout-max.conf | ||
| bad-fstrm-set-flush-timeout-min.conf | ||
| bad-fstrm-set-input-queue-size-max.conf | ||
| bad-fstrm-set-input-queue-size-min.conf | ||
| bad-fstrm-set-input-queue-size-po2.conf | ||
| bad-fstrm-set-output-notify-threshold.conf | ||
| bad-fstrm-set-output-queue-size-max.conf | ||
| bad-fstrm-set-output-queue-size-min.conf | ||
| bad-fstrm-set-reopen-interval-max.conf | ||
| bad-fstrm-set-reopen-interval-min.conf | ||
| bad-missing-dnstap-output-view.conf | ||
| bad-missing-dnstap-output.conf | ||
| bad-size-version.conf | ||
| good-dnstap-in-options.conf | ||
| good-dnstap-in-view.conf | ||
| good-fstrm-reopen-interval.conf | ||
| good-fstrm-set-buffer-hint.conf | ||
| good-fstrm-set-flush-timeout.conf | ||
| good-fstrm-set-input-queue-size.conf | ||
| good-fstrm-set-output-notify-threshold.conf | ||
| good-fstrm-set-output-queue-model-mpsc.conf | ||
| good-fstrm-set-output-queue-model-spsc.conf | ||
| good-fstrm-set-output-queue-size.conf | ||
| good-fstrm-set-reopen-interval.conf | ||
| good-size-unlimited.conf | ||
| good-size-version.conf | ||
| large-answer.fstrm | ||
| README | ||
| tests.sh | ||
| tests_dnstap.py | ||
| tests_sh_dnstap.py | ||
| ydump.py | ||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
SPDX-License-Identifier: MPL-2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, you can obtain one at https://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
The "large-answer.fstrm" file was generated by configuring a named instance
compiled with --enable-dnstap with the following directives:
minimal-responses yes;
dnstap { auth response; };
dnstap-identity none;
dnstap-output file "large-answer.fstrm";
The captured RRset from the "example." zone was created using:
$GENERATE 1-48 @ IN A 127.0.0.$
A server instance set up this way was then queried non-recursively (RD=0) for
"example/A".