Compare commits
No commits in common. "c8" and "c8-beta" have entirely different histories.
|
@ -1,46 +0,0 @@
|
||||||
From 6c26ede8edcb700caca12c501c6c129801989526 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Mark Andrews <marka@isc.org>
|
|
||||||
Date: Fri, 23 Feb 2024 10:12:47 +1100
|
|
||||||
Subject: [PATCH] Do not use header_prev in expire_lru_headers
|
|
||||||
|
|
||||||
dns__cacherbt_expireheader can unlink / free header_prev underneath
|
|
||||||
it. Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
|
|
||||||
instead to get the next pointer to be processed.
|
|
||||||
|
|
||||||
(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)
|
|
||||||
(cherry picked from commit f88f21b7d890eb80097f4bd434fedb29c2f9ff63)
|
|
||||||
---
|
|
||||||
lib/dns/rbtdb.c | 8 ++++----
|
|
||||||
1 file changed, 4 insertions(+), 4 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
|
|
||||||
index cc40eaec60..ee59c1b18b 100644
|
|
||||||
--- a/lib/dns/rbtdb.c
|
|
||||||
+++ b/lib/dns/rbtdb.c
|
|
||||||
@@ -10667,19 +10667,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header,
|
|
||||||
static size_t
|
|
||||||
expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
|
|
||||||
bool tree_locked) {
|
|
||||||
- rdatasetheader_t *header, *header_prev;
|
|
||||||
+ rdatasetheader_t *header;
|
|
||||||
size_t purged = 0;
|
|
||||||
|
|
||||||
for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
|
|
||||||
- header != NULL && purged <= purgesize; header = header_prev)
|
|
||||||
+ header != NULL && purged <= purgesize;
|
|
||||||
+ header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
|
|
||||||
{
|
|
||||||
- header_prev = ISC_LIST_PREV(header, link);
|
|
||||||
/*
|
|
||||||
* Unlink the entry at this point to avoid checking it
|
|
||||||
* again even if it's currently used someone else and
|
|
||||||
* cannot be purged at this moment. This entry won't be
|
|
||||||
* referenced any more (so unlinking is safe) since the
|
|
||||||
- * TTL was reset to 0.
|
|
||||||
+ * TTL will be reset to 0.
|
|
||||||
*/
|
|
||||||
ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
|
|
||||||
size_t header_size = rdataset_size(header);
|
|
||||||
--
|
|
||||||
2.43.2
|
|
||||||
|
|
File diff suppressed because it is too large
Load Diff
|
@ -1,64 +0,0 @@
|
||||||
From f0fc9d7999a94da3d471c4e0a35b1f447f25eea6 Mon Sep 17 00:00:00 2001
|
|
||||||
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
||||||
Date: Mon, 26 Feb 2024 21:08:42 +0100
|
|
||||||
Subject: [PATCH] Add normal task queue also to non-thread version
|
|
||||||
|
|
||||||
Non-thread builds are used by us for dhcp package. Make it working
|
|
||||||
again.
|
|
||||||
|
|
||||||
Related to [GL #4424] and [GL #4459].
|
|
||||||
---
|
|
||||||
lib/isc/task.c | 14 ++++++++------
|
|
||||||
1 file changed, 8 insertions(+), 6 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/lib/isc/task.c b/lib/isc/task.c
|
|
||||||
index cc83269..5315b51 100644
|
|
||||||
--- a/lib/isc/task.c
|
|
||||||
+++ b/lib/isc/task.c
|
|
||||||
@@ -1115,7 +1115,7 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
|
||||||
}
|
|
||||||
#else /* USE_WORKER_THREADS */
|
|
||||||
if (total_dispatch_count >= DEFAULT_TASKMGR_QUANTUM ||
|
|
||||||
- empty_readyq(manager))
|
|
||||||
+ empty_readyq(manager, qid))
|
|
||||||
break;
|
|
||||||
#endif /* USE_WORKER_THREADS */
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
|
|
||||||
@@ -1318,11 +1318,11 @@ dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
|
||||||
}
|
|
||||||
|
|
||||||
#ifndef USE_WORKER_THREADS
|
|
||||||
- ISC_LIST_APPENDLIST(manager->ready_tasks, new_ready_tasks, ready_link);
|
|
||||||
- ISC_LIST_APPENDLIST(manager->ready_priority_tasks, new_priority_tasks,
|
|
||||||
+ ISC_LIST_APPENDLIST(manager->ready_tasks[qid], new_ready_tasks, ready_link);
|
|
||||||
+ ISC_LIST_APPENDLIST(manager->ready_priority_tasks[qid], new_priority_tasks,
|
|
||||||
ready_priority_link);
|
|
||||||
manager->tasks_ready += tasks_ready;
|
|
||||||
- if (empty_readyq(manager))
|
|
||||||
+ if (empty_readyq(manager, qid))
|
|
||||||
manager->mode = isc_taskmgrmode_normal;
|
|
||||||
#endif
|
|
||||||
|
|
||||||
@@ -1713,7 +1713,8 @@ isc__taskmgr_ready(isc_taskmgr_t *manager0) {
|
|
||||||
return (false);
|
|
||||||
|
|
||||||
LOCK(&manager->lock);
|
|
||||||
- is_ready = !empty_readyq(manager);
|
|
||||||
+ is_ready = !empty_readyq(manager, isc_taskqueue_normal) ||
|
|
||||||
+ !empty_readyq(manager, isc_taskqueue_slow);
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
|
|
||||||
return (is_ready);
|
|
||||||
@@ -1730,7 +1731,8 @@ isc__taskmgr_dispatch(isc_taskmgr_t *manager0) {
|
|
||||||
if (manager == NULL)
|
|
||||||
return (ISC_R_NOTFOUND);
|
|
||||||
|
|
||||||
- dispatch(manager);
|
|
||||||
+ dispatch(manager, isc_taskqueue_normal);
|
|
||||||
+ dispatch(manager, isc_taskqueue_slow);
|
|
||||||
|
|
||||||
return (ISC_R_SUCCESS);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.43.2
|
|
||||||
|
|
|
@ -1,737 +0,0 @@
|
||||||
From 4c20ab54ec503f65d8ee0b863cbf41103d95130a Mon Sep 17 00:00:00 2001
|
|
||||||
From: Mark Andrews <marka@isc.org>
|
|
||||||
Date: Wed, 22 Nov 2023 16:59:03 +1100
|
|
||||||
Subject: [PATCH] Fail the DNSSEC validation on the first failure
|
|
||||||
|
|
||||||
Be more strict when encountering DNSSEC validation failures - fail on
|
|
||||||
the first failure. This will break domains that have DNSSEC signing
|
|
||||||
keys with duplicate key ids, but this is something that's much easier
|
|
||||||
to fix on the authoritative side, so we are just going to be strict
|
|
||||||
on the resolver side where it is causing performance problems.
|
|
||||||
|
|
||||||
(cherry picked from commit 8b7ecba9885e163c07c2dd3e1ceab79b2ba89e34)
|
|
||||||
|
|
||||||
Add normal and slow task queues
|
|
||||||
|
|
||||||
Split the task manager queues into normal and slow task queues, so we
|
|
||||||
can move the tasks that blocks processing for a long time (like DNSSEC
|
|
||||||
validation) into the slow queue which doesn't block fast
|
|
||||||
operations (like responding from the cache). This mitigates the whole
|
|
||||||
class of KeyTrap-like issues.
|
|
||||||
|
|
||||||
(cherry picked from commit db083a21726300916fa0b9fd8a433a796fedf636)
|
|
||||||
|
|
||||||
Don't iterate from start every time we select new signing key
|
|
||||||
|
|
||||||
Improve the selecting of the new signing key by remembering where
|
|
||||||
we stopped the iteration and just continue from that place instead
|
|
||||||
of iterating from the start over and over again each time.
|
|
||||||
|
|
||||||
(cherry picked from commit 75faeefcab47e4f1e12b358525190b4be90f97de)
|
|
||||||
|
|
||||||
Optimize selecting the signing key
|
|
||||||
|
|
||||||
Don't parse the crypto data before parsing and matching the id and the
|
|
||||||
algorithm.
|
|
||||||
|
|
||||||
(cherry picked from commit b38552cca7200a72658e482f8407f57516efc5db)
|
|
||||||
|
|
||||||
6322. [security] Specific DNS answers could cause a denial-of-service
|
|
||||||
condition due to DNS validation taking a long time.
|
|
||||||
(CVE-2023-50387) [GL #4424]
|
|
||||||
|
|
||||||
The same code change also addresses another problem:
|
|
||||||
preparing NSEC3 closest encloser proofs could exhaust
|
|
||||||
available CPU resources. (CVE-2023-50868) [GL #4459]
|
|
||||||
---
|
|
||||||
lib/dns/dst_api.c | 25 ++++--
|
|
||||||
lib/dns/include/dns/validator.h | 1 +
|
|
||||||
lib/dns/include/dst/dst.h | 4 +
|
|
||||||
lib/dns/resolver.c | 2 +-
|
|
||||||
lib/dns/validator.c | 97 +++++++++-----------
|
|
||||||
lib/dns/win32/libdns.def.in | 1 +
|
|
||||||
lib/isc/include/isc/task.h | 11 ++-
|
|
||||||
lib/isc/task.c | 153 ++++++++++++++++++++++----------
|
|
||||||
8 files changed, 186 insertions(+), 108 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
|
|
||||||
index 2156384ec1..6bcd99796c 100644
|
|
||||||
--- a/lib/dns/dst_api.c
|
|
||||||
+++ b/lib/dns/dst_api.c
|
|
||||||
@@ -105,6 +105,7 @@ static isc_result_t frombuffer(dns_name_t *name,
|
|
||||||
dns_rdataclass_t rdclass,
|
|
||||||
isc_buffer_t *source,
|
|
||||||
isc_mem_t *mctx,
|
|
||||||
+ bool no_rdata,
|
|
||||||
dst_key_t **keyp);
|
|
||||||
|
|
||||||
static isc_result_t algorithm_status(unsigned int alg);
|
|
||||||
@@ -764,6 +765,13 @@ isc_result_t
|
|
||||||
dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
|
||||||
isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
|
|
||||||
{
|
|
||||||
+ return (dst_key_fromdns_ex(name, rdclass, source, mctx, false, keyp));
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+isc_result_t
|
|
||||||
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
|
|
||||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
|
||||||
+ dst_key_t **keyp) {
|
|
||||||
uint8_t alg, proto;
|
|
||||||
uint32_t flags, extflags;
|
|
||||||
dst_key_t *key = NULL;
|
|
||||||
@@ -792,7 +800,7 @@ dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
|
||||||
}
|
|
||||||
|
|
||||||
result = frombuffer(name, alg, flags, proto, rdclass, source,
|
|
||||||
- mctx, &key);
|
|
||||||
+ mctx, no_rdata, &key);
|
|
||||||
if (result != ISC_R_SUCCESS)
|
|
||||||
return (result);
|
|
||||||
key->key_id = id;
|
|
||||||
@@ -814,7 +822,7 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
|
|
||||||
REQUIRE(dst_initialized);
|
|
||||||
|
|
||||||
result = frombuffer(name, alg, flags, protocol, rdclass, source,
|
|
||||||
- mctx, &key);
|
|
||||||
+ mctx, false, &key);
|
|
||||||
if (result != ISC_R_SUCCESS)
|
|
||||||
return (result);
|
|
||||||
|
|
||||||
@@ -1915,7 +1923,8 @@ computeid(dst_key_t *key) {
|
|
||||||
static isc_result_t
|
|
||||||
frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
|
|
||||||
unsigned int protocol, dns_rdataclass_t rdclass,
|
|
||||||
- isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp)
|
|
||||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
|
||||||
+ dst_key_t **keyp)
|
|
||||||
{
|
|
||||||
dst_key_t *key;
|
|
||||||
isc_result_t ret;
|
|
||||||
@@ -1940,10 +1949,12 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
|
|
||||||
return (DST_R_UNSUPPORTEDALG);
|
|
||||||
}
|
|
||||||
|
|
||||||
- ret = key->func->fromdns(key, source);
|
|
||||||
- if (ret != ISC_R_SUCCESS) {
|
|
||||||
- dst_key_free(&key);
|
|
||||||
- return (ret);
|
|
||||||
+ if (!no_rdata) {
|
|
||||||
+ ret = key->func->fromdns(key, source);
|
|
||||||
+ if (ret != ISC_R_SUCCESS) {
|
|
||||||
+ dst_key_free(&key);
|
|
||||||
+ return (ret);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/lib/dns/include/dns/validator.h b/lib/dns/include/dns/validator.h
|
|
||||||
index cc4478d6d4..b4bf8f29db 100644
|
|
||||||
--- a/lib/dns/include/dns/validator.h
|
|
||||||
+++ b/lib/dns/include/dns/validator.h
|
|
||||||
@@ -160,6 +160,7 @@ struct dns_validator {
|
|
||||||
unsigned int depth;
|
|
||||||
unsigned int authcount;
|
|
||||||
unsigned int authfail;
|
|
||||||
+ bool failed;
|
|
||||||
isc_stdtime_t start;
|
|
||||||
};
|
|
||||||
|
|
||||||
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
|
|
||||||
index 180c841307..a8be2daf67 100644
|
|
||||||
--- a/lib/dns/include/dst/dst.h
|
|
||||||
+++ b/lib/dns/include/dst/dst.h
|
|
||||||
@@ -435,6 +435,10 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory);
|
|
||||||
*/
|
|
||||||
|
|
||||||
isc_result_t
|
|
||||||
+dst_key_fromdns_ex(dns_name_t *name, dns_rdataclass_t rdclass,
|
|
||||||
+ isc_buffer_t *source, isc_mem_t *mctx, bool no_rdata,
|
|
||||||
+ dst_key_t **keyp);
|
|
||||||
+isc_result_t
|
|
||||||
dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
|
|
||||||
isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
|
|
||||||
/*%<
|
|
||||||
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
|
||||||
index 4f71f48039..487107614c 100644
|
|
||||||
--- a/lib/dns/resolver.c
|
|
||||||
+++ b/lib/dns/resolver.c
|
|
||||||
@@ -9267,7 +9267,7 @@ dns_resolver_create(dns_view_t *view,
|
|
||||||
if (result != ISC_R_SUCCESS)
|
|
||||||
goto cleanup_buckets;
|
|
||||||
res->buckets[i].task = NULL;
|
|
||||||
- result = isc_task_create(taskmgr, 0, &res->buckets[i].task);
|
|
||||||
+ result = isc_task_create(taskmgr, ISC_TASK_QUANTUM_SLOW, &res->buckets[i].task);
|
|
||||||
if (result != ISC_R_SUCCESS) {
|
|
||||||
DESTROYLOCK(&res->buckets[i].lock);
|
|
||||||
goto cleanup_buckets;
|
|
||||||
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
|
|
||||||
index 2a5c3caa6a..0b257fe874 100644
|
|
||||||
--- a/lib/dns/validator.c
|
|
||||||
+++ b/lib/dns/validator.c
|
|
||||||
@@ -1207,6 +1207,12 @@ create_validator(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type,
|
|
||||||
* val->key at it.
|
|
||||||
*
|
|
||||||
* If val->key is non-NULL, this returns the next matching key.
|
|
||||||
+ * If val->key is already non-NULL, start searching from the next position in
|
|
||||||
+ * 'rdataset' to find the *next* key that could have signed 'siginfo', then
|
|
||||||
+ * set val->key to that.
|
|
||||||
+ *
|
|
||||||
+ * Returns ISC_R_SUCCESS if a possible matching key has been found,
|
|
||||||
+ * ISC_R_NOTFOUND if not. Any other value indicates error.
|
|
||||||
*/
|
|
||||||
static isc_result_t
|
|
||||||
get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
|
|
||||||
@@ -1216,54 +1222,59 @@ get_dst_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo,
|
|
||||||
isc_buffer_t b;
|
|
||||||
dns_rdata_t rdata = DNS_RDATA_INIT;
|
|
||||||
dst_key_t *oldkey = val->key;
|
|
||||||
- bool foundold;
|
|
||||||
+ bool no_rdata = false;
|
|
||||||
|
|
||||||
- if (oldkey == NULL)
|
|
||||||
- foundold = true;
|
|
||||||
- else {
|
|
||||||
- foundold = false;
|
|
||||||
+ if (oldkey == NULL) {
|
|
||||||
+ result = dns_rdataset_first(rdataset);
|
|
||||||
+ } else {
|
|
||||||
+ dst_key_free(&oldkey);
|
|
||||||
val->key = NULL;
|
|
||||||
+ result = dns_rdataset_next(rdataset);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (result != ISC_R_SUCCESS) {
|
|
||||||
+ goto done;
|
|
||||||
}
|
|
||||||
|
|
||||||
- result = dns_rdataset_first(rdataset);
|
|
||||||
- if (result != ISC_R_SUCCESS)
|
|
||||||
- goto failure;
|
|
||||||
do {
|
|
||||||
dns_rdataset_current(rdataset, &rdata);
|
|
||||||
|
|
||||||
isc_buffer_init(&b, rdata.data, rdata.length);
|
|
||||||
isc_buffer_add(&b, rdata.length);
|
|
||||||
INSIST(val->key == NULL);
|
|
||||||
- result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
|
|
||||||
- val->view->mctx, &val->key);
|
|
||||||
+ result = dst_key_fromdns_ex(&siginfo->signer, rdata.rdclass, &b,
|
|
||||||
+ val->view->mctx, no_rdata,
|
|
||||||
+ &val->key);
|
|
||||||
if (result == ISC_R_SUCCESS) {
|
|
||||||
if (siginfo->algorithm ==
|
|
||||||
(dns_secalg_t)dst_key_alg(val->key) &&
|
|
||||||
siginfo->keyid ==
|
|
||||||
(dns_keytag_t)dst_key_id(val->key) &&
|
|
||||||
+ (dst_key_flags(val->key) & DNS_KEYFLAG_REVOKE) ==
|
|
||||||
+ 0 &&
|
|
||||||
dst_key_iszonekey(val->key))
|
|
||||||
{
|
|
||||||
- if (foundold) {
|
|
||||||
- /*
|
|
||||||
- * This is the key we're looking for.
|
|
||||||
- */
|
|
||||||
- return (ISC_R_SUCCESS);
|
|
||||||
- } else if (dst_key_compare(oldkey, val->key)) {
|
|
||||||
- foundold = true;
|
|
||||||
- dst_key_free(&oldkey);
|
|
||||||
+ if (no_rdata) {
|
|
||||||
+ /* Retry with full key */
|
|
||||||
+ dns_rdata_reset(&rdata);
|
|
||||||
+ dst_key_free(&val->key);
|
|
||||||
+ no_rdata = false;
|
|
||||||
+ continue;
|
|
||||||
}
|
|
||||||
+ /* This is the key we're looking for. */
|
|
||||||
+ goto done;
|
|
||||||
}
|
|
||||||
dst_key_free(&val->key);
|
|
||||||
}
|
|
||||||
dns_rdata_reset(&rdata);
|
|
||||||
result = dns_rdataset_next(rdataset);
|
|
||||||
+ no_rdata = true;
|
|
||||||
} while (result == ISC_R_SUCCESS);
|
|
||||||
- if (result == ISC_R_NOMORE)
|
|
||||||
- result = ISC_R_NOTFOUND;
|
|
||||||
|
|
||||||
- failure:
|
|
||||||
- if (oldkey != NULL)
|
|
||||||
- dst_key_free(&oldkey);
|
|
||||||
+done:
|
|
||||||
+ if (result == ISC_R_NOMORE) {
|
|
||||||
+ result = ISC_R_NOTFOUND;
|
|
||||||
+ }
|
|
||||||
|
|
||||||
return (result);
|
|
||||||
}
|
|
||||||
@@ -1633,37 +1644,13 @@ validate(dns_validator_t *val, bool resume) {
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
- do {
|
|
||||||
- vresult = verify(val, val->key, &rdata,
|
|
||||||
- val->siginfo->keyid);
|
|
||||||
- if (vresult == ISC_R_SUCCESS)
|
|
||||||
- break;
|
|
||||||
- if (val->keynode != NULL) {
|
|
||||||
- dns_keynode_t *nextnode = NULL;
|
|
||||||
- result = dns_keytable_findnextkeynode(
|
|
||||||
- val->keytable,
|
|
||||||
- val->keynode,
|
|
||||||
- &nextnode);
|
|
||||||
- dns_keytable_detachkeynode(val->keytable,
|
|
||||||
- &val->keynode);
|
|
||||||
- val->keynode = nextnode;
|
|
||||||
- if (result != ISC_R_SUCCESS) {
|
|
||||||
- val->key = NULL;
|
|
||||||
- break;
|
|
||||||
- }
|
|
||||||
- val->key = dns_keynode_key(val->keynode);
|
|
||||||
- if (val->key == NULL)
|
|
||||||
- break;
|
|
||||||
- } else {
|
|
||||||
- if (get_dst_key(val, val->siginfo, val->keyset)
|
|
||||||
- != ISC_R_SUCCESS)
|
|
||||||
- break;
|
|
||||||
- }
|
|
||||||
- } while (1);
|
|
||||||
- if (vresult != ISC_R_SUCCESS)
|
|
||||||
+ vresult = verify(val, val->key, &rdata,
|
|
||||||
+ val->siginfo->keyid);
|
|
||||||
+ if (vresult != ISC_R_SUCCESS) {
|
|
||||||
+ val->failed = true;
|
|
||||||
validator_log(val, ISC_LOG_DEBUG(3),
|
|
||||||
"failed to verify rdataset");
|
|
||||||
- else {
|
|
||||||
+ } else {
|
|
||||||
dns_rdataset_trimttl(event->rdataset,
|
|
||||||
event->sigrdataset,
|
|
||||||
val->siginfo, val->start,
|
|
||||||
@@ -1700,9 +1687,13 @@ validate(dns_validator_t *val, bool resume) {
|
|
||||||
} else {
|
|
||||||
validator_log(val, ISC_LOG_DEBUG(3),
|
|
||||||
"verify failure: %s",
|
|
||||||
- isc_result_totext(result));
|
|
||||||
+ isc_result_totext(vresult));
|
|
||||||
resume = false;
|
|
||||||
}
|
|
||||||
+ if (val->failed) {
|
|
||||||
+ result = ISC_R_NOMORE;
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
if (result != ISC_R_NOMORE) {
|
|
||||||
validator_log(val, ISC_LOG_DEBUG(3),
|
|
||||||
diff --git a/lib/dns/win32/libdns.def.in b/lib/dns/win32/libdns.def.in
|
|
||||||
index f597049493..7320653439 100644
|
|
||||||
--- a/lib/dns/win32/libdns.def.in
|
|
||||||
+++ b/lib/dns/win32/libdns.def.in
|
|
||||||
@@ -1439,6 +1439,7 @@ dst_key_format
|
|
||||||
dst_key_free
|
|
||||||
dst_key_frombuffer
|
|
||||||
dst_key_fromdns
|
|
||||||
+dst_key_fromdns_ex
|
|
||||||
dst_key_fromfile
|
|
||||||
dst_key_fromgssapi
|
|
||||||
dst_key_fromlabel
|
|
||||||
diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
|
|
||||||
index 28e5e25fc6..42f7763869 100644
|
|
||||||
--- a/lib/isc/include/isc/task.h
|
|
||||||
+++ b/lib/isc/include/isc/task.h
|
|
||||||
@@ -98,8 +98,15 @@ ISC_LANG_BEGINDECLS
|
|
||||||
***/
|
|
||||||
|
|
||||||
typedef enum {
|
|
||||||
- isc_taskmgrmode_normal = 0,
|
|
||||||
- isc_taskmgrmode_privileged
|
|
||||||
+ isc_taskqueue_normal = 0,
|
|
||||||
+ isc_taskqueue_slow = 1,
|
|
||||||
+} isc_taskqueue_t;
|
|
||||||
+
|
|
||||||
+#define ISC_TASK_QUANTUM_SLOW 1024
|
|
||||||
+
|
|
||||||
+typedef enum {
|
|
||||||
+ isc_taskmgrmode_normal = 0,
|
|
||||||
+ isc_taskmgrmode_privileged
|
|
||||||
} isc_taskmgrmode_t;
|
|
||||||
|
|
||||||
/*% Task and task manager methods */
|
|
||||||
diff --git a/lib/isc/task.c b/lib/isc/task.c
|
|
||||||
index 048639350b..cc83269df2 100644
|
|
||||||
--- a/lib/isc/task.c
|
|
||||||
+++ b/lib/isc/task.c
|
|
||||||
@@ -107,6 +107,7 @@ struct isc__task {
|
|
||||||
isc_eventlist_t on_shutdown;
|
|
||||||
unsigned int nevents;
|
|
||||||
unsigned int quantum;
|
|
||||||
+ unsigned int qid;
|
|
||||||
unsigned int flags;
|
|
||||||
isc_stdtime_t now;
|
|
||||||
isc_time_t tnow;
|
|
||||||
@@ -141,11 +142,11 @@ struct isc__taskmgr {
|
|
||||||
/* Locked by task manager lock. */
|
|
||||||
unsigned int default_quantum;
|
|
||||||
LIST(isc__task_t) tasks;
|
|
||||||
- isc__tasklist_t ready_tasks;
|
|
||||||
- isc__tasklist_t ready_priority_tasks;
|
|
||||||
+ isc__tasklist_t ready_tasks[2];
|
|
||||||
+ isc__tasklist_t ready_priority_tasks[2];
|
|
||||||
isc_taskmgrmode_t mode;
|
|
||||||
#ifdef ISC_PLATFORM_USETHREADS
|
|
||||||
- isc_condition_t work_available;
|
|
||||||
+ isc_condition_t work_available[2];
|
|
||||||
isc_condition_t exclusive_granted;
|
|
||||||
isc_condition_t paused;
|
|
||||||
#endif /* ISC_PLATFORM_USETHREADS */
|
|
||||||
@@ -247,13 +248,13 @@ isc_taskmgrmode_t
|
|
||||||
isc__taskmgr_mode(isc_taskmgr_t *manager0);
|
|
||||||
|
|
||||||
static inline bool
|
|
||||||
-empty_readyq(isc__taskmgr_t *manager);
|
|
||||||
+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
|
|
||||||
|
|
||||||
static inline isc__task_t *
|
|
||||||
-pop_readyq(isc__taskmgr_t *manager);
|
|
||||||
+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid);
|
|
||||||
|
|
||||||
static inline void
|
|
||||||
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task);
|
|
||||||
+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid);
|
|
||||||
|
|
||||||
static struct isc__taskmethods {
|
|
||||||
isc_taskmethods_t methods;
|
|
||||||
@@ -324,7 +325,8 @@ task_finished(isc__task_t *task) {
|
|
||||||
* any idle worker threads so they
|
|
||||||
* can exit.
|
|
||||||
*/
|
|
||||||
- BROADCAST(&manager->work_available);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
}
|
|
||||||
#endif /* USE_WORKER_THREADS */
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
@@ -364,7 +366,13 @@ isc__task_create(isc_taskmgr_t *manager0, unsigned int quantum,
|
|
||||||
INIT_LIST(task->events);
|
|
||||||
INIT_LIST(task->on_shutdown);
|
|
||||||
task->nevents = 0;
|
|
||||||
- task->quantum = quantum;
|
|
||||||
+ if (quantum >= ISC_TASK_QUANTUM_SLOW) {
|
|
||||||
+ task->qid = isc_taskqueue_slow;
|
|
||||||
+ task->quantum = quantum - ISC_TASK_QUANTUM_SLOW;
|
|
||||||
+ } else {
|
|
||||||
+ task->qid = isc_taskqueue_normal;
|
|
||||||
+ task->quantum = quantum;
|
|
||||||
+ }
|
|
||||||
task->flags = 0;
|
|
||||||
task->now = 0;
|
|
||||||
isc_time_settoepoch(&task->tnow);
|
|
||||||
@@ -476,11 +484,11 @@ task_ready(isc__task_t *task) {
|
|
||||||
|
|
||||||
LOCK(&manager->lock);
|
|
||||||
LOCK(&task->lock);
|
|
||||||
- push_readyq(manager, task);
|
|
||||||
+ push_readyq(manager, task, task->qid);
|
|
||||||
UNLOCK(&task->lock);
|
|
||||||
#ifdef USE_WORKER_THREADS
|
|
||||||
if (manager->mode == isc_taskmgrmode_normal || has_privilege)
|
|
||||||
- SIGNAL(&manager->work_available);
|
|
||||||
+ SIGNAL(&manager->work_available[task->qid]);
|
|
||||||
#endif /* USE_WORKER_THREADS */
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
}
|
|
||||||
@@ -961,13 +969,13 @@ isc__task_getcurrenttimex(isc_task_t *task0, isc_time_t *t) {
|
|
||||||
* Caller must hold the task manager lock.
|
|
||||||
*/
|
|
||||||
static inline bool
|
|
||||||
-empty_readyq(isc__taskmgr_t *manager) {
|
|
||||||
+empty_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
|
||||||
isc__tasklist_t queue;
|
|
||||||
|
|
||||||
if (manager->mode == isc_taskmgrmode_normal)
|
|
||||||
- queue = manager->ready_tasks;
|
|
||||||
+ queue = manager->ready_tasks[qid];
|
|
||||||
else
|
|
||||||
- queue = manager->ready_priority_tasks;
|
|
||||||
+ queue = manager->ready_priority_tasks[qid];
|
|
||||||
|
|
||||||
return (EMPTY(queue));
|
|
||||||
}
|
|
||||||
@@ -981,18 +989,18 @@ empty_readyq(isc__taskmgr_t *manager) {
|
|
||||||
* Caller must hold the task manager lock.
|
|
||||||
*/
|
|
||||||
static inline isc__task_t *
|
|
||||||
-pop_readyq(isc__taskmgr_t *manager) {
|
|
||||||
+pop_readyq(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
|
||||||
isc__task_t *task;
|
|
||||||
|
|
||||||
if (manager->mode == isc_taskmgrmode_normal)
|
|
||||||
- task = HEAD(manager->ready_tasks);
|
|
||||||
+ task = HEAD(manager->ready_tasks[qid]);
|
|
||||||
else
|
|
||||||
- task = HEAD(manager->ready_priority_tasks);
|
|
||||||
+ task = HEAD(manager->ready_priority_tasks[qid]);
|
|
||||||
|
|
||||||
if (task != NULL) {
|
|
||||||
- DEQUEUE(manager->ready_tasks, task, ready_link);
|
|
||||||
+ DEQUEUE(manager->ready_tasks[qid], task, ready_link);
|
|
||||||
if (ISC_LINK_LINKED(task, ready_priority_link))
|
|
||||||
- DEQUEUE(manager->ready_priority_tasks, task,
|
|
||||||
+ DEQUEUE(manager->ready_priority_tasks[qid], task,
|
|
||||||
ready_priority_link);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -1006,16 +1014,16 @@ pop_readyq(isc__taskmgr_t *manager) {
|
|
||||||
* Caller must hold the task manager lock.
|
|
||||||
*/
|
|
||||||
static inline void
|
|
||||||
-push_readyq(isc__taskmgr_t *manager, isc__task_t *task) {
|
|
||||||
- ENQUEUE(manager->ready_tasks, task, ready_link);
|
|
||||||
+push_readyq(isc__taskmgr_t *manager, isc__task_t *task, isc_taskqueue_t qid) {
|
|
||||||
+ ENQUEUE(manager->ready_tasks[qid], task, ready_link);
|
|
||||||
if ((task->flags & TASK_F_PRIVILEGED) != 0)
|
|
||||||
- ENQUEUE(manager->ready_priority_tasks, task,
|
|
||||||
+ ENQUEUE(manager->ready_priority_tasks[qid], task,
|
|
||||||
ready_priority_link);
|
|
||||||
manager->tasks_ready++;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
|
||||||
-dispatch(isc__taskmgr_t *manager) {
|
|
||||||
+dispatch(isc__taskmgr_t *manager, isc_taskqueue_t qid) {
|
|
||||||
isc__task_t *task;
|
|
||||||
#ifndef USE_WORKER_THREADS
|
|
||||||
unsigned int total_dispatch_count = 0;
|
|
||||||
@@ -1094,13 +1102,13 @@ dispatch(isc__taskmgr_t *manager) {
|
|
||||||
* If a pause has been requested, don't do any work
|
|
||||||
* until it's been released.
|
|
||||||
*/
|
|
||||||
- while ((empty_readyq(manager) || manager->pause_requested ||
|
|
||||||
+ while ((empty_readyq(manager, qid) || manager->pause_requested ||
|
|
||||||
manager->exclusive_requested) && !FINISHED(manager))
|
|
||||||
{
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat,
|
|
||||||
ISC_MSGSET_GENERAL,
|
|
||||||
ISC_MSG_WAIT, "wait"));
|
|
||||||
- WAIT(&manager->work_available, &manager->lock);
|
|
||||||
+ WAIT(&manager->work_available[qid], &manager->lock);
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat,
|
|
||||||
ISC_MSGSET_TASK,
|
|
||||||
ISC_MSG_AWAKE, "awake"));
|
|
||||||
@@ -1113,7 +1121,7 @@ dispatch(isc__taskmgr_t *manager) {
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_TASK,
|
|
||||||
ISC_MSG_WORKING, "working"));
|
|
||||||
|
|
||||||
- task = pop_readyq(manager);
|
|
||||||
+ task = pop_readyq(manager, qid);
|
|
||||||
if (task != NULL) {
|
|
||||||
unsigned int dispatch_count = 0;
|
|
||||||
bool done = false;
|
|
||||||
@@ -1278,7 +1286,7 @@ dispatch(isc__taskmgr_t *manager) {
|
|
||||||
*/
|
|
||||||
#ifdef USE_WORKER_THREADS
|
|
||||||
LOCK(&task->lock);
|
|
||||||
- push_readyq(manager, task);
|
|
||||||
+ push_readyq(manager, task, qid);
|
|
||||||
UNLOCK(&task->lock);
|
|
||||||
#else
|
|
||||||
ENQUEUE(new_ready_tasks, task, ready_link);
|
|
||||||
@@ -1297,10 +1305,14 @@ dispatch(isc__taskmgr_t *manager) {
|
|
||||||
* we're stuck. Automatically drop privileges at that
|
|
||||||
* point and continue with the regular ready queue.
|
|
||||||
*/
|
|
||||||
- if (manager->tasks_running == 0 && empty_readyq(manager)) {
|
|
||||||
+ if (manager->tasks_running == 0 && empty_readyq(manager, isc_taskqueue_normal) && empty_readyq(manager, isc_taskqueue_slow)) {
|
|
||||||
manager->mode = isc_taskmgrmode_normal;
|
|
||||||
- if (!empty_readyq(manager))
|
|
||||||
- BROADCAST(&manager->work_available);
|
|
||||||
+ if (!empty_readyq(manager, isc_taskqueue_normal)) {
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ }
|
|
||||||
+ if (!empty_readyq(manager, isc_taskqueue_slow)) {
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
}
|
|
||||||
@@ -1322,13 +1334,37 @@ static isc_threadresult_t
|
|
||||||
#ifdef _WIN32
|
|
||||||
WINAPI
|
|
||||||
#endif
|
|
||||||
-run(void *uap) {
|
|
||||||
+run_normal(void *uap) {
|
|
||||||
isc__taskmgr_t *manager = uap;
|
|
||||||
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
ISC_MSG_STARTING, "starting"));
|
|
||||||
|
|
||||||
- dispatch(manager);
|
|
||||||
+ dispatch(manager, isc_taskqueue_normal);
|
|
||||||
+
|
|
||||||
+ XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
+ ISC_MSG_EXITING, "exiting"));
|
|
||||||
+
|
|
||||||
+#ifdef OPENSSL_LEAKS
|
|
||||||
+ ERR_remove_state(0);
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+ return ((isc_threadresult_t)0);
|
|
||||||
+}
|
|
||||||
+#endif /* USE_WORKER_THREADS */
|
|
||||||
+
|
|
||||||
+#ifdef USE_WORKER_THREADS
|
|
||||||
+static isc_threadresult_t
|
|
||||||
+#ifdef _WIN32
|
|
||||||
+WINAPI
|
|
||||||
+#endif
|
|
||||||
+run_slow(void *uap) {
|
|
||||||
+ isc__taskmgr_t *manager = uap;
|
|
||||||
+
|
|
||||||
+ XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
+ ISC_MSG_STARTING, "starting"));
|
|
||||||
+
|
|
||||||
+ dispatch(manager, isc_taskqueue_slow);
|
|
||||||
|
|
||||||
XTHREADTRACE(isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
ISC_MSG_EXITING, "exiting"));
|
|
||||||
@@ -1347,7 +1383,8 @@ manager_free(isc__taskmgr_t *manager) {
|
|
||||||
|
|
||||||
#ifdef USE_WORKER_THREADS
|
|
||||||
(void)isc_condition_destroy(&manager->exclusive_granted);
|
|
||||||
- (void)isc_condition_destroy(&manager->work_available);
|
|
||||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
(void)isc_condition_destroy(&manager->paused);
|
|
||||||
isc_mem_free(manager->mctx, manager->threads);
|
|
||||||
#endif /* USE_WORKER_THREADS */
|
|
||||||
@@ -1414,12 +1451,20 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
|
||||||
#ifdef USE_WORKER_THREADS
|
|
||||||
manager->workers = 0;
|
|
||||||
manager->threads = isc_mem_allocate(mctx,
|
|
||||||
- workers * sizeof(isc_thread_t));
|
|
||||||
+ 2 * workers * sizeof(isc_thread_t));
|
|
||||||
if (manager->threads == NULL) {
|
|
||||||
result = ISC_R_NOMEMORY;
|
|
||||||
goto cleanup_lock;
|
|
||||||
}
|
|
||||||
- if (isc_condition_init(&manager->work_available) != ISC_R_SUCCESS) {
|
|
||||||
+ if (isc_condition_init(&manager->work_available[isc_taskqueue_normal]) != ISC_R_SUCCESS) {
|
|
||||||
+ UNEXPECTED_ERROR(__FILE__, __LINE__,
|
|
||||||
+ "isc_condition_init() %s",
|
|
||||||
+ isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
+ ISC_MSG_FAILED, "failed"));
|
|
||||||
+ result = ISC_R_UNEXPECTED;
|
|
||||||
+ goto cleanup_threads;
|
|
||||||
+ }
|
|
||||||
+ if (isc_condition_init(&manager->work_available[isc_taskqueue_slow]) != ISC_R_SUCCESS) {
|
|
||||||
UNEXPECTED_ERROR(__FILE__, __LINE__,
|
|
||||||
"isc_condition_init() %s",
|
|
||||||
isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
|
|
||||||
@@ -1448,8 +1493,10 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
|
||||||
default_quantum = DEFAULT_DEFAULT_QUANTUM;
|
|
||||||
manager->default_quantum = default_quantum;
|
|
||||||
INIT_LIST(manager->tasks);
|
|
||||||
- INIT_LIST(manager->ready_tasks);
|
|
||||||
- INIT_LIST(manager->ready_priority_tasks);
|
|
||||||
+ INIT_LIST(manager->ready_tasks[isc_taskqueue_normal]);
|
|
||||||
+ INIT_LIST(manager->ready_tasks[isc_taskqueue_slow]);
|
|
||||||
+ INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_normal]);
|
|
||||||
+ INIT_LIST(manager->ready_priority_tasks[isc_taskqueue_slow]);
|
|
||||||
manager->tasks_running = 0;
|
|
||||||
manager->tasks_ready = 0;
|
|
||||||
manager->exclusive_requested = false;
|
|
||||||
@@ -1465,7 +1512,19 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
|
||||||
* Start workers.
|
|
||||||
*/
|
|
||||||
for (i = 0; i < workers; i++) {
|
|
||||||
- if (isc_thread_create(run, manager,
|
|
||||||
+ if (isc_thread_create(run_normal, manager,
|
|
||||||
+ &manager->threads[manager->workers]) ==
|
|
||||||
+ ISC_R_SUCCESS) {
|
|
||||||
+ char name[21]; /* thread name limit on Linux */
|
|
||||||
+ snprintf(name, sizeof(name), "isc-worker%04u", i);
|
|
||||||
+ isc_thread_setname(manager->threads[manager->workers],
|
|
||||||
+ name);
|
|
||||||
+ manager->workers++;
|
|
||||||
+ started++;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+ for (; i < workers * 2; i++) {
|
|
||||||
+ if (isc_thread_create(run_slow, manager,
|
|
||||||
&manager->threads[manager->workers]) ==
|
|
||||||
ISC_R_SUCCESS) {
|
|
||||||
char name[21]; /* thread name limit on Linux */
|
|
||||||
@@ -1482,7 +1541,7 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
|
||||||
manager_free(manager);
|
|
||||||
return (ISC_R_NOTHREADS);
|
|
||||||
}
|
|
||||||
- isc_thread_setconcurrency(workers);
|
|
||||||
+ isc_thread_setconcurrency(workers * 2);
|
|
||||||
#endif /* USE_WORKER_THREADS */
|
|
||||||
#ifdef USE_SHARED_MANAGER
|
|
||||||
manager->refs = 1;
|
|
||||||
@@ -1497,7 +1556,8 @@ isc__taskmgr_create(isc_mem_t *mctx, unsigned int workers,
|
|
||||||
cleanup_exclusivegranted:
|
|
||||||
(void)isc_condition_destroy(&manager->exclusive_granted);
|
|
||||||
cleanup_workavailable:
|
|
||||||
- (void)isc_condition_destroy(&manager->work_available);
|
|
||||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
+ (void)isc_condition_destroy(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
cleanup_threads:
|
|
||||||
isc_mem_free(mctx, manager->threads);
|
|
||||||
cleanup_lock:
|
|
||||||
@@ -1582,7 +1642,7 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
|
|
||||||
task = NEXT(task, link)) {
|
|
||||||
LOCK(&task->lock);
|
|
||||||
if (task_shutdown(task))
|
|
||||||
- push_readyq(manager, task);
|
|
||||||
+ push_readyq(manager, task, task->qid);
|
|
||||||
UNLOCK(&task->lock);
|
|
||||||
}
|
|
||||||
#ifdef USE_WORKER_THREADS
|
|
||||||
@@ -1591,7 +1651,8 @@ isc__taskmgr_destroy(isc_taskmgr_t **managerp) {
|
|
||||||
* there's work left to do, and if there are already no tasks left
|
|
||||||
* it will cause the workers to see manager->exiting.
|
|
||||||
*/
|
|
||||||
- BROADCAST(&manager->work_available);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
|
|
||||||
/*
|
|
||||||
@@ -1693,7 +1754,8 @@ isc__taskmgr_resume(isc_taskmgr_t *manager0) {
|
|
||||||
LOCK(&manager->lock);
|
|
||||||
if (manager->pause_requested) {
|
|
||||||
manager->pause_requested = false;
|
|
||||||
- BROADCAST(&manager->work_available);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
}
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
}
|
|
||||||
@@ -1778,7 +1840,8 @@ isc__task_endexclusive(isc_task_t *task0) {
|
|
||||||
LOCK(&manager->lock);
|
|
||||||
REQUIRE(manager->exclusive_requested);
|
|
||||||
manager->exclusive_requested = false;
|
|
||||||
- BROADCAST(&manager->work_available);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_normal]);
|
|
||||||
+ BROADCAST(&manager->work_available[isc_taskqueue_slow]);
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
#else
|
|
||||||
UNUSED(task0);
|
|
||||||
@@ -1804,10 +1867,10 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
|
|
||||||
|
|
||||||
LOCK(&manager->lock);
|
|
||||||
if (priv && ISC_LINK_LINKED(task, ready_link))
|
|
||||||
- ENQUEUE(manager->ready_priority_tasks, task,
|
|
||||||
+ ENQUEUE(manager->ready_priority_tasks[task->qid], task,
|
|
||||||
ready_priority_link);
|
|
||||||
else if (!priv && ISC_LINK_LINKED(task, ready_priority_link))
|
|
||||||
- DEQUEUE(manager->ready_priority_tasks, task,
|
|
||||||
+ DEQUEUE(manager->ready_priority_tasks[task->qid], task,
|
|
||||||
ready_priority_link);
|
|
||||||
UNLOCK(&manager->lock);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.43.2
|
|
||||||
|
|
|
@ -0,0 +1,65 @@
|
||||||
|
From 8a7bff93037432fcfe8532752e89f150ea3030a4 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Petr Mensik <pemensik@redhat.com>
|
||||||
|
Date: Mon, 9 Oct 2023 19:00:12 +0200
|
||||||
|
Subject: [PATCH] Do not keep stale records by default
|
||||||
|
|
||||||
|
By default set max-stale-ttl to 0, unless stale-answer-enable yes. This
|
||||||
|
were enabled by mistake when backporting fix for CVE-2023-2828. It
|
||||||
|
causes increased cache usage on servers not wanting to serve stale
|
||||||
|
records. Fix that by setting smart defaults based on stale answers
|
||||||
|
enabled with possible manual tuning.
|
||||||
|
---
|
||||||
|
bin/named/server.c | 25 +++++++++++++++++++------
|
||||||
|
1 file changed, 19 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/bin/named/server.c b/bin/named/server.c
|
||||||
|
index 7af90d0..afdc4fa 100644
|
||||||
|
--- a/bin/named/server.c
|
||||||
|
+++ b/bin/named/server.c
|
||||||
|
@@ -3295,7 +3295,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||||
|
size_t max_acache_size;
|
||||||
|
size_t max_adb_size;
|
||||||
|
uint32_t lame_ttl, fail_ttl;
|
||||||
|
- uint32_t max_stale_ttl;
|
||||||
|
+ uint32_t max_stale_ttl = 0;
|
||||||
|
dns_tsig_keyring_t *ring = NULL;
|
||||||
|
dns_view_t *pview = NULL; /* Production view */
|
||||||
|
isc_mem_t *cmctx = NULL, *hmctx = NULL;
|
||||||
|
@@ -3739,16 +3739,29 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
|
||||||
|
if (view->maxncachettl > 7 * 24 * 3600)
|
||||||
|
view->maxncachettl = 7 * 24 * 3600;
|
||||||
|
|
||||||
|
- obj = NULL;
|
||||||
|
- result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||||
|
- INSIST(result == ISC_R_SUCCESS);
|
||||||
|
- max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
-
|
||||||
|
obj = NULL;
|
||||||
|
result = ns_config_get(maps, "stale-answer-enable", &obj);
|
||||||
|
INSIST(result == ISC_R_SUCCESS);
|
||||||
|
view->staleanswersenable = cfg_obj_asboolean(obj);
|
||||||
|
|
||||||
|
+ // RHEL-11785 -- set the stale-ttl to non-zero value only if enabled
|
||||||
|
+ obj = NULL;
|
||||||
|
+ if (view->staleanswersenable) {
|
||||||
|
+ result = ns_config_get(maps, "max-stale-ttl", &obj);
|
||||||
|
+ INSIST(result == ISC_R_SUCCESS);
|
||||||
|
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
+ /*
|
||||||
|
+ * If 'stale-answer-enable' is false, max_stale_ttl is set
|
||||||
|
+ * to 0, meaning keeping stale RRsets in cache is disabled.
|
||||||
|
+ */
|
||||||
|
+ } else {
|
||||||
|
+ /* Do not use default value if stale is disabled,
|
||||||
|
+ * but allow manual overriding, like 'stale-cache-enable' */
|
||||||
|
+ result = ns_config_get(optionmaps, "max-stale-ttl", &obj);
|
||||||
|
+ if (result == ISC_R_SUCCESS)
|
||||||
|
+ max_stale_ttl = cfg_obj_asuint32(obj);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
result = dns_viewlist_find(&ns_g_server->viewlist, view->name,
|
||||||
|
view->rdclass, &pview);
|
||||||
|
if (result == ISC_R_SUCCESS) {
|
||||||
|
--
|
||||||
|
2.41.0
|
||||||
|
|
|
@ -0,0 +1,31 @@
|
||||||
|
From 4e595a6b961e73af43350833109ccba0950119f9 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Mark Andrews <marka@isc.org>
|
||||||
|
Date: Thu, 12 Oct 2023 10:19:38 +1100
|
||||||
|
Subject: [PATCH] Update b.root-servers.net IP addresses
|
||||||
|
|
||||||
|
This covers both root hints and the default primaries for the root
|
||||||
|
zone mirror. The official change date is Nov 27, 2023.
|
||||||
|
|
||||||
|
(cherry picked from commit 2ca2f7e9852a3d6e93f065c01ea4679f723688f7)
|
||||||
|
---
|
||||||
|
lib/dns/rootns.c | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
|
||||||
|
index 9653f3b..d6ff76e 100644
|
||||||
|
--- a/lib/dns/rootns.c
|
||||||
|
+++ b/lib/dns/rootns.c
|
||||||
|
@@ -56,8 +56,8 @@ static char root_ns[] =
|
||||||
|
". 518400 IN NS M.ROOT-SERVERS.NET.\n"
|
||||||
|
"A.ROOT-SERVERS.NET. 3600000 IN A 198.41.0.4\n"
|
||||||
|
"A.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:503:BA3E::2:30\n"
|
||||||
|
-"B.ROOT-SERVERS.NET. 3600000 IN A 199.9.14.201\n"
|
||||||
|
-"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:200::b\n"
|
||||||
|
+"B.ROOT-SERVERS.NET. 3600000 IN A 170.247.170.2\n"
|
||||||
|
+"B.ROOT-SERVERS.NET. 3600000 IN AAAA 2801:1b8:10::b\n"
|
||||||
|
"C.ROOT-SERVERS.NET. 3600000 IN A 192.33.4.12\n"
|
||||||
|
"C.ROOT-SERVERS.NET. 3600000 IN AAAA 2001:500:2::c\n"
|
||||||
|
"D.ROOT-SERVERS.NET. 3600000 IN A 199.7.91.13\n"
|
||||||
|
--
|
||||||
|
2.43.0
|
||||||
|
|
|
@ -1,13 +1,13 @@
|
||||||
|
|
||||||
; <<>> DiG 9.11.3-RedHat-9.11.3-3.fc27 <<>> +bufsize=1200 +norec @a.root-servers.net
|
; <<>> DiG 9.18.20 <<>> -4 +tcp +norec +nostats @d.root-servers.net
|
||||||
; (2 servers found)
|
; (1 server found)
|
||||||
;; global options: +cmd
|
;; global options: +cmd
|
||||||
;; Got answer:
|
;; Got answer:
|
||||||
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46900
|
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47286
|
||||||
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
|
;; flags: qr aa; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 27
|
||||||
|
|
||||||
;; OPT PSEUDOSECTION:
|
;; OPT PSEUDOSECTION:
|
||||||
; EDNS: version: 0, flags:; udp: 1472
|
; EDNS: version: 0, flags:; udp: 1450
|
||||||
;; QUESTION SECTION:
|
;; QUESTION SECTION:
|
||||||
;. IN NS
|
;. IN NS
|
||||||
|
|
||||||
|
@ -28,7 +28,7 @@
|
||||||
|
|
||||||
;; ADDITIONAL SECTION:
|
;; ADDITIONAL SECTION:
|
||||||
a.root-servers.net. 518400 IN A 198.41.0.4
|
a.root-servers.net. 518400 IN A 198.41.0.4
|
||||||
b.root-servers.net. 518400 IN A 199.9.14.201
|
b.root-servers.net. 518400 IN A 170.247.170.2
|
||||||
c.root-servers.net. 518400 IN A 192.33.4.12
|
c.root-servers.net. 518400 IN A 192.33.4.12
|
||||||
d.root-servers.net. 518400 IN A 199.7.91.13
|
d.root-servers.net. 518400 IN A 199.7.91.13
|
||||||
e.root-servers.net. 518400 IN A 192.203.230.10
|
e.root-servers.net. 518400 IN A 192.203.230.10
|
||||||
|
@ -41,7 +41,7 @@ k.root-servers.net. 518400 IN A 193.0.14.129
|
||||||
l.root-servers.net. 518400 IN A 199.7.83.42
|
l.root-servers.net. 518400 IN A 199.7.83.42
|
||||||
m.root-servers.net. 518400 IN A 202.12.27.33
|
m.root-servers.net. 518400 IN A 202.12.27.33
|
||||||
a.root-servers.net. 518400 IN AAAA 2001:503:ba3e::2:30
|
a.root-servers.net. 518400 IN AAAA 2001:503:ba3e::2:30
|
||||||
b.root-servers.net. 518400 IN AAAA 2001:500:200::b
|
b.root-servers.net. 518400 IN AAAA 2801:1b8:10::b
|
||||||
c.root-servers.net. 518400 IN AAAA 2001:500:2::c
|
c.root-servers.net. 518400 IN AAAA 2001:500:2::c
|
||||||
d.root-servers.net. 518400 IN AAAA 2001:500:2d::d
|
d.root-servers.net. 518400 IN AAAA 2001:500:2d::d
|
||||||
e.root-servers.net. 518400 IN AAAA 2001:500:a8::e
|
e.root-servers.net. 518400 IN AAAA 2001:500:a8::e
|
||||||
|
@ -54,8 +54,3 @@ k.root-servers.net. 518400 IN AAAA 2001:7fd::1
|
||||||
l.root-servers.net. 518400 IN AAAA 2001:500:9f::42
|
l.root-servers.net. 518400 IN AAAA 2001:500:9f::42
|
||||||
m.root-servers.net. 518400 IN AAAA 2001:dc3::35
|
m.root-servers.net. 518400 IN AAAA 2001:dc3::35
|
||||||
|
|
||||||
;; Query time: 24 msec
|
|
||||||
;; SERVER: 198.41.0.4#53(198.41.0.4)
|
|
||||||
;; WHEN: Thu Apr 05 15:57:34 CEST 2018
|
|
||||||
;; MSG SIZE rcvd: 811
|
|
||||||
|
|
||||||
|
|
|
@ -68,7 +68,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
|
||||||
Name: bind
|
Name: bind
|
||||||
License: MPLv2.0
|
License: MPLv2.0
|
||||||
Version: 9.11.36
|
Version: 9.11.36
|
||||||
Release: 11%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.1
|
Release: 13%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
|
||||||
Epoch: 32
|
Epoch: 32
|
||||||
Url: https://www.isc.org/downloads/bind/
|
Url: https://www.isc.org/downloads/bind/
|
||||||
#
|
#
|
||||||
|
@ -175,14 +175,10 @@ Patch196: bind-9.16-CVE-2022-3094-test.patch
|
||||||
# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
|
# https://gitlab.isc.org/isc-projects/bind9/commit/f1d9e9ee3859976f403914d20ad2a10855343702
|
||||||
Patch197: bind-9.11-CVE-2023-2828.patch
|
Patch197: bind-9.11-CVE-2023-2828.patch
|
||||||
Patch198: bind-9.16-CVE-2023-3341.patch
|
Patch198: bind-9.16-CVE-2023-3341.patch
|
||||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8768
|
# https://issues.redhat.com/browse/RHEL-11785, downstream
|
||||||
Patch199: bind-9.11-CVE-2023-4408.patch
|
Patch199: bind-9.11-stale-cache.patch
|
||||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8769
|
# https://gitlab.isc.org/isc-projects/bind9/commit/8924adca613ca9daea63786563cce6fdbd742c56
|
||||||
Patch200: bind-9.11-CVE-2023-50387.patch
|
Patch200: bind-9.16-update-b.root-servers.net.patch
|
||||||
# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/8778
|
|
||||||
Patch201: bind-9.11-CVE-2023-2828-fixup.patch
|
|
||||||
# addition to patch 200
|
|
||||||
Patch202: bind-9.11-CVE-2023-50387-fixup.patch
|
|
||||||
|
|
||||||
# SDB patches
|
# SDB patches
|
||||||
Patch11: bind-9.3.2b2-sdbsrc.patch
|
Patch11: bind-9.3.2b2-sdbsrc.patch
|
||||||
|
@ -591,10 +587,8 @@ are used for building ISC DHCP.
|
||||||
%patch196 -p1 -b .CVE-2022-3094-test
|
%patch196 -p1 -b .CVE-2022-3094-test
|
||||||
%patch197 -p1 -b .CVE-2023-2828
|
%patch197 -p1 -b .CVE-2023-2828
|
||||||
%patch198 -p1 -b .CVE-2023-3341
|
%patch198 -p1 -b .CVE-2023-3341
|
||||||
%patch199 -p1 -b .CVE-2023-4408
|
%patch199 -p1 -b .RHEL-11785
|
||||||
%patch200 -p1 -b .CVE-2023-50387+50868
|
%patch200 -p1 -b .b.root-servers.net
|
||||||
%patch201 -p1 -b .CVE-2023-2828-fixup
|
|
||||||
%patch202 -p1 -b .CVE-2023-50387-fixup
|
|
||||||
|
|
||||||
mkdir lib/dns/tests/testdata/dstrandom
|
mkdir lib/dns/tests/testdata/dstrandom
|
||||||
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
|
cp -a %{SOURCE50} lib/dns/tests/testdata/dstrandom/random.data
|
||||||
|
@ -1647,10 +1641,11 @@ rm -rf ${RPM_BUILD_ROOT}
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Mon Feb 26 2024 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11.1
|
* Thu Dec 07 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-13
|
||||||
- Speed up parsing of DNS messages with many different names (CVE-2023-4408)
|
- Update addresses of b.root-servers.net (RHEL-18449)
|
||||||
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
|
|
||||||
- Do not use header_prev in expire_lru_headers
|
* Mon Oct 09 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-12
|
||||||
|
- Disable caching of stale records by default (RHEL-11785)
|
||||||
|
|
||||||
* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
|
* Tue Sep 19 2023 Petr Menšík <pemensik@redhat.com> - 32:9.11.36-11
|
||||||
- Prevent exahustion of memory from control channel (CVE-2023-3341)
|
- Prevent exahustion of memory from control channel (CVE-2023-3341)
|
||||||
|
|
Loading…
Reference in New Issue