xref: /netbsd-src/external/mpl/bind/dist/lib/dns/resolver.c (revision bcda20f65a8566e103791ec395f7f499ef322704)
1 /*	$NetBSD: resolver.c,v 1.21 2025/01/26 16:25:25 christos Exp $	*/
2 
3 /*
4  * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
5  *
6  * SPDX-License-Identifier: MPL-2.0
7  *
8  * This Source Code Form is subject to the terms of the Mozilla Public
9  * License, v. 2.0. If a copy of the MPL was not distributed with this
10  * file, you can obtain one at https://mozilla.org/MPL/2.0/.
11  *
12  * See the COPYRIGHT file distributed with this work for additional
13  * information regarding copyright ownership.
14  */
15 
16 /*! \file */
17 
18 #include <ctype.h>
19 #include <inttypes.h>
20 #include <stdbool.h>
21 
22 #include <isc/ascii.h>
23 #include <isc/async.h>
24 #include <isc/atomic.h>
25 #include <isc/counter.h>
26 #include <isc/hash.h>
27 #include <isc/hashmap.h>
28 #include <isc/log.h>
29 #include <isc/loop.h>
30 #include <isc/mutex.h>
31 #include <isc/random.h>
32 #include <isc/refcount.h>
33 #include <isc/result.h>
34 #include <isc/rwlock.h>
35 #include <isc/siphash.h>
36 #include <isc/stats.h>
37 #include <isc/string.h>
38 #include <isc/tid.h>
39 #include <isc/time.h>
40 #include <isc/timer.h>
41 #include <isc/util.h>
42 
43 #include <dns/acl.h>
44 #include <dns/adb.h>
45 #include <dns/cache.h>
46 #include <dns/db.h>
47 #include <dns/dispatch.h>
48 #include <dns/dns64.h>
49 #include <dns/dnstap.h>
50 #include <dns/ds.h>
51 #include <dns/edns.h>
52 #include <dns/forward.h>
53 #include <dns/keytable.h>
54 #include <dns/log.h>
55 #include <dns/message.h>
56 #include <dns/name.h>
57 #include <dns/nametree.h>
58 #include <dns/ncache.h>
59 #include <dns/nsec.h>
60 #include <dns/nsec3.h>
61 #include <dns/opcode.h>
62 #include <dns/peer.h>
63 #include <dns/rbt.h>
64 #include <dns/rcode.h>
65 #include <dns/rdata.h>
66 #include <dns/rdataclass.h>
67 #include <dns/rdatalist.h>
68 #include <dns/rdataset.h>
69 #include <dns/rdatastruct.h>
70 #include <dns/rdatatype.h>
71 #include <dns/resolver.h>
72 #include <dns/rootns.h>
73 #include <dns/stats.h>
74 #include <dns/tsig.h>
75 #include <dns/validator.h>
76 #include <dns/zone.h>
77 
78 #ifdef WANT_QUERYTRACE
79 #define RTRACE(m)                                                             \
80 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                     \
81 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \
82 		      res, (m))
83 #define RRTRACE(r, m)                                                         \
84 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                     \
85 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), "res %p: %s", \
86 		      (r), (m))
87 #define FCTXTRACE(m)                                            \
88 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,       \
89 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \
90 		      "fctx %p(%s): %s", fctx, fctx->info, (m))
91 #define FCTXTRACE2(m1, m2)                                      \
92 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,       \
93 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), \
94 		      "fctx %p(%s): %s %s", fctx, fctx->info, (m1), (m2))
95 #define FCTXTRACE3(m, res)                                              \
96 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,               \
97 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),         \
98 		      "fctx %p(%s): [result: %s] %s", fctx, fctx->info, \
99 		      isc_result_totext(res), (m))
100 #define FCTXTRACE4(m1, m2, res)                                            \
101 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                  \
102 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),            \
103 		      "fctx %p(%s): [result: %s] %s %s", fctx, fctx->info, \
104 		      isc_result_totext(res), (m1), (m2))
105 #define FCTXTRACE5(m1, m2, v)                                               \
106 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                   \
107 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),             \
108 		      "fctx %p(%s): %s %s%u", fctx, fctx->info, (m1), (m2), \
109 		      (v))
110 #define FTRACE(m)                                                          \
111 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                  \
112 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),            \
113 		      "fetch %p (fctx %p(%s)): %s", fetch, fetch->private, \
114 		      fetch->private->info, (m))
115 #define QTRACE(m)                                                          \
116 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,                  \
117 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),            \
118 		      "resquery %p (fctx %p(%s)): %s", query, query->fctx, \
119 		      query->fctx->info, (m))
120 #else /* ifdef WANT_QUERYTRACE */
121 #define RTRACE(m)          \
122 	do {               \
123 		UNUSED(m); \
124 	} while (0)
125 #define RRTRACE(r, m)      \
126 	do {               \
127 		UNUSED(r); \
128 		UNUSED(m); \
129 	} while (0)
130 #define FCTXTRACE(m)          \
131 	do {                  \
132 		UNUSED(fctx); \
133 		UNUSED(m);    \
134 	} while (0)
135 #define FCTXTRACE2(m1, m2)    \
136 	do {                  \
137 		UNUSED(fctx); \
138 		UNUSED(m1);   \
139 		UNUSED(m2);   \
140 	} while (0)
141 #define FCTXTRACE3(m1, res)   \
142 	do {                  \
143 		UNUSED(fctx); \
144 		UNUSED(m1);   \
145 		UNUSED(res);  \
146 	} while (0)
147 #define FCTXTRACE4(m1, m2, res) \
148 	do {                    \
149 		UNUSED(fctx);   \
150 		UNUSED(m1);     \
151 		UNUSED(m2);     \
152 		UNUSED(res);    \
153 	} while (0)
154 #define FCTXTRACE5(m1, m2, v) \
155 	do {                  \
156 		UNUSED(fctx); \
157 		UNUSED(m1);   \
158 		UNUSED(m2);   \
159 		UNUSED(v);    \
160 	} while (0)
161 #define FTRACE(m)          \
162 	do {               \
163 		UNUSED(m); \
164 	} while (0)
165 #define QTRACE(m)          \
166 	do {               \
167 		UNUSED(m); \
168 	} while (0)
169 #endif /* WANT_QUERYTRACE */
170 
171 /*
172  * The maximum time we will wait for a single query.
173  */
174 #define MAX_SINGLE_QUERY_TIMEOUT    9000U
175 #define MAX_SINGLE_QUERY_TIMEOUT_US (MAX_SINGLE_QUERY_TIMEOUT * US_PER_MS)
176 
177 /*
178  * The default maximum number of validations and validation failures per-fetch
179  */
180 #ifndef DEFAULT_MAX_VALIDATIONS
181 #define DEFAULT_MAX_VALIDATIONS 16
182 #endif
183 #ifndef DEFAULT_MAX_VALIDATION_FAILURES
184 #define DEFAULT_MAX_VALIDATION_FAILURES 1
185 #endif
186 
187 /*
188  * A minumum sane timeout value for the whole query to live when e.g. talking to
189  * a backend server and a quick timeout is preferred by the user.
190  *
191  * IMPORTANT: if changing this value, note there is a documented behavior when
192  * values of 'resolver-query-timeout' less than or equal to 300 are treated as
193  * seconds and converted to milliseconds before applying the limits, that's
194  * why the value of 301 was chosen as the absolute minimum in order to not break
195  * backward compatibility.
196  */
197 #define MINIMUM_QUERY_TIMEOUT 301U
198 
199 /*
200  * The default time in seconds for the whole query to live.
201  * We want to allow an individual query time to complete / timeout.
202  */
203 #ifndef DEFAULT_QUERY_TIMEOUT
204 #define DEFAULT_QUERY_TIMEOUT (MAX_SINGLE_QUERY_TIMEOUT + 1000U)
205 #endif /* ifndef DEFAULT_QUERY_TIMEOUT */
206 
207 /* The maximum time in seconds for the whole query to live. */
208 #ifndef MAXIMUM_QUERY_TIMEOUT
209 #define MAXIMUM_QUERY_TIMEOUT 30000
210 #endif /* ifndef MAXIMUM_QUERY_TIMEOUT */
211 
212 /* The default maximum number of recursions to follow before giving up. */
213 #ifndef DEFAULT_RECURSION_DEPTH
214 #define DEFAULT_RECURSION_DEPTH 7
215 #endif /* ifndef DEFAULT_RECURSION_DEPTH */
216 
217 /* The default maximum number of iterative queries to allow before giving up. */
218 #ifndef DEFAULT_MAX_QUERIES
219 #define DEFAULT_MAX_QUERIES 50
220 #endif /* ifndef DEFAULT_MAX_QUERIES */
221 
222 /*
223  * After NS_FAIL_LIMIT attempts to fetch a name server address,
224  * if the number of addresses in the NS RRset exceeds NS_RR_LIMIT,
225  * stop trying to fetch, in order to avoid wasting resources.
226  */
227 #define NS_FAIL_LIMIT 4
228 #define NS_RR_LIMIT   5
229 /*
230  * IP address lookups are performed for at most NS_PROCESSING_LIMIT NS RRs in
231  * any NS RRset encountered, to avoid excessive resource use while processing
232  * large delegations.
233  */
234 #define NS_PROCESSING_LIMIT 20
235 
236 STATIC_ASSERT(NS_PROCESSING_LIMIT > NS_RR_LIMIT,
237 	      "The maximum number of NS RRs processed for each delegation "
238 	      "(NS_PROCESSING_LIMIT) must be larger than the large delegation "
239 	      "threshold (NS_RR_LIMIT).");
240 
241 /* Hash table for zone counters */
242 #ifndef RES_DOMAIN_HASH_BITS
243 #define RES_DOMAIN_HASH_BITS 12
244 #endif /* ifndef RES_DOMAIN_HASH_BITS */
245 
246 /*%
247  * Maximum EDNS0 input packet size.
248  */
249 #define RECV_BUFFER_SIZE 4096 /* XXXRTH  Constant. */
250 
251 /*%
252  * This defines the maximum number of timeouts we will permit before we
253  * disable EDNS0 on the query.
254  */
255 #define MAX_EDNS0_TIMEOUTS 3
256 
257 typedef struct fetchctx fetchctx_t;
258 
259 typedef struct query {
260 	/* Locked by loop event serialization. */
261 	unsigned int magic;
262 	isc_refcount_t references;
263 	fetchctx_t *fctx;
264 	dns_message_t *rmessage;
265 	dns_dispatchmgr_t *dispatchmgr;
266 	dns_dispatch_t *dispatch;
267 	dns_adbaddrinfo_t *addrinfo;
268 	isc_time_t start;
269 	dns_messageid_t id;
270 	dns_dispentry_t *dispentry;
271 	ISC_LINK(struct query) link;
272 	isc_buffer_t buffer;
273 	isc_buffer_t *tsig;
274 	dns_tsigkey_t *tsigkey;
275 	int ednsversion;
276 	unsigned int options;
277 	unsigned int attributes;
278 	unsigned int udpsize;
279 	unsigned char data[512];
280 } resquery_t;
281 
282 #if DNS_RESOLVER_TRACE
283 #define resquery_ref(ptr)   resquery__ref(ptr, __func__, __FILE__, __LINE__)
284 #define resquery_unref(ptr) resquery__unref(ptr, __func__, __FILE__, __LINE__)
285 #define resquery_attach(ptr, ptrp) \
286 	resquery__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
287 #define resquery_detach(ptrp) \
288 	resquery__detach(ptrp, __func__, __FILE__, __LINE__)
289 ISC_REFCOUNT_TRACE_DECL(resquery);
290 #else
291 ISC_REFCOUNT_DECL(resquery);
292 #endif
293 
294 struct tried {
295 	isc_sockaddr_t addr;
296 	unsigned int count;
297 	ISC_LINK(struct tried) link;
298 };
299 
300 #define QUERY_MAGIC	   ISC_MAGIC('Q', '!', '!', '!')
301 #define VALID_QUERY(query) ISC_MAGIC_VALID(query, QUERY_MAGIC)
302 
303 #define RESQUERY_ATTR_CANCELED 0x02
304 
305 #define RESQUERY_CONNECTING(q) ((q)->connects > 0)
306 #define RESQUERY_CANCELED(q)   (((q)->attributes & RESQUERY_ATTR_CANCELED) != 0)
307 #define RESQUERY_SENDING(q)    ((q)->sends > 0)
308 
309 typedef enum {
310 	fetchstate_active,
311 	fetchstate_done /*%< Fetch completion events posted. */
312 } fetchstate_t;
313 
314 typedef enum {
315 	badns_unreachable = 0,
316 	badns_response,
317 	badns_validation,
318 	badns_forwarder,
319 } badnstype_t;
320 
321 #define FCTXCOUNT_MAGIC		 ISC_MAGIC('F', 'C', 'n', 't')
322 #define VALID_FCTXCOUNT(counter) ISC_MAGIC_VALID(counter, FCTXCOUNT_MAGIC)
323 
324 typedef struct fctxcount fctxcount_t;
325 struct fctxcount {
326 	unsigned int magic;
327 	isc_mem_t *mctx;
328 	isc_mutex_t lock;
329 	dns_fixedname_t dfname;
330 	dns_name_t *domain;
331 	uint_fast32_t count;
332 	uint_fast32_t allowed;
333 	uint_fast32_t dropped;
334 	isc_stdtime_t logged;
335 };
336 
337 struct fetchctx {
338 	/*% Not locked. */
339 	unsigned int magic;
340 	dns_resolver_t *res;
341 	dns_fixedname_t fname;
342 	dns_name_t *name;
343 	dns_rdatatype_t type;
344 	unsigned int options;
345 	fctxcount_t *counter;
346 	char *info;
347 	isc_mem_t *mctx;
348 	isc_stdtime_t now;
349 
350 	isc_loop_t *loop;
351 	unsigned int tid;
352 
353 	/* Atomic */
354 	isc_refcount_t references;
355 
356 	/*% Locked by lock. */
357 	isc_mutex_t lock;
358 	fetchstate_t state;
359 	bool hashed;
360 	bool cloned;
361 	bool spilled;
362 	ISC_LINK(struct fetchctx) link;
363 	ISC_LIST(dns_fetchresponse_t) resps;
364 
365 	/*% Locked by loop event serialization. */
366 	dns_fixedname_t dfname;
367 	dns_name_t *domain;
368 	dns_rdataset_t nameservers;
369 	atomic_uint_fast32_t attributes;
370 	isc_timer_t *timer;
371 	isc_time_t expires;
372 	isc_time_t next_timeout;
373 	isc_interval_t interval;
374 	dns_message_t *qmessage;
375 	ISC_LIST(resquery_t) queries;
376 	dns_adbfindlist_t finds;
377 	dns_adbfind_t *find;
378 	/*
379 	 * altfinds are names and/or addresses of dual stack servers that
380 	 * should be used when iterative resolution to a server is not
381 	 * possible because the address family of that server is not usable.
382 	 */
383 	dns_adbfindlist_t altfinds;
384 	dns_adbfind_t *altfind;
385 	dns_adbaddrinfolist_t forwaddrs;
386 	dns_adbaddrinfolist_t altaddrs;
387 	dns_forwarderlist_t forwarders;
388 	dns_fwdpolicy_t fwdpolicy;
389 	isc_sockaddrlist_t bad;
390 	ISC_LIST(struct tried) edns;
391 	isc_sockaddrlist_t bad_edns;
392 	dns_validator_t *validator;
393 	ISC_LIST(dns_validator_t) validators;
394 	dns_db_t *cache;
395 	dns_adb_t *adb;
396 	bool ns_ttl_ok;
397 	uint32_t ns_ttl;
398 	isc_counter_t *qc;
399 	bool minimized;
400 	unsigned int qmin_labels;
401 	isc_result_t qmin_warning;
402 	bool force_qmin_warning;
403 	bool ip6arpaskip;
404 	bool forwarding;
405 	dns_fixedname_t qminfname;
406 	dns_name_t *qminname;
407 	dns_rdatatype_t qmintype;
408 	dns_fetch_t *qminfetch;
409 	dns_rdataset_t qminrrset;
410 	dns_fixedname_t qmindcfname;
411 	dns_name_t *qmindcname;
412 	dns_fixedname_t fwdfname;
413 	dns_name_t *fwdname;
414 
415 	/*%
416 	 * The number of events we're waiting for.
417 	 */
418 	atomic_uint_fast32_t pending;
419 
420 	/*%
421 	 * The number of times we've "restarted" the current
422 	 * nameserver set.  This acts as a failsafe to prevent
423 	 * us from pounding constantly on a particular set of
424 	 * servers that, for whatever reason, are not giving
425 	 * us useful responses, but are responding in such a
426 	 * way that they are not marked "bad".
427 	 */
428 	unsigned int restarts;
429 
430 	/*%
431 	 * The number of timeouts that have occurred since we
432 	 * last successfully received a response packet.  This
433 	 * is used for EDNS0 black hole detection.
434 	 */
435 	unsigned int timeouts;
436 
437 	/*%
438 	 * Look aside state for DS lookups.
439 	 */
440 	dns_fixedname_t nsfname;
441 	dns_name_t *nsname;
442 
443 	dns_fetch_t *nsfetch;
444 	dns_rdataset_t nsrrset;
445 
446 	/*%
447 	 * Number of queries that reference this context.
448 	 */
449 	atomic_uint_fast32_t nqueries; /* Bucket lock. */
450 
451 	/*%
452 	 * Random numbers to use for mixing up server addresses.
453 	 */
454 	uint32_t rand_buf;
455 	uint32_t rand_bits;
456 
457 	/*%
458 	 * Fetch-local statistics for detailed logging.
459 	 */
460 	isc_result_t result;  /*%< fetch result */
461 	isc_result_t vresult; /*%< validation result */
462 	isc_time_t start;
463 	uint64_t duration;
464 	bool logged;
465 	unsigned int querysent;
466 	unsigned int referrals;
467 	unsigned int lamecount;
468 	unsigned int quotacount;
469 	unsigned int neterr;
470 	unsigned int badresp;
471 	unsigned int adberr;
472 	unsigned int findfail;
473 	unsigned int valfail;
474 	bool timeout;
475 	dns_adbaddrinfo_t *addrinfo;
476 	unsigned int depth;
477 	char clientstr[ISC_SOCKADDR_FORMATSIZE];
478 
479 	uint32_t nvalidations;
480 	uint32_t nfails;
481 };
482 
483 #define FCTX_MAGIC	 ISC_MAGIC('F', '!', '!', '!')
484 #define VALID_FCTX(fctx) ISC_MAGIC_VALID(fctx, FCTX_MAGIC)
485 
486 #define FCTX_ATTR_HAVEANSWER 0x0001
487 #define FCTX_ATTR_GLUING     0x0002
488 #define FCTX_ATTR_ADDRWAIT   0x0004
489 #define FCTX_ATTR_WANTCACHE  0x0010
490 #define FCTX_ATTR_WANTNCACHE 0x0020
491 #define FCTX_ATTR_NEEDEDNS0  0x0040
492 #define FCTX_ATTR_TRIEDFIND  0x0080
493 #define FCTX_ATTR_TRIEDALT   0x0100
494 
495 #define HAVE_ANSWER(f) \
496 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_HAVEANSWER) != 0)
497 #define GLUING(f) \
498 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_GLUING) != 0)
499 #define ADDRWAIT(f) \
500 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_ADDRWAIT) != 0)
501 #define SHUTTINGDOWN(f) ((f)->state == fetchstate_done)
502 #define WANTCACHE(f) \
503 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTCACHE) != 0)
504 #define WANTNCACHE(f) \
505 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_WANTNCACHE) != 0)
506 #define NEEDEDNS0(f) \
507 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_NEEDEDNS0) != 0)
508 #define TRIEDFIND(f) \
509 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDFIND) != 0)
510 #define TRIEDALT(f) \
511 	((atomic_load_acquire(&(f)->attributes) & FCTX_ATTR_TRIEDALT) != 0)
512 
513 #define FCTX_ATTR_SET(f, a) atomic_fetch_or_release(&(f)->attributes, (a))
514 #define FCTX_ATTR_CLR(f, a) atomic_fetch_and_release(&(f)->attributes, ~(a))
515 
516 typedef struct {
517 	dns_adbaddrinfo_t *addrinfo;
518 	fetchctx_t *fctx;
519 } dns_valarg_t;
520 
521 struct dns_fetch {
522 	unsigned int magic;
523 	isc_mem_t *mctx;
524 	dns_resolver_t *res;
525 	fetchctx_t *private;
526 };
527 
528 #define DNS_FETCH_MAGIC	       ISC_MAGIC('F', 't', 'c', 'h')
529 #define DNS_FETCH_VALID(fetch) ISC_MAGIC_VALID(fetch, DNS_FETCH_MAGIC)
530 
531 typedef struct alternate {
532 	bool isaddress;
533 	union {
534 		isc_sockaddr_t addr;
535 		struct {
536 			dns_name_t name;
537 			in_port_t port;
538 		} _n;
539 	} _u;
540 	ISC_LINK(struct alternate) link;
541 } alternate_t;
542 
543 struct dns_resolver {
544 	/* Unlocked. */
545 	unsigned int magic;
546 	isc_mem_t *mctx;
547 	isc_mutex_t lock;
548 	isc_mutex_t primelock;
549 	dns_rdataclass_t rdclass;
550 	isc_loopmgr_t *loopmgr;
551 	isc_nm_t *nm;
552 	dns_view_t *view;
553 	bool frozen;
554 	unsigned int options;
555 	isc_tlsctx_cache_t *tlsctx_cache;
556 	dns_dispatchset_t *dispatches4;
557 	dns_dispatchset_t *dispatches6;
558 
559 	isc_hashmap_t *fctxs;
560 	isc_rwlock_t fctxs_lock;
561 
562 	isc_hashmap_t *counters;
563 	isc_rwlock_t counters_lock;
564 
565 	uint32_t lame_ttl;
566 	ISC_LIST(alternate_t) alternates;
567 	dns_nametree_t *algorithms;
568 	dns_nametree_t *digests;
569 	dns_nametree_t *mustbesecure;
570 	unsigned int spillatmax;
571 	unsigned int spillatmin;
572 	isc_timer_t *spillattimer;
573 	bool zero_no_soa_ttl;
574 	unsigned int query_timeout;
575 	unsigned int maxdepth;
576 	unsigned int maxqueries;
577 	isc_result_t quotaresp[2];
578 	isc_stats_t *stats;
579 	dns_stats_t *querystats;
580 
581 	/* Additions for serve-stale feature. */
582 	unsigned int retryinterval; /* in milliseconds */
583 	unsigned int nonbackofftries;
584 
585 	/* Atomic */
586 	isc_refcount_t references;
587 	atomic_uint_fast32_t zspill; /* fetches-per-zone */
588 	atomic_bool exiting;
589 	atomic_bool priming;
590 
591 	atomic_uint_fast32_t maxvalidations;
592 	atomic_uint_fast32_t maxvalidationfails;
593 
594 	/* Locked by lock. */
595 	unsigned int spillat; /* clients-per-query */
596 
597 	/* Locked by primelock. */
598 	dns_fetch_t *primefetch;
599 
600 	/* Atomic. */
601 	atomic_uint_fast32_t nfctx;
602 
603 	uint32_t nloops;
604 
605 	isc_mempool_t **namepools;
606 	isc_mempool_t **rdspools;
607 };
608 
609 #define RES_MAGIC	    ISC_MAGIC('R', 'e', 's', '!')
610 #define VALID_RESOLVER(res) ISC_MAGIC_VALID(res, RES_MAGIC)
611 
612 /*%
613  * Private addrinfo flags.
614  */
615 enum {
616 	FCTX_ADDRINFO_MARK = 1 << 0,
617 	FCTX_ADDRINFO_FORWARDER = 1 << 1,
618 	FCTX_ADDRINFO_EDNSOK = 1 << 2,
619 	FCTX_ADDRINFO_NOCOOKIE = 1 << 3,
620 	FCTX_ADDRINFO_BADCOOKIE = 1 << 4,
621 	FCTX_ADDRINFO_DUALSTACK = 1 << 5,
622 	FCTX_ADDRINFO_NOEDNS0 = 1 << 6,
623 };
624 
625 #define UNMARKED(a)    (((a)->flags & FCTX_ADDRINFO_MARK) == 0)
626 #define ISFORWARDER(a) (((a)->flags & FCTX_ADDRINFO_FORWARDER) != 0)
627 #define NOCOOKIE(a)    (((a)->flags & FCTX_ADDRINFO_NOCOOKIE) != 0)
628 #define EDNSOK(a)      (((a)->flags & FCTX_ADDRINFO_EDNSOK) != 0)
629 #define BADCOOKIE(a)   (((a)->flags & FCTX_ADDRINFO_BADCOOKIE) != 0)
630 #define ISDUALSTACK(a) (((a)->flags & FCTX_ADDRINFO_DUALSTACK) != 0)
631 
632 #define NXDOMAIN(r)   (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
633 #define NEGATIVE(r)   (((r)->attributes & DNS_RDATASETATTR_NEGATIVE) != 0)
634 #define STATICSTUB(r) (((r)->attributes & DNS_RDATASETATTR_STATICSTUB) != 0)
635 
636 #ifdef ENABLE_AFL
637 bool dns_fuzzing_resolver = false;
638 void
639 dns_resolver_setfuzzing(void) {
640 	dns_fuzzing_resolver = true;
641 }
642 #endif /* ifdef ENABLE_AFL */
643 
644 static unsigned char ip6_arpa_data[] = "\003IP6\004ARPA";
645 static unsigned char ip6_arpa_offsets[] = { 0, 4, 9 };
646 static const dns_name_t ip6_arpa = DNS_NAME_INITABSOLUTE(ip6_arpa_data,
647 							 ip6_arpa_offsets);
648 
649 static void
650 dns_resolver__destroy(dns_resolver_t *res);
651 static isc_result_t
652 resquery_send(resquery_t *query);
653 static void
654 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg);
655 static void
656 resquery_response_continue(void *arg, isc_result_t result);
657 static void
658 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg);
659 static void
660 fctx_try(fetchctx_t *fctx, bool retrying);
661 static void
662 fctx_shutdown(void *arg);
663 static void
664 fctx_minimize_qname(fetchctx_t *fctx);
665 static void
666 fctx_destroy(fetchctx_t *fctx);
667 static isc_result_t
668 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
669 		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
670 		  dns_ttl_t maxttl, bool optout, bool secure,
671 		  dns_rdataset_t *ardataset, isc_result_t *eresultp);
672 static void
673 validated(void *arg);
674 static void
675 maybe_cancel_validators(fetchctx_t *fctx);
676 static void
677 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo,
678 	isc_result_t reason, badnstype_t badtype);
679 static isc_result_t
680 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
681 	    dns_rdatatype_t type, dns_name_t **noqname);
682 
683 #define fctx_done_detach(fctxp, result)                                 \
684 	if (fctx__done(*fctxp, result, __func__, __FILE__, __LINE__)) { \
685 		fetchctx_detach(fctxp);                                 \
686 	}
687 
688 #define fctx_done_unref(fctx, result)                                 \
689 	if (fctx__done(fctx, result, __func__, __FILE__, __LINE__)) { \
690 		fetchctx_unref(fctx);                                 \
691 	}
692 
693 #if DNS_RESOLVER_TRACE
694 #define fetchctx_ref(ptr)   fetchctx__ref(ptr, __func__, __FILE__, __LINE__)
695 #define fetchctx_unref(ptr) fetchctx__unref(ptr, __func__, __FILE__, __LINE__)
696 #define fetchctx_attach(ptr, ptrp) \
697 	fetchctx__attach(ptr, ptrp, __func__, __FILE__, __LINE__)
698 #define fetchctx_detach(ptrp) \
699 	fetchctx__detach(ptrp, __func__, __FILE__, __LINE__)
700 ISC_REFCOUNT_TRACE_DECL(fetchctx);
701 #else
702 ISC_REFCOUNT_DECL(fetchctx);
703 #endif
704 
705 static bool
706 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func,
707 	   const char *file, unsigned int line);
708 
709 static void
710 resume_qmin(void *arg);
711 
712 static isc_result_t
713 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
714 		  dns_rdatatype_t type, const dns_name_t *domain,
715 		  dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
716 		  unsigned int options, unsigned int depth, isc_counter_t *qc,
717 		  fetchctx_t **fctxp, bool *new_fctx);
718 static void
719 release_fctx(fetchctx_t *fctx);
720 
721 /*%
722  * The structure and functions defined below implement the resolver
723  * query (resquery) response handling logic.
724  *
725  * When a resolver query is sent and a response is received, the
726  * resquery_response() event handler is run, which calls the rctx_*()
727  * functions.  The respctx_t structure maintains state from function
728  * to function.
729  *
730  * The call flow is described below:
731  *
732  * 1. resquery_response():
733  *    - Initialize a respctx_t structure (rctx_respinit()).
734  *    - Check for dispatcher failure (rctx_dispfail()).
735  *    - Parse the response (rctx_parse()).
736  *    - Log the response (rctx_logpacket()).
737  *    - Check the parsed response for an OPT record and handle
738  *      EDNS (rctx_opt(), rctx_edns()).
739  *    - Check for a bad or lame server (rctx_badserver(), rctx_lameserver()).
740  *    - If RCODE and ANCOUNT suggest this is a positive answer, and
741  *      if so, call rctx_answer(): go to step 2.
742  *    - If RCODE and NSCOUNT suggest this is a negative answer or a
743  *      referral, call rctx_answer_none(): go to step 4.
744  *    - Check the additional section for data that should be cached
745  *      (rctx_additional()).
746  *    - Clean up and finish by calling rctx_done(): go to step 5.
747  *
748  * 2. rctx_answer():
749  *    - If the answer appears to be positive, call rctx_answer_positive():
750  *      go to step 3.
751  *    - If the response is a malformed delegation (with glue or NS records
752  *      in the answer section), call rctx_answer_none(): go to step 4.
753  *
754  * 3. rctx_answer_positive():
755  *    - Initialize the portions of respctx_t needed for processing an answer
756  *      (rctx_answer_init()).
757  *    - Scan the answer section to find records that are responsive to the
758  *      query (rctx_answer_scan()).
759  *    - For whichever type of response was found, call a separate routine
760  *      to handle it: matching QNAME/QTYPE (rctx_answer_match()),
761  *      CNAME (rctx_answer_cname()), covering DNAME (rctx_answer_dname()),
762  *      or any records returned in response to a query of type ANY
763  *      (rctx_answer_any()).
764  *    - Scan the authority section for NS or other records that may be
765  *      included with a positive answer (rctx_authority_scan()).
766  *
767  * 4. rctx_answer_none():
768  *    - Determine whether this is an NXDOMAIN, NXRRSET, or referral.
769  *    - If referral, set up the resolver to follow the delegation
770  *      (rctx_referral()).
771  *    - If NXDOMAIN/NXRRSET, scan the authority section for NS and SOA
772  *      records included with a negative response (rctx_authority_negative()),
773  *      then for DNSSEC proof of nonexistence (rctx_authority_dnssec()).
774  *
775  * 5. rctx_done():
776  *    - Set up chasing of DS records if needed (rctx_chaseds()).
777  *    - If the response wasn't intended for us, wait for another response
778  *      from the dispatcher (rctx_next()).
779  *    - If there is a problem with the responding server, set up another
780  *      query to a different server (rctx_nextserver()).
781  *    - If there is a problem that might be temporary or dependent on
782  *      EDNS options, set up another query to the same server with changed
783  *      options (rctx_resend()).
784  *    - Shut down the fetch context.
785  */
786 
787 typedef struct respctx {
788 	resquery_t *query;
789 	fetchctx_t *fctx;
790 	isc_mem_t *mctx;
791 	isc_result_t result;
792 	isc_buffer_t buffer;
793 	unsigned int retryopts; /* updated options to pass to
794 				 * fctx_query() when resending */
795 
796 	dns_rdatatype_t type; /* type being sought (set to
797 			       * ANY if qtype was SIG or RRSIG) */
798 	bool aa;	      /* authoritative answer? */
799 	dns_trust_t trust;    /* answer trust level */
800 	bool chaining;	      /* CNAME/DNAME processing? */
801 	bool next_server;     /* give up, try the next server
802 			       * */
803 
804 	badnstype_t broken_type; /* type of name server problem
805 				  * */
806 	isc_result_t broken_server;
807 
808 	bool get_nameservers; /* get a new NS rrset at
809 			       * zone cut? */
810 	bool resend;	      /* resend this query? */
811 	bool nextitem;	      /* invalid response; keep
812 			       * listening for the correct one */
813 	bool truncated;	      /* response was truncated */
814 	bool no_response;     /* no response was received */
815 	bool glue_in_answer;  /* glue may be in the answer
816 			       * section */
817 	bool ns_in_answer;    /* NS may be in the answer
818 			       * section */
819 	bool negative;	      /* is this a negative response? */
820 
821 	isc_stdtime_t now; /* time info */
822 	isc_time_t tnow;
823 	isc_time_t *finish;
824 
825 	unsigned int dname_labels;
826 	unsigned int domain_labels; /* range of permissible number
827 				     * of
828 				     * labels in a DNAME */
829 
830 	dns_name_t *aname;	   /* answer name */
831 	dns_rdataset_t *ardataset; /* answer rdataset */
832 
833 	dns_name_t *cname;	   /* CNAME name */
834 	dns_rdataset_t *crdataset; /* CNAME rdataset */
835 
836 	dns_name_t *dname;	   /* DNAME name */
837 	dns_rdataset_t *drdataset; /* DNAME rdataset */
838 
839 	dns_name_t *ns_name;	     /* NS name */
840 	dns_rdataset_t *ns_rdataset; /* NS rdataset */
841 
842 	dns_name_t *soa_name; /* SOA name in a negative answer */
843 	dns_name_t *ds_name;  /* DS name in a negative answer */
844 
845 	dns_name_t *found_name;	    /* invalid name in negative
846 				     * response */
847 	dns_rdatatype_t found_type; /* invalid type in negative
848 				     * response */
849 
850 	dns_rdataset_t *opt; /* OPT rdataset */
851 } respctx_t;
852 
853 static void
854 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result,
855 	      isc_region_t *region, respctx_t *rctx);
856 
857 static void
858 rctx_answer_init(respctx_t *rctx);
859 
860 static void
861 rctx_answer_scan(respctx_t *rctx);
862 
863 static void
864 rctx_authority_positive(respctx_t *rctx);
865 
866 static isc_result_t
867 rctx_answer_any(respctx_t *rctx);
868 
869 static isc_result_t
870 rctx_answer_match(respctx_t *rctx);
871 
872 static isc_result_t
873 rctx_answer_cname(respctx_t *rctx);
874 
875 static isc_result_t
876 rctx_answer_dname(respctx_t *rctx);
877 
878 static isc_result_t
879 rctx_answer_positive(respctx_t *rctx);
880 
881 static isc_result_t
882 rctx_authority_negative(respctx_t *rctx);
883 
884 static isc_result_t
885 rctx_authority_dnssec(respctx_t *rctx);
886 
887 static void
888 rctx_additional(respctx_t *rctx);
889 
890 static isc_result_t
891 rctx_referral(respctx_t *rctx);
892 
893 static isc_result_t
894 rctx_answer_none(respctx_t *rctx);
895 
896 static void
897 rctx_nextserver(respctx_t *rctx, dns_message_t *message,
898 		dns_adbaddrinfo_t *addrinfo, isc_result_t result);
899 
900 static void
901 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo);
902 
903 static isc_result_t
904 rctx_next(respctx_t *rctx);
905 
906 static void
907 rctx_chaseds(respctx_t *rctx, dns_message_t *message,
908 	     dns_adbaddrinfo_t *addrinfo, isc_result_t result);
909 
910 static void
911 rctx_done(respctx_t *rctx, isc_result_t result);
912 
913 static void
914 rctx_logpacket(respctx_t *rctx);
915 
916 static void
917 rctx_opt(respctx_t *rctx);
918 
919 static void
920 rctx_edns(respctx_t *rctx);
921 
922 static isc_result_t
923 rctx_parse(respctx_t *rctx);
924 
925 static isc_result_t
926 rctx_badserver(respctx_t *rctx, isc_result_t result);
927 
928 static isc_result_t
929 rctx_answer(respctx_t *rctx);
930 
931 static isc_result_t
932 rctx_lameserver(respctx_t *rctx);
933 
934 static isc_result_t
935 rctx_dispfail(respctx_t *rctx);
936 
937 static isc_result_t
938 rctx_timedout(respctx_t *rctx);
939 
940 static void
941 rctx_ncache(respctx_t *rctx);
942 
943 /*%
944  * Increment resolver-related statistics counters.
945  */
946 static void
947 inc_stats(dns_resolver_t *res, isc_statscounter_t counter) {
948 	if (res->stats != NULL) {
949 		isc_stats_increment(res->stats, counter);
950 	}
951 }
952 
953 static void
954 dec_stats(dns_resolver_t *res, isc_statscounter_t counter) {
955 	if (res->stats != NULL) {
956 		isc_stats_decrement(res->stats, counter);
957 	}
958 }
959 
960 static void
961 set_stats(dns_resolver_t *res, isc_statscounter_t counter, uint64_t val) {
962 	if (res->stats != NULL) {
963 		isc_stats_set(res->stats, val, counter);
964 	}
965 }
966 
967 static isc_result_t
968 valcreate(fetchctx_t *fctx, dns_message_t *message, dns_adbaddrinfo_t *addrinfo,
969 	  dns_name_t *name, dns_rdatatype_t type, dns_rdataset_t *rdataset,
970 	  dns_rdataset_t *sigrdataset, unsigned int valoptions) {
971 	dns_validator_t *validator = NULL;
972 	dns_valarg_t *valarg = NULL;
973 	isc_result_t result;
974 
975 	valarg = isc_mem_get(fctx->mctx, sizeof(*valarg));
976 	*valarg = (dns_valarg_t){
977 		.addrinfo = addrinfo,
978 	};
979 
980 	fetchctx_attach(fctx, &valarg->fctx);
981 
982 	if (!ISC_LIST_EMPTY(fctx->validators)) {
983 		valoptions |= DNS_VALIDATOR_DEFER;
984 	} else {
985 		valoptions &= ~DNS_VALIDATOR_DEFER;
986 	}
987 
988 	result = dns_validator_create(
989 		fctx->res->view, name, type, rdataset, sigrdataset, message,
990 		valoptions, fctx->loop, validated, valarg, &fctx->nvalidations,
991 		&fctx->nfails, fctx->qc, &validator);
992 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
993 	inc_stats(fctx->res, dns_resstatscounter_val);
994 	if ((valoptions & DNS_VALIDATOR_DEFER) == 0) {
995 		INSIST(fctx->validator == NULL);
996 		fctx->validator = validator;
997 	}
998 	ISC_LIST_APPEND(fctx->validators, validator, link);
999 	return ISC_R_SUCCESS;
1000 }
1001 
1002 static void
1003 resquery_destroy(resquery_t *query) {
1004 	fetchctx_t *fctx = query->fctx;
1005 
1006 	query->magic = 0;
1007 
1008 	if (ISC_LINK_LINKED(query, link)) {
1009 		ISC_LIST_UNLINK(fctx->queries, query, link);
1010 	}
1011 
1012 	if (query->tsig != NULL) {
1013 		isc_buffer_free(&query->tsig);
1014 	}
1015 
1016 	if (query->tsigkey != NULL) {
1017 		dns_tsigkey_detach(&query->tsigkey);
1018 	}
1019 
1020 	if (query->dispentry != NULL) {
1021 		dns_dispatch_done(&query->dispentry);
1022 	}
1023 
1024 	if (query->dispatch != NULL) {
1025 		dns_dispatch_detach(&query->dispatch);
1026 	}
1027 
1028 	LOCK(&fctx->lock);
1029 	atomic_fetch_sub_release(&fctx->nqueries, 1);
1030 	UNLOCK(&fctx->lock);
1031 
1032 	if (query->rmessage != NULL) {
1033 		dns_message_detach(&query->rmessage);
1034 	}
1035 
1036 	isc_mem_put(fctx->mctx, query, sizeof(*query));
1037 
1038 	fetchctx_detach(&fctx);
1039 }
1040 
1041 #if DNS_RESOLVER_TRACE
1042 ISC_REFCOUNT_TRACE_IMPL(resquery, resquery_destroy);
1043 #else
1044 ISC_REFCOUNT_IMPL(resquery, resquery_destroy);
1045 #endif
1046 
1047 /*%
1048  * Update EDNS statistics for a server after not getting a response to a UDP
1049  * query sent to it.
1050  */
1051 static void
1052 update_edns_stats(resquery_t *query) {
1053 	fetchctx_t *fctx = query->fctx;
1054 
1055 	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
1056 		return;
1057 	}
1058 
1059 	if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
1060 		dns_adb_ednsto(fctx->adb, query->addrinfo);
1061 	} else {
1062 		dns_adb_timeout(fctx->adb, query->addrinfo);
1063 	}
1064 }
1065 
1066 static void
1067 fctx_expired(void *arg);
1068 
1069 /*
1070  * Start the maximum lifetime timer for the fetch. This will
1071  * trigger if, for example, some ADB or validator dependency
1072  * loop occurs and causes a fetch to hang.
1073  */
1074 static void
1075 fctx_starttimer(fetchctx_t *fctx) {
1076 	isc_interval_t interval;
1077 	isc_time_t now;
1078 	isc_time_t expires;
1079 
1080 	isc_interval_set(&interval, 2, 0);
1081 	isc_time_add(&fctx->expires, &interval, &expires);
1082 
1083 	now = isc_time_now();
1084 	if (isc_time_compare(&expires, &now) <= 0) {
1085 		isc_interval_set(&interval, 0, 1);
1086 	} else {
1087 		isc_time_subtract(&expires, &now, &interval);
1088 	}
1089 
1090 	isc_timer_start(fctx->timer, isc_timertype_once, &interval);
1091 }
1092 
1093 static void
1094 fctx_stoptimer(fetchctx_t *fctx) {
1095 	isc_timer_stop(fctx->timer);
1096 }
1097 
1098 static void
1099 fctx_cancelquery(resquery_t **queryp, isc_time_t *finish, bool no_response,
1100 		 bool age_untried) {
1101 	resquery_t *query = NULL;
1102 	fetchctx_t *fctx = NULL;
1103 	dns_adbfind_t *find = NULL;
1104 	dns_adbaddrinfo_t *addrinfo;
1105 	isc_stdtime_t now = isc_stdtime_now();
1106 
1107 	REQUIRE(queryp != NULL);
1108 
1109 	query = *queryp;
1110 	fctx = query->fctx;
1111 
1112 	if (RESQUERY_CANCELED(query)) {
1113 		return;
1114 	}
1115 
1116 	FCTXTRACE("cancelquery");
1117 
1118 	query->attributes |= RESQUERY_ATTR_CANCELED;
1119 
1120 	/*
1121 	 * Should we update the RTT?
1122 	 */
1123 	if (finish != NULL || no_response) {
1124 		unsigned int rtt, factor;
1125 		if (finish != NULL) {
1126 			/*
1127 			 * We have both the start and finish times for this
1128 			 * packet, so we can compute a real RTT.
1129 			 */
1130 			unsigned int rttms;
1131 
1132 			rtt = (unsigned int)isc_time_microdiff(finish,
1133 							       &query->start);
1134 			rttms = rtt / US_PER_MS;
1135 			factor = DNS_ADB_RTTADJDEFAULT;
1136 
1137 			if (rttms < DNS_RESOLVER_QRYRTTCLASS0) {
1138 				inc_stats(fctx->res,
1139 					  dns_resstatscounter_queryrtt0);
1140 			} else if (rttms < DNS_RESOLVER_QRYRTTCLASS1) {
1141 				inc_stats(fctx->res,
1142 					  dns_resstatscounter_queryrtt1);
1143 			} else if (rttms < DNS_RESOLVER_QRYRTTCLASS2) {
1144 				inc_stats(fctx->res,
1145 					  dns_resstatscounter_queryrtt2);
1146 			} else if (rttms < DNS_RESOLVER_QRYRTTCLASS3) {
1147 				inc_stats(fctx->res,
1148 					  dns_resstatscounter_queryrtt3);
1149 			} else if (rttms < DNS_RESOLVER_QRYRTTCLASS4) {
1150 				inc_stats(fctx->res,
1151 					  dns_resstatscounter_queryrtt4);
1152 			} else {
1153 				inc_stats(fctx->res,
1154 					  dns_resstatscounter_queryrtt5);
1155 			}
1156 		} else {
1157 			uint32_t value;
1158 			uint32_t mask;
1159 
1160 			update_edns_stats(query);
1161 
1162 			/*
1163 			 * If "forward first;" is used and a forwarder timed
1164 			 * out, do not attempt to query it again in this fetch
1165 			 * context.
1166 			 */
1167 			if (fctx->fwdpolicy == dns_fwdpolicy_first &&
1168 			    ISFORWARDER(query->addrinfo))
1169 			{
1170 				add_bad(fctx, query->rmessage, query->addrinfo,
1171 					ISC_R_TIMEDOUT, badns_forwarder);
1172 			}
1173 
1174 			/*
1175 			 * We don't have an RTT for this query.  Maybe the
1176 			 * packet was lost, or maybe this server is very
1177 			 * slow.  We don't know.  Increase the RTT.
1178 			 */
1179 			INSIST(no_response);
1180 			value = isc_random32();
1181 			if (query->addrinfo->srtt > 800000) {
1182 				mask = 0x3fff;
1183 			} else if (query->addrinfo->srtt > 400000) {
1184 				mask = 0x7fff;
1185 			} else if (query->addrinfo->srtt > 200000) {
1186 				mask = 0xffff;
1187 			} else if (query->addrinfo->srtt > 100000) {
1188 				mask = 0x1ffff;
1189 			} else if (query->addrinfo->srtt > 50000) {
1190 				mask = 0x3ffff;
1191 			} else if (query->addrinfo->srtt > 25000) {
1192 				mask = 0x7ffff;
1193 			} else {
1194 				mask = 0xfffff;
1195 			}
1196 
1197 			/*
1198 			 * Don't adjust timeout on EDNS queries unless we have
1199 			 * seen a EDNS response.
1200 			 */
1201 			if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0 &&
1202 			    !EDNSOK(query->addrinfo))
1203 			{
1204 				mask >>= 2;
1205 			}
1206 
1207 			rtt = query->addrinfo->srtt + (value & mask);
1208 			if (rtt > MAX_SINGLE_QUERY_TIMEOUT_US) {
1209 				rtt = MAX_SINGLE_QUERY_TIMEOUT_US;
1210 			}
1211 			if (rtt > fctx->res->query_timeout * US_PER_MS) {
1212 				rtt = fctx->res->query_timeout * US_PER_MS;
1213 			}
1214 
1215 			/*
1216 			 * Replace the current RTT with our value.
1217 			 */
1218 			factor = DNS_ADB_RTTADJREPLACE;
1219 		}
1220 
1221 		dns_adb_adjustsrtt(fctx->adb, query->addrinfo, rtt, factor);
1222 	}
1223 
1224 	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
1225 		/* Inform the ADB that we're ending a UDP fetch */
1226 		dns_adb_endudpfetch(fctx->adb, query->addrinfo);
1227 	}
1228 
1229 	/*
1230 	 * Age RTTs of servers not tried.
1231 	 */
1232 	if (finish != NULL || age_untried) {
1233 		for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
1234 		     addrinfo != NULL;
1235 		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
1236 		{
1237 			if (UNMARKED(addrinfo)) {
1238 				dns_adb_agesrtt(fctx->adb, addrinfo, now);
1239 			}
1240 		}
1241 	}
1242 
1243 	if ((finish != NULL || age_untried) && TRIEDFIND(fctx)) {
1244 		for (find = ISC_LIST_HEAD(fctx->finds); find != NULL;
1245 		     find = ISC_LIST_NEXT(find, publink))
1246 		{
1247 			for (addrinfo = ISC_LIST_HEAD(find->list);
1248 			     addrinfo != NULL;
1249 			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
1250 			{
1251 				if (UNMARKED(addrinfo)) {
1252 					dns_adb_agesrtt(fctx->adb, addrinfo,
1253 							now);
1254 				}
1255 			}
1256 		}
1257 	}
1258 
1259 	if ((finish != NULL || age_untried) && TRIEDALT(fctx)) {
1260 		for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL;
1261 		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
1262 		{
1263 			if (UNMARKED(addrinfo)) {
1264 				dns_adb_agesrtt(fctx->adb, addrinfo, now);
1265 			}
1266 		}
1267 		for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL;
1268 		     find = ISC_LIST_NEXT(find, publink))
1269 		{
1270 			for (addrinfo = ISC_LIST_HEAD(find->list);
1271 			     addrinfo != NULL;
1272 			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
1273 			{
1274 				if (UNMARKED(addrinfo)) {
1275 					dns_adb_agesrtt(fctx->adb, addrinfo,
1276 							now);
1277 				}
1278 			}
1279 		}
1280 	}
1281 
1282 	/*
1283 	 * Check for any outstanding dispatch responses and if they
1284 	 * exist, cancel them.
1285 	 */
1286 	if (query->dispentry != NULL) {
1287 		dns_dispatch_done(&query->dispentry);
1288 	}
1289 
1290 	LOCK(&fctx->lock);
1291 	if (ISC_LINK_LINKED(query, link)) {
1292 		ISC_LIST_UNLINK(fctx->queries, query, link);
1293 	}
1294 	UNLOCK(&fctx->lock);
1295 
1296 	resquery_detach(queryp);
1297 }
1298 
1299 static void
1300 fctx_cleanup(fetchctx_t *fctx) {
1301 	dns_adbfind_t *find = NULL, *next_find = NULL;
1302 	dns_adbaddrinfo_t *addr = NULL, *next_addr = NULL;
1303 
1304 	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
1305 
1306 	for (find = ISC_LIST_HEAD(fctx->finds); find != NULL; find = next_find)
1307 	{
1308 		next_find = ISC_LIST_NEXT(find, publink);
1309 		ISC_LIST_UNLINK(fctx->finds, find, publink);
1310 		dns_adb_destroyfind(&find);
1311 		fetchctx_unref(fctx);
1312 	}
1313 	fctx->find = NULL;
1314 
1315 	for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL;
1316 	     find = next_find)
1317 	{
1318 		next_find = ISC_LIST_NEXT(find, publink);
1319 		ISC_LIST_UNLINK(fctx->altfinds, find, publink);
1320 		dns_adb_destroyfind(&find);
1321 		fetchctx_unref(fctx);
1322 	}
1323 	fctx->altfind = NULL;
1324 
1325 	for (addr = ISC_LIST_HEAD(fctx->forwaddrs); addr != NULL;
1326 	     addr = next_addr)
1327 	{
1328 		next_addr = ISC_LIST_NEXT(addr, publink);
1329 		ISC_LIST_UNLINK(fctx->forwaddrs, addr, publink);
1330 		dns_adb_freeaddrinfo(fctx->adb, &addr);
1331 	}
1332 
1333 	for (addr = ISC_LIST_HEAD(fctx->altaddrs); addr != NULL;
1334 	     addr = next_addr)
1335 	{
1336 		next_addr = ISC_LIST_NEXT(addr, publink);
1337 		ISC_LIST_UNLINK(fctx->altaddrs, addr, publink);
1338 		dns_adb_freeaddrinfo(fctx->adb, &addr);
1339 	}
1340 }
1341 
1342 static void
1343 fctx_cancelqueries(fetchctx_t *fctx, bool no_response, bool age_untried) {
1344 	resquery_t *query = NULL, *next_query = NULL;
1345 	ISC_LIST(resquery_t) queries;
1346 
1347 	FCTXTRACE("cancelqueries");
1348 
1349 	ISC_LIST_INIT(queries);
1350 
1351 	/*
1352 	 * Move the queries to a local list so we can cancel
1353 	 * them without holding the lock.
1354 	 */
1355 	LOCK(&fctx->lock);
1356 	ISC_LIST_MOVE(queries, fctx->queries);
1357 	UNLOCK(&fctx->lock);
1358 
1359 	for (query = ISC_LIST_HEAD(queries); query != NULL; query = next_query)
1360 	{
1361 		next_query = ISC_LIST_NEXT(query, link);
1362 
1363 		/*
1364 		 * Note that we have to unlink the query here,
1365 		 * because if it's still linked in fctx_cancelquery(),
1366 		 * then it will try to unlink it from fctx->queries.
1367 		 */
1368 		ISC_LIST_UNLINK(queries, query, link);
1369 		fctx_cancelquery(&query, NULL, no_response, age_untried);
1370 	}
1371 }
1372 
1373 static void
1374 fcount_logspill(fetchctx_t *fctx, fctxcount_t *counter, bool final) {
1375 	char dbuf[DNS_NAME_FORMATSIZE];
1376 	isc_stdtime_t now;
1377 
1378 	if (!isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) {
1379 		return;
1380 	}
1381 
1382 	/* Do not log a message if there were no dropped fetches. */
1383 	if (counter->dropped == 0) {
1384 		return;
1385 	}
1386 
1387 	/* Do not log the cumulative message if the previous log is recent. */
1388 	now = isc_stdtime_now();
1389 	if (!final && counter->logged > now - 60) {
1390 		return;
1391 	}
1392 
1393 	dns_name_format(fctx->domain, dbuf, sizeof(dbuf));
1394 
1395 	if (!final) {
1396 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL,
1397 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
1398 			      "too many simultaneous fetches for %s "
1399 			      "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32
1400 			      "; %s)",
1401 			      dbuf, counter->allowed, counter->dropped,
1402 			      counter->dropped == 1 ? "initial trigger event"
1403 						    : "cumulative since "
1404 						      "initial trigger event");
1405 	} else {
1406 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_SPILL,
1407 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
1408 			      "fetch counters for %s now being discarded "
1409 			      "(allowed %" PRIuFAST32 " spilled %" PRIuFAST32
1410 			      "; cumulative since initial trigger event)",
1411 			      dbuf, counter->allowed, counter->dropped);
1412 	}
1413 
1414 	counter->logged = now;
1415 }
1416 
1417 static bool
1418 fcount_match(void *node, const void *key) {
1419 	const fctxcount_t *counter = node;
1420 	const dns_name_t *domain = key;
1421 
1422 	return dns_name_equal(counter->domain, domain);
1423 }
1424 
1425 static isc_result_t
1426 fcount_incr(fetchctx_t *fctx, bool force) {
1427 	isc_result_t result = ISC_R_SUCCESS;
1428 	dns_resolver_t *res = NULL;
1429 	fctxcount_t *counter = NULL;
1430 	uint32_t hashval;
1431 	uint_fast32_t spill;
1432 	isc_rwlocktype_t locktype = isc_rwlocktype_read;
1433 
1434 	REQUIRE(fctx != NULL);
1435 	res = fctx->res;
1436 	REQUIRE(res != NULL);
1437 	INSIST(fctx->counter == NULL);
1438 
1439 	/* Skip any counting if fetches-per-zone is disabled */
1440 	spill = atomic_load_acquire(&res->zspill);
1441 	if (spill == 0) {
1442 		return ISC_R_SUCCESS;
1443 	}
1444 
1445 	hashval = dns_name_hash(fctx->domain);
1446 
1447 	RWLOCK(&res->counters_lock, locktype);
1448 	result = isc_hashmap_find(res->counters, hashval, fcount_match,
1449 				  fctx->domain, (void **)&counter);
1450 	switch (result) {
1451 	case ISC_R_SUCCESS:
1452 		break;
1453 	case ISC_R_NOTFOUND:
1454 		counter = isc_mem_get(fctx->mctx, sizeof(*counter));
1455 		*counter = (fctxcount_t){
1456 			.magic = FCTXCOUNT_MAGIC,
1457 			.count = 0,
1458 			.allowed = 0,
1459 		};
1460 		isc_mem_attach(fctx->mctx, &counter->mctx);
1461 		isc_mutex_init(&counter->lock);
1462 		counter->domain = dns_fixedname_initname(&counter->dfname);
1463 		dns_name_copy(fctx->domain, counter->domain);
1464 
1465 		UPGRADELOCK(&res->counters_lock, locktype);
1466 
1467 		void *found = NULL;
1468 		result = isc_hashmap_add(res->counters, hashval, fcount_match,
1469 					 counter->domain, counter, &found);
1470 		if (result == ISC_R_EXISTS) {
1471 			isc_mutex_destroy(&counter->lock);
1472 			isc_mem_putanddetach(&counter->mctx, counter,
1473 					     sizeof(*counter));
1474 			counter = found;
1475 			result = ISC_R_SUCCESS;
1476 		}
1477 
1478 		INSIST(result == ISC_R_SUCCESS);
1479 		break;
1480 	default:
1481 		UNREACHABLE();
1482 	}
1483 	INSIST(VALID_FCTXCOUNT(counter));
1484 
1485 	INSIST(spill > 0);
1486 	LOCK(&counter->lock);
1487 	if (++counter->count > spill && !force) {
1488 		counter->count--;
1489 		INSIST(counter->count > 0);
1490 		counter->dropped++;
1491 		fcount_logspill(fctx, counter, false);
1492 		result = ISC_R_QUOTA;
1493 	} else {
1494 		counter->allowed++;
1495 		fctx->counter = counter;
1496 	}
1497 	UNLOCK(&counter->lock);
1498 	RWUNLOCK(&res->counters_lock, locktype);
1499 
1500 	return result;
1501 }
1502 
1503 static bool
1504 match_ptr(void *node, const void *key) {
1505 	return node == key;
1506 }
1507 
1508 static void
1509 fcount_decr(fetchctx_t *fctx) {
1510 	REQUIRE(fctx != NULL);
1511 
1512 	fctxcount_t *counter = fctx->counter;
1513 	if (counter == NULL) {
1514 		return;
1515 	}
1516 	fctx->counter = NULL;
1517 
1518 	/*
1519 	 * FIXME: This should not require a write lock, but should be
1520 	 * implemented using reference counting later, otherwise we would could
1521 	 * encounter ABA problem here - the count could go up and down when we
1522 	 * switch from read to write lock.
1523 	 */
1524 	RWLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
1525 
1526 	LOCK(&counter->lock);
1527 	INSIST(VALID_FCTXCOUNT(counter));
1528 	INSIST(counter->count > 0);
1529 	if (--counter->count > 0) {
1530 		UNLOCK(&counter->lock);
1531 		RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
1532 		return;
1533 	}
1534 
1535 	isc_result_t result = isc_hashmap_delete(fctx->res->counters,
1536 						 dns_name_hash(counter->domain),
1537 						 match_ptr, counter);
1538 	INSIST(result == ISC_R_SUCCESS);
1539 
1540 	fcount_logspill(fctx, counter, true);
1541 	UNLOCK(&counter->lock);
1542 
1543 	isc_mutex_destroy(&counter->lock);
1544 	isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter));
1545 
1546 	RWUNLOCK(&fctx->res->counters_lock, isc_rwlocktype_write);
1547 }
1548 
1549 static void
1550 spillattimer_countdown(void *arg);
1551 
1552 static void
1553 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
1554 	dns_fetchresponse_t *resp = NULL, *next = NULL;
1555 	unsigned int count = 0;
1556 	bool logit = false;
1557 	isc_time_t now;
1558 	unsigned int old_spillat;
1559 	unsigned int new_spillat = 0; /* initialized to silence
1560 				       * compiler warnings */
1561 
1562 	LOCK(&fctx->lock);
1563 
1564 	REQUIRE(fctx->state == fetchstate_done);
1565 
1566 	FCTXTRACE("sendevents");
1567 
1568 	/*
1569 	 * Keep some record of fetch result for logging later (if required).
1570 	 */
1571 	fctx->result = result;
1572 	now = isc_time_now();
1573 	fctx->duration = isc_time_microdiff(&now, &fctx->start);
1574 
1575 	for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL; resp = next) {
1576 		next = ISC_LIST_NEXT(resp, link);
1577 		ISC_LIST_UNLINK(fctx->resps, resp, link);
1578 
1579 		count++;
1580 
1581 		resp->vresult = fctx->vresult;
1582 		if (!HAVE_ANSWER(fctx)) {
1583 			resp->result = result;
1584 		}
1585 
1586 		INSIST(resp->result != ISC_R_SUCCESS ||
1587 		       dns_rdataset_isassociated(resp->rdataset) ||
1588 		       fctx->type == dns_rdatatype_any ||
1589 		       fctx->type == dns_rdatatype_rrsig ||
1590 		       fctx->type == dns_rdatatype_sig);
1591 
1592 		/*
1593 		 * Negative results must be indicated in resp->result.
1594 		 */
1595 		if (dns_rdataset_isassociated(resp->rdataset) &&
1596 		    NEGATIVE(resp->rdataset))
1597 		{
1598 			INSIST(resp->result == DNS_R_NCACHENXDOMAIN ||
1599 			       resp->result == DNS_R_NCACHENXRRSET);
1600 		}
1601 
1602 		FCTXTRACE("post response event");
1603 		isc_async_run(resp->loop, resp->cb, resp);
1604 	}
1605 	UNLOCK(&fctx->lock);
1606 
1607 	if (HAVE_ANSWER(fctx) && fctx->spilled &&
1608 	    (count < fctx->res->spillatmax || fctx->res->spillatmax == 0))
1609 	{
1610 		LOCK(&fctx->res->lock);
1611 		if (count == fctx->res->spillat &&
1612 		    !atomic_load_acquire(&fctx->res->exiting))
1613 		{
1614 			old_spillat = fctx->res->spillat;
1615 			fctx->res->spillat += 5;
1616 			if (fctx->res->spillat > fctx->res->spillatmax &&
1617 			    fctx->res->spillatmax != 0)
1618 			{
1619 				fctx->res->spillat = fctx->res->spillatmax;
1620 			}
1621 			new_spillat = fctx->res->spillat;
1622 			if (new_spillat != old_spillat) {
1623 				logit = true;
1624 			}
1625 
1626 			/* Timer not running */
1627 			if (fctx->res->spillattimer == NULL) {
1628 				isc_interval_t i;
1629 
1630 				isc_timer_create(
1631 					isc_loop(), spillattimer_countdown,
1632 					fctx->res, &fctx->res->spillattimer);
1633 
1634 				isc_interval_set(&i, 20 * 60, 0);
1635 				isc_timer_start(fctx->res->spillattimer,
1636 						isc_timertype_ticker, &i);
1637 			}
1638 		}
1639 		UNLOCK(&fctx->res->lock);
1640 		if (logit) {
1641 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
1642 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
1643 				      "clients-per-query increased to %u",
1644 				      new_spillat);
1645 		}
1646 	}
1647 }
1648 
1649 static bool
1650 fctx__done(fetchctx_t *fctx, isc_result_t result, const char *func,
1651 	   const char *file, unsigned int line) {
1652 	bool no_response = false;
1653 	bool age_untried = false;
1654 
1655 	REQUIRE(fctx != NULL);
1656 	REQUIRE(fctx->tid == isc_tid());
1657 
1658 	FCTXTRACE("done");
1659 
1660 #ifdef DNS_RESOLVER_TRACE
1661 	fprintf(stderr, "%s:%s:%s:%u:(%p): %s\n", __func__, func, file, line,
1662 		fctx, isc_result_totext(result));
1663 #else
1664 	UNUSED(file);
1665 	UNUSED(line);
1666 	UNUSED(func);
1667 #endif
1668 
1669 	LOCK(&fctx->lock);
1670 	/* We need to do this under the lock for intra-thread synchronization */
1671 	if (fctx->state == fetchstate_done) {
1672 		UNLOCK(&fctx->lock);
1673 		return false;
1674 	}
1675 	fctx->state = fetchstate_done;
1676 	release_fctx(fctx);
1677 
1678 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
1679 	UNLOCK(&fctx->lock);
1680 
1681 	if (result == ISC_R_SUCCESS) {
1682 		if (fctx->qmin_warning != ISC_R_SUCCESS) {
1683 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
1684 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
1685 				      "success resolving '%s' after disabling "
1686 				      "qname minimization due to '%s'",
1687 				      fctx->info,
1688 				      isc_result_totext(fctx->qmin_warning));
1689 		}
1690 
1691 		/*
1692 		 * A success result indicates we got a response to a
1693 		 * query. That query should be canceled already. If
1694 		 * there still are any outstanding queries attached to the
1695 		 * same fctx, then those have *not* gotten a response,
1696 		 * so we set 'no_response' to true here: that way, when
1697 		 * we run fctx_cancelqueries() below, the SRTTs will
1698 		 * be adjusted.
1699 		 */
1700 		no_response = true;
1701 	} else if (result == ISC_R_TIMEDOUT) {
1702 		age_untried = true;
1703 	}
1704 
1705 	fctx->qmin_warning = ISC_R_SUCCESS;
1706 
1707 	fctx_cancelqueries(fctx, no_response, age_untried);
1708 	fctx_stoptimer(fctx);
1709 
1710 	/*
1711 	 * Cancel all pending validators.  Note that this must be done
1712 	 * without the fctx lock held, since that could cause
1713 	 * deadlock.
1714 	 */
1715 	maybe_cancel_validators(fctx);
1716 
1717 	if (fctx->nsfetch != NULL) {
1718 		dns_resolver_cancelfetch(fctx->nsfetch);
1719 	}
1720 
1721 	if (fctx->qminfetch != NULL) {
1722 		dns_resolver_cancelfetch(fctx->qminfetch);
1723 	}
1724 
1725 	/*
1726 	 * Shut down anything still running on behalf of this
1727 	 * fetch, and clean up finds and addresses.
1728 	 */
1729 	fctx_sendevents(fctx, result);
1730 	fctx_cleanup(fctx);
1731 
1732 	isc_timer_destroy(&fctx->timer);
1733 
1734 	return true;
1735 }
1736 
1737 static void
1738 resquery_senddone(isc_result_t eresult, isc_region_t *region, void *arg) {
1739 	resquery_t *query = (resquery_t *)arg;
1740 	resquery_t *copy = query;
1741 	fetchctx_t *fctx = NULL;
1742 
1743 	QTRACE("senddone");
1744 
1745 	UNUSED(region);
1746 
1747 	REQUIRE(VALID_QUERY(query));
1748 	fctx = query->fctx;
1749 	REQUIRE(VALID_FCTX(fctx));
1750 	REQUIRE(fctx->tid == isc_tid());
1751 
1752 	if (RESQUERY_CANCELED(query)) {
1753 		goto detach;
1754 	}
1755 
1756 	/*
1757 	 * See the note in resquery_connected() about reference
1758 	 * counting on error conditions.
1759 	 */
1760 	switch (eresult) {
1761 	case ISC_R_SUCCESS:
1762 	case ISC_R_CANCELED:
1763 	case ISC_R_SHUTTINGDOWN:
1764 		break;
1765 
1766 	case ISC_R_HOSTDOWN:
1767 	case ISC_R_HOSTUNREACH:
1768 	case ISC_R_NETDOWN:
1769 	case ISC_R_NETUNREACH:
1770 	case ISC_R_NOPERM:
1771 	case ISC_R_ADDRNOTAVAIL:
1772 	case ISC_R_CONNREFUSED:
1773 	case ISC_R_CONNECTIONRESET:
1774 	case ISC_R_TIMEDOUT:
1775 		/* No route to remote. */
1776 		FCTXTRACE3("query canceled in resquery_senddone(): "
1777 			   "no route to host; no response",
1778 			   eresult);
1779 		add_bad(fctx, query->rmessage, query->addrinfo, eresult,
1780 			badns_unreachable);
1781 		fctx_cancelquery(&copy, NULL, true, false);
1782 		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
1783 		fctx_try(fctx, true);
1784 		break;
1785 
1786 	default:
1787 		FCTXTRACE3("query canceled in resquery_senddone() "
1788 			   "due to unexpected result; responding",
1789 			   eresult);
1790 		fctx_cancelquery(&copy, NULL, false, false);
1791 		fctx_done_detach(&fctx, eresult);
1792 		break;
1793 	}
1794 
1795 detach:
1796 	resquery_detach(&query);
1797 }
1798 
1799 static isc_result_t
1800 fctx_addopt(dns_message_t *message, unsigned int version, uint16_t udpsize,
1801 	    dns_ednsopt_t *ednsopts, size_t count) {
1802 	dns_rdataset_t *rdataset = NULL;
1803 	isc_result_t result;
1804 
1805 	result = dns_message_buildopt(message, &rdataset, version, udpsize,
1806 				      DNS_MESSAGEEXTFLAG_DO, ednsopts, count);
1807 	if (result != ISC_R_SUCCESS) {
1808 		return result;
1809 	}
1810 	return dns_message_setopt(message, rdataset);
1811 }
1812 
1813 static void
1814 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
1815 	unsigned int seconds, us;
1816 	uint64_t limit;
1817 	isc_time_t now;
1818 
1819 	/*
1820 	 * Has this fetch already expired?
1821 	 */
1822 	now = isc_time_now();
1823 	limit = isc_time_microdiff(&fctx->expires, &now);
1824 	if (limit < US_PER_MS) {
1825 		FCTXTRACE("fetch already expired");
1826 		isc_interval_set(&fctx->interval, 0, 0);
1827 		return;
1828 	}
1829 
1830 	us = fctx->res->retryinterval * US_PER_MS;
1831 
1832 	/*
1833 	 * Exponential backoff after the first few tries.
1834 	 */
1835 	if (fctx->restarts > fctx->res->nonbackofftries) {
1836 		int shift = fctx->restarts - fctx->res->nonbackofftries;
1837 		if (shift > 6) {
1838 			shift = 6;
1839 		}
1840 		us <<= shift;
1841 	}
1842 
1843 	/*
1844 	 * Add a fudge factor to the expected rtt based on the current
1845 	 * estimate.
1846 	 */
1847 	if (rtt < 50000) {
1848 		rtt += 50000;
1849 	} else if (rtt < 100000) {
1850 		rtt += 100000;
1851 	} else {
1852 		rtt += 200000;
1853 	}
1854 
1855 	/*
1856 	 * Always wait for at least the expected rtt.
1857 	 */
1858 	if (us < rtt) {
1859 		us = rtt;
1860 	}
1861 
1862 	/*
1863 	 * But don't wait past the the final expiration of the fetch,
1864 	 * or for more than 10 seconds total.
1865 	 */
1866 	if (us > limit) {
1867 		us = limit;
1868 	}
1869 	if (us > MAX_SINGLE_QUERY_TIMEOUT_US) {
1870 		us = MAX_SINGLE_QUERY_TIMEOUT_US;
1871 	}
1872 	if (us > fctx->res->query_timeout * US_PER_MS) {
1873 		us = fctx->res->query_timeout * US_PER_MS;
1874 	}
1875 
1876 	seconds = us / US_PER_SEC;
1877 	us -= seconds * US_PER_SEC;
1878 	isc_interval_set(&fctx->interval, seconds, us * NS_PER_US);
1879 	isc_time_nowplusinterval(&fctx->next_timeout, &fctx->interval);
1880 }
1881 
1882 static isc_result_t
1883 fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
1884 	   unsigned int options) {
1885 	isc_result_t result;
1886 	dns_resolver_t *res = NULL;
1887 	dns_dns64_t *dns64 = NULL;
1888 	resquery_t *query = NULL;
1889 	isc_sockaddr_t addr, sockaddr;
1890 	bool have_addr = false;
1891 	unsigned int srtt;
1892 	isc_tlsctx_cache_t *tlsctx_cache = NULL;
1893 
1894 	FCTXTRACE("query");
1895 
1896 	res = fctx->res;
1897 
1898 	srtt = addrinfo->srtt;
1899 
1900 	if (addrinfo->transport != NULL) {
1901 		switch (dns_transport_get_type(addrinfo->transport)) {
1902 		case DNS_TRANSPORT_TLS:
1903 			options |= DNS_FETCHOPT_TCP;
1904 			tlsctx_cache = res->tlsctx_cache;
1905 			break;
1906 		case DNS_TRANSPORT_TCP:
1907 		case DNS_TRANSPORT_HTTP:
1908 			options |= DNS_FETCHOPT_TCP;
1909 			break;
1910 		default:
1911 			break;
1912 		}
1913 	}
1914 
1915 	/*
1916 	 * Allow an additional second for the kernel to resend the SYN
1917 	 * (or SYN without ECN in the case of stupid firewalls blocking
1918 	 * ECN negotiation) over the current RTT estimate.
1919 	 */
1920 	if ((options & DNS_FETCHOPT_TCP) != 0) {
1921 		srtt += US_PER_SEC;
1922 	}
1923 
1924 	/*
1925 	 * A forwarder needs to make multiple queries. Give it at least
1926 	 * a second to do these in.
1927 	 */
1928 	if (ISFORWARDER(addrinfo) && srtt < US_PER_SEC) {
1929 		srtt = US_PER_SEC;
1930 	}
1931 
1932 	fctx_setretryinterval(fctx, srtt);
1933 	if (isc_interval_iszero(&fctx->interval)) {
1934 		FCTXTRACE("fetch expired");
1935 		return ISC_R_TIMEDOUT;
1936 	}
1937 
1938 	INSIST(ISC_LIST_EMPTY(fctx->validators));
1939 
1940 	query = isc_mem_get(fctx->mctx, sizeof(*query));
1941 	*query = (resquery_t){
1942 		.options = options,
1943 		.addrinfo = addrinfo,
1944 		.dispatchmgr = res->view->dispatchmgr,
1945 		.link = ISC_LINK_INITIALIZER,
1946 	};
1947 
1948 #if DNS_RESOLVER_TRACE
1949 	fprintf(stderr, "rctx_init:%s:%s:%d:%p->references = 1\n", __func__,
1950 		__FILE__, __LINE__, query);
1951 #endif
1952 	isc_refcount_init(&query->references, 1);
1953 
1954 	/*
1955 	 * Note that the caller MUST guarantee that 'addrinfo' will
1956 	 * remain valid until this query is canceled.
1957 	 */
1958 
1959 	dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid],
1960 			   fctx->res->rdspools[fctx->tid],
1961 			   DNS_MESSAGE_INTENTPARSE, &query->rmessage);
1962 	query->start = isc_time_now();
1963 
1964 	/*
1965 	 * Maybe apply DNS64 mappings to IPv4 addresses.
1966 	 */
1967 	sockaddr = addrinfo->sockaddr;
1968 	dns64 = ISC_LIST_HEAD(fctx->res->view->dns64);
1969 	if (isc_sockaddr_pf(&sockaddr) == AF_INET &&
1970 	    fctx->res->view->usedns64 && dns64 != NULL)
1971 	{
1972 		struct in6_addr aaaa;
1973 
1974 		result = dns_dns64_aaaafroma(
1975 			dns64, NULL, NULL, fctx->res->view->aclenv, 0,
1976 			(unsigned char *)&sockaddr.type.sin.sin_addr.s_addr,
1977 			aaaa.s6_addr);
1978 		if (result == ISC_R_SUCCESS) {
1979 			char sockaddrbuf1[ISC_SOCKADDR_FORMATSIZE];
1980 			char sockaddrbuf2[ISC_SOCKADDR_FORMATSIZE];
1981 
1982 			/* format old address */
1983 			isc_sockaddr_format(&sockaddr, sockaddrbuf1,
1984 					    sizeof(sockaddrbuf1));
1985 
1986 			/* replace address */
1987 			isc_sockaddr_fromin6(&sockaddr, &aaaa,
1988 					     ntohs(sockaddr.type.sin.sin_port));
1989 			addrinfo->sockaddr = sockaddr;
1990 
1991 			/* format new address */
1992 			isc_sockaddr_format(&sockaddr, sockaddrbuf2,
1993 					    sizeof(sockaddrbuf2));
1994 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
1995 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
1996 				      "Using DNS64 address %s to talk to %s\n",
1997 				      sockaddrbuf2, sockaddrbuf1);
1998 		}
1999 	}
2000 	if (res->view->peers != NULL) {
2001 		dns_peer_t *peer = NULL;
2002 		isc_netaddr_t dstip;
2003 		bool usetcp = false;
2004 		isc_netaddr_fromsockaddr(&dstip, &sockaddr);
2005 		result = dns_peerlist_peerbyaddr(res->view->peers, &dstip,
2006 						 &peer);
2007 		if (result == ISC_R_SUCCESS) {
2008 			result = dns_peer_getquerysource(peer, &addr);
2009 			if (result == ISC_R_SUCCESS) {
2010 				have_addr = true;
2011 			}
2012 			result = dns_peer_getforcetcp(peer, &usetcp);
2013 			if (result == ISC_R_SUCCESS && usetcp) {
2014 				query->options |= DNS_FETCHOPT_TCP;
2015 			}
2016 		}
2017 	}
2018 
2019 	/*
2020 	 * If this is a TCP query, then we need to make a socket and
2021 	 * a dispatch for it here.  Otherwise we use the resolver's
2022 	 * shared dispatch.
2023 	 */
2024 	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
2025 		int pf;
2026 
2027 		pf = isc_sockaddr_pf(&sockaddr);
2028 		if (!have_addr) {
2029 			switch (pf) {
2030 			case PF_INET:
2031 				result = dns_dispatch_getlocaladdress(
2032 					res->dispatches4->dispatches[0], &addr);
2033 				break;
2034 			case PF_INET6:
2035 				result = dns_dispatch_getlocaladdress(
2036 					res->dispatches6->dispatches[0], &addr);
2037 				break;
2038 			default:
2039 				result = ISC_R_NOTIMPLEMENTED;
2040 				break;
2041 			}
2042 			if (result != ISC_R_SUCCESS) {
2043 				goto cleanup_query;
2044 			}
2045 		}
2046 		isc_sockaddr_setport(&addr, 0);
2047 
2048 		result = dns_dispatch_createtcp(res->view->dispatchmgr, &addr,
2049 						&sockaddr, addrinfo->transport,
2050 						DNS_DISPATCHOPT_UNSHARED,
2051 						&query->dispatch);
2052 		if (result != ISC_R_SUCCESS) {
2053 			goto cleanup_query;
2054 		}
2055 
2056 		FCTXTRACE("connecting via TCP");
2057 	} else {
2058 		if (have_addr) {
2059 			result = dns_dispatch_createudp(res->view->dispatchmgr,
2060 							&addr,
2061 							&query->dispatch);
2062 			if (result != ISC_R_SUCCESS) {
2063 				goto cleanup_query;
2064 			}
2065 		} else {
2066 			switch (isc_sockaddr_pf(&sockaddr)) {
2067 			case PF_INET:
2068 				dns_dispatch_attach(
2069 					dns_resolver_dispatchv4(res),
2070 					&query->dispatch);
2071 				break;
2072 			case PF_INET6:
2073 				dns_dispatch_attach(
2074 					dns_resolver_dispatchv6(res),
2075 					&query->dispatch);
2076 				break;
2077 			default:
2078 				result = ISC_R_NOTIMPLEMENTED;
2079 				goto cleanup_query;
2080 			}
2081 		}
2082 
2083 		/*
2084 		 * We should always have a valid dispatcher here.  If we
2085 		 * don't support a protocol family, then its dispatcher
2086 		 * will be NULL, but we shouldn't be finding addresses
2087 		 * for protocol types we don't support, so the
2088 		 * dispatcher we found should never be NULL.
2089 		 */
2090 		INSIST(query->dispatch != NULL);
2091 	}
2092 
2093 	LOCK(&fctx->lock);
2094 	INSIST(!SHUTTINGDOWN(fctx));
2095 	fetchctx_attach(fctx, &query->fctx);
2096 	query->magic = QUERY_MAGIC;
2097 
2098 	if ((query->options & DNS_FETCHOPT_TCP) == 0) {
2099 		if (dns_adb_overquota(fctx->adb, addrinfo)) {
2100 			UNLOCK(&fctx->lock);
2101 			result = ISC_R_QUOTA;
2102 			goto cleanup_dispatch;
2103 		}
2104 
2105 		/* Inform the ADB that we're starting a UDP fetch */
2106 		dns_adb_beginudpfetch(fctx->adb, addrinfo);
2107 	}
2108 
2109 	ISC_LIST_APPEND(fctx->queries, query, link);
2110 	atomic_fetch_add_relaxed(&fctx->nqueries, 1);
2111 	UNLOCK(&fctx->lock);
2112 
2113 	/* Set up the dispatch and set the query ID */
2114 	result = dns_dispatch_add(query->dispatch, fctx->loop, 0,
2115 				  isc_interval_ms(&fctx->interval), &sockaddr,
2116 				  addrinfo->transport, tlsctx_cache,
2117 				  resquery_connected, resquery_senddone,
2118 				  resquery_response, query, &query->id,
2119 				  &query->dispentry);
2120 	if (result != ISC_R_SUCCESS) {
2121 		goto cleanup_udpfetch;
2122 	}
2123 
2124 	/* Connect the socket */
2125 	resquery_ref(query);
2126 	result = dns_dispatch_connect(query->dispentry);
2127 
2128 	if (result != ISC_R_SUCCESS && (query->options & DNS_FETCHOPT_TCP) != 0)
2129 	{
2130 		int log_level = ISC_LOG_NOTICE;
2131 		if (isc_log_wouldlog(dns_lctx, log_level)) {
2132 			char peerbuf[ISC_SOCKADDR_FORMATSIZE];
2133 
2134 			isc_sockaddr_format(&sockaddr, peerbuf,
2135 					    ISC_SOCKADDR_FORMATSIZE);
2136 
2137 			isc_log_write(
2138 				dns_lctx, DNS_LOGCATEGORY_RESOLVER,
2139 				DNS_LOGMODULE_RESOLVER, log_level,
2140 				"Unable to establish a connection to %s: %s\n",
2141 				peerbuf, isc_result_totext(result));
2142 		}
2143 		dns_dispatch_done(&query->dispentry);
2144 		goto cleanup_fetch;
2145 	} else {
2146 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
2147 	}
2148 
2149 	return result;
2150 
2151 cleanup_udpfetch:
2152 	if (!RESQUERY_CANCELED(query)) {
2153 		if ((query->options & DNS_FETCHOPT_TCP) == 0) {
2154 			/* Inform the ADB that we're ending a UDP fetch */
2155 			dns_adb_endudpfetch(fctx->adb, addrinfo);
2156 		}
2157 	}
2158 
2159 cleanup_fetch:
2160 	LOCK(&fctx->lock);
2161 	if (ISC_LINK_LINKED(query, link)) {
2162 		atomic_fetch_sub_release(&fctx->nqueries, 1);
2163 		ISC_LIST_UNLINK(fctx->queries, query, link);
2164 	}
2165 	UNLOCK(&fctx->lock);
2166 
2167 cleanup_dispatch:
2168 	fetchctx_detach(&query->fctx);
2169 
2170 	if (query->dispatch != NULL) {
2171 		dns_dispatch_detach(&query->dispatch);
2172 	}
2173 
2174 cleanup_query:
2175 	query->magic = 0;
2176 	dns_message_detach(&query->rmessage);
2177 	isc_mem_put(fctx->mctx, query, sizeof(*query));
2178 
2179 	return result;
2180 }
2181 
2182 static bool
2183 bad_edns(fetchctx_t *fctx, isc_sockaddr_t *address) {
2184 	isc_sockaddr_t *sa;
2185 
2186 	for (sa = ISC_LIST_HEAD(fctx->bad_edns); sa != NULL;
2187 	     sa = ISC_LIST_NEXT(sa, link))
2188 	{
2189 		if (isc_sockaddr_equal(sa, address)) {
2190 			return true;
2191 		}
2192 	}
2193 
2194 	return false;
2195 }
2196 
2197 static void
2198 add_bad_edns(fetchctx_t *fctx, isc_sockaddr_t *address) {
2199 	isc_sockaddr_t *sa;
2200 
2201 #ifdef ENABLE_AFL
2202 	if (dns_fuzzing_resolver) {
2203 		return;
2204 	}
2205 #endif /* ifdef ENABLE_AFL */
2206 	if (bad_edns(fctx, address)) {
2207 		return;
2208 	}
2209 
2210 	sa = isc_mem_get(fctx->mctx, sizeof(*sa));
2211 
2212 	*sa = *address;
2213 	ISC_LIST_INITANDAPPEND(fctx->bad_edns, sa, link);
2214 }
2215 
2216 static struct tried *
2217 triededns(fetchctx_t *fctx, isc_sockaddr_t *address) {
2218 	struct tried *tried;
2219 
2220 	for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL;
2221 	     tried = ISC_LIST_NEXT(tried, link))
2222 	{
2223 		if (isc_sockaddr_equal(&tried->addr, address)) {
2224 			return tried;
2225 		}
2226 	}
2227 
2228 	return NULL;
2229 }
2230 
2231 static void
2232 add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) {
2233 	struct tried *tried;
2234 
2235 	tried = triededns(fctx, address);
2236 	if (tried != NULL) {
2237 		tried->count++;
2238 		return;
2239 	}
2240 
2241 	tried = isc_mem_get(fctx->mctx, sizeof(*tried));
2242 
2243 	tried->addr = *address;
2244 	tried->count = 1;
2245 	ISC_LIST_INITANDAPPEND(fctx->edns, tried, link);
2246 }
2247 
2248 static size_t
2249 addr2buf(void *buf, const size_t bufsize, const isc_sockaddr_t *sockaddr) {
2250 	isc_netaddr_t netaddr;
2251 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
2252 	switch (netaddr.family) {
2253 	case AF_INET:
2254 		INSIST(bufsize >= 4);
2255 		memmove(buf, &netaddr.type.in, 4);
2256 		return 4;
2257 	case AF_INET6:
2258 		INSIST(bufsize >= 16);
2259 		memmove(buf, &netaddr.type.in6, 16);
2260 		return 16;
2261 	default:
2262 		UNREACHABLE();
2263 	}
2264 	return 0;
2265 }
2266 
2267 static size_t
2268 add_serveraddr(uint8_t *buf, const size_t bufsize, const resquery_t *query) {
2269 	return addr2buf(buf, bufsize, &query->addrinfo->sockaddr);
2270 }
2271 
2272 /*
2273  * Client cookie is 8 octets.
2274  * Server cookie is [8..32] octets.
2275  */
2276 #define CLIENT_COOKIE_SIZE 8U
2277 #define COOKIE_BUFFER_SIZE (8U + 32U)
2278 
2279 static void
2280 compute_cc(const resquery_t *query, uint8_t *cookie, const size_t len) {
2281 	INSIST(len >= CLIENT_COOKIE_SIZE);
2282 	STATIC_ASSERT(sizeof(query->fctx->res->view->secret) >=
2283 			      ISC_SIPHASH24_KEY_LENGTH,
2284 		      "The view->secret size can't fit SipHash 2-4 key "
2285 		      "length");
2286 
2287 	uint8_t buf[16] ISC_NONSTRING = { 0 };
2288 	size_t buflen = add_serveraddr(buf, sizeof(buf), query);
2289 
2290 	uint8_t digest[ISC_SIPHASH24_TAG_LENGTH] ISC_NONSTRING = { 0 };
2291 	isc_siphash24(query->fctx->res->view->secret, buf, buflen, true,
2292 		      digest);
2293 	memmove(cookie, digest, CLIENT_COOKIE_SIZE);
2294 }
2295 
2296 static isc_result_t
2297 issecuredomain(dns_view_t *view, const dns_name_t *name, dns_rdatatype_t type,
2298 	       isc_stdtime_t now, bool checknta, bool *ntap, bool *issecure) {
2299 	dns_name_t suffix;
2300 	unsigned int labels;
2301 
2302 	/*
2303 	 * For DS variants we need to check fom the parent domain,
2304 	 * since there may be a negative trust anchor for the name,
2305 	 * while the enclosing domain where the DS record lives is
2306 	 * under a secure entry point.
2307 	 */
2308 	labels = dns_name_countlabels(name);
2309 	if (dns_rdatatype_atparent(type) && labels > 1) {
2310 		dns_name_init(&suffix, NULL);
2311 		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
2312 		name = &suffix;
2313 	}
2314 
2315 	return dns_view_issecuredomain(view, name, now, checknta, ntap,
2316 				       issecure);
2317 }
2318 
2319 static isc_result_t
2320 resquery_send(resquery_t *query) {
2321 	isc_result_t result;
2322 	fetchctx_t *fctx = query->fctx;
2323 	dns_resolver_t *res = fctx->res;
2324 	isc_buffer_t buffer;
2325 	dns_name_t *qname = NULL;
2326 	dns_rdataset_t *qrdataset = NULL;
2327 	isc_region_t r;
2328 	isc_netaddr_t ipaddr;
2329 	dns_tsigkey_t *tsigkey = NULL;
2330 	dns_peer_t *peer = NULL;
2331 	dns_compress_t cctx;
2332 	bool useedns;
2333 	bool secure_domain;
2334 	bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0);
2335 	dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS];
2336 	unsigned int ednsopt = 0;
2337 	uint16_t hint = 0, udpsize = 0; /* No EDNS */
2338 #ifdef HAVE_DNSTAP
2339 	isc_sockaddr_t localaddr, *la = NULL;
2340 	unsigned char zone[DNS_NAME_MAXWIRE];
2341 	dns_transport_type_t transport_type;
2342 	dns_dtmsgtype_t dtmsgtype;
2343 	isc_region_t zr;
2344 	isc_buffer_t zb;
2345 #endif /* HAVE_DNSTAP */
2346 
2347 	QTRACE("send");
2348 
2349 	if (atomic_load_acquire(&res->exiting)) {
2350 		FCTXTRACE("resquery_send: resolver shutting down");
2351 		return ISC_R_SHUTTINGDOWN;
2352 	}
2353 
2354 	dns_message_gettempname(fctx->qmessage, &qname);
2355 	dns_message_gettemprdataset(fctx->qmessage, &qrdataset);
2356 
2357 	fctx->qmessage->opcode = dns_opcode_query;
2358 
2359 	/*
2360 	 * Set up question.
2361 	 */
2362 	dns_name_clone(fctx->name, qname);
2363 	dns_rdataset_makequestion(qrdataset, res->rdclass, fctx->type);
2364 	ISC_LIST_APPEND(qname->list, qrdataset, link);
2365 	dns_message_addname(fctx->qmessage, qname, DNS_SECTION_QUESTION);
2366 
2367 	/*
2368 	 * Set RD if the client has requested that we do a recursive
2369 	 * query, or if we're sending to a forwarder.
2370 	 */
2371 	if ((query->options & DNS_FETCHOPT_RECURSIVE) != 0 ||
2372 	    ISFORWARDER(query->addrinfo))
2373 	{
2374 		fctx->qmessage->flags |= DNS_MESSAGEFLAG_RD;
2375 	}
2376 
2377 	/*
2378 	 * Set CD if the client says not to validate, or if the
2379 	 * question is under a secure entry point and this is a
2380 	 * recursive/forward query -- unless the client said not to.
2381 	 */
2382 	if ((query->options & DNS_FETCHOPT_NOCDFLAG) != 0) {
2383 		/* Do nothing */
2384 	} else if ((query->options & DNS_FETCHOPT_NOVALIDATE) != 0) {
2385 		fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
2386 	} else if (res->view->enablevalidation &&
2387 		   ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0))
2388 	{
2389 		bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0);
2390 		bool ntacovered = false;
2391 		result = issecuredomain(res->view, fctx->name, fctx->type,
2392 					isc_time_seconds(&query->start),
2393 					checknta, &ntacovered, &secure_domain);
2394 		if (result != ISC_R_SUCCESS) {
2395 			secure_domain = false;
2396 		}
2397 		if (secure_domain ||
2398 		    (ISFORWARDER(query->addrinfo) && ntacovered))
2399 		{
2400 			fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
2401 		}
2402 	}
2403 
2404 	/*
2405 	 * We don't have to set opcode because it defaults to query.
2406 	 */
2407 	fctx->qmessage->id = query->id;
2408 
2409 	/*
2410 	 * Convert the question to wire format.
2411 	 */
2412 	dns_compress_init(&cctx, fctx->mctx, 0);
2413 
2414 	isc_buffer_init(&buffer, query->data, sizeof(query->data));
2415 	result = dns_message_renderbegin(fctx->qmessage, &cctx, &buffer);
2416 	if (result != ISC_R_SUCCESS) {
2417 		goto cleanup_message;
2418 	}
2419 
2420 	result = dns_message_rendersection(fctx->qmessage, DNS_SECTION_QUESTION,
2421 					   0);
2422 	if (result != ISC_R_SUCCESS) {
2423 		goto cleanup_message;
2424 	}
2425 
2426 	isc_netaddr_fromsockaddr(&ipaddr, &query->addrinfo->sockaddr);
2427 	(void)dns_peerlist_peerbyaddr(fctx->res->view->peers, &ipaddr, &peer);
2428 
2429 	/*
2430 	 * The ADB does not know about servers with "edns no".  Check
2431 	 * this, and then inform the ADB for future use.
2432 	 */
2433 	if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0 &&
2434 	    peer != NULL &&
2435 	    dns_peer_getsupportedns(peer, &useedns) == ISC_R_SUCCESS &&
2436 	    !useedns)
2437 	{
2438 		query->options |= DNS_FETCHOPT_NOEDNS0;
2439 		dns_adb_changeflags(fctx->adb, query->addrinfo,
2440 				    FCTX_ADDRINFO_NOEDNS0,
2441 				    FCTX_ADDRINFO_NOEDNS0);
2442 	}
2443 
2444 	/* Sync NOEDNS0 flag in addrinfo->flags and options now. */
2445 	if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) != 0) {
2446 		query->options |= DNS_FETCHOPT_NOEDNS0;
2447 	}
2448 
2449 	if (fctx->timeout && (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
2450 		isc_sockaddr_t *sockaddr = &query->addrinfo->sockaddr;
2451 		struct tried *tried;
2452 
2453 		/*
2454 		 * If this is the first timeout for this server in this
2455 		 * fetch context, try setting EDNS UDP buffer size to
2456 		 * the largest UDP response size we have seen from this
2457 		 * server so far.
2458 		 *
2459 		 * If this server has already timed out twice or more in
2460 		 * this fetch context, force TCP.
2461 		 */
2462 		if ((tried = triededns(fctx, sockaddr)) != NULL) {
2463 			if (tried->count == 1U) {
2464 				hint = dns_adb_getudpsize(fctx->adb,
2465 							  query->addrinfo);
2466 			} else if (tried->count >= 2U) {
2467 				if ((query->options & DNS_FETCHOPT_TCP) == 0) {
2468 					/*
2469 					 * Inform the ADB that we're ending a
2470 					 * UDP fetch, and turn the query into
2471 					 * a TCP query.
2472 					 */
2473 					dns_adb_endudpfetch(fctx->adb,
2474 							    query->addrinfo);
2475 					query->options |= DNS_FETCHOPT_TCP;
2476 				}
2477 			}
2478 		}
2479 	}
2480 	fctx->timeout = false;
2481 
2482 	/*
2483 	 * Use EDNS0, unless the caller doesn't want it, or we know that
2484 	 * the remote server doesn't like it.
2485 	 */
2486 	if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
2487 		if ((query->addrinfo->flags & FCTX_ADDRINFO_NOEDNS0) == 0) {
2488 			uint16_t peerudpsize = 0;
2489 			unsigned int version = DNS_EDNS_VERSION;
2490 			unsigned int flags = query->addrinfo->flags;
2491 			bool reqnsid = res->view->requestnsid;
2492 			bool sendcookie = res->view->sendcookie;
2493 			bool tcpkeepalive = false;
2494 			unsigned char cookie[COOKIE_BUFFER_SIZE];
2495 			uint16_t padding = 0;
2496 
2497 			/*
2498 			 * Set the default UDP size to what was
2499 			 * configured as 'edns-buffer-size'
2500 			 */
2501 			udpsize = res->view->udpsize;
2502 
2503 			/*
2504 			 * This server timed out for the first time in
2505 			 * this fetch context and we received a response
2506 			 * from it before (either in this fetch context
2507 			 * or in a different one).  Set 'udpsize' to the
2508 			 * size of the largest UDP response we have
2509 			 * received from this server so far.
2510 			 */
2511 			if (hint != 0U) {
2512 				udpsize = hint;
2513 			}
2514 
2515 			/*
2516 			 * If a fixed EDNS UDP buffer size is configured
2517 			 * for this server, make sure we obey that.
2518 			 */
2519 			if (peer != NULL) {
2520 				(void)dns_peer_getudpsize(peer, &peerudpsize);
2521 				if (peerudpsize != 0) {
2522 					udpsize = peerudpsize;
2523 				}
2524 			}
2525 
2526 			if ((flags & DNS_FETCHOPT_EDNSVERSIONSET) != 0) {
2527 				version = flags & DNS_FETCHOPT_EDNSVERSIONMASK;
2528 				version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT;
2529 			}
2530 
2531 			/* Request NSID/COOKIE/VERSION for current peer?
2532 			 */
2533 			if (peer != NULL) {
2534 				uint8_t ednsversion;
2535 				(void)dns_peer_getrequestnsid(peer, &reqnsid);
2536 				(void)dns_peer_getsendcookie(peer, &sendcookie);
2537 				result = dns_peer_getednsversion(peer,
2538 								 &ednsversion);
2539 				if (result == ISC_R_SUCCESS &&
2540 				    ednsversion < version)
2541 				{
2542 					version = ednsversion;
2543 				}
2544 			}
2545 			if (NOCOOKIE(query->addrinfo)) {
2546 				sendcookie = false;
2547 			}
2548 			if (reqnsid) {
2549 				INSIST(ednsopt < DNS_EDNSOPTIONS);
2550 				ednsopts[ednsopt].code = DNS_OPT_NSID;
2551 				ednsopts[ednsopt].length = 0;
2552 				ednsopts[ednsopt].value = NULL;
2553 				ednsopt++;
2554 			}
2555 			if (sendcookie) {
2556 				INSIST(ednsopt < DNS_EDNSOPTIONS);
2557 				ednsopts[ednsopt].code = DNS_OPT_COOKIE;
2558 				ednsopts[ednsopt].length =
2559 					(uint16_t)dns_adb_getcookie(
2560 						query->addrinfo, cookie,
2561 						sizeof(cookie));
2562 				if (ednsopts[ednsopt].length != 0) {
2563 					ednsopts[ednsopt].value = cookie;
2564 					inc_stats(
2565 						fctx->res,
2566 						dns_resstatscounter_cookieout);
2567 				} else {
2568 					compute_cc(query, cookie,
2569 						   CLIENT_COOKIE_SIZE);
2570 					ednsopts[ednsopt].value = cookie;
2571 					ednsopts[ednsopt].length =
2572 						CLIENT_COOKIE_SIZE;
2573 					inc_stats(
2574 						fctx->res,
2575 						dns_resstatscounter_cookienew);
2576 				}
2577 				ednsopt++;
2578 			}
2579 
2580 			/* Add TCP keepalive option if appropriate */
2581 			if ((peer != NULL) && tcp) {
2582 				(void)dns_peer_gettcpkeepalive(peer,
2583 							       &tcpkeepalive);
2584 			}
2585 			if (tcpkeepalive) {
2586 				INSIST(ednsopt < DNS_EDNSOPTIONS);
2587 				ednsopts[ednsopt].code = DNS_OPT_TCP_KEEPALIVE;
2588 				ednsopts[ednsopt].length = 0;
2589 				ednsopts[ednsopt].value = NULL;
2590 				ednsopt++;
2591 			}
2592 
2593 			/* Add PAD for current peer? Require TCP for now
2594 			 */
2595 			if ((peer != NULL) && tcp) {
2596 				(void)dns_peer_getpadding(peer, &padding);
2597 			}
2598 			if (padding != 0) {
2599 				INSIST(ednsopt < DNS_EDNSOPTIONS);
2600 				ednsopts[ednsopt].code = DNS_OPT_PAD;
2601 				ednsopts[ednsopt].length = 0;
2602 				ednsopt++;
2603 				dns_message_setpadding(fctx->qmessage, padding);
2604 			}
2605 
2606 			query->ednsversion = version;
2607 			result = fctx_addopt(fctx->qmessage, version, udpsize,
2608 					     ednsopts, ednsopt);
2609 			if (reqnsid && result == ISC_R_SUCCESS) {
2610 				query->options |= DNS_FETCHOPT_WANTNSID;
2611 			} else if (result != ISC_R_SUCCESS) {
2612 				/*
2613 				 * We couldn't add the OPT, but we'll
2614 				 * press on. We're not using EDNS0, so
2615 				 * set the NOEDNS0 bit.
2616 				 */
2617 				query->options |= DNS_FETCHOPT_NOEDNS0;
2618 				query->ednsversion = -1;
2619 				udpsize = 0;
2620 			}
2621 		} else {
2622 			/*
2623 			 * We know this server doesn't like EDNS0, so we
2624 			 * won't use it.  Set the NOEDNS0 bit since
2625 			 * we're not using EDNS0.
2626 			 */
2627 			query->options |= DNS_FETCHOPT_NOEDNS0;
2628 			query->ednsversion = -1;
2629 		}
2630 	} else {
2631 		query->ednsversion = -1;
2632 	}
2633 
2634 	/*
2635 	 * Record the UDP EDNS size chosen.
2636 	 */
2637 	query->udpsize = udpsize;
2638 
2639 	/*
2640 	 * If we need EDNS0 to do this query and aren't using it, we
2641 	 * lose.
2642 	 */
2643 	if (NEEDEDNS0(fctx) && (query->options & DNS_FETCHOPT_NOEDNS0) != 0) {
2644 		result = DNS_R_SERVFAIL;
2645 		goto cleanup_message;
2646 	}
2647 
2648 	add_triededns(fctx, &query->addrinfo->sockaddr);
2649 
2650 	/*
2651 	 * Clear CD if EDNS is not in use.
2652 	 */
2653 	if ((query->options & DNS_FETCHOPT_NOEDNS0) != 0) {
2654 		fctx->qmessage->flags &= ~DNS_MESSAGEFLAG_CD;
2655 	}
2656 
2657 	/*
2658 	 * Add TSIG record tailored to the current recipient.
2659 	 */
2660 	result = dns_view_getpeertsig(fctx->res->view, &ipaddr, &tsigkey);
2661 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
2662 		goto cleanup_message;
2663 	}
2664 
2665 	if (tsigkey != NULL) {
2666 		result = dns_message_settsigkey(fctx->qmessage, tsigkey);
2667 		dns_tsigkey_detach(&tsigkey);
2668 		if (result != ISC_R_SUCCESS) {
2669 			goto cleanup_message;
2670 		}
2671 	}
2672 
2673 	result = dns_message_rendersection(fctx->qmessage,
2674 					   DNS_SECTION_ADDITIONAL, 0);
2675 	if (result != ISC_R_SUCCESS) {
2676 		goto cleanup_message;
2677 	}
2678 
2679 	result = dns_message_renderend(fctx->qmessage);
2680 	if (result != ISC_R_SUCCESS) {
2681 		goto cleanup_message;
2682 	}
2683 
2684 #ifdef HAVE_DNSTAP
2685 	memset(&zr, 0, sizeof(zr));
2686 	isc_buffer_init(&zb, zone, sizeof(zone));
2687 	dns_compress_setpermitted(&cctx, false);
2688 	result = dns_name_towire(fctx->domain, &cctx, &zb, NULL);
2689 	if (result == ISC_R_SUCCESS) {
2690 		isc_buffer_usedregion(&zb, &zr);
2691 	}
2692 #endif /* HAVE_DNSTAP */
2693 
2694 	if (dns_message_gettsigkey(fctx->qmessage) != NULL) {
2695 		dns_tsigkey_attach(dns_message_gettsigkey(fctx->qmessage),
2696 				   &query->tsigkey);
2697 		result = dns_message_getquerytsig(fctx->qmessage, fctx->mctx,
2698 						  &query->tsig);
2699 		if (result != ISC_R_SUCCESS) {
2700 			goto cleanup_message;
2701 		}
2702 	}
2703 
2704 	/*
2705 	 * Log the outgoing packet.
2706 	 */
2707 	dns_message_logfmtpacket(
2708 		fctx->qmessage, "sending packet to", &query->addrinfo->sockaddr,
2709 		DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS,
2710 		&dns_master_style_comment, ISC_LOG_DEBUG(11), fctx->mctx);
2711 
2712 	/*
2713 	 * We're now done with the query message.
2714 	 */
2715 	dns_compress_invalidate(&cctx);
2716 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
2717 
2718 	isc_buffer_usedregion(&buffer, &r);
2719 
2720 	resquery_ref(query);
2721 	dns_dispatch_send(query->dispentry, &r);
2722 
2723 	QTRACE("sent");
2724 
2725 #ifdef HAVE_DNSTAP
2726 	/*
2727 	 * Log the outgoing query via dnstap.
2728 	 */
2729 	if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
2730 		dtmsgtype = DNS_DTTYPE_FQ;
2731 	} else {
2732 		dtmsgtype = DNS_DTTYPE_RQ;
2733 	}
2734 
2735 	result = dns_dispentry_getlocaladdress(query->dispentry, &localaddr);
2736 	if (result == ISC_R_SUCCESS) {
2737 		la = &localaddr;
2738 	}
2739 
2740 	if (query->addrinfo->transport != NULL) {
2741 		transport_type =
2742 			dns_transport_get_type(query->addrinfo->transport);
2743 	} else if ((query->options & DNS_FETCHOPT_TCP) != 0) {
2744 		transport_type = DNS_TRANSPORT_TCP;
2745 	} else {
2746 		transport_type = DNS_TRANSPORT_UDP;
2747 	}
2748 
2749 	dns_dt_send(fctx->res->view, dtmsgtype, la, &query->addrinfo->sockaddr,
2750 		    transport_type, &zr, &query->start, NULL, &buffer);
2751 #endif /* HAVE_DNSTAP */
2752 
2753 	return ISC_R_SUCCESS;
2754 
2755 cleanup_message:
2756 	dns_compress_invalidate(&cctx);
2757 
2758 	dns_message_reset(fctx->qmessage, DNS_MESSAGE_INTENTRENDER);
2759 
2760 	/*
2761 	 * Stop the dispatcher from listening.
2762 	 */
2763 	dns_dispatch_done(&query->dispentry);
2764 
2765 	return result;
2766 }
2767 
2768 static void
2769 resquery_connected(isc_result_t eresult, isc_region_t *region, void *arg) {
2770 	resquery_t *query = (resquery_t *)arg;
2771 	resquery_t *copy = query;
2772 	isc_result_t result;
2773 	fetchctx_t *fctx = NULL;
2774 	dns_resolver_t *res = NULL;
2775 	int pf;
2776 
2777 	REQUIRE(VALID_QUERY(query));
2778 
2779 	QTRACE("connected");
2780 
2781 	UNUSED(region);
2782 
2783 	fctx = query->fctx;
2784 
2785 	REQUIRE(VALID_FCTX(fctx));
2786 	REQUIRE(fctx->tid == isc_tid());
2787 
2788 	res = fctx->res;
2789 
2790 	if (RESQUERY_CANCELED(query)) {
2791 		goto detach;
2792 	}
2793 
2794 	if (atomic_load_acquire(&fctx->res->exiting)) {
2795 		eresult = ISC_R_SHUTTINGDOWN;
2796 	}
2797 
2798 	/*
2799 	 * The reference counting of resquery objects is complex:
2800 	 *
2801 	 * 1. attached in fctx_query()
2802 	 * 2. attached prior to dns_dispatch_connect(), detached in
2803 	 *    resquery_connected()
2804 	 * 3. attached prior to dns_dispatch_send(), detached in
2805 	 *    resquery_senddone()
2806 	 * 4. finally detached in fctx_cancelquery()
2807 	 *
2808 	 * On error conditions, it's necessary to call fctx_cancelquery()
2809 	 * from resquery_connected() or _senddone(), detaching twice
2810 	 * within the same function. To make it clear that's what's
2811 	 * happening, we cancel-and-detach 'copy' and detach 'query',
2812 	 * which are both pointing to the same object.
2813 	 */
2814 	switch (eresult) {
2815 	case ISC_R_SUCCESS:
2816 		/*
2817 		 * We are connected. Send the query.
2818 		 */
2819 
2820 		result = resquery_send(query);
2821 		if (result != ISC_R_SUCCESS) {
2822 			FCTXTRACE("query canceled: resquery_send() failed; "
2823 				  "responding");
2824 
2825 			fctx_cancelquery(&copy, NULL, false, false);
2826 			fctx_done_detach(&fctx, result);
2827 			break;
2828 		}
2829 
2830 		fctx->querysent++;
2831 
2832 		pf = isc_sockaddr_pf(&query->addrinfo->sockaddr);
2833 		if (pf == PF_INET) {
2834 			inc_stats(res, dns_resstatscounter_queryv4);
2835 		} else {
2836 			inc_stats(res, dns_resstatscounter_queryv6);
2837 		}
2838 		if (res->querystats != NULL) {
2839 			dns_rdatatypestats_increment(res->querystats,
2840 						     fctx->type);
2841 		}
2842 		break;
2843 
2844 	case ISC_R_CANCELED:
2845 	case ISC_R_SHUTTINGDOWN:
2846 		FCTXTRACE3("shutdown in resquery_connected()", eresult);
2847 		fctx_cancelquery(&copy, NULL, true, false);
2848 		fctx_done_detach(&fctx, eresult);
2849 		break;
2850 
2851 	case ISC_R_HOSTDOWN:
2852 	case ISC_R_HOSTUNREACH:
2853 	case ISC_R_NETDOWN:
2854 	case ISC_R_NETUNREACH:
2855 	case ISC_R_CONNREFUSED:
2856 	case ISC_R_NOPERM:
2857 	case ISC_R_ADDRNOTAVAIL:
2858 	case ISC_R_CONNECTIONRESET:
2859 	case ISC_R_TIMEDOUT:
2860 		/*
2861 		 * Do not query this server again in this fetch context.
2862 		 */
2863 		FCTXTRACE3("query failed in resquery_connected(): "
2864 			   "no response",
2865 			   eresult);
2866 		add_bad(fctx, query->rmessage, query->addrinfo, eresult,
2867 			badns_unreachable);
2868 		fctx_cancelquery(&copy, NULL, true, false);
2869 
2870 		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
2871 		fctx_try(fctx, true);
2872 		break;
2873 
2874 	default:
2875 		FCTXTRACE3("query canceled in resquery_connected() "
2876 			   "due to unexpected result; responding",
2877 			   eresult);
2878 
2879 		fctx_cancelquery(&copy, NULL, false, false);
2880 		fctx_done_detach(&fctx, eresult);
2881 		break;
2882 	}
2883 
2884 detach:
2885 	resquery_detach(&query);
2886 }
2887 
2888 static void
2889 fctx_finddone(void *arg) {
2890 	dns_adbfind_t *find = (dns_adbfind_t *)arg;
2891 	fetchctx_t *fctx = (fetchctx_t *)find->cbarg;
2892 	bool want_try = false;
2893 	bool want_done = false;
2894 	uint_fast32_t pending;
2895 
2896 	REQUIRE(VALID_FCTX(fctx));
2897 
2898 	FCTXTRACE("finddone");
2899 
2900 	REQUIRE(fctx->tid == isc_tid());
2901 
2902 	LOCK(&fctx->lock);
2903 	pending = atomic_fetch_sub_release(&fctx->pending, 1);
2904 	INSIST(pending > 0);
2905 
2906 	if (ADDRWAIT(fctx)) {
2907 		/*
2908 		 * The fetch is waiting for a name to be found.
2909 		 */
2910 		INSIST(!SHUTTINGDOWN(fctx));
2911 		if (dns_adb_findstatus(find) == DNS_ADB_MOREADDRESSES) {
2912 			FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
2913 			want_try = true;
2914 		} else {
2915 			fctx->findfail++;
2916 			if (atomic_load_acquire(&fctx->pending) == 0) {
2917 				/*
2918 				 * We've got nothing else to wait for
2919 				 * and don't know the answer.  There's
2920 				 * nothing to do but fail the fctx.
2921 				 */
2922 				FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
2923 				want_done = true;
2924 			}
2925 		}
2926 	}
2927 
2928 	UNLOCK(&fctx->lock);
2929 
2930 	dns_adb_destroyfind(&find);
2931 
2932 	if (want_done) {
2933 		FCTXTRACE("fetch failed in finddone(); return "
2934 			  "ISC_R_FAILURE");
2935 
2936 		fctx_done_unref(fctx, ISC_R_FAILURE);
2937 	} else if (want_try) {
2938 		fctx_try(fctx, true);
2939 	}
2940 
2941 	fetchctx_detach(&fctx);
2942 }
2943 
2944 static bool
2945 bad_server(fetchctx_t *fctx, isc_sockaddr_t *address) {
2946 	isc_sockaddr_t *sa;
2947 
2948 	for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL;
2949 	     sa = ISC_LIST_NEXT(sa, link))
2950 	{
2951 		if (isc_sockaddr_equal(sa, address)) {
2952 			return true;
2953 		}
2954 	}
2955 
2956 	return false;
2957 }
2958 
2959 static bool
2960 mark_bad(fetchctx_t *fctx) {
2961 	dns_adbfind_t *curr;
2962 	dns_adbaddrinfo_t *addrinfo;
2963 	bool all_bad = true;
2964 
2965 #ifdef ENABLE_AFL
2966 	if (dns_fuzzing_resolver) {
2967 		return false;
2968 	}
2969 #endif /* ifdef ENABLE_AFL */
2970 
2971 	/*
2972 	 * Mark all known bad servers, so we don't try to talk to them
2973 	 * again.
2974 	 */
2975 
2976 	/*
2977 	 * Mark any bad nameservers.
2978 	 */
2979 	for (curr = ISC_LIST_HEAD(fctx->finds); curr != NULL;
2980 	     curr = ISC_LIST_NEXT(curr, publink))
2981 	{
2982 		for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL;
2983 		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
2984 		{
2985 			if (bad_server(fctx, &addrinfo->sockaddr)) {
2986 				addrinfo->flags |= FCTX_ADDRINFO_MARK;
2987 			} else {
2988 				all_bad = false;
2989 			}
2990 		}
2991 	}
2992 
2993 	/*
2994 	 * Mark any bad forwarders.
2995 	 */
2996 	for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL;
2997 	     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
2998 	{
2999 		if (bad_server(fctx, &addrinfo->sockaddr)) {
3000 			addrinfo->flags |= FCTX_ADDRINFO_MARK;
3001 		} else {
3002 			all_bad = false;
3003 		}
3004 	}
3005 
3006 	/*
3007 	 * Mark any bad alternates.
3008 	 */
3009 	for (curr = ISC_LIST_HEAD(fctx->altfinds); curr != NULL;
3010 	     curr = ISC_LIST_NEXT(curr, publink))
3011 	{
3012 		for (addrinfo = ISC_LIST_HEAD(curr->list); addrinfo != NULL;
3013 		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3014 		{
3015 			if (bad_server(fctx, &addrinfo->sockaddr)) {
3016 				addrinfo->flags |= FCTX_ADDRINFO_MARK;
3017 			} else {
3018 				all_bad = false;
3019 			}
3020 		}
3021 	}
3022 
3023 	for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL;
3024 	     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3025 	{
3026 		if (bad_server(fctx, &addrinfo->sockaddr)) {
3027 			addrinfo->flags |= FCTX_ADDRINFO_MARK;
3028 		} else {
3029 			all_bad = false;
3030 		}
3031 	}
3032 
3033 	return all_bad;
3034 }
3035 
3036 static void
3037 add_bad(fetchctx_t *fctx, dns_message_t *rmessage, dns_adbaddrinfo_t *addrinfo,
3038 	isc_result_t reason, badnstype_t badtype) {
3039 	char namebuf[DNS_NAME_FORMATSIZE];
3040 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
3041 	char classbuf[64];
3042 	char typebuf[64];
3043 	char code[64];
3044 	isc_buffer_t b;
3045 	isc_sockaddr_t *sa;
3046 	const char *spc = "";
3047 	isc_sockaddr_t *address = &addrinfo->sockaddr;
3048 
3049 #ifdef ENABLE_AFL
3050 	if (dns_fuzzing_resolver) {
3051 		return;
3052 	}
3053 #endif /* ifdef ENABLE_AFL */
3054 
3055 	if (reason == DNS_R_LAME) {
3056 		fctx->lamecount++;
3057 	} else {
3058 		switch (badtype) {
3059 		case badns_unreachable:
3060 			fctx->neterr++;
3061 			break;
3062 		case badns_response:
3063 			fctx->badresp++;
3064 			break;
3065 		case badns_validation:
3066 			break; /* counted as 'valfail' */
3067 		case badns_forwarder:
3068 			/*
3069 			 * We were called to prevent the given forwarder
3070 			 * from being used again for this fetch context.
3071 			 */
3072 			break;
3073 		}
3074 	}
3075 
3076 	if (bad_server(fctx, address)) {
3077 		/*
3078 		 * We already know this server is bad.
3079 		 */
3080 		return;
3081 	}
3082 
3083 	FCTXTRACE("add_bad");
3084 
3085 	sa = isc_mem_get(fctx->mctx, sizeof(*sa));
3086 	*sa = *address;
3087 	ISC_LIST_INITANDAPPEND(fctx->bad, sa, link);
3088 
3089 	if (reason == DNS_R_LAME) { /* already logged */
3090 		return;
3091 	}
3092 
3093 	if (reason == DNS_R_UNEXPECTEDRCODE &&
3094 	    rmessage->rcode == dns_rcode_servfail && ISFORWARDER(addrinfo))
3095 	{
3096 		return;
3097 	}
3098 
3099 	if (reason == DNS_R_UNEXPECTEDRCODE) {
3100 		isc_buffer_init(&b, code, sizeof(code) - 1);
3101 		dns_rcode_totext(rmessage->rcode, &b);
3102 		code[isc_buffer_usedlength(&b)] = '\0';
3103 		spc = " ";
3104 	} else if (reason == DNS_R_UNEXPECTEDOPCODE) {
3105 		isc_buffer_init(&b, code, sizeof(code) - 1);
3106 		dns_opcode_totext((dns_opcode_t)rmessage->opcode, &b);
3107 		code[isc_buffer_usedlength(&b)] = '\0';
3108 		spc = " ";
3109 	} else {
3110 		code[0] = '\0';
3111 	}
3112 	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
3113 	dns_rdatatype_format(fctx->type, typebuf, sizeof(typebuf));
3114 	dns_rdataclass_format(fctx->res->rdclass, classbuf, sizeof(classbuf));
3115 	isc_sockaddr_format(address, addrbuf, sizeof(addrbuf));
3116 	isc_log_write(
3117 		dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS, DNS_LOGMODULE_RESOLVER,
3118 		ISC_LOG_INFO, "%s%s%s resolving '%s/%s/%s': %s", code, spc,
3119 		isc_result_totext(reason), namebuf, typebuf, classbuf, addrbuf);
3120 }
3121 
3122 /*
3123  * Sort addrinfo list by RTT.
3124  */
3125 static void
3126 sort_adbfind(dns_adbfind_t *find, unsigned int bias) {
3127 	dns_adbaddrinfo_t *best, *curr;
3128 	dns_adbaddrinfolist_t sorted;
3129 
3130 	/* Lame N^2 bubble sort. */
3131 	ISC_LIST_INIT(sorted);
3132 	while (!ISC_LIST_EMPTY(find->list)) {
3133 		unsigned int best_srtt;
3134 		best = ISC_LIST_HEAD(find->list);
3135 		best_srtt = best->srtt;
3136 		if (isc_sockaddr_pf(&best->sockaddr) != AF_INET6) {
3137 			best_srtt += bias;
3138 		}
3139 		curr = ISC_LIST_NEXT(best, publink);
3140 		while (curr != NULL) {
3141 			unsigned int curr_srtt = curr->srtt;
3142 			if (isc_sockaddr_pf(&curr->sockaddr) != AF_INET6) {
3143 				curr_srtt += bias;
3144 			}
3145 			if (curr_srtt < best_srtt) {
3146 				best = curr;
3147 				best_srtt = curr_srtt;
3148 			}
3149 			curr = ISC_LIST_NEXT(curr, publink);
3150 		}
3151 		ISC_LIST_UNLINK(find->list, best, publink);
3152 		ISC_LIST_APPEND(sorted, best, publink);
3153 	}
3154 	find->list = sorted;
3155 }
3156 
3157 /*
3158  * Sort a list of finds by server RTT.
3159  */
3160 static void
3161 sort_finds(dns_adbfindlist_t *findlist, unsigned int bias) {
3162 	dns_adbfind_t *best, *curr;
3163 	dns_adbfindlist_t sorted;
3164 	dns_adbaddrinfo_t *addrinfo, *bestaddrinfo;
3165 
3166 	/* Sort each find's addrinfo list by SRTT. */
3167 	for (curr = ISC_LIST_HEAD(*findlist); curr != NULL;
3168 	     curr = ISC_LIST_NEXT(curr, publink))
3169 	{
3170 		sort_adbfind(curr, bias);
3171 	}
3172 
3173 	/* Lame N^2 bubble sort. */
3174 	ISC_LIST_INIT(sorted);
3175 	while (!ISC_LIST_EMPTY(*findlist)) {
3176 		unsigned int best_srtt;
3177 		best = ISC_LIST_HEAD(*findlist);
3178 		bestaddrinfo = ISC_LIST_HEAD(best->list);
3179 		INSIST(bestaddrinfo != NULL);
3180 		best_srtt = bestaddrinfo->srtt;
3181 		if (isc_sockaddr_pf(&bestaddrinfo->sockaddr) != AF_INET6) {
3182 			best_srtt += bias;
3183 		}
3184 		curr = ISC_LIST_NEXT(best, publink);
3185 		while (curr != NULL) {
3186 			unsigned int curr_srtt;
3187 			addrinfo = ISC_LIST_HEAD(curr->list);
3188 			INSIST(addrinfo != NULL);
3189 			curr_srtt = addrinfo->srtt;
3190 			if (isc_sockaddr_pf(&addrinfo->sockaddr) != AF_INET6) {
3191 				curr_srtt += bias;
3192 			}
3193 			if (curr_srtt < best_srtt) {
3194 				best = curr;
3195 				best_srtt = curr_srtt;
3196 			}
3197 			curr = ISC_LIST_NEXT(curr, publink);
3198 		}
3199 		ISC_LIST_UNLINK(*findlist, best, publink);
3200 		ISC_LIST_APPEND(sorted, best, publink);
3201 	}
3202 	*findlist = sorted;
3203 }
3204 
3205 /*
3206  * Return true iff the ADB find has a pending fetch for 'type'.  This is
3207  * used to find out whether we're in a loop, where a fetch is waiting for a
3208  * find which is waiting for that same fetch.
3209  *
3210  * Note: This could be done with either an equivalence check (e.g.,
3211  * query_pending == DNS_ADBFIND_INET) or with a bit check, as below.  If
3212  * we checked for equivalence, that would mean we could only detect a loop
3213  * when there is exactly one pending fetch, and we're it. If there were
3214  * pending fetches for *both* address families, then a loop would be
3215  * undetected.
3216  *
3217  * However, using a bit check means that in theory, an ADB find might be
3218  * aborted that could have succeeded, if the other fetch had returned an
3219  * answer.
3220  *
3221  * Since there's a good chance the server is broken and won't answer either
3222  * query, and since an ADB find with two pending fetches is a very rare
3223  * occurrance anyway, we regard this theoretical SERVFAIL as the lesser
3224  * evil.
3225  */
3226 static bool
3227 waiting_for(dns_adbfind_t *find, dns_rdatatype_t type) {
3228 	switch (type) {
3229 	case dns_rdatatype_a:
3230 		return (find->query_pending & DNS_ADBFIND_INET) != 0;
3231 	case dns_rdatatype_aaaa:
3232 		return (find->query_pending & DNS_ADBFIND_INET6) != 0;
3233 	default:
3234 		return false;
3235 	}
3236 }
3237 
3238 static void
3239 findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
3240 	 unsigned int options, unsigned int flags, isc_stdtime_t now,
3241 	 bool *overquota, bool *need_alternate, unsigned int *no_addresses) {
3242 	dns_adbaddrinfo_t *ai = NULL;
3243 	dns_adbfind_t *find = NULL;
3244 	dns_resolver_t *res = fctx->res;
3245 	bool unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0);
3246 	isc_result_t result;
3247 
3248 	FCTXTRACE("FINDNAME");
3249 
3250 	/*
3251 	 * If this name is a subdomain of the query domain, tell
3252 	 * the ADB to start looking using zone/hint data. This keeps us
3253 	 * from getting stuck if the nameserver is beneath the zone cut
3254 	 * and we don't know its address (e.g. because the A record has
3255 	 * expired).
3256 	 */
3257 	if (dns_name_issubdomain(name, fctx->domain)) {
3258 		options |= DNS_ADBFIND_STARTATZONE;
3259 	}
3260 
3261 	/*
3262 	 * Exempt prefetches from ADB quota.
3263 	 */
3264 	if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) {
3265 		options |= DNS_ADBFIND_QUOTAEXEMPT;
3266 	}
3267 
3268 	/*
3269 	 * See what we know about this address.
3270 	 */
3271 	INSIST(!SHUTTINGDOWN(fctx));
3272 	fetchctx_ref(fctx);
3273 	result = dns_adb_createfind(fctx->adb, fctx->loop, fctx_finddone, fctx,
3274 				    name, fctx->name, fctx->type, options, now,
3275 				    NULL, res->view->dstport, fctx->depth + 1,
3276 				    fctx->qc, &find);
3277 
3278 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
3279 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
3280 		      "fctx %p(%s): createfind for %s - %s", fctx, fctx->info,
3281 		      fctx->clientstr, isc_result_totext(result));
3282 
3283 	if (result != ISC_R_SUCCESS) {
3284 		if (result == DNS_R_ALIAS) {
3285 			char namebuf[DNS_NAME_FORMATSIZE];
3286 
3287 			/*
3288 			 * XXXRTH  Follow the CNAME/DNAME chain?
3289 			 */
3290 			dns_adb_destroyfind(&find);
3291 			fctx->adberr++;
3292 			dns_name_format(name, namebuf, sizeof(namebuf));
3293 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_CNAME,
3294 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
3295 				      "skipping nameserver '%s' because it "
3296 				      "is a CNAME, while resolving '%s'",
3297 				      namebuf, fctx->info);
3298 		}
3299 		fetchctx_detach(&fctx);
3300 		return;
3301 	}
3302 
3303 	if (!ISC_LIST_EMPTY(find->list)) {
3304 		/*
3305 		 * We have at least some of the addresses for the
3306 		 * name.
3307 		 */
3308 		INSIST((find->options & DNS_ADBFIND_WANTEVENT) == 0);
3309 		if (flags != 0 || port != 0) {
3310 			for (ai = ISC_LIST_HEAD(find->list); ai != NULL;
3311 			     ai = ISC_LIST_NEXT(ai, publink))
3312 			{
3313 				ai->flags |= flags;
3314 				if (port != 0) {
3315 					isc_sockaddr_setport(&ai->sockaddr,
3316 							     port);
3317 				}
3318 			}
3319 		}
3320 		if ((flags & FCTX_ADDRINFO_DUALSTACK) != 0) {
3321 			ISC_LIST_APPEND(fctx->altfinds, find, publink);
3322 		} else {
3323 			ISC_LIST_APPEND(fctx->finds, find, publink);
3324 		}
3325 		return;
3326 	}
3327 
3328 	/*
3329 	 * We don't know any of the addresses for this name.
3330 	 *
3331 	 * The find may be waiting on a resolver fetch for a server
3332 	 * address. We need to make sure it isn't waiting on *this*
3333 	 * fetch, because if it is, we won't be answering it and it
3334 	 * won't be answering us.
3335 	 */
3336 	if (waiting_for(find, fctx->type) && dns_name_equal(name, fctx->name)) {
3337 		fctx->adberr++;
3338 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
3339 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
3340 			      "loop detected resolving '%s'", fctx->info);
3341 
3342 		if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) {
3343 			atomic_fetch_add_relaxed(&fctx->pending, 1);
3344 			dns_adb_cancelfind(find);
3345 		} else {
3346 			dns_adb_destroyfind(&find);
3347 			fetchctx_detach(&fctx);
3348 		}
3349 		return;
3350 	}
3351 
3352 	/*
3353 	 * We may be waiting for another fetch to complete, and
3354 	 * we'll get an event later when the find has what it needs.
3355 	 */
3356 	if ((find->options & DNS_ADBFIND_WANTEVENT) != 0) {
3357 		atomic_fetch_add_relaxed(&fctx->pending, 1);
3358 
3359 		/*
3360 		 * Bootstrap.
3361 		 */
3362 		if (need_alternate != NULL && !*need_alternate && unshared &&
3363 		    ((res->dispatches4 == NULL &&
3364 		      find->result_v6 != DNS_R_NXDOMAIN) ||
3365 		     (res->dispatches6 == NULL &&
3366 		      find->result_v4 != DNS_R_NXDOMAIN)))
3367 		{
3368 			*need_alternate = true;
3369 		}
3370 		if (no_addresses != NULL) {
3371 			(*no_addresses)++;
3372 		}
3373 		return;
3374 	}
3375 
3376 	/*
3377 	 * No addresses and no pending events: the find failed.
3378 	 */
3379 	if ((find->options & DNS_ADBFIND_OVERQUOTA) != 0) {
3380 		if (overquota != NULL) {
3381 			*overquota = true;
3382 		}
3383 		fctx->quotacount++; /* quota exceeded */
3384 	} else {
3385 		fctx->adberr++; /* unreachable server, etc. */
3386 	}
3387 
3388 	/*
3389 	 * If we know there are no addresses for the family we are using then
3390 	 * try to add an alternative server.
3391 	 */
3392 	if (need_alternate != NULL && !*need_alternate &&
3393 	    ((res->dispatches4 == NULL && find->result_v6 == DNS_R_NXRRSET) ||
3394 	     (res->dispatches6 == NULL && find->result_v4 == DNS_R_NXRRSET)))
3395 	{
3396 		*need_alternate = true;
3397 	}
3398 	dns_adb_destroyfind(&find);
3399 	fetchctx_detach(&fctx);
3400 }
3401 
3402 static bool
3403 isstrictsubdomain(const dns_name_t *name1, const dns_name_t *name2) {
3404 	int order;
3405 	unsigned int nlabels;
3406 	dns_namereln_t namereln;
3407 
3408 	namereln = dns_name_fullcompare(name1, name2, &order, &nlabels);
3409 	return namereln == dns_namereln_subdomain;
3410 }
3411 
3412 static isc_result_t
3413 fctx_getaddresses(fetchctx_t *fctx) {
3414 	dns_rdata_t rdata = DNS_RDATA_INIT;
3415 	isc_result_t result;
3416 	dns_resolver_t *res;
3417 	isc_stdtime_t now;
3418 	unsigned int stdoptions = 0;
3419 	dns_forwarder_t *fwd;
3420 	dns_adbaddrinfo_t *ai;
3421 	bool all_bad;
3422 	dns_rdata_ns_t ns;
3423 	bool need_alternate = false;
3424 	bool all_spilled = false;
3425 	unsigned int no_addresses = 0;
3426 	unsigned int ns_processed = 0;
3427 
3428 	FCTXTRACE5("getaddresses", "fctx->depth=", fctx->depth);
3429 
3430 	/*
3431 	 * Don't pound on remote servers.  (Failsafe!)
3432 	 */
3433 	fctx->restarts++;
3434 	if (fctx->restarts > 100) {
3435 		FCTXTRACE("too many restarts");
3436 		return DNS_R_SERVFAIL;
3437 	}
3438 
3439 	res = fctx->res;
3440 
3441 	if (fctx->depth > res->maxdepth) {
3442 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
3443 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
3444 			      "too much NS indirection resolving '%s' "
3445 			      "(depth=%u, maxdepth=%u)",
3446 			      fctx->info, fctx->depth, res->maxdepth);
3447 		return DNS_R_SERVFAIL;
3448 	}
3449 
3450 	/*
3451 	 * Forwarders.
3452 	 */
3453 
3454 	INSIST(ISC_LIST_EMPTY(fctx->forwaddrs));
3455 	INSIST(ISC_LIST_EMPTY(fctx->altaddrs));
3456 
3457 	/*
3458 	 * If we have DNS_FETCHOPT_NOFORWARD set and forwarding policy
3459 	 * allows us to not forward - skip forwarders and go straight
3460 	 * to NSes. This is currently used to make sure that priming
3461 	 * query gets root servers' IP addresses in ADDITIONAL section.
3462 	 */
3463 	if ((fctx->options & DNS_FETCHOPT_NOFORWARD) != 0 &&
3464 	    (fctx->fwdpolicy != dns_fwdpolicy_only))
3465 	{
3466 		goto normal_nses;
3467 	}
3468 
3469 	/*
3470 	 * If this fctx has forwarders, use them; otherwise use any
3471 	 * selective forwarders specified in the view; otherwise use the
3472 	 * resolver's forwarders (if any).
3473 	 */
3474 	fwd = ISC_LIST_HEAD(fctx->forwarders);
3475 	if (fwd == NULL) {
3476 		dns_forwarders_t *forwarders = NULL;
3477 		dns_name_t *name = fctx->name;
3478 		dns_name_t suffix;
3479 
3480 		/*
3481 		 * DS records are found in the parent server.
3482 		 * Strip label to get the correct forwarder (if any).
3483 		 */
3484 		if (dns_rdatatype_atparent(fctx->type) &&
3485 		    dns_name_countlabels(name) > 1)
3486 		{
3487 			unsigned int labels;
3488 			dns_name_init(&suffix, NULL);
3489 			labels = dns_name_countlabels(name);
3490 			dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
3491 			name = &suffix;
3492 		}
3493 
3494 		result = dns_fwdtable_find(res->view->fwdtable, name,
3495 					   &forwarders);
3496 		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
3497 			fwd = ISC_LIST_HEAD(forwarders->fwdrs);
3498 			fctx->fwdpolicy = forwarders->fwdpolicy;
3499 			dns_name_copy(&forwarders->name, fctx->fwdname);
3500 			if (fctx->fwdpolicy == dns_fwdpolicy_only &&
3501 			    isstrictsubdomain(&forwarders->name, fctx->domain))
3502 			{
3503 				fcount_decr(fctx);
3504 				dns_name_copy(&forwarders->name, fctx->domain);
3505 				result = fcount_incr(fctx, true);
3506 				if (result != ISC_R_SUCCESS) {
3507 					dns_forwarders_detach(&forwarders);
3508 					return result;
3509 				}
3510 			}
3511 			dns_forwarders_detach(&forwarders);
3512 		}
3513 	}
3514 
3515 	while (fwd != NULL) {
3516 		if ((isc_sockaddr_pf(&fwd->addr) == AF_INET &&
3517 		     res->dispatches4 == NULL) ||
3518 		    (isc_sockaddr_pf(&fwd->addr) == AF_INET6 &&
3519 		     res->dispatches6 == NULL))
3520 		{
3521 			fwd = ISC_LIST_NEXT(fwd, link);
3522 			continue;
3523 		}
3524 		ai = NULL;
3525 		result = dns_adb_findaddrinfo(fctx->adb, &fwd->addr, &ai, 0);
3526 		if (result == ISC_R_SUCCESS) {
3527 			dns_adbaddrinfo_t *cur;
3528 			ai->flags |= FCTX_ADDRINFO_FORWARDER;
3529 			if (fwd->tlsname != NULL) {
3530 				result = dns_view_gettransport(
3531 					res->view, DNS_TRANSPORT_TLS,
3532 					fwd->tlsname, &ai->transport);
3533 				if (result != ISC_R_SUCCESS) {
3534 					dns_adb_freeaddrinfo(fctx->adb, &ai);
3535 					goto next;
3536 				}
3537 			}
3538 			cur = ISC_LIST_HEAD(fctx->forwaddrs);
3539 			while (cur != NULL && cur->srtt < ai->srtt) {
3540 				cur = ISC_LIST_NEXT(cur, publink);
3541 			}
3542 			if (cur != NULL) {
3543 				ISC_LIST_INSERTBEFORE(fctx->forwaddrs, cur, ai,
3544 						      publink);
3545 			} else {
3546 				ISC_LIST_APPEND(fctx->forwaddrs, ai, publink);
3547 			}
3548 		}
3549 	next:
3550 		fwd = ISC_LIST_NEXT(fwd, link);
3551 	}
3552 
3553 	/*
3554 	 * If the forwarding policy is "only", we don't need the
3555 	 * addresses of the nameservers.
3556 	 */
3557 	if (fctx->fwdpolicy == dns_fwdpolicy_only) {
3558 		goto out;
3559 	}
3560 
3561 	/*
3562 	 * Normal nameservers.
3563 	 */
3564 normal_nses:
3565 	stdoptions = DNS_ADBFIND_WANTEVENT | DNS_ADBFIND_EMPTYEVENT;
3566 	if (fctx->restarts == 1) {
3567 		/*
3568 		 * To avoid sending out a flood of queries likely to
3569 		 * result in NXRRSET, we suppress fetches for address
3570 		 * families we don't have the first time through,
3571 		 * provided that we have addresses in some family we
3572 		 * can use.
3573 		 *
3574 		 * We don't want to set this option all the time, since
3575 		 * if fctx->restarts > 1, we've clearly been having
3576 		 * trouble with the addresses we had, so getting more
3577 		 * could help.
3578 		 */
3579 		stdoptions |= DNS_ADBFIND_AVOIDFETCHES;
3580 	}
3581 	if (res->dispatches4 != NULL) {
3582 		stdoptions |= DNS_ADBFIND_INET;
3583 	}
3584 	if (res->dispatches6 != NULL) {
3585 		stdoptions |= DNS_ADBFIND_INET6;
3586 	}
3587 
3588 	if ((stdoptions & DNS_ADBFIND_ADDRESSMASK) == 0) {
3589 		return DNS_R_SERVFAIL;
3590 	}
3591 
3592 	now = isc_stdtime_now();
3593 	all_spilled = true; /* resets to false below after the first success */
3594 
3595 	INSIST(ISC_LIST_EMPTY(fctx->finds));
3596 	INSIST(ISC_LIST_EMPTY(fctx->altfinds));
3597 
3598 	for (result = dns_rdataset_first(&fctx->nameservers);
3599 	     result == ISC_R_SUCCESS;
3600 	     result = dns_rdataset_next(&fctx->nameservers))
3601 	{
3602 		bool overquota = false;
3603 		unsigned int static_stub = 0;
3604 
3605 		dns_rdataset_current(&fctx->nameservers, &rdata);
3606 		/*
3607 		 * Extract the name from the NS record.
3608 		 */
3609 		result = dns_rdata_tostruct(&rdata, &ns, NULL);
3610 		if (result != ISC_R_SUCCESS) {
3611 			continue;
3612 		}
3613 
3614 		if (STATICSTUB(&fctx->nameservers) &&
3615 		    dns_name_equal(&ns.name, fctx->domain))
3616 		{
3617 			static_stub = DNS_ADBFIND_STATICSTUB;
3618 		}
3619 
3620 		if (no_addresses > NS_FAIL_LIMIT &&
3621 		    dns_rdataset_count(&fctx->nameservers) > NS_RR_LIMIT)
3622 		{
3623 			stdoptions |= DNS_ADBFIND_NOFETCH;
3624 		}
3625 		findname(fctx, &ns.name, 0, stdoptions | static_stub, 0, now,
3626 			 &overquota, &need_alternate, &no_addresses);
3627 
3628 		if (!overquota) {
3629 			all_spilled = false;
3630 		}
3631 
3632 		dns_rdata_reset(&rdata);
3633 		dns_rdata_freestruct(&ns);
3634 
3635 		if (++ns_processed >= NS_PROCESSING_LIMIT) {
3636 			result = ISC_R_NOMORE;
3637 			break;
3638 		}
3639 	}
3640 	if (result != ISC_R_NOMORE) {
3641 		return result;
3642 	}
3643 
3644 	/*
3645 	 * Do we need to use 6 to 4?
3646 	 */
3647 	if (need_alternate) {
3648 		int family;
3649 		alternate_t *a;
3650 		family = (res->dispatches6 != NULL) ? AF_INET6 : AF_INET;
3651 		for (a = ISC_LIST_HEAD(res->alternates); a != NULL;
3652 		     a = ISC_LIST_NEXT(a, link))
3653 		{
3654 			if (!a->isaddress) {
3655 				findname(fctx, &a->_u._n.name, a->_u._n.port,
3656 					 stdoptions, FCTX_ADDRINFO_DUALSTACK,
3657 					 now, NULL, NULL, NULL);
3658 				continue;
3659 			}
3660 			if (isc_sockaddr_pf(&a->_u.addr) != family) {
3661 				continue;
3662 			}
3663 			ai = NULL;
3664 			result = dns_adb_findaddrinfo(fctx->adb, &a->_u.addr,
3665 						      &ai, 0);
3666 			if (result == ISC_R_SUCCESS) {
3667 				dns_adbaddrinfo_t *cur;
3668 				ai->flags |= FCTX_ADDRINFO_FORWARDER;
3669 				ai->flags |= FCTX_ADDRINFO_DUALSTACK;
3670 				cur = ISC_LIST_HEAD(fctx->altaddrs);
3671 				while (cur != NULL && cur->srtt < ai->srtt) {
3672 					cur = ISC_LIST_NEXT(cur, publink);
3673 				}
3674 				if (cur != NULL) {
3675 					ISC_LIST_INSERTBEFORE(fctx->altaddrs,
3676 							      cur, ai, publink);
3677 				} else {
3678 					ISC_LIST_APPEND(fctx->altaddrs, ai,
3679 							publink);
3680 				}
3681 			}
3682 		}
3683 	}
3684 
3685 out:
3686 	/*
3687 	 * Mark all known bad servers.
3688 	 */
3689 	all_bad = mark_bad(fctx);
3690 
3691 	/*
3692 	 * How are we doing?
3693 	 */
3694 	if (all_bad) {
3695 		/*
3696 		 * We've got no addresses.
3697 		 */
3698 		if (atomic_load_acquire(&fctx->pending) > 0) {
3699 			/*
3700 			 * We're fetching the addresses, but don't have
3701 			 * any yet.   Tell the caller to wait for an
3702 			 * answer.
3703 			 */
3704 			result = DNS_R_WAIT;
3705 		} else {
3706 			/*
3707 			 * We've lost completely.  We don't know any
3708 			 * addresses, and the ADB has told us it can't
3709 			 * get them.
3710 			 */
3711 			FCTXTRACE("no addresses");
3712 
3713 			result = ISC_R_FAILURE;
3714 
3715 			/*
3716 			 * If all of the addresses found were over the
3717 			 * fetches-per-server quota, return the
3718 			 * configured response.
3719 			 */
3720 			if (all_spilled) {
3721 				result = res->quotaresp[dns_quotatype_server];
3722 				inc_stats(res, dns_resstatscounter_serverquota);
3723 			}
3724 		}
3725 	} else {
3726 		/*
3727 		 * We've found some addresses.  We might still be
3728 		 * looking for more addresses.
3729 		 */
3730 		sort_finds(&fctx->finds, res->view->v6bias);
3731 		sort_finds(&fctx->altfinds, 0);
3732 		result = ISC_R_SUCCESS;
3733 	}
3734 
3735 	return result;
3736 }
3737 
3738 static void
3739 possibly_mark(fetchctx_t *fctx, dns_adbaddrinfo_t *addr) {
3740 	isc_netaddr_t na;
3741 	isc_sockaddr_t *sa = &addr->sockaddr;
3742 	bool aborted = false;
3743 	bool bogus;
3744 	dns_acl_t *blackhole;
3745 	isc_netaddr_t ipaddr;
3746 	dns_peer_t *peer = NULL;
3747 	dns_resolver_t *res = fctx->res;
3748 	const char *msg = NULL;
3749 
3750 	isc_netaddr_fromsockaddr(&ipaddr, sa);
3751 	blackhole = dns_dispatchmgr_getblackhole(res->view->dispatchmgr);
3752 	(void)dns_peerlist_peerbyaddr(res->view->peers, &ipaddr, &peer);
3753 
3754 	if (blackhole != NULL) {
3755 		int match;
3756 
3757 		if ((dns_acl_match(&ipaddr, NULL, blackhole, res->view->aclenv,
3758 				   &match, NULL) == ISC_R_SUCCESS) &&
3759 		    match > 0)
3760 		{
3761 			aborted = true;
3762 		}
3763 	}
3764 
3765 	if (peer != NULL && dns_peer_getbogus(peer, &bogus) == ISC_R_SUCCESS &&
3766 	    bogus)
3767 	{
3768 		aborted = true;
3769 	}
3770 
3771 	if (aborted) {
3772 		addr->flags |= FCTX_ADDRINFO_MARK;
3773 		msg = "ignoring blackholed / bogus server: ";
3774 	} else if (isc_sockaddr_isnetzero(sa)) {
3775 		addr->flags |= FCTX_ADDRINFO_MARK;
3776 		msg = "ignoring net zero address: ";
3777 	} else if (isc_sockaddr_ismulticast(sa)) {
3778 		addr->flags |= FCTX_ADDRINFO_MARK;
3779 		msg = "ignoring multicast address: ";
3780 	} else if (isc_sockaddr_isexperimental(sa)) {
3781 		addr->flags |= FCTX_ADDRINFO_MARK;
3782 		msg = "ignoring experimental address: ";
3783 	} else if (sa->type.sa.sa_family != AF_INET6) {
3784 		return;
3785 	} else if (IN6_IS_ADDR_V4MAPPED(&sa->type.sin6.sin6_addr)) {
3786 		addr->flags |= FCTX_ADDRINFO_MARK;
3787 		msg = "ignoring IPv6 mapped IPV4 address: ";
3788 	} else if (IN6_IS_ADDR_V4COMPAT(&sa->type.sin6.sin6_addr)) {
3789 		addr->flags |= FCTX_ADDRINFO_MARK;
3790 		msg = "ignoring IPv6 compatibility IPV4 address: ";
3791 	} else {
3792 		return;
3793 	}
3794 
3795 	if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(3))) {
3796 		char buf[ISC_NETADDR_FORMATSIZE];
3797 		isc_netaddr_fromsockaddr(&na, sa);
3798 		isc_netaddr_format(&na, buf, sizeof(buf));
3799 		FCTXTRACE2(msg, buf);
3800 	}
3801 }
3802 
3803 static dns_adbaddrinfo_t *
3804 fctx_nextaddress(fetchctx_t *fctx) {
3805 	dns_adbfind_t *find, *start;
3806 	dns_adbaddrinfo_t *addrinfo;
3807 	dns_adbaddrinfo_t *faddrinfo;
3808 
3809 	/*
3810 	 * Return the next untried address, if any.
3811 	 */
3812 
3813 	/*
3814 	 * Find the first unmarked forwarder (if any).
3815 	 */
3816 	for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs); addrinfo != NULL;
3817 	     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3818 	{
3819 		if (!UNMARKED(addrinfo)) {
3820 			continue;
3821 		}
3822 		possibly_mark(fctx, addrinfo);
3823 		if (UNMARKED(addrinfo)) {
3824 			addrinfo->flags |= FCTX_ADDRINFO_MARK;
3825 			fctx->find = NULL;
3826 			fctx->forwarding = true;
3827 
3828 			/*
3829 			 * QNAME minimization is disabled when
3830 			 * forwarding, and has to remain disabled if
3831 			 * we switch back to normal recursion; otherwise
3832 			 * forwarding could leave us in an inconsistent
3833 			 * state.
3834 			 */
3835 			fctx->minimized = false;
3836 			return addrinfo;
3837 		}
3838 	}
3839 
3840 	/*
3841 	 * No forwarders.  Move to the next find.
3842 	 */
3843 	fctx->forwarding = false;
3844 	FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDFIND);
3845 
3846 	find = fctx->find;
3847 	if (find == NULL) {
3848 		find = ISC_LIST_HEAD(fctx->finds);
3849 	} else {
3850 		find = ISC_LIST_NEXT(find, publink);
3851 		if (find == NULL) {
3852 			find = ISC_LIST_HEAD(fctx->finds);
3853 		}
3854 	}
3855 
3856 	/*
3857 	 * Find the first unmarked addrinfo.
3858 	 */
3859 	addrinfo = NULL;
3860 	if (find != NULL) {
3861 		start = find;
3862 		do {
3863 			for (addrinfo = ISC_LIST_HEAD(find->list);
3864 			     addrinfo != NULL;
3865 			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3866 			{
3867 				if (!UNMARKED(addrinfo)) {
3868 					continue;
3869 				}
3870 				possibly_mark(fctx, addrinfo);
3871 				if (UNMARKED(addrinfo)) {
3872 					addrinfo->flags |= FCTX_ADDRINFO_MARK;
3873 					break;
3874 				}
3875 			}
3876 			if (addrinfo != NULL) {
3877 				break;
3878 			}
3879 			find = ISC_LIST_NEXT(find, publink);
3880 			if (find == NULL) {
3881 				find = ISC_LIST_HEAD(fctx->finds);
3882 			}
3883 		} while (find != start);
3884 	}
3885 
3886 	fctx->find = find;
3887 	if (addrinfo != NULL) {
3888 		return addrinfo;
3889 	}
3890 
3891 	/*
3892 	 * No nameservers left.  Try alternates.
3893 	 */
3894 
3895 	FCTX_ATTR_SET(fctx, FCTX_ATTR_TRIEDALT);
3896 
3897 	find = fctx->altfind;
3898 	if (find == NULL) {
3899 		find = ISC_LIST_HEAD(fctx->altfinds);
3900 	} else {
3901 		find = ISC_LIST_NEXT(find, publink);
3902 		if (find == NULL) {
3903 			find = ISC_LIST_HEAD(fctx->altfinds);
3904 		}
3905 	}
3906 
3907 	/*
3908 	 * Find the first unmarked addrinfo.
3909 	 */
3910 	addrinfo = NULL;
3911 	if (find != NULL) {
3912 		start = find;
3913 		do {
3914 			for (addrinfo = ISC_LIST_HEAD(find->list);
3915 			     addrinfo != NULL;
3916 			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3917 			{
3918 				if (!UNMARKED(addrinfo)) {
3919 					continue;
3920 				}
3921 				possibly_mark(fctx, addrinfo);
3922 				if (UNMARKED(addrinfo)) {
3923 					addrinfo->flags |= FCTX_ADDRINFO_MARK;
3924 					break;
3925 				}
3926 			}
3927 			if (addrinfo != NULL) {
3928 				break;
3929 			}
3930 			find = ISC_LIST_NEXT(find, publink);
3931 			if (find == NULL) {
3932 				find = ISC_LIST_HEAD(fctx->altfinds);
3933 			}
3934 		} while (find != start);
3935 	}
3936 
3937 	faddrinfo = addrinfo;
3938 
3939 	/*
3940 	 * See if we have a better alternate server by address.
3941 	 */
3942 
3943 	for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL;
3944 	     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
3945 	{
3946 		if (!UNMARKED(addrinfo)) {
3947 			continue;
3948 		}
3949 		possibly_mark(fctx, addrinfo);
3950 		if (UNMARKED(addrinfo) &&
3951 		    (faddrinfo == NULL || addrinfo->srtt < faddrinfo->srtt))
3952 		{
3953 			if (faddrinfo != NULL) {
3954 				faddrinfo->flags &= ~FCTX_ADDRINFO_MARK;
3955 			}
3956 			addrinfo->flags |= FCTX_ADDRINFO_MARK;
3957 			break;
3958 		}
3959 	}
3960 
3961 	if (addrinfo == NULL) {
3962 		addrinfo = faddrinfo;
3963 		fctx->altfind = find;
3964 	}
3965 
3966 	return addrinfo;
3967 }
3968 
3969 static void
3970 fctx_try(fetchctx_t *fctx, bool retrying) {
3971 	isc_result_t result;
3972 	dns_adbaddrinfo_t *addrinfo = NULL;
3973 	dns_resolver_t *res = NULL;
3974 
3975 	FCTXTRACE5("try", "fctx->qc=", isc_counter_used(fctx->qc));
3976 
3977 	REQUIRE(!ADDRWAIT(fctx));
3978 	REQUIRE(fctx->tid == isc_tid());
3979 
3980 	res = fctx->res;
3981 
3982 	/* We've already exceeded maximum query count */
3983 	if (isc_counter_used(fctx->qc) > res->maxqueries) {
3984 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
3985 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
3986 			      "exceeded max queries resolving '%s' "
3987 			      "(querycount=%u, maxqueries=%u)",
3988 			      fctx->info, isc_counter_used(fctx->qc),
3989 			      res->maxqueries);
3990 		result = DNS_R_SERVFAIL;
3991 		goto done;
3992 	}
3993 
3994 	addrinfo = fctx_nextaddress(fctx);
3995 
3996 	/* Try to find an address that isn't over quota */
3997 	while (addrinfo != NULL && dns_adb_overquota(fctx->adb, addrinfo)) {
3998 		addrinfo = fctx_nextaddress(fctx);
3999 	}
4000 
4001 	if (addrinfo == NULL) {
4002 		/* We have no more addresses.  Start over. */
4003 		fctx_cancelqueries(fctx, true, false);
4004 		fctx_cleanup(fctx);
4005 		result = fctx_getaddresses(fctx);
4006 		switch (result) {
4007 		case ISC_R_SUCCESS:
4008 			break;
4009 		case DNS_R_WAIT:
4010 			/* Sleep waiting for addresses. */
4011 			FCTXTRACE("addrwait");
4012 			FCTX_ATTR_SET(fctx, FCTX_ATTR_ADDRWAIT);
4013 			return;
4014 		default:
4015 			goto done;
4016 		}
4017 
4018 		addrinfo = fctx_nextaddress(fctx);
4019 
4020 		while (addrinfo != NULL &&
4021 		       dns_adb_overquota(fctx->adb, addrinfo))
4022 		{
4023 			addrinfo = fctx_nextaddress(fctx);
4024 		}
4025 
4026 		/*
4027 		 * While we may have addresses from the ADB, they
4028 		 * might be bad ones.  In this case, return SERVFAIL.
4029 		 */
4030 		if (addrinfo == NULL) {
4031 			result = DNS_R_SERVFAIL;
4032 			goto done;
4033 		}
4034 	}
4035 	/*
4036 	 * We're minimizing and we're not yet at the final NS -
4037 	 * we need to launch a query for NS for 'upper' domain
4038 	 */
4039 	if (fctx->minimized && !fctx->forwarding) {
4040 		unsigned int options = fctx->options;
4041 
4042 		options &= ~DNS_FETCHOPT_QMINIMIZE;
4043 
4044 		/*
4045 		 * Is another QNAME minimization fetch still running?
4046 		 */
4047 		if (fctx->qminfetch != NULL) {
4048 			bool validfctx = (DNS_FETCH_VALID(fctx->qminfetch) &&
4049 					  VALID_FCTX(fctx->qminfetch->private));
4050 			char namebuf[DNS_NAME_FORMATSIZE];
4051 			char typebuf[DNS_RDATATYPE_FORMATSIZE];
4052 
4053 			dns_name_format(fctx->qminname, namebuf,
4054 					sizeof(namebuf));
4055 			dns_rdatatype_format(fctx->qmintype, typebuf,
4056 					     sizeof(typebuf));
4057 
4058 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4059 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_ERROR,
4060 				      "fctx %p(%s): attempting QNAME "
4061 				      "minimization fetch for %s/%s but "
4062 				      "fetch %p(%s) still running",
4063 				      fctx, fctx->info, namebuf, typebuf,
4064 				      fctx->qminfetch,
4065 				      validfctx ? fctx->qminfetch->private->info
4066 						: "<invalid>");
4067 			result = DNS_R_SERVFAIL;
4068 			goto done;
4069 		}
4070 
4071 		/*
4072 		 * Turn on NOFOLLOW in relaxed mode so that QNAME minimization
4073 		 * doesn't cause additional queries to resolve the target of the
4074 		 * QNAME minimization request when a referral is returned.  This
4075 		 * will also reduce the impact of mis-matched NS RRsets where
4076 		 * the child's NS RRset is garbage.  If a delegation is
4077 		 * discovered DNS_R_DELEGATION will be returned to resume_qmin.
4078 		 */
4079 		if ((options & DNS_FETCHOPT_QMIN_STRICT) == 0) {
4080 			options |= DNS_FETCHOPT_NOFOLLOW;
4081 		}
4082 
4083 		fetchctx_ref(fctx);
4084 		result = dns_resolver_createfetch(
4085 			fctx->res, fctx->qminname, fctx->qmintype, fctx->domain,
4086 			&fctx->nameservers, NULL, NULL, 0, options, 0, fctx->qc,
4087 			fctx->loop, resume_qmin, fctx, &fctx->qminrrset, NULL,
4088 			&fctx->qminfetch);
4089 		if (result != ISC_R_SUCCESS) {
4090 			fetchctx_unref(fctx);
4091 			goto done;
4092 		}
4093 		return;
4094 	}
4095 
4096 	result = isc_counter_increment(fctx->qc);
4097 	if (result != ISC_R_SUCCESS) {
4098 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4099 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
4100 			      "exceeded max queries resolving '%s'",
4101 			      fctx->info);
4102 		goto done;
4103 	}
4104 
4105 	result = fctx_query(fctx, addrinfo, fctx->options);
4106 	if (result != ISC_R_SUCCESS) {
4107 		goto done;
4108 	}
4109 	if (retrying) {
4110 		inc_stats(res, dns_resstatscounter_retry);
4111 	}
4112 
4113 done:
4114 	if (result != ISC_R_SUCCESS) {
4115 		fctx_done_detach(&fctx, result);
4116 	}
4117 }
4118 
4119 static void
4120 resume_qmin(void *arg) {
4121 	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
4122 	fetchctx_t *fctx = resp->arg;
4123 	dns_resolver_t *res = NULL;
4124 	isc_result_t result;
4125 	unsigned int findoptions = 0;
4126 	dns_name_t *fname = NULL, *dcname = NULL;
4127 	dns_fixedname_t ffixed, dcfixed;
4128 
4129 	REQUIRE(VALID_FCTX(fctx));
4130 
4131 	res = fctx->res;
4132 
4133 	REQUIRE(fctx->tid == isc_tid());
4134 
4135 	FCTXTRACE("resume_qmin");
4136 
4137 	fname = dns_fixedname_initname(&ffixed);
4138 	dcname = dns_fixedname_initname(&dcfixed);
4139 
4140 	if (resp->node != NULL) {
4141 		dns_db_detachnode(resp->db, &resp->node);
4142 	}
4143 	if (resp->db != NULL) {
4144 		dns_db_detach(&resp->db);
4145 	}
4146 
4147 	if (dns_rdataset_isassociated(resp->rdataset)) {
4148 		dns_rdataset_disassociate(resp->rdataset);
4149 	}
4150 
4151 	result = resp->result;
4152 	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
4153 
4154 	LOCK(&fctx->lock);
4155 	if (SHUTTINGDOWN(fctx)) {
4156 		result = ISC_R_SHUTTINGDOWN;
4157 	}
4158 	UNLOCK(&fctx->lock);
4159 
4160 	dns_resolver_destroyfetch(&fctx->qminfetch);
4161 
4162 	/*
4163 	 * Beware, the switch() below is little bit tricky - the order of the
4164 	 * branches is important.
4165 	 */
4166 	switch (result) {
4167 	case ISC_R_SHUTTINGDOWN:
4168 	case ISC_R_CANCELED:
4169 		goto cleanup;
4170 
4171 	case DNS_R_NXDOMAIN:
4172 	case DNS_R_NCACHENXDOMAIN:
4173 	case DNS_R_FORMERR:
4174 	case DNS_R_REMOTEFORMERR:
4175 	case ISC_R_FAILURE:
4176 		if ((fctx->options & DNS_FETCHOPT_QMIN_STRICT) != 0) {
4177 			/* These results cause a hard fail in strict mode */
4178 			goto cleanup;
4179 		}
4180 
4181 		/* ...or disable minimization in relaxed mode */
4182 		fctx->qmin_labels = DNS_NAME_MAXLABELS;
4183 
4184 		/*
4185 		 * We store the result. If we succeed in the end
4186 		 * we'll issue a warning that the server is
4187 		 * broken.
4188 		 */
4189 		fctx->qmin_warning = result;
4190 		break;
4191 
4192 	case ISC_R_SUCCESS:
4193 	case DNS_R_DELEGATION:
4194 	case DNS_R_NXRRSET:
4195 	case DNS_R_NCACHENXRRSET:
4196 	case DNS_R_CNAME:
4197 	case DNS_R_DNAME:
4198 		/*
4199 		 * We have previously detected a possible error of an
4200 		 * incorrect NXDOMAIN and now have a response that
4201 		 * indicates that it was an actual error.
4202 		 */
4203 		if (fctx->qmin_warning == DNS_R_NCACHENXDOMAIN ||
4204 		    fctx->qmin_warning == DNS_R_NXDOMAIN)
4205 		{
4206 			fctx->force_qmin_warning = true;
4207 		}
4208 		/*
4209 		 * Any other result will *not* cause a failure in strict
4210 		 * mode, or cause minimization to be disabled in relaxed
4211 		 * mode.
4212 		 *
4213 		 * If DNS_R_DELEGATION is set here, it implies that
4214 		 * DNS_FETCHOPT_NOFOLLOW was set, and a delegation was
4215 		 * discovered but not followed; we will do so now.
4216 		 */
4217 		break;
4218 
4219 	default:
4220 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4221 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5),
4222 			      "QNAME minimization: unexpected result %s",
4223 			      isc_result_totext(result));
4224 		break;
4225 	}
4226 
4227 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
4228 		dns_rdataset_disassociate(&fctx->nameservers);
4229 	}
4230 
4231 	if (dns_rdatatype_atparent(fctx->type)) {
4232 		findoptions |= DNS_DBFIND_NOEXACT;
4233 	}
4234 	result = dns_view_findzonecut(res->view, fctx->name, fname, dcname,
4235 				      fctx->now, findoptions, true, true,
4236 				      &fctx->nameservers, NULL);
4237 
4238 	/*
4239 	 * DNS_R_NXDOMAIN here means we have not loaded the root zone
4240 	 * mirror yet - but DNS_R_NXDOMAIN is not a valid return value
4241 	 * when doing recursion, we need to patch it.
4242 	 */
4243 	if (result == DNS_R_NXDOMAIN) {
4244 		result = DNS_R_SERVFAIL;
4245 	}
4246 
4247 	if (result != ISC_R_SUCCESS) {
4248 		goto cleanup;
4249 	}
4250 	fcount_decr(fctx);
4251 
4252 	dns_name_copy(fname, fctx->domain);
4253 
4254 	result = fcount_incr(fctx, true);
4255 	if (result != ISC_R_SUCCESS) {
4256 		goto cleanup;
4257 	}
4258 
4259 	dns_name_copy(dcname, fctx->qmindcname);
4260 	fctx->ns_ttl = fctx->nameservers.ttl;
4261 	fctx->ns_ttl_ok = true;
4262 
4263 	fctx_minimize_qname(fctx);
4264 
4265 	if (!fctx->minimized) {
4266 		/*
4267 		 * We have finished minimizing, but fctx->finds was
4268 		 * filled at the beginning of the run - now we need to
4269 		 * clear it before sending the final query to use proper
4270 		 * nameservers.
4271 		 */
4272 		fctx_cancelqueries(fctx, false, false);
4273 		fctx_cleanup(fctx);
4274 	}
4275 
4276 	fctx_try(fctx, true);
4277 
4278 cleanup:
4279 	if (result != ISC_R_SUCCESS) {
4280 		/* An error occurred, tear down whole fctx */
4281 		fctx_done_unref(fctx, result);
4282 	}
4283 	fetchctx_detach(&fctx);
4284 }
4285 
4286 static void
4287 fctx_destroy(fetchctx_t *fctx) {
4288 	dns_resolver_t *res = NULL;
4289 	isc_sockaddr_t *sa = NULL, *next_sa = NULL;
4290 	struct tried *tried = NULL;
4291 	uint_fast32_t nfctx;
4292 
4293 	REQUIRE(VALID_FCTX(fctx));
4294 	REQUIRE(ISC_LIST_EMPTY(fctx->resps));
4295 	REQUIRE(ISC_LIST_EMPTY(fctx->queries));
4296 	REQUIRE(ISC_LIST_EMPTY(fctx->finds));
4297 	REQUIRE(ISC_LIST_EMPTY(fctx->altfinds));
4298 	REQUIRE(atomic_load_acquire(&fctx->pending) == 0);
4299 	REQUIRE(ISC_LIST_EMPTY(fctx->validators));
4300 	REQUIRE(fctx->state != fetchstate_active);
4301 
4302 	FCTXTRACE("destroy");
4303 
4304 	fctx->magic = 0;
4305 
4306 	res = fctx->res;
4307 
4308 	dec_stats(res, dns_resstatscounter_nfetch);
4309 
4310 	nfctx = atomic_fetch_sub_release(&res->nfctx, 1);
4311 	INSIST(nfctx > 0);
4312 
4313 	/* Free bad */
4314 	for (sa = ISC_LIST_HEAD(fctx->bad); sa != NULL; sa = next_sa) {
4315 		next_sa = ISC_LIST_NEXT(sa, link);
4316 		ISC_LIST_UNLINK(fctx->bad, sa, link);
4317 		isc_mem_put(fctx->mctx, sa, sizeof(*sa));
4318 	}
4319 
4320 	for (tried = ISC_LIST_HEAD(fctx->edns); tried != NULL;
4321 	     tried = ISC_LIST_HEAD(fctx->edns))
4322 	{
4323 		ISC_LIST_UNLINK(fctx->edns, tried, link);
4324 		isc_mem_put(fctx->mctx, tried, sizeof(*tried));
4325 	}
4326 
4327 	for (sa = ISC_LIST_HEAD(fctx->bad_edns); sa != NULL; sa = next_sa) {
4328 		next_sa = ISC_LIST_NEXT(sa, link);
4329 		ISC_LIST_UNLINK(fctx->bad_edns, sa, link);
4330 		isc_mem_put(fctx->mctx, sa, sizeof(*sa));
4331 	}
4332 
4333 	isc_counter_detach(&fctx->qc);
4334 	fcount_decr(fctx);
4335 	dns_message_detach(&fctx->qmessage);
4336 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
4337 		dns_rdataset_disassociate(&fctx->nameservers);
4338 	}
4339 	dns_db_detach(&fctx->cache);
4340 	dns_adb_detach(&fctx->adb);
4341 
4342 	dns_resolver_detach(&fctx->res);
4343 
4344 	isc_mutex_destroy(&fctx->lock);
4345 
4346 	isc_mem_free(fctx->mctx, fctx->info);
4347 	isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx));
4348 }
4349 
4350 static void
4351 fctx_expired(void *arg) {
4352 	fetchctx_t *fctx = (fetchctx_t *)arg;
4353 
4354 	REQUIRE(VALID_FCTX(fctx));
4355 	REQUIRE(fctx->tid == isc_tid());
4356 
4357 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4358 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
4359 		      "shut down hung fetch while resolving %p(%s)", fctx,
4360 		      fctx->info);
4361 	fctx_done_detach(&fctx, DNS_R_SERVFAIL);
4362 }
4363 
4364 static void
4365 fctx_shutdown(void *arg) {
4366 	fetchctx_t *fctx = arg;
4367 
4368 	REQUIRE(VALID_FCTX(fctx));
4369 
4370 	fctx_done_unref(fctx, ISC_R_SHUTTINGDOWN);
4371 	fetchctx_detach(&fctx);
4372 }
4373 
4374 static void
4375 fctx_start(void *arg) {
4376 	fetchctx_t *fctx = (fetchctx_t *)arg;
4377 
4378 	REQUIRE(VALID_FCTX(fctx));
4379 
4380 	FCTXTRACE("start");
4381 
4382 	LOCK(&fctx->lock);
4383 	if (SHUTTINGDOWN(fctx)) {
4384 		UNLOCK(&fctx->lock);
4385 		goto detach;
4386 	}
4387 
4388 	/*
4389 	 * Normal fctx startup.
4390 	 */
4391 	fctx->state = fetchstate_active;
4392 	UNLOCK(&fctx->lock);
4393 
4394 	/*
4395 	 * As a backstop, we also set a timer to stop the fetch
4396 	 * if in-band netmgr timeouts don't work. It will fire two
4397 	 * seconds after the fetch should have finished. (This
4398 	 * should be enough of a gap to avoid the timer firing
4399 	 * while a response is being processed normally.)
4400 	 */
4401 	fctx_starttimer(fctx);
4402 	fctx_try(fctx, false);
4403 
4404 detach:
4405 	fetchctx_detach(&fctx);
4406 }
4407 
4408 /*
4409  * Fetch Creation, Joining, and Cancellation.
4410  */
4411 
4412 static void
4413 fctx_add_event(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client,
4414 	       dns_messageid_t id, isc_job_cb cb, void *arg,
4415 	       dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
4416 	       dns_fetch_t *fetch) {
4417 	dns_fetchresponse_t *resp = NULL;
4418 
4419 	FCTXTRACE("addevent");
4420 
4421 	resp = isc_mem_get(fctx->mctx, sizeof(*resp));
4422 	*resp = (dns_fetchresponse_t){
4423 		.result = DNS_R_SERVFAIL,
4424 		.qtype = fctx->type,
4425 		.rdataset = rdataset,
4426 		.sigrdataset = sigrdataset,
4427 		.fetch = fetch,
4428 		.client = client,
4429 		.id = id,
4430 		.loop = loop,
4431 		.cb = cb,
4432 		.arg = arg,
4433 		.link = ISC_LINK_INITIALIZER,
4434 	};
4435 	isc_mem_attach(fctx->mctx, &resp->mctx);
4436 
4437 	resp->foundname = dns_fixedname_initname(&resp->fname);
4438 
4439 	/*
4440 	 * Store the sigrdataset in the first resp in case it is needed
4441 	 * by any of the events.
4442 	 */
4443 	if (resp->sigrdataset != NULL) {
4444 		ISC_LIST_PREPEND(fctx->resps, resp, link);
4445 	} else {
4446 		ISC_LIST_APPEND(fctx->resps, resp, link);
4447 	}
4448 }
4449 
4450 static void
4451 fctx_join(fetchctx_t *fctx, isc_loop_t *loop, const isc_sockaddr_t *client,
4452 	  dns_messageid_t id, isc_job_cb cb, void *arg,
4453 	  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
4454 	  dns_fetch_t *fetch) {
4455 	FCTXTRACE("join");
4456 
4457 	REQUIRE(!SHUTTINGDOWN(fctx));
4458 
4459 	fctx_add_event(fctx, loop, client, id, cb, arg, rdataset, sigrdataset,
4460 		       fetch);
4461 
4462 	fetch->magic = DNS_FETCH_MAGIC;
4463 	fetchctx_attach(fctx, &fetch->private);
4464 }
4465 
4466 static void
4467 log_ns_ttl(fetchctx_t *fctx, const char *where) {
4468 	char namebuf[DNS_NAME_FORMATSIZE];
4469 	char domainbuf[DNS_NAME_FORMATSIZE];
4470 
4471 	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
4472 	dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
4473 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4474 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10),
4475 		      "log_ns_ttl: fctx %p: %s: %s (in '%s'?): %u %u", fctx,
4476 		      where, namebuf, domainbuf, fctx->ns_ttl_ok, fctx->ns_ttl);
4477 }
4478 
4479 static isc_result_t
4480 fctx_create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
4481 	    dns_rdatatype_t type, const dns_name_t *domain,
4482 	    dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
4483 	    unsigned int options, unsigned int depth, isc_counter_t *qc,
4484 	    fetchctx_t **fctxp) {
4485 	fetchctx_t *fctx = NULL;
4486 	isc_result_t result;
4487 	isc_result_t iresult;
4488 	isc_interval_t interval;
4489 	unsigned int findoptions = 0;
4490 	char buf[DNS_NAME_FORMATSIZE + DNS_RDATATYPE_FORMATSIZE + 1];
4491 	uint_fast32_t nfctx;
4492 	isc_mem_t *mctx = isc_loop_getmctx(loop);
4493 	size_t p;
4494 
4495 	/*
4496 	 * Caller must be holding the lock for 'bucket'
4497 	 */
4498 	REQUIRE(fctxp != NULL && *fctxp == NULL);
4499 
4500 	fctx = isc_mem_get(mctx, sizeof(*fctx));
4501 	*fctx = (fetchctx_t){
4502 		.type = type,
4503 		.qmintype = type,
4504 		.options = options,
4505 		.tid = isc_tid(),
4506 		.state = fetchstate_active,
4507 		.depth = depth,
4508 		.qmin_labels = 1,
4509 		.fwdpolicy = dns_fwdpolicy_none,
4510 		.result = ISC_R_FAILURE,
4511 		.loop = loop,
4512 		.nvalidations = atomic_load_relaxed(&res->maxvalidations),
4513 		.nfails = atomic_load_relaxed(&res->maxvalidationfails),
4514 	};
4515 
4516 	isc_mem_attach(mctx, &fctx->mctx);
4517 	dns_resolver_attach(res, &fctx->res);
4518 
4519 	isc_mutex_init(&fctx->lock);
4520 
4521 	/*
4522 	 * Make fctx->info point to a copy of a formatted string
4523 	 * "name/type". FCTXTRACE won't work until this is done.
4524 	 */
4525 	dns_name_format(name, buf, sizeof(buf));
4526 	p = strlcat(buf, "/", sizeof(buf));
4527 	INSIST(p + DNS_RDATATYPE_FORMATSIZE < sizeof(buf));
4528 	dns_rdatatype_format(type, buf + p, sizeof(buf) - p);
4529 	fctx->info = isc_mem_strdup(fctx->mctx, buf);
4530 
4531 	FCTXTRACE("create");
4532 
4533 	if (qc != NULL) {
4534 		isc_counter_attach(qc, &fctx->qc);
4535 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4536 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9),
4537 			      "fctx %p(%s): attached to counter %p (%d)", fctx,
4538 			      fctx->info, fctx->qc, isc_counter_used(fctx->qc));
4539 	} else {
4540 		result = isc_counter_create(fctx->mctx, res->maxqueries,
4541 					    &fctx->qc);
4542 		if (result != ISC_R_SUCCESS) {
4543 			goto cleanup_fetch;
4544 		}
4545 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4546 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(9),
4547 			      "fctx %p(%s): created counter %p", fctx,
4548 			      fctx->info, fctx->qc);
4549 	}
4550 
4551 #if DNS_RESOLVER_TRACE
4552 	fprintf(stderr, "fetchctx__init:%s:%s:%d:%p:%p->references = 1\n",
4553 		__func__, __FILE__, __LINE__, fctx, fctx);
4554 #endif
4555 	isc_refcount_init(&fctx->references, 1);
4556 
4557 	ISC_LIST_INIT(fctx->queries);
4558 	ISC_LIST_INIT(fctx->finds);
4559 	ISC_LIST_INIT(fctx->altfinds);
4560 	ISC_LIST_INIT(fctx->forwaddrs);
4561 	ISC_LIST_INIT(fctx->altaddrs);
4562 	ISC_LIST_INIT(fctx->forwarders);
4563 	ISC_LIST_INIT(fctx->bad);
4564 	ISC_LIST_INIT(fctx->edns);
4565 	ISC_LIST_INIT(fctx->bad_edns);
4566 	ISC_LIST_INIT(fctx->validators);
4567 
4568 	atomic_init(&fctx->attributes, 0);
4569 
4570 	fctx->name = dns_fixedname_initname(&fctx->fname);
4571 	fctx->nsname = dns_fixedname_initname(&fctx->nsfname);
4572 	fctx->domain = dns_fixedname_initname(&fctx->dfname);
4573 	fctx->qminname = dns_fixedname_initname(&fctx->qminfname);
4574 	fctx->qmindcname = dns_fixedname_initname(&fctx->qmindcfname);
4575 	fctx->fwdname = dns_fixedname_initname(&fctx->fwdfname);
4576 
4577 	dns_name_copy(name, fctx->name);
4578 	dns_name_copy(name, fctx->qminname);
4579 
4580 	dns_rdataset_init(&fctx->nameservers);
4581 	dns_rdataset_init(&fctx->qminrrset);
4582 	dns_rdataset_init(&fctx->nsrrset);
4583 
4584 	fctx->start = isc_time_now();
4585 	fctx->now = (isc_stdtime_t)fctx->start.seconds;
4586 
4587 	if (client != NULL) {
4588 		isc_sockaddr_format(client, fctx->clientstr,
4589 				    sizeof(fctx->clientstr));
4590 	} else {
4591 		strlcpy(fctx->clientstr, "<unknown>", sizeof(fctx->clientstr));
4592 	}
4593 
4594 	if (domain == NULL) {
4595 		dns_forwarders_t *forwarders = NULL;
4596 		unsigned int labels;
4597 		const dns_name_t *fwdname = name;
4598 		dns_name_t suffix;
4599 
4600 		/*
4601 		 * DS records are found in the parent server. Strip one
4602 		 * leading label from the name (to be used in finding
4603 		 * the forwarder).
4604 		 */
4605 		if (dns_rdatatype_atparent(fctx->type) &&
4606 		    dns_name_countlabels(name) > 1)
4607 		{
4608 			dns_name_init(&suffix, NULL);
4609 			labels = dns_name_countlabels(name);
4610 			dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
4611 			fwdname = &suffix;
4612 		}
4613 
4614 		/* Find the forwarder for this name. */
4615 		result = dns_fwdtable_find(fctx->res->view->fwdtable, fwdname,
4616 					   &forwarders);
4617 		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
4618 			fctx->fwdpolicy = forwarders->fwdpolicy;
4619 			dns_name_copy(&forwarders->name, fctx->fwdname);
4620 			dns_forwarders_detach(&forwarders);
4621 		}
4622 
4623 		if (fctx->fwdpolicy == dns_fwdpolicy_only) {
4624 			/*
4625 			 * We're in forward-only mode.  Set the query
4626 			 * domain.
4627 			 */
4628 			dns_name_copy(fctx->fwdname, fctx->domain);
4629 			dns_name_copy(fctx->fwdname, fctx->qmindcname);
4630 			/*
4631 			 * Disable query minimization
4632 			 */
4633 			options &= ~DNS_FETCHOPT_QMINIMIZE;
4634 		} else {
4635 			dns_fixedname_t dcfixed;
4636 			dns_name_t *dcname = dns_fixedname_initname(&dcfixed);
4637 
4638 			/*
4639 			 * The caller didn't supply a query domain and
4640 			 * nameservers, and we're not in forward-only
4641 			 * mode, so find the best nameservers to use.
4642 			 */
4643 			if (dns_rdatatype_atparent(fctx->type)) {
4644 				findoptions |= DNS_DBFIND_NOEXACT;
4645 			}
4646 			result = dns_view_findzonecut(
4647 				res->view, name, fctx->fwdname, dcname,
4648 				fctx->now, findoptions, true, true,
4649 				&fctx->nameservers, NULL);
4650 			if (result != ISC_R_SUCCESS) {
4651 				goto cleanup_nameservers;
4652 			}
4653 
4654 			dns_name_copy(fctx->fwdname, fctx->domain);
4655 			dns_name_copy(dcname, fctx->qmindcname);
4656 			fctx->ns_ttl = fctx->nameservers.ttl;
4657 			fctx->ns_ttl_ok = true;
4658 		}
4659 	} else {
4660 		dns_name_copy(domain, fctx->domain);
4661 		dns_name_copy(domain, fctx->qmindcname);
4662 		dns_rdataset_clone(nameservers, &fctx->nameservers);
4663 		fctx->ns_ttl = fctx->nameservers.ttl;
4664 		fctx->ns_ttl_ok = true;
4665 	}
4666 
4667 	/*
4668 	 * Exempt prefetch queries from the fetches-per-zone quota check
4669 	 */
4670 	if ((fctx->options & DNS_FETCHOPT_PREFETCH) == 0) {
4671 		/*
4672 		 * Are there too many simultaneous queries for this domain?
4673 		 */
4674 		result = fcount_incr(fctx, false);
4675 		if (result != ISC_R_SUCCESS) {
4676 			result = fctx->res->quotaresp[dns_quotatype_zone];
4677 			inc_stats(res, dns_resstatscounter_zonequota);
4678 			goto cleanup_nameservers;
4679 		}
4680 	}
4681 
4682 	log_ns_ttl(fctx, "fctx_create");
4683 
4684 	if (!dns_name_issubdomain(fctx->name, fctx->domain)) {
4685 		dns_name_format(fctx->domain, buf, sizeof(buf));
4686 		UNEXPECTED_ERROR("'%s' is not subdomain of '%s'", fctx->info,
4687 				 buf);
4688 		result = ISC_R_UNEXPECTED;
4689 		goto cleanup_fcount;
4690 	}
4691 
4692 	dns_message_create(fctx->mctx, fctx->res->namepools[fctx->tid],
4693 			   fctx->res->rdspools[fctx->tid],
4694 			   DNS_MESSAGE_INTENTRENDER, &fctx->qmessage);
4695 
4696 	/*
4697 	 * Compute an expiration time for the entire fetch.
4698 	 */
4699 	isc_interval_set(&interval, res->query_timeout / 1000,
4700 			 res->query_timeout % 1000 * 1000000);
4701 	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
4702 	if (iresult != ISC_R_SUCCESS) {
4703 		UNEXPECTED_ERROR("isc_time_nowplusinterval: %s",
4704 				 isc_result_totext(iresult));
4705 		result = ISC_R_UNEXPECTED;
4706 		goto cleanup_qmessage;
4707 	}
4708 
4709 	/*
4710 	 * Default retry interval initialization.  We set the interval
4711 	 * now mostly so it won't be uninitialized.  It will be set to
4712 	 * the correct value before a query is issued.
4713 	 */
4714 	isc_interval_set(&fctx->interval, 2, 0);
4715 
4716 	/*
4717 	 * Attach to the view's cache and adb.
4718 	 */
4719 	dns_db_attach(res->view->cachedb, &fctx->cache);
4720 	dns_view_getadb(res->view, &fctx->adb);
4721 
4722 	ISC_LIST_INIT(fctx->resps);
4723 	ISC_LINK_INIT(fctx, link);
4724 	fctx->magic = FCTX_MAGIC;
4725 
4726 	/*
4727 	 * If qname minimization is enabled we need to trim
4728 	 * the name in fctx to proper length.
4729 	 */
4730 	if ((options & DNS_FETCHOPT_QMINIMIZE) != 0) {
4731 		fctx->ip6arpaskip = (options & DNS_FETCHOPT_QMIN_SKIP_IP6A) !=
4732 					    0 &&
4733 				    dns_name_issubdomain(fctx->name, &ip6_arpa);
4734 		fctx_minimize_qname(fctx);
4735 	}
4736 
4737 	nfctx = atomic_fetch_add_relaxed(&res->nfctx, 1);
4738 	INSIST(nfctx < UINT32_MAX);
4739 
4740 	inc_stats(res, dns_resstatscounter_nfetch);
4741 
4742 	isc_timer_create(fctx->loop, fctx_expired, fctx, &fctx->timer);
4743 
4744 	*fctxp = fctx;
4745 
4746 	return ISC_R_SUCCESS;
4747 
4748 cleanup_qmessage:
4749 	dns_message_detach(&fctx->qmessage);
4750 
4751 cleanup_fcount:
4752 	fcount_decr(fctx);
4753 
4754 cleanup_nameservers:
4755 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
4756 		dns_rdataset_disassociate(&fctx->nameservers);
4757 	}
4758 	isc_mem_free(fctx->mctx, fctx->info);
4759 	isc_counter_detach(&fctx->qc);
4760 
4761 cleanup_fetch:
4762 	dns_resolver_detach(&fctx->res);
4763 	isc_mem_putanddetach(&fctx->mctx, fctx, sizeof(*fctx));
4764 
4765 	return result;
4766 }
4767 
4768 /*
4769  * Handle Responses
4770  */
4771 static bool
4772 is_lame(fetchctx_t *fctx, dns_message_t *message) {
4773 	dns_name_t *name;
4774 	dns_rdataset_t *rdataset;
4775 	isc_result_t result;
4776 
4777 	if (message->rcode != dns_rcode_noerror &&
4778 	    message->rcode != dns_rcode_yxdomain &&
4779 	    message->rcode != dns_rcode_nxdomain)
4780 	{
4781 		return false;
4782 	}
4783 
4784 	if (message->counts[DNS_SECTION_ANSWER] != 0) {
4785 		return false;
4786 	}
4787 
4788 	if (message->counts[DNS_SECTION_AUTHORITY] == 0) {
4789 		return false;
4790 	}
4791 
4792 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
4793 	while (result == ISC_R_SUCCESS) {
4794 		name = NULL;
4795 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
4796 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
4797 		     rdataset = ISC_LIST_NEXT(rdataset, link))
4798 		{
4799 			dns_namereln_t namereln;
4800 			int order;
4801 			unsigned int labels;
4802 			if (rdataset->type != dns_rdatatype_ns) {
4803 				continue;
4804 			}
4805 			namereln = dns_name_fullcompare(name, fctx->domain,
4806 							&order, &labels);
4807 			if (namereln == dns_namereln_equal &&
4808 			    (message->flags & DNS_MESSAGEFLAG_AA) != 0)
4809 			{
4810 				return false;
4811 			}
4812 			if (namereln == dns_namereln_subdomain) {
4813 				return false;
4814 			}
4815 			return true;
4816 		}
4817 		result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
4818 	}
4819 
4820 	return false;
4821 }
4822 
4823 static void
4824 log_lame(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo) {
4825 	char namebuf[DNS_NAME_FORMATSIZE];
4826 	char domainbuf[DNS_NAME_FORMATSIZE];
4827 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
4828 
4829 	dns_name_format(fctx->name, namebuf, sizeof(namebuf));
4830 	dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
4831 	isc_sockaddr_format(&addrinfo->sockaddr, addrbuf, sizeof(addrbuf));
4832 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_LAME_SERVERS,
4833 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
4834 		      "lame server resolving '%s' (in '%s'?): %s", namebuf,
4835 		      domainbuf, addrbuf);
4836 }
4837 
4838 static void
4839 log_formerr(fetchctx_t *fctx, const char *format, ...) {
4840 	char nsbuf[ISC_SOCKADDR_FORMATSIZE];
4841 	char msgbuf[2048];
4842 	va_list args;
4843 
4844 	va_start(args, format);
4845 	vsnprintf(msgbuf, sizeof(msgbuf), format, args);
4846 	va_end(args);
4847 
4848 	isc_sockaddr_format(&fctx->addrinfo->sockaddr, nsbuf, sizeof(nsbuf));
4849 
4850 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
4851 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
4852 		      "DNS format error from %s resolving %s for %s: %s", nsbuf,
4853 		      fctx->info, fctx->clientstr, msgbuf);
4854 }
4855 
4856 static isc_result_t
4857 same_question(fetchctx_t *fctx, dns_message_t *message) {
4858 	isc_result_t result;
4859 	dns_name_t *name = NULL;
4860 	dns_rdataset_t *rdataset = NULL;
4861 
4862 	/*
4863 	 * Caller must be holding the fctx lock.
4864 	 */
4865 
4866 	/*
4867 	 * XXXRTH  Currently we support only one question.
4868 	 */
4869 	if (message->counts[DNS_SECTION_QUESTION] == 0) {
4870 		if ((message->flags & DNS_MESSAGEFLAG_TC) != 0) {
4871 			/*
4872 			 * If TC=1 and the question section is empty, we
4873 			 * accept the reply message as a truncated
4874 			 * answer, to be retried over TCP.
4875 			 *
4876 			 * It is really a FORMERR condition, but this is
4877 			 * a workaround to accept replies from some
4878 			 * implementations.
4879 			 *
4880 			 * Because the question section matching is not
4881 			 * performed, the worst that could happen is
4882 			 * that an attacker who gets past the ID and
4883 			 * source port checks can force the use of
4884 			 * TCP. This is considered an acceptable risk.
4885 			 */
4886 			log_formerr(fctx, "empty question section, "
4887 					  "accepting it anyway as TC=1");
4888 			return ISC_R_SUCCESS;
4889 		} else {
4890 			log_formerr(fctx, "empty question section");
4891 			return DNS_R_FORMERR;
4892 		}
4893 	} else if (message->counts[DNS_SECTION_QUESTION] > 1) {
4894 		log_formerr(fctx, "too many questions");
4895 		return DNS_R_FORMERR;
4896 	}
4897 
4898 	result = dns_message_firstname(message, DNS_SECTION_QUESTION);
4899 	if (result != ISC_R_SUCCESS) {
4900 		return result;
4901 	}
4902 
4903 	dns_message_currentname(message, DNS_SECTION_QUESTION, &name);
4904 	rdataset = ISC_LIST_HEAD(name->list);
4905 	INSIST(rdataset != NULL);
4906 	INSIST(ISC_LIST_NEXT(rdataset, link) == NULL);
4907 
4908 	if (fctx->type != rdataset->type ||
4909 	    fctx->res->rdclass != rdataset->rdclass ||
4910 	    !dns_name_equal(fctx->name, name))
4911 	{
4912 		char namebuf[DNS_NAME_FORMATSIZE];
4913 		char classbuf[DNS_RDATACLASS_FORMATSIZE];
4914 		char typebuf[DNS_RDATATYPE_FORMATSIZE];
4915 
4916 		dns_name_format(name, namebuf, sizeof(namebuf));
4917 		dns_rdataclass_format(rdataset->rdclass, classbuf,
4918 				      sizeof(classbuf));
4919 		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
4920 		log_formerr(fctx, "question section mismatch: got %s/%s/%s",
4921 			    namebuf, classbuf, typebuf);
4922 		return DNS_R_FORMERR;
4923 	}
4924 
4925 	return ISC_R_SUCCESS;
4926 }
4927 
4928 static void
4929 clone_results(fetchctx_t *fctx) {
4930 	dns_fetchresponse_t *resp = NULL, *hresp = NULL;
4931 
4932 	FCTXTRACE("clone_results");
4933 
4934 	/*
4935 	 * Set up any other resps to have the same data as the first.
4936 	 *
4937 	 * Caller must be holding the appropriate lock.
4938 	 */
4939 
4940 	fctx->cloned = true;
4941 
4942 	for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
4943 	     resp = ISC_LIST_NEXT(resp, link))
4944 	{
4945 		/* This is the head resp; keep a pointer and move on */
4946 		if (hresp == NULL) {
4947 			hresp = ISC_LIST_HEAD(fctx->resps);
4948 			continue;
4949 		}
4950 
4951 		resp->result = hresp->result;
4952 		dns_name_copy(hresp->foundname, resp->foundname);
4953 		dns_db_attach(hresp->db, &resp->db);
4954 		dns_db_attachnode(hresp->db, hresp->node, &resp->node);
4955 
4956 		INSIST(hresp->rdataset != NULL);
4957 		INSIST(resp->rdataset != NULL);
4958 		if (dns_rdataset_isassociated(hresp->rdataset)) {
4959 			dns_rdataset_clone(hresp->rdataset, resp->rdataset);
4960 		}
4961 
4962 		INSIST(!(hresp->sigrdataset == NULL &&
4963 			 resp->sigrdataset != NULL));
4964 		if (hresp->sigrdataset != NULL &&
4965 		    dns_rdataset_isassociated(hresp->sigrdataset) &&
4966 		    resp->sigrdataset != NULL)
4967 		{
4968 			dns_rdataset_clone(hresp->sigrdataset,
4969 					   resp->sigrdataset);
4970 		}
4971 	}
4972 }
4973 
4974 #define CACHE(r)      (((r)->attributes & DNS_RDATASETATTR_CACHE) != 0)
4975 #define ANSWER(r)     (((r)->attributes & DNS_RDATASETATTR_ANSWER) != 0)
4976 #define ANSWERSIG(r)  (((r)->attributes & DNS_RDATASETATTR_ANSWERSIG) != 0)
4977 #define EXTERNAL(r)   (((r)->attributes & DNS_RDATASETATTR_EXTERNAL) != 0)
4978 #define CHAINING(r)   (((r)->attributes & DNS_RDATASETATTR_CHAINING) != 0)
4979 #define CHASE(r)      (((r)->attributes & DNS_RDATASETATTR_CHASE) != 0)
4980 #define CHECKNAMES(r) (((r)->attributes & DNS_RDATASETATTR_CHECKNAMES) != 0)
4981 
4982 /*
4983  * Cancel validators associated with '*fctx' if it is ready to be
4984  * destroyed (i.e., no queries waiting for it and no pending ADB finds).
4985  * Caller must hold fctx bucket lock.
4986  *
4987  * Requires:
4988  *      '*fctx' is shutting down.
4989  */
4990 static void
4991 maybe_cancel_validators(fetchctx_t *fctx) {
4992 	if (atomic_load_acquire(&fctx->pending) != 0 ||
4993 	    atomic_load_acquire(&fctx->nqueries) != 0)
4994 	{
4995 		return;
4996 	}
4997 
4998 	REQUIRE(SHUTTINGDOWN(fctx));
4999 	for (dns_validator_t *validator = ISC_LIST_HEAD(fctx->validators);
5000 	     validator != NULL; validator = ISC_LIST_NEXT(validator, link))
5001 	{
5002 		dns_validator_cancel(validator);
5003 	}
5004 }
5005 
5006 /*
5007  * typemap with just RRSIG(46) and NSEC(47) bits set.
5008  *
5009  * Bitmap calculation from dns_nsec_setbit:
5010  *
5011  *					46	47
5012  *	shift = 7 - (type % 8);		0	1
5013  *	mask = 1 << shift;		0x02	0x01
5014  *	array[type / 8] |= mask;
5015  *
5016  * Window (0), bitmap length (6), and bitmap.
5017  */
5018 static const unsigned char minimal_typemap[] = { 0, 6, 0, 0, 0, 0, 0, 0x03 };
5019 
5020 static bool
5021 is_minimal_nsec(dns_rdataset_t *nsecset) {
5022 	dns_rdataset_t rdataset;
5023 	isc_result_t result;
5024 
5025 	dns_rdataset_init(&rdataset);
5026 	dns_rdataset_clone(nsecset, &rdataset);
5027 
5028 	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
5029 	     result = dns_rdataset_next(&rdataset))
5030 	{
5031 		dns_rdata_t rdata = DNS_RDATA_INIT;
5032 		dns_rdata_nsec_t nsec;
5033 		dns_rdataset_current(&rdataset, &rdata);
5034 		result = dns_rdata_tostruct(&rdata, &nsec, NULL);
5035 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
5036 		if (nsec.len == sizeof(minimal_typemap) &&
5037 		    memcmp(nsec.typebits, minimal_typemap, nsec.len) == 0)
5038 		{
5039 			dns_rdataset_disassociate(&rdataset);
5040 			return true;
5041 		}
5042 	}
5043 	dns_rdataset_disassociate(&rdataset);
5044 	return false;
5045 }
5046 
5047 /*
5048  * If there is a SOA record in the type map then there must be a DNSKEY.
5049  */
5050 static bool
5051 check_soa_and_dnskey(dns_rdataset_t *nsecset) {
5052 	dns_rdataset_t rdataset;
5053 	isc_result_t result;
5054 
5055 	dns_rdataset_init(&rdataset);
5056 	dns_rdataset_clone(nsecset, &rdataset);
5057 
5058 	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
5059 	     result = dns_rdataset_next(&rdataset))
5060 	{
5061 		dns_rdata_t rdata = DNS_RDATA_INIT;
5062 		dns_rdataset_current(&rdataset, &rdata);
5063 		if (dns_nsec_typepresent(&rdata, dns_rdatatype_soa) &&
5064 		    (!dns_nsec_typepresent(&rdata, dns_rdatatype_dnskey) ||
5065 		     !dns_nsec_typepresent(&rdata, dns_rdatatype_ns)))
5066 		{
5067 			dns_rdataset_disassociate(&rdataset);
5068 			return false;
5069 		}
5070 	}
5071 	dns_rdataset_disassociate(&rdataset);
5072 	return true;
5073 }
5074 
5075 /*
5076  * Look for NSEC next name that starts with the label '\000'.
5077  */
5078 static bool
5079 has_000_label(dns_rdataset_t *nsecset) {
5080 	dns_rdataset_t rdataset;
5081 	isc_result_t result;
5082 
5083 	dns_rdataset_init(&rdataset);
5084 	dns_rdataset_clone(nsecset, &rdataset);
5085 
5086 	for (result = dns_rdataset_first(&rdataset); result == ISC_R_SUCCESS;
5087 	     result = dns_rdataset_next(&rdataset))
5088 	{
5089 		dns_rdata_t rdata = DNS_RDATA_INIT;
5090 		dns_rdataset_current(&rdataset, &rdata);
5091 		if (rdata.length > 1 && rdata.data[0] == 1 &&
5092 		    rdata.data[1] == 0)
5093 		{
5094 			dns_rdataset_disassociate(&rdataset);
5095 			return true;
5096 		}
5097 	}
5098 	dns_rdataset_disassociate(&rdataset);
5099 	return false;
5100 }
5101 
5102 /*
5103  * The validator has finished.
5104  */
5105 static void
5106 validated(void *arg) {
5107 	dns_validator_t *val = (dns_validator_t *)arg;
5108 	dns_adbaddrinfo_t *addrinfo = NULL;
5109 	dns_dbnode_t *node = NULL;
5110 	dns_dbnode_t *nsnode = NULL;
5111 	dns_fetchresponse_t *hresp = NULL;
5112 	dns_name_t *name = NULL;
5113 	dns_rdataset_t *ardataset = NULL;
5114 	dns_rdataset_t *asigrdataset = NULL;
5115 	dns_rdataset_t *rdataset = NULL;
5116 	dns_rdataset_t *sigrdataset = NULL;
5117 	dns_resolver_t *res = NULL;
5118 	dns_valarg_t *valarg = NULL;
5119 	fetchctx_t *fctx = NULL;
5120 	bool chaining;
5121 	bool negative;
5122 	bool sentresponse;
5123 	isc_result_t eresult = ISC_R_SUCCESS;
5124 	isc_result_t result = ISC_R_SUCCESS;
5125 	isc_stdtime_t now;
5126 	uint32_t ttl;
5127 	unsigned int options;
5128 	dns_fixedname_t fwild;
5129 	dns_name_t *wild = NULL;
5130 	dns_message_t *message = NULL;
5131 	bool done = false;
5132 
5133 	valarg = val->arg;
5134 
5135 	REQUIRE(VALID_FCTX(valarg->fctx));
5136 	REQUIRE(!ISC_LIST_EMPTY(valarg->fctx->validators));
5137 
5138 	fctx = valarg->fctx;
5139 	valarg->fctx = NULL;
5140 
5141 	REQUIRE(fctx->tid == isc_tid());
5142 
5143 	FCTXTRACE("received validation completion event");
5144 
5145 	res = fctx->res;
5146 	addrinfo = valarg->addrinfo;
5147 
5148 	message = val->message;
5149 	fctx->vresult = val->result;
5150 
5151 	LOCK(&fctx->lock);
5152 	ISC_LIST_UNLINK(fctx->validators, val, link);
5153 	fctx->validator = NULL;
5154 	UNLOCK(&fctx->lock);
5155 
5156 	/*
5157 	 * Destroy the validator early so that we can
5158 	 * destroy the fctx if necessary.  Save the wildcard name.
5159 	 */
5160 	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
5161 		wild = dns_fixedname_initname(&fwild);
5162 		dns_name_copy(dns_fixedname_name(&val->wild), wild);
5163 	}
5164 
5165 	isc_mem_put(fctx->mctx, valarg, sizeof(*valarg));
5166 
5167 	negative = (val->rdataset == NULL);
5168 
5169 	LOCK(&fctx->lock);
5170 	sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0);
5171 
5172 	/*
5173 	 * If shutting down, ignore the results.  Check to see if we're
5174 	 * done waiting for validator completions and ADB pending
5175 	 * events; if so, destroy the fctx.
5176 	 */
5177 	if (SHUTTINGDOWN(fctx) && !sentresponse) {
5178 		UNLOCK(&fctx->lock);
5179 		goto cleanup_fetchctx;
5180 	}
5181 
5182 	now = isc_stdtime_now();
5183 
5184 	/*
5185 	 * If chaining, we need to make sure that the right result code
5186 	 * is returned, and that the rdatasets are bound.
5187 	 */
5188 	if (val->result == ISC_R_SUCCESS && !negative &&
5189 	    val->rdataset != NULL && CHAINING(val->rdataset))
5190 	{
5191 		if (val->rdataset->type == dns_rdatatype_cname) {
5192 			eresult = DNS_R_CNAME;
5193 		} else {
5194 			INSIST(val->rdataset->type == dns_rdatatype_dname);
5195 			eresult = DNS_R_DNAME;
5196 		}
5197 		chaining = true;
5198 	} else {
5199 		chaining = false;
5200 	}
5201 
5202 	/*
5203 	 * Either we're not shutting down, or we are shutting down but
5204 	 * want to cache the result anyway (if this was a validation
5205 	 * started by a query with cd set)
5206 	 */
5207 
5208 	hresp = ISC_LIST_HEAD(fctx->resps);
5209 	if (hresp != NULL) {
5210 		if (!negative && !chaining &&
5211 		    (fctx->type == dns_rdatatype_any ||
5212 		     fctx->type == dns_rdatatype_rrsig ||
5213 		     fctx->type == dns_rdatatype_sig))
5214 		{
5215 			/*
5216 			 * Don't bind rdatasets; the caller
5217 			 * will iterate the node.
5218 			 */
5219 		} else {
5220 			ardataset = hresp->rdataset;
5221 			asigrdataset = hresp->sigrdataset;
5222 		}
5223 	}
5224 
5225 	if (val->result != ISC_R_SUCCESS) {
5226 		FCTXTRACE("validation failed");
5227 		inc_stats(res, dns_resstatscounter_valfail);
5228 		fctx->valfail++;
5229 		fctx->vresult = val->result;
5230 		if (fctx->vresult != DNS_R_BROKENCHAIN) {
5231 			result = ISC_R_NOTFOUND;
5232 			if (val->rdataset != NULL) {
5233 				result = dns_db_findnode(fctx->cache, val->name,
5234 							 false, &node);
5235 			}
5236 			if (result == ISC_R_SUCCESS) {
5237 				(void)dns_db_deleterdataset(fctx->cache, node,
5238 							    NULL, val->type, 0);
5239 			}
5240 			if (result == ISC_R_SUCCESS && val->sigrdataset != NULL)
5241 			{
5242 				(void)dns_db_deleterdataset(
5243 					fctx->cache, node, NULL,
5244 					dns_rdatatype_rrsig, val->type);
5245 			}
5246 			if (result == ISC_R_SUCCESS) {
5247 				dns_db_detachnode(fctx->cache, &node);
5248 			}
5249 		}
5250 		if (fctx->vresult == DNS_R_BROKENCHAIN && !negative) {
5251 			/*
5252 			 * Cache the data as pending for later
5253 			 * validation.
5254 			 */
5255 			result = ISC_R_NOTFOUND;
5256 			if (val->rdataset != NULL) {
5257 				result = dns_db_findnode(fctx->cache, val->name,
5258 							 true, &node);
5259 			}
5260 			if (result == ISC_R_SUCCESS) {
5261 				(void)dns_db_addrdataset(
5262 					fctx->cache, node, NULL, now,
5263 					val->rdataset, 0, NULL);
5264 			}
5265 			if (result == ISC_R_SUCCESS && val->sigrdataset != NULL)
5266 			{
5267 				(void)dns_db_addrdataset(
5268 					fctx->cache, node, NULL, now,
5269 					val->sigrdataset, 0, NULL);
5270 			}
5271 			if (result == ISC_R_SUCCESS) {
5272 				dns_db_detachnode(fctx->cache, &node);
5273 			}
5274 		}
5275 		result = fctx->vresult;
5276 		add_bad(fctx, message, addrinfo, result, badns_validation);
5277 
5278 		UNLOCK(&fctx->lock);
5279 
5280 		INSIST(fctx->validator == NULL);
5281 
5282 		fctx->validator = ISC_LIST_HEAD(fctx->validators);
5283 		if (fctx->validator != NULL) {
5284 			dns_validator_send(fctx->validator);
5285 			goto cleanup_fetchctx;
5286 		} else if (sentresponse) {
5287 			done = true;
5288 			goto cleanup_fetchctx;
5289 		} else if (result == DNS_R_BROKENCHAIN) {
5290 			done = true;
5291 			goto cleanup_fetchctx;
5292 		} else {
5293 			fctx_try(fctx, true);
5294 			goto cleanup_fetchctx;
5295 		}
5296 		UNREACHABLE();
5297 	}
5298 
5299 	if (negative) {
5300 		dns_rdatatype_t covers;
5301 		FCTXTRACE("nonexistence validation OK");
5302 
5303 		inc_stats(res, dns_resstatscounter_valnegsuccess);
5304 
5305 		/*
5306 		 * Cache DS NXDOMAIN separately to other types.
5307 		 */
5308 		if (message->rcode == dns_rcode_nxdomain &&
5309 		    fctx->type != dns_rdatatype_ds)
5310 		{
5311 			covers = dns_rdatatype_any;
5312 		} else {
5313 			covers = fctx->type;
5314 		}
5315 
5316 		/*
5317 		 * Don't report qname minimisation NXDOMAIN errors
5318 		 * when the result is NXDOMAIN except we have already
5319 		 * confirmed a higher error.
5320 		 */
5321 		if (!fctx->force_qmin_warning &&
5322 		    message->rcode == dns_rcode_nxdomain &&
5323 		    (fctx->qmin_warning == DNS_R_NXDOMAIN ||
5324 		     fctx->qmin_warning == DNS_R_NCACHENXDOMAIN))
5325 		{
5326 			fctx->qmin_warning = ISC_R_SUCCESS;
5327 		}
5328 
5329 		result = dns_db_findnode(fctx->cache, val->name, true, &node);
5330 		if (result != ISC_R_SUCCESS) {
5331 			/* fctx->lock unlocked in noanswer_response */
5332 			goto noanswer_response;
5333 		}
5334 
5335 		/*
5336 		 * If we are asking for a SOA record set the cache time
5337 		 * to zero to facilitate locating the containing zone of
5338 		 * a arbitrary zone.
5339 		 */
5340 		ttl = res->view->maxncachettl;
5341 		if (fctx->type == dns_rdatatype_soa &&
5342 		    covers == dns_rdatatype_any && res->zero_no_soa_ttl)
5343 		{
5344 			ttl = 0;
5345 		}
5346 
5347 		result = ncache_adderesult(message, fctx->cache, node, covers,
5348 					   now, fctx->res->view->minncachettl,
5349 					   ttl, val->optout, val->secure,
5350 					   ardataset, &eresult);
5351 		if (result != ISC_R_SUCCESS) {
5352 			goto noanswer_response;
5353 		}
5354 		goto answer_response;
5355 	} else {
5356 		inc_stats(res, dns_resstatscounter_valsuccess);
5357 	}
5358 
5359 	FCTXTRACE("validation OK");
5360 
5361 	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL) {
5362 		result = dns_rdataset_addnoqname(
5363 			val->rdataset, val->proofs[DNS_VALIDATOR_NOQNAMEPROOF]);
5364 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
5365 		INSIST(val->sigrdataset != NULL);
5366 		val->sigrdataset->ttl = val->rdataset->ttl;
5367 		if (val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) {
5368 			result = dns_rdataset_addclosest(
5369 				val->rdataset,
5370 				val->proofs[DNS_VALIDATOR_CLOSESTENCLOSER]);
5371 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
5372 		}
5373 	} else if (val->rdataset->trust == dns_trust_answer &&
5374 		   val->rdataset->type != dns_rdatatype_rrsig)
5375 	{
5376 		isc_result_t tresult;
5377 		dns_name_t *noqname = NULL;
5378 		tresult = findnoqname(fctx, message, val->name,
5379 				      val->rdataset->type, &noqname);
5380 		if (tresult == ISC_R_SUCCESS && noqname != NULL) {
5381 			tresult = dns_rdataset_addnoqname(val->rdataset,
5382 							  noqname);
5383 			RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
5384 		}
5385 	}
5386 
5387 	/*
5388 	 * The data was already cached as pending data.
5389 	 * Re-cache it as secure and bind the cached
5390 	 * rdatasets to the first event on the fetch
5391 	 * event list.
5392 	 */
5393 	result = dns_db_findnode(fctx->cache, val->name, true, &node);
5394 	if (result != ISC_R_SUCCESS) {
5395 		goto noanswer_response;
5396 	}
5397 
5398 	options = 0;
5399 	if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0) {
5400 		options = DNS_DBADD_PREFETCH;
5401 	}
5402 	result = dns_db_addrdataset(fctx->cache, node, NULL, now, val->rdataset,
5403 				    options, ardataset);
5404 	if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) {
5405 		goto noanswer_response;
5406 	}
5407 	if (ardataset != NULL && NEGATIVE(ardataset)) {
5408 		if (NXDOMAIN(ardataset)) {
5409 			eresult = DNS_R_NCACHENXDOMAIN;
5410 		} else {
5411 			eresult = DNS_R_NCACHENXRRSET;
5412 		}
5413 	} else if (val->sigrdataset != NULL) {
5414 		result = dns_db_addrdataset(fctx->cache, node, NULL, now,
5415 					    val->sigrdataset, options,
5416 					    asigrdataset);
5417 		if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED) {
5418 			goto noanswer_response;
5419 		}
5420 	}
5421 
5422 	if (sentresponse) {
5423 		/*
5424 		 * If we only deferred the destroy because we wanted to
5425 		 * cache the data, destroy now.
5426 		 */
5427 		dns_db_detachnode(fctx->cache, &node);
5428 		if (SHUTTINGDOWN(fctx)) {
5429 			maybe_cancel_validators(fctx);
5430 		}
5431 		UNLOCK(&fctx->lock);
5432 		goto cleanup_fetchctx;
5433 	}
5434 
5435 	if (!ISC_LIST_EMPTY(fctx->validators)) {
5436 		INSIST(!negative);
5437 		INSIST(fctx->type == dns_rdatatype_any ||
5438 		       fctx->type == dns_rdatatype_rrsig ||
5439 		       fctx->type == dns_rdatatype_sig);
5440 		/*
5441 		 * Don't send a response yet - we have
5442 		 * more rdatasets that still need to
5443 		 * be validated.
5444 		 */
5445 		dns_db_detachnode(fctx->cache, &node);
5446 		UNLOCK(&fctx->lock);
5447 		dns_validator_send(ISC_LIST_HEAD(fctx->validators));
5448 		goto cleanup_fetchctx;
5449 	}
5450 
5451 answer_response:
5452 
5453 	/*
5454 	 * Cache any SOA/NS/NSEC records that happened to be validated.
5455 	 */
5456 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
5457 	while (result == ISC_R_SUCCESS) {
5458 		name = NULL;
5459 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
5460 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
5461 		     rdataset = ISC_LIST_NEXT(rdataset, link))
5462 		{
5463 			if ((rdataset->type != dns_rdatatype_ns &&
5464 			     rdataset->type != dns_rdatatype_soa &&
5465 			     rdataset->type != dns_rdatatype_nsec) ||
5466 			    rdataset->trust != dns_trust_secure)
5467 			{
5468 				continue;
5469 			}
5470 			for (sigrdataset = ISC_LIST_HEAD(name->list);
5471 			     sigrdataset != NULL;
5472 			     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
5473 			{
5474 				if (sigrdataset->type != dns_rdatatype_rrsig ||
5475 				    sigrdataset->covers != rdataset->type)
5476 				{
5477 					continue;
5478 				}
5479 				break;
5480 			}
5481 			if (sigrdataset == NULL ||
5482 			    sigrdataset->trust != dns_trust_secure)
5483 			{
5484 				continue;
5485 			}
5486 
5487 			/*
5488 			 * Don't cache NSEC if missing NSEC or RRSIG types.
5489 			 */
5490 			if (rdataset->type == dns_rdatatype_nsec &&
5491 			    !dns_nsec_requiredtypespresent(rdataset))
5492 			{
5493 				continue;
5494 			}
5495 
5496 			/*
5497 			 * Don't cache "white lies" but do cache
5498 			 * "black lies".
5499 			 */
5500 			if (rdataset->type == dns_rdatatype_nsec &&
5501 			    !dns_name_equal(fctx->name, name) &&
5502 			    is_minimal_nsec(rdataset))
5503 			{
5504 				continue;
5505 			}
5506 
5507 			/*
5508 			 * Check SOA and DNSKEY consistency.
5509 			 */
5510 			if (rdataset->type == dns_rdatatype_nsec &&
5511 			    !check_soa_and_dnskey(rdataset))
5512 			{
5513 				continue;
5514 			}
5515 
5516 			/*
5517 			 * Look for \000 label in next name.
5518 			 */
5519 			if (rdataset->type == dns_rdatatype_nsec &&
5520 			    has_000_label(rdataset))
5521 			{
5522 				continue;
5523 			}
5524 
5525 			result = dns_db_findnode(fctx->cache, name, true,
5526 						 &nsnode);
5527 			if (result != ISC_R_SUCCESS) {
5528 				continue;
5529 			}
5530 
5531 			result = dns_db_addrdataset(fctx->cache, nsnode, NULL,
5532 						    now, rdataset, 0, NULL);
5533 			if (result == ISC_R_SUCCESS) {
5534 				result = dns_db_addrdataset(
5535 					fctx->cache, nsnode, NULL, now,
5536 					sigrdataset, 0, NULL);
5537 			}
5538 			dns_db_detachnode(fctx->cache, &nsnode);
5539 			if (result != ISC_R_SUCCESS) {
5540 				continue;
5541 			}
5542 		}
5543 		result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
5544 	}
5545 
5546 	/*
5547 	 * Add the wild card entry.
5548 	 */
5549 	if (val->proofs[DNS_VALIDATOR_NOQNAMEPROOF] != NULL &&
5550 	    val->rdataset != NULL && dns_rdataset_isassociated(val->rdataset) &&
5551 	    val->rdataset->trust == dns_trust_secure &&
5552 	    val->sigrdataset != NULL &&
5553 	    dns_rdataset_isassociated(val->sigrdataset) &&
5554 	    val->sigrdataset->trust == dns_trust_secure && wild != NULL)
5555 	{
5556 		dns_dbnode_t *wnode = NULL;
5557 
5558 		result = dns_db_findnode(fctx->cache, wild, true, &wnode);
5559 		if (result == ISC_R_SUCCESS) {
5560 			result = dns_db_addrdataset(fctx->cache, wnode, NULL,
5561 						    now, val->rdataset, 0,
5562 						    NULL);
5563 		}
5564 		if (result == ISC_R_SUCCESS) {
5565 			(void)dns_db_addrdataset(fctx->cache, wnode, NULL, now,
5566 						 val->sigrdataset, 0, NULL);
5567 		}
5568 		if (wnode != NULL) {
5569 			dns_db_detachnode(fctx->cache, &wnode);
5570 		}
5571 	}
5572 
5573 	result = ISC_R_SUCCESS;
5574 
5575 	/*
5576 	 * Respond with an answer, positive or negative,
5577 	 * as opposed to an error.  'node' must be non-NULL.
5578 	 */
5579 
5580 	FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
5581 
5582 	if (hresp != NULL) {
5583 		/*
5584 		 * Negative results must be indicated in val->result.
5585 		 */
5586 		INSIST(hresp->rdataset != NULL);
5587 		if (dns_rdataset_isassociated(hresp->rdataset) &&
5588 		    NEGATIVE(hresp->rdataset))
5589 		{
5590 			INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
5591 			       eresult == DNS_R_NCACHENXRRSET);
5592 		}
5593 
5594 		hresp->result = eresult;
5595 		dns_name_copy(val->name, hresp->foundname);
5596 		dns_db_attach(fctx->cache, &hresp->db);
5597 		dns_db_transfernode(fctx->cache, &node, &hresp->node);
5598 		clone_results(fctx);
5599 	}
5600 
5601 noanswer_response:
5602 	if (node != NULL) {
5603 		dns_db_detachnode(fctx->cache, &node);
5604 	}
5605 
5606 	UNLOCK(&fctx->lock);
5607 	done = true;
5608 
5609 cleanup_fetchctx:
5610 	if (done) {
5611 		fctx_done_unref(fctx, result);
5612 	}
5613 
5614 	/*
5615 	 * val->name points to name on a message on one of the
5616 	 * queries on the fetch context so the name has to be
5617 	 * released first with a dns_validator_shutdown() call.
5618 	 */
5619 	dns_validator_shutdown(val);
5620 	dns_validator_detach(&val);
5621 	fetchctx_detach(&fctx);
5622 	INSIST(node == NULL);
5623 }
5624 
5625 static void
5626 fctx_log(void *arg, int level, const char *fmt, ...) {
5627 	char msgbuf[2048];
5628 	va_list args;
5629 	fetchctx_t *fctx = arg;
5630 
5631 	va_start(args, fmt);
5632 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, args);
5633 	va_end(args);
5634 
5635 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
5636 		      DNS_LOGMODULE_RESOLVER, level, "fctx %p(%s): %s", fctx,
5637 		      fctx->info, msgbuf);
5638 }
5639 
5640 static isc_result_t
5641 findnoqname(fetchctx_t *fctx, dns_message_t *message, dns_name_t *name,
5642 	    dns_rdatatype_t type, dns_name_t **noqnamep) {
5643 	dns_rdataset_t *nrdataset, *next, *sigrdataset;
5644 	dns_rdata_rrsig_t rrsig;
5645 	isc_result_t result;
5646 	unsigned int labels;
5647 	dns_section_t section;
5648 	dns_name_t *zonename;
5649 	dns_fixedname_t fzonename;
5650 	dns_name_t *closest;
5651 	dns_fixedname_t fclosest;
5652 	dns_name_t *nearest;
5653 	dns_fixedname_t fnearest;
5654 	dns_rdatatype_t found = dns_rdatatype_none;
5655 	dns_name_t *noqname = NULL;
5656 
5657 	FCTXTRACE("findnoqname");
5658 
5659 	REQUIRE(noqnamep != NULL && *noqnamep == NULL);
5660 
5661 	/*
5662 	 * Find the SIG for this rdataset, if we have it.
5663 	 */
5664 	for (sigrdataset = ISC_LIST_HEAD(name->list); sigrdataset != NULL;
5665 	     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
5666 	{
5667 		if (sigrdataset->type == dns_rdatatype_rrsig &&
5668 		    sigrdataset->covers == type)
5669 		{
5670 			break;
5671 		}
5672 	}
5673 
5674 	if (sigrdataset == NULL) {
5675 		return ISC_R_NOTFOUND;
5676 	}
5677 
5678 	labels = dns_name_countlabels(name);
5679 
5680 	for (result = dns_rdataset_first(sigrdataset); result == ISC_R_SUCCESS;
5681 	     result = dns_rdataset_next(sigrdataset))
5682 	{
5683 		dns_rdata_t rdata = DNS_RDATA_INIT;
5684 		dns_rdataset_current(sigrdataset, &rdata);
5685 		result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
5686 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
5687 		/* Wildcard has rrsig.labels < labels - 1. */
5688 		if (rrsig.labels + 1U >= labels) {
5689 			continue;
5690 		}
5691 		break;
5692 	}
5693 
5694 	if (result == ISC_R_NOMORE) {
5695 		return ISC_R_NOTFOUND;
5696 	}
5697 	if (result != ISC_R_SUCCESS) {
5698 		return result;
5699 	}
5700 
5701 	zonename = dns_fixedname_initname(&fzonename);
5702 	closest = dns_fixedname_initname(&fclosest);
5703 	nearest = dns_fixedname_initname(&fnearest);
5704 
5705 #define NXND(x) ((x) == ISC_R_SUCCESS)
5706 
5707 	section = DNS_SECTION_AUTHORITY;
5708 	for (result = dns_message_firstname(message, section);
5709 	     result == ISC_R_SUCCESS;
5710 	     result = dns_message_nextname(message, section))
5711 	{
5712 		dns_name_t *nsec = NULL;
5713 		dns_message_currentname(message, section, &nsec);
5714 		for (nrdataset = ISC_LIST_HEAD(nsec->list); nrdataset != NULL;
5715 		     nrdataset = next)
5716 		{
5717 			bool data = false, exists = false;
5718 			bool optout = false, unknown = false;
5719 			bool setclosest = false;
5720 			bool setnearest = false;
5721 
5722 			next = ISC_LIST_NEXT(nrdataset, link);
5723 			if (nrdataset->type != dns_rdatatype_nsec &&
5724 			    nrdataset->type != dns_rdatatype_nsec3)
5725 			{
5726 				continue;
5727 			}
5728 
5729 			if (nrdataset->type == dns_rdatatype_nsec &&
5730 			    NXND(dns_nsec_noexistnodata(
5731 				    type, name, nsec, nrdataset, &exists, &data,
5732 				    NULL, fctx_log, fctx)))
5733 			{
5734 				if (!exists) {
5735 					noqname = nsec;
5736 					found = dns_rdatatype_nsec;
5737 				}
5738 			}
5739 
5740 			if (nrdataset->type == dns_rdatatype_nsec3 &&
5741 			    NXND(dns_nsec3_noexistnodata(
5742 				    type, name, nsec, nrdataset, zonename,
5743 				    &exists, &data, &optout, &unknown,
5744 				    &setclosest, &setnearest, closest, nearest,
5745 				    fctx_log, fctx)))
5746 			{
5747 				if (!exists && setnearest) {
5748 					noqname = nsec;
5749 					found = dns_rdatatype_nsec3;
5750 				}
5751 			}
5752 		}
5753 	}
5754 	if (result == ISC_R_NOMORE) {
5755 		result = ISC_R_SUCCESS;
5756 	}
5757 	if (noqname != NULL) {
5758 		for (sigrdataset = ISC_LIST_HEAD(noqname->list);
5759 		     sigrdataset != NULL;
5760 		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
5761 		{
5762 			if (sigrdataset->type == dns_rdatatype_rrsig &&
5763 			    sigrdataset->covers == found)
5764 			{
5765 				break;
5766 			}
5767 		}
5768 		if (sigrdataset != NULL) {
5769 			*noqnamep = noqname;
5770 		}
5771 	}
5772 	return result;
5773 }
5774 
5775 static isc_result_t
5776 cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message,
5777 	   dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) {
5778 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
5779 	dns_rdataset_t *addedrdataset = NULL;
5780 	dns_rdataset_t *ardataset = NULL, *asigrdataset = NULL;
5781 	dns_rdataset_t *valrdataset = NULL, *valsigrdataset = NULL;
5782 	dns_dbnode_t *node = NULL, **anodep = NULL;
5783 	dns_db_t **adbp = NULL;
5784 	dns_resolver_t *res = fctx->res;
5785 	bool need_validation = false;
5786 	bool secure_domain = false;
5787 	bool have_answer = false;
5788 	isc_result_t result, eresult = ISC_R_SUCCESS;
5789 	dns_fetchresponse_t *resp = NULL;
5790 	unsigned int options;
5791 	bool fail;
5792 	unsigned int valoptions = 0;
5793 	bool checknta = true;
5794 
5795 	FCTXTRACE("cache_name");
5796 
5797 	/*
5798 	 * The appropriate bucket lock must be held.
5799 	 */
5800 
5801 	/*
5802 	 * Is DNSSEC validation required for this name?
5803 	 */
5804 	if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) {
5805 		valoptions |= DNS_VALIDATOR_NONTA;
5806 		checknta = false;
5807 	}
5808 
5809 	if (res->view->enablevalidation) {
5810 		result = issecuredomain(res->view, name, fctx->type, now,
5811 					checknta, NULL, &secure_domain);
5812 		if (result != ISC_R_SUCCESS) {
5813 			return result;
5814 		}
5815 	}
5816 
5817 	if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) {
5818 		valoptions |= DNS_VALIDATOR_NOCDFLAG;
5819 	}
5820 
5821 	if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) {
5822 		need_validation = false;
5823 	} else {
5824 		need_validation = secure_domain;
5825 	}
5826 
5827 	if (name->attributes.answer && !need_validation) {
5828 		have_answer = true;
5829 		resp = ISC_LIST_HEAD(fctx->resps);
5830 
5831 		if (resp != NULL) {
5832 			adbp = &resp->db;
5833 			dns_name_copy(name, resp->foundname);
5834 			anodep = &resp->node;
5835 
5836 			/*
5837 			 * If this is an ANY, SIG or RRSIG query, we're
5838 			 * not going to return any rdatasets, unless we
5839 			 * encountered a CNAME or DNAME as "the answer".
5840 			 * In this case, we're going to return
5841 			 * DNS_R_CNAME or DNS_R_DNAME and we must set up
5842 			 * the rdatasets.
5843 			 */
5844 			if ((fctx->type != dns_rdatatype_any &&
5845 			     fctx->type != dns_rdatatype_rrsig &&
5846 			     fctx->type != dns_rdatatype_sig) ||
5847 			    name->attributes.chaining)
5848 			{
5849 				ardataset = resp->rdataset;
5850 				asigrdataset = resp->sigrdataset;
5851 			}
5852 		}
5853 	}
5854 
5855 	/*
5856 	 * Find or create the cache node.
5857 	 */
5858 	result = dns_db_findnode(fctx->cache, name, true, &node);
5859 	if (result != ISC_R_SUCCESS) {
5860 		return result;
5861 	}
5862 
5863 	/*
5864 	 * Cache or validate each cacheable rdataset.
5865 	 */
5866 	fail = ((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0);
5867 	for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
5868 	     rdataset = ISC_LIST_NEXT(rdataset, link))
5869 	{
5870 		if (!CACHE(rdataset)) {
5871 			continue;
5872 		}
5873 		if (CHECKNAMES(rdataset)) {
5874 			char namebuf[DNS_NAME_FORMATSIZE];
5875 			char typebuf[DNS_RDATATYPE_FORMATSIZE];
5876 			char classbuf[DNS_RDATATYPE_FORMATSIZE];
5877 
5878 			dns_name_format(name, namebuf, sizeof(namebuf));
5879 			dns_rdatatype_format(rdataset->type, typebuf,
5880 					     sizeof(typebuf));
5881 			dns_rdataclass_format(rdataset->rdclass, classbuf,
5882 					      sizeof(classbuf));
5883 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
5884 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
5885 				      "check-names %s %s/%s/%s",
5886 				      fail ? "failure" : "warning", namebuf,
5887 				      typebuf, classbuf);
5888 			if (fail) {
5889 				if (ANSWER(rdataset)) {
5890 					dns_db_detachnode(fctx->cache, &node);
5891 					return DNS_R_BADNAME;
5892 				}
5893 				continue;
5894 			}
5895 		}
5896 
5897 		/*
5898 		 * Enforce the configure maximum cache TTL.
5899 		 */
5900 		if (rdataset->ttl > res->view->maxcachettl) {
5901 			rdataset->ttl = res->view->maxcachettl;
5902 		}
5903 
5904 		/*
5905 		 * Enforce configured minimum cache TTL.
5906 		 */
5907 		if (rdataset->ttl < res->view->mincachettl) {
5908 			rdataset->ttl = res->view->mincachettl;
5909 		}
5910 
5911 		/*
5912 		 * Mark the rdataset as being prefetch eligible.
5913 		 */
5914 		if (rdataset->ttl >= fctx->res->view->prefetch_eligible) {
5915 			rdataset->attributes |= DNS_RDATASETATTR_PREFETCH;
5916 		}
5917 
5918 		/*
5919 		 * Find the SIG for this rdataset, if we have it.
5920 		 */
5921 		for (sigrdataset = ISC_LIST_HEAD(name->list);
5922 		     sigrdataset != NULL;
5923 		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
5924 		{
5925 			if (sigrdataset->type == dns_rdatatype_rrsig &&
5926 			    sigrdataset->covers == rdataset->type)
5927 			{
5928 				break;
5929 			}
5930 		}
5931 
5932 		/*
5933 		 * If this RRset is in a secure domain, is in bailiwick,
5934 		 * and is not glue, attempt DNSSEC validation.	(We do
5935 		 * not attempt to validate glue or out-of-bailiwick
5936 		 * data--even though there might be some performance
5937 		 * benefit to doing so--because it makes it simpler and
5938 		 * safer to ensure that records from a secure domain are
5939 		 * only cached if validated within the context of a
5940 		 * query to the domain that owns them.)
5941 		 */
5942 		if (secure_domain && rdataset->trust != dns_trust_glue &&
5943 		    !EXTERNAL(rdataset))
5944 		{
5945 			dns_trust_t trust;
5946 
5947 			/*
5948 			 * RRSIGs are validated as part of validating
5949 			 * the type they cover.
5950 			 */
5951 			if (rdataset->type == dns_rdatatype_rrsig) {
5952 				continue;
5953 			}
5954 
5955 			if (sigrdataset == NULL && need_validation &&
5956 			    !ANSWER(rdataset))
5957 			{
5958 				/*
5959 				 * Ignore unrelated non-answer
5960 				 * rdatasets that are missing
5961 				 * signatures.
5962 				 */
5963 				continue;
5964 			}
5965 
5966 			/*
5967 			 * Normalize the rdataset and sigrdataset TTLs.
5968 			 */
5969 			if (sigrdataset != NULL) {
5970 				rdataset->ttl = ISC_MIN(rdataset->ttl,
5971 							sigrdataset->ttl);
5972 				sigrdataset->ttl = rdataset->ttl;
5973 			}
5974 
5975 			/*
5976 			 * Mark the rdataset as being prefetch eligible.
5977 			 */
5978 			if (rdataset->ttl >= fctx->res->view->prefetch_eligible)
5979 			{
5980 				rdataset->attributes |=
5981 					DNS_RDATASETATTR_PREFETCH;
5982 			}
5983 
5984 			/*
5985 			 * Cache this rdataset/sigrdataset pair as
5986 			 * pending data.  Track whether it was
5987 			 * additional or not. If this was a priming
5988 			 * query, additional should be cached as glue.
5989 			 */
5990 			if (rdataset->trust == dns_trust_additional) {
5991 				trust = dns_trust_pending_additional;
5992 			} else {
5993 				trust = dns_trust_pending_answer;
5994 			}
5995 
5996 			rdataset->trust = trust;
5997 			if (sigrdataset != NULL) {
5998 				sigrdataset->trust = trust;
5999 			}
6000 			if (!need_validation || !ANSWER(rdataset)) {
6001 				options = 0;
6002 				if (ANSWER(rdataset) &&
6003 				    rdataset->type != dns_rdatatype_rrsig)
6004 				{
6005 					isc_result_t tresult;
6006 					dns_name_t *noqname = NULL;
6007 					tresult = findnoqname(
6008 						fctx, message, name,
6009 						rdataset->type, &noqname);
6010 					if (tresult == ISC_R_SUCCESS &&
6011 					    noqname != NULL)
6012 					{
6013 						(void)dns_rdataset_addnoqname(
6014 							rdataset, noqname);
6015 					}
6016 				}
6017 				if ((fctx->options & DNS_FETCHOPT_PREFETCH) !=
6018 				    0)
6019 				{
6020 					options = DNS_DBADD_PREFETCH;
6021 				}
6022 				if ((fctx->options & DNS_FETCHOPT_NOCACHED) !=
6023 				    0)
6024 				{
6025 					options |= DNS_DBADD_FORCE;
6026 				}
6027 				addedrdataset = ardataset;
6028 				result = dns_db_addrdataset(
6029 					fctx->cache, node, NULL, now, rdataset,
6030 					options, addedrdataset);
6031 				if (result == DNS_R_UNCHANGED) {
6032 					result = ISC_R_SUCCESS;
6033 					if (!need_validation &&
6034 					    ardataset != NULL &&
6035 					    NEGATIVE(ardataset))
6036 					{
6037 						/*
6038 						 * The answer in the
6039 						 * cache is better than
6040 						 * the answer we found,
6041 						 * and is a negative
6042 						 * cache entry, so we
6043 						 * must set eresult
6044 						 * appropriately.
6045 						 */
6046 						if (NXDOMAIN(ardataset)) {
6047 							eresult =
6048 								DNS_R_NCACHENXDOMAIN;
6049 						} else {
6050 							eresult =
6051 								DNS_R_NCACHENXRRSET;
6052 						}
6053 						/*
6054 						 * We have a negative
6055 						 * response from the
6056 						 * cache so don't
6057 						 * attempt to add the
6058 						 * RRSIG rrset.
6059 						 */
6060 						continue;
6061 					}
6062 				}
6063 				if (result != ISC_R_SUCCESS) {
6064 					break;
6065 				}
6066 				if (sigrdataset != NULL) {
6067 					addedrdataset = asigrdataset;
6068 					result = dns_db_addrdataset(
6069 						fctx->cache, node, NULL, now,
6070 						sigrdataset, options,
6071 						addedrdataset);
6072 					if (result == DNS_R_UNCHANGED) {
6073 						result = ISC_R_SUCCESS;
6074 					}
6075 					if (result != ISC_R_SUCCESS) {
6076 						break;
6077 					}
6078 				} else if (!ANSWER(rdataset)) {
6079 					continue;
6080 				}
6081 			}
6082 
6083 			if (ANSWER(rdataset) && need_validation) {
6084 				if (fctx->type != dns_rdatatype_any &&
6085 				    fctx->type != dns_rdatatype_rrsig &&
6086 				    fctx->type != dns_rdatatype_sig)
6087 				{
6088 					/*
6089 					 * This is The Answer.  We will
6090 					 * validate it, but first we
6091 					 * cache the rest of the
6092 					 * response - it may contain
6093 					 * useful keys.
6094 					 */
6095 					INSIST(valrdataset == NULL &&
6096 					       valsigrdataset == NULL);
6097 					valrdataset = rdataset;
6098 					valsigrdataset = sigrdataset;
6099 				} else {
6100 					/*
6101 					 * This is one of (potentially)
6102 					 * multiple answers to an ANY
6103 					 * or SIG query.  To keep things
6104 					 * simple, we just start the
6105 					 * validator right away rather
6106 					 * than caching first and
6107 					 * having to remember which
6108 					 * rdatasets needed validation.
6109 					 */
6110 					result = valcreate(
6111 						fctx, message, addrinfo, name,
6112 						rdataset->type, rdataset,
6113 						sigrdataset, valoptions);
6114 				}
6115 			} else if (CHAINING(rdataset)) {
6116 				if (rdataset->type == dns_rdatatype_cname) {
6117 					eresult = DNS_R_CNAME;
6118 				} else {
6119 					INSIST(rdataset->type ==
6120 					       dns_rdatatype_dname);
6121 					eresult = DNS_R_DNAME;
6122 				}
6123 			}
6124 		} else if (!EXTERNAL(rdataset)) {
6125 			/*
6126 			 * It's OK to cache this rdataset now.
6127 			 */
6128 			if (ANSWER(rdataset)) {
6129 				addedrdataset = ardataset;
6130 			} else if (ANSWERSIG(rdataset)) {
6131 				addedrdataset = asigrdataset;
6132 			} else {
6133 				addedrdataset = NULL;
6134 			}
6135 			if (CHAINING(rdataset)) {
6136 				if (rdataset->type == dns_rdatatype_cname) {
6137 					eresult = DNS_R_CNAME;
6138 				} else {
6139 					INSIST(rdataset->type ==
6140 					       dns_rdatatype_dname);
6141 					eresult = DNS_R_DNAME;
6142 				}
6143 			}
6144 			if (rdataset->trust == dns_trust_glue &&
6145 			    (rdataset->type == dns_rdatatype_ns ||
6146 			     (rdataset->type == dns_rdatatype_rrsig &&
6147 			      rdataset->covers == dns_rdatatype_ns)))
6148 			{
6149 				/*
6150 				 * If the trust level is
6151 				 * 'dns_trust_glue' then we are adding
6152 				 * data from a referral we got while
6153 				 * executing the search algorithm. New
6154 				 * referral data always takes precedence
6155 				 * over the existing cache contents.
6156 				 */
6157 				options = DNS_DBADD_FORCE;
6158 			} else if ((fctx->options & DNS_FETCHOPT_PREFETCH) != 0)
6159 			{
6160 				options = DNS_DBADD_PREFETCH;
6161 			} else {
6162 				options = 0;
6163 			}
6164 
6165 			if (ANSWER(rdataset) &&
6166 			    rdataset->type != dns_rdatatype_rrsig)
6167 			{
6168 				isc_result_t tresult;
6169 				dns_name_t *noqname = NULL;
6170 				tresult = findnoqname(fctx, message, name,
6171 						      rdataset->type, &noqname);
6172 				if (tresult == ISC_R_SUCCESS && noqname != NULL)
6173 				{
6174 					(void)dns_rdataset_addnoqname(rdataset,
6175 								      noqname);
6176 				}
6177 			}
6178 
6179 			/*
6180 			 * Now we can add the rdataset.
6181 			 */
6182 			result = dns_db_addrdataset(fctx->cache, node, NULL,
6183 						    now, rdataset, options,
6184 						    addedrdataset);
6185 
6186 			if (result == DNS_R_UNCHANGED) {
6187 				if (ANSWER(rdataset) && ardataset != NULL &&
6188 				    NEGATIVE(ardataset))
6189 				{
6190 					/*
6191 					 * The answer in the cache is
6192 					 * better than the answer we
6193 					 * found, and is a negative
6194 					 * cache entry, so we must set
6195 					 * eresult appropriately.
6196 					 */
6197 					if (NXDOMAIN(ardataset)) {
6198 						eresult = DNS_R_NCACHENXDOMAIN;
6199 					} else {
6200 						eresult = DNS_R_NCACHENXRRSET;
6201 					}
6202 				}
6203 				result = ISC_R_SUCCESS;
6204 			} else if (result != ISC_R_SUCCESS) {
6205 				break;
6206 			}
6207 		}
6208 	}
6209 
6210 	if (valrdataset != NULL) {
6211 		dns_rdatatype_t vtype = fctx->type;
6212 		if (CHAINING(valrdataset)) {
6213 			if (valrdataset->type == dns_rdatatype_cname) {
6214 				vtype = dns_rdatatype_cname;
6215 			} else {
6216 				vtype = dns_rdatatype_dname;
6217 			}
6218 		}
6219 
6220 		result = valcreate(fctx, message, addrinfo, name, vtype,
6221 				   valrdataset, valsigrdataset, valoptions);
6222 	}
6223 
6224 	if (result == ISC_R_SUCCESS && have_answer) {
6225 		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
6226 		if (resp != NULL) {
6227 			/*
6228 			 * Negative results must be indicated in
6229 			 * resp->result.
6230 			 */
6231 			if (dns_rdataset_isassociated(resp->rdataset) &&
6232 			    NEGATIVE(resp->rdataset))
6233 			{
6234 				INSIST(eresult == DNS_R_NCACHENXDOMAIN ||
6235 				       eresult == DNS_R_NCACHENXRRSET);
6236 			}
6237 			resp->result = eresult;
6238 			if (adbp != NULL && *adbp != NULL) {
6239 				if (anodep != NULL && *anodep != NULL) {
6240 					dns_db_detachnode(*adbp, anodep);
6241 				}
6242 				dns_db_detach(adbp);
6243 			}
6244 			dns_db_attach(fctx->cache, adbp);
6245 			dns_db_transfernode(fctx->cache, &node, anodep);
6246 			clone_results(fctx);
6247 		}
6248 	}
6249 
6250 	if (node != NULL) {
6251 		dns_db_detachnode(fctx->cache, &node);
6252 	}
6253 
6254 	return result;
6255 }
6256 
6257 static isc_result_t
6258 cache_message(fetchctx_t *fctx, dns_message_t *message,
6259 	      dns_adbaddrinfo_t *addrinfo, isc_stdtime_t now) {
6260 	isc_result_t result;
6261 	dns_section_t section;
6262 	dns_name_t *name;
6263 
6264 	FCTXTRACE("cache_message");
6265 
6266 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTCACHE);
6267 
6268 	LOCK(&fctx->lock);
6269 
6270 	for (section = DNS_SECTION_ANSWER; section <= DNS_SECTION_ADDITIONAL;
6271 	     section++)
6272 	{
6273 		result = dns_message_firstname(message, section);
6274 		while (result == ISC_R_SUCCESS) {
6275 			name = NULL;
6276 			dns_message_currentname(message, section, &name);
6277 			if (name->attributes.cache) {
6278 				result = cache_name(fctx, name, message,
6279 						    addrinfo, now);
6280 				if (result != ISC_R_SUCCESS) {
6281 					break;
6282 				}
6283 			}
6284 			result = dns_message_nextname(message, section);
6285 		}
6286 		if (result != ISC_R_NOMORE) {
6287 			break;
6288 		}
6289 	}
6290 	if (result == ISC_R_NOMORE) {
6291 		result = ISC_R_SUCCESS;
6292 	}
6293 
6294 	UNLOCK(&fctx->lock);
6295 
6296 	return result;
6297 }
6298 
6299 /*
6300  * Do what dns_ncache_addoptout() does, and then compute an appropriate
6301  * eresult.
6302  */
6303 static isc_result_t
6304 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
6305 		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
6306 		  dns_ttl_t maxttl, bool optout, bool secure,
6307 		  dns_rdataset_t *ardataset, isc_result_t *eresultp) {
6308 	isc_result_t result;
6309 	dns_rdataset_t rdataset;
6310 
6311 	if (ardataset == NULL) {
6312 		dns_rdataset_init(&rdataset);
6313 		ardataset = &rdataset;
6314 	}
6315 	if (secure) {
6316 		result = dns_ncache_addoptout(message, cache, node, covers, now,
6317 					      minttl, maxttl, optout,
6318 					      ardataset);
6319 	} else {
6320 		result = dns_ncache_add(message, cache, node, covers, now,
6321 					minttl, maxttl, ardataset);
6322 	}
6323 	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
6324 		/*
6325 		 * If the cache now contains a negative entry and we
6326 		 * care about whether it is DNS_R_NCACHENXDOMAIN or
6327 		 * DNS_R_NCACHENXRRSET then extract it.
6328 		 */
6329 		if (NEGATIVE(ardataset)) {
6330 			/*
6331 			 * The cache data is a negative cache entry.
6332 			 */
6333 			if (NXDOMAIN(ardataset)) {
6334 				*eresultp = DNS_R_NCACHENXDOMAIN;
6335 			} else {
6336 				*eresultp = DNS_R_NCACHENXRRSET;
6337 			}
6338 		} else {
6339 			/*
6340 			 * Either we don't care about the nature of the
6341 			 * cache rdataset (because no fetch is
6342 			 * interested in the outcome), or the cache
6343 			 * rdataset is not a negative cache entry.
6344 			 * Whichever case it is, we can return success.
6345 			 *
6346 			 * XXXRTH  There's a CNAME/DNAME problem here.
6347 			 */
6348 			*eresultp = ISC_R_SUCCESS;
6349 		}
6350 		result = ISC_R_SUCCESS;
6351 	}
6352 	if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) {
6353 		dns_rdataset_disassociate(ardataset);
6354 	}
6355 
6356 	return result;
6357 }
6358 
6359 static isc_result_t
6360 ncache_message(fetchctx_t *fctx, dns_message_t *message,
6361 	       dns_adbaddrinfo_t *addrinfo, dns_rdatatype_t covers,
6362 	       isc_stdtime_t now) {
6363 	isc_result_t result, eresult = ISC_R_SUCCESS;
6364 	dns_name_t *name = fctx->name;
6365 	dns_resolver_t *res = fctx->res;
6366 	dns_db_t **adbp = NULL;
6367 	dns_dbnode_t *node = NULL, **anodep = NULL;
6368 	dns_rdataset_t *ardataset = NULL;
6369 	bool need_validation = false, secure_domain = false;
6370 	dns_fetchresponse_t *resp = NULL;
6371 	uint32_t ttl;
6372 	unsigned int valoptions = 0;
6373 	bool checknta = true;
6374 
6375 	FCTXTRACE("ncache_message");
6376 
6377 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_WANTNCACHE);
6378 
6379 	POST(need_validation);
6380 
6381 	/*
6382 	 * XXXMPA remove when we follow cnames and adjust the setting
6383 	 * of FCTX_ATTR_WANTNCACHE in rctx_answer_none().
6384 	 */
6385 	INSIST(message->counts[DNS_SECTION_ANSWER] == 0);
6386 
6387 	/*
6388 	 * Is DNSSEC validation required for this name?
6389 	 */
6390 	if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) {
6391 		valoptions |= DNS_VALIDATOR_NONTA;
6392 		checknta = false;
6393 	}
6394 
6395 	if (fctx->res->view->enablevalidation) {
6396 		result = issecuredomain(res->view, name, fctx->type, now,
6397 					checknta, NULL, &secure_domain);
6398 		if (result != ISC_R_SUCCESS) {
6399 			return result;
6400 		}
6401 	}
6402 
6403 	if ((fctx->options & DNS_FETCHOPT_NOCDFLAG) != 0) {
6404 		valoptions |= DNS_VALIDATOR_NOCDFLAG;
6405 	}
6406 
6407 	if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0) {
6408 		need_validation = false;
6409 	} else {
6410 		need_validation = secure_domain;
6411 	}
6412 
6413 	if (secure_domain) {
6414 		/*
6415 		 * Mark all rdatasets as pending.
6416 		 */
6417 		result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
6418 		while (result == ISC_R_SUCCESS) {
6419 			dns_rdataset_t *trdataset = NULL;
6420 			dns_name_t *tname = NULL;
6421 
6422 			dns_message_currentname(message, DNS_SECTION_AUTHORITY,
6423 						&tname);
6424 			for (trdataset = ISC_LIST_HEAD(tname->list);
6425 			     trdataset != NULL;
6426 			     trdataset = ISC_LIST_NEXT(trdataset, link))
6427 			{
6428 				trdataset->trust = dns_trust_pending_answer;
6429 			}
6430 			result = dns_message_nextname(message,
6431 						      DNS_SECTION_AUTHORITY);
6432 		}
6433 		if (result != ISC_R_NOMORE) {
6434 			return result;
6435 		}
6436 	}
6437 
6438 	if (need_validation) {
6439 		/*
6440 		 * Do negative response validation.
6441 		 */
6442 		result = valcreate(fctx, message, addrinfo, name, fctx->type,
6443 				   NULL, NULL, valoptions);
6444 		/*
6445 		 * If validation is necessary, return now.  Otherwise
6446 		 * continue to process the message, letting the
6447 		 * validation complete in its own good time.
6448 		 */
6449 		return result;
6450 	}
6451 
6452 	LOCK(&fctx->lock);
6453 
6454 	if (!HAVE_ANSWER(fctx)) {
6455 		resp = ISC_LIST_HEAD(fctx->resps);
6456 		if (resp != NULL) {
6457 			adbp = &resp->db;
6458 			dns_name_copy(name, resp->foundname);
6459 			anodep = &resp->node;
6460 			ardataset = resp->rdataset;
6461 		}
6462 	}
6463 
6464 	result = dns_db_findnode(fctx->cache, name, true, &node);
6465 	if (result != ISC_R_SUCCESS) {
6466 		goto unlock;
6467 	}
6468 
6469 	/*
6470 	 * Don't report qname minimisation NXDOMAIN errors
6471 	 * when the result is NXDOMAIN except we have already
6472 	 * confirmed a higher error.
6473 	 */
6474 	if (!fctx->force_qmin_warning && message->rcode == dns_rcode_nxdomain &&
6475 	    (fctx->qmin_warning == DNS_R_NXDOMAIN ||
6476 	     fctx->qmin_warning == DNS_R_NCACHENXDOMAIN))
6477 	{
6478 		fctx->qmin_warning = ISC_R_SUCCESS;
6479 	}
6480 
6481 	/*
6482 	 * If we are asking for a SOA record set the cache time
6483 	 * to zero to facilitate locating the containing zone of
6484 	 * a arbitrary zone.
6485 	 */
6486 	ttl = fctx->res->view->maxncachettl;
6487 	if (fctx->type == dns_rdatatype_soa && covers == dns_rdatatype_any &&
6488 	    fctx->res->zero_no_soa_ttl)
6489 	{
6490 		ttl = 0;
6491 	}
6492 
6493 	result = ncache_adderesult(message, fctx->cache, node, covers, now,
6494 				   fctx->res->view->minncachettl, ttl, false,
6495 				   false, ardataset, &eresult);
6496 	if (result != ISC_R_SUCCESS) {
6497 		goto unlock;
6498 	}
6499 
6500 	if (!HAVE_ANSWER(fctx)) {
6501 		FCTX_ATTR_SET(fctx, FCTX_ATTR_HAVEANSWER);
6502 		if (resp != NULL) {
6503 			resp->result = eresult;
6504 			if (adbp != NULL && *adbp != NULL) {
6505 				if (anodep != NULL && *anodep != NULL) {
6506 					dns_db_detachnode(*adbp, anodep);
6507 				}
6508 				dns_db_detach(adbp);
6509 			}
6510 			dns_db_attach(fctx->cache, adbp);
6511 			dns_db_transfernode(fctx->cache, &node, anodep);
6512 			clone_results(fctx);
6513 		}
6514 	}
6515 
6516 unlock:
6517 	UNLOCK(&fctx->lock);
6518 
6519 	if (node != NULL) {
6520 		dns_db_detachnode(fctx->cache, &node);
6521 	}
6522 
6523 	return result;
6524 }
6525 
6526 static void
6527 mark_related(dns_name_t *name, dns_rdataset_t *rdataset, bool external,
6528 	     bool gluing) {
6529 	name->attributes.cache = true;
6530 	if (gluing) {
6531 		rdataset->trust = dns_trust_glue;
6532 		/*
6533 		 * Glue with 0 TTL causes problems.  We force the TTL to
6534 		 * 1 second to prevent this.
6535 		 */
6536 		if (rdataset->ttl == 0) {
6537 			rdataset->ttl = 1;
6538 		}
6539 	} else {
6540 		rdataset->trust = dns_trust_additional;
6541 	}
6542 	/*
6543 	 * Avoid infinite loops by only marking new rdatasets.
6544 	 */
6545 	if (!CACHE(rdataset)) {
6546 		name->attributes.chase = true;
6547 		rdataset->attributes |= DNS_RDATASETATTR_CHASE;
6548 	}
6549 	rdataset->attributes |= DNS_RDATASETATTR_CACHE;
6550 	if (external) {
6551 		rdataset->attributes |= DNS_RDATASETATTR_EXTERNAL;
6552 	}
6553 }
6554 
6555 /*
6556  * Returns true if 'name' is external to the namespace for which
6557  * the server being queried can answer, either because it's not a
6558  * subdomain or because it's below a forward declaration or a
6559  * locally served zone.
6560  */
6561 static inline bool
6562 name_external(const dns_name_t *name, dns_rdatatype_t type, fetchctx_t *fctx) {
6563 	isc_result_t result;
6564 	dns_forwarders_t *forwarders = NULL;
6565 	dns_name_t *apex = NULL;
6566 	dns_name_t suffix;
6567 	dns_zone_t *zone = NULL;
6568 	unsigned int labels;
6569 	dns_namereln_t rel;
6570 
6571 	apex = (ISDUALSTACK(fctx->addrinfo) || !ISFORWARDER(fctx->addrinfo))
6572 		       ? fctx->domain
6573 		       : fctx->fwdname;
6574 
6575 	/*
6576 	 * The name is outside the queried namespace.
6577 	 */
6578 	rel = dns_name_fullcompare(name, apex, &(int){ 0 },
6579 				   &(unsigned int){ 0U });
6580 	if (rel != dns_namereln_subdomain && rel != dns_namereln_equal) {
6581 		return true;
6582 	}
6583 
6584 	/*
6585 	 * If the record lives in the parent zone, adjust the name so we
6586 	 * look for the correct zone or forward clause.
6587 	 */
6588 	labels = dns_name_countlabels(name);
6589 	if (dns_rdatatype_atparent(type) && labels > 1U) {
6590 		dns_name_init(&suffix, NULL);
6591 		dns_name_getlabelsequence(name, 1, labels - 1, &suffix);
6592 		name = &suffix;
6593 	} else if (rel == dns_namereln_equal) {
6594 		/* If 'name' is 'apex', no further checking is needed. */
6595 		return false;
6596 	}
6597 
6598 	/*
6599 	 * If there is a locally served zone between 'apex' and 'name'
6600 	 * then don't cache.
6601 	 */
6602 	dns_ztfind_t options = DNS_ZTFIND_NOEXACT | DNS_ZTFIND_MIRROR;
6603 	result = dns_view_findzone(fctx->res->view, name, options, &zone);
6604 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
6605 		dns_name_t *zname = dns_zone_getorigin(zone);
6606 		dns_namereln_t reln = dns_name_fullcompare(
6607 			zname, apex, &(int){ 0 }, &(unsigned int){ 0U });
6608 		dns_zone_detach(&zone);
6609 		if (reln == dns_namereln_subdomain) {
6610 			return true;
6611 		}
6612 	}
6613 
6614 	/*
6615 	 * Look for a forward declaration below 'name'.
6616 	 */
6617 	result = dns_fwdtable_find(fctx->res->view->fwdtable, name,
6618 				   &forwarders);
6619 
6620 	if (ISFORWARDER(fctx->addrinfo)) {
6621 		/*
6622 		 * See if the forwarder declaration is better.
6623 		 */
6624 		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
6625 			bool better = !dns_name_equal(&forwarders->name,
6626 						      fctx->fwdname);
6627 			dns_forwarders_detach(&forwarders);
6628 			return better;
6629 		}
6630 
6631 		/*
6632 		 * If the lookup failed, the configuration must have
6633 		 * changed: play it safe and don't cache.
6634 		 */
6635 		return true;
6636 	} else if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
6637 		/*
6638 		 * If 'name' is covered by a 'forward only' clause then we
6639 		 * can't cache this response.
6640 		 */
6641 		bool nocache = (forwarders->fwdpolicy == dns_fwdpolicy_only &&
6642 				!ISC_LIST_EMPTY(forwarders->fwdrs));
6643 		dns_forwarders_detach(&forwarders);
6644 		return nocache;
6645 	}
6646 
6647 	return false;
6648 }
6649 
6650 static isc_result_t
6651 check_section(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
6652 	      dns_rdataset_t *found, dns_section_t section) {
6653 	respctx_t *rctx = arg;
6654 	fetchctx_t *fctx = rctx->fctx;
6655 	isc_result_t result;
6656 	dns_name_t *name = NULL;
6657 	dns_rdataset_t *rdataset = NULL;
6658 	bool external;
6659 	dns_rdatatype_t rtype;
6660 	bool gluing;
6661 
6662 	REQUIRE(VALID_FCTX(fctx));
6663 
6664 #if CHECK_FOR_GLUE_IN_ANSWER
6665 	if (section == DNS_SECTION_ANSWER && type != dns_rdatatype_a) {
6666 		return ISC_R_SUCCESS;
6667 	}
6668 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
6669 
6670 	gluing = (GLUING(fctx) || (fctx->type == dns_rdatatype_ns &&
6671 				   dns_name_equal(fctx->name, dns_rootname)));
6672 
6673 	result = dns_message_findname(rctx->query->rmessage, section, addname,
6674 				      dns_rdatatype_any, 0, &name, NULL);
6675 	if (result == ISC_R_SUCCESS) {
6676 		external = name_external(name, type, fctx);
6677 		if (type == dns_rdatatype_a) {
6678 			for (rdataset = ISC_LIST_HEAD(name->list);
6679 			     rdataset != NULL;
6680 			     rdataset = ISC_LIST_NEXT(rdataset, link))
6681 			{
6682 				if (rdataset->type == dns_rdatatype_rrsig) {
6683 					rtype = rdataset->covers;
6684 				} else {
6685 					rtype = rdataset->type;
6686 				}
6687 				if (rtype == dns_rdatatype_a ||
6688 				    rtype == dns_rdatatype_aaaa)
6689 				{
6690 					mark_related(name, rdataset, external,
6691 						     gluing);
6692 				}
6693 			}
6694 		} else {
6695 			result = dns_message_findtype(name, type, 0, &rdataset);
6696 			if (result == ISC_R_SUCCESS) {
6697 				mark_related(name, rdataset, external, gluing);
6698 				if (found != NULL) {
6699 					dns_rdataset_clone(rdataset, found);
6700 				}
6701 				/*
6702 				 * Do we have its SIG too?
6703 				 */
6704 				rdataset = NULL;
6705 				result = dns_message_findtype(
6706 					name, dns_rdatatype_rrsig, type,
6707 					&rdataset);
6708 				if (result == ISC_R_SUCCESS) {
6709 					mark_related(name, rdataset, external,
6710 						     gluing);
6711 				}
6712 			}
6713 		}
6714 	}
6715 
6716 	return ISC_R_SUCCESS;
6717 }
6718 
6719 static isc_result_t
6720 check_related(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
6721 	      dns_rdataset_t *found DNS__DB_FLARG) {
6722 	return check_section(arg, addname, type, found, DNS_SECTION_ADDITIONAL);
6723 }
6724 
6725 #ifndef CHECK_FOR_GLUE_IN_ANSWER
6726 #define CHECK_FOR_GLUE_IN_ANSWER 0
6727 #endif /* ifndef CHECK_FOR_GLUE_IN_ANSWER */
6728 
6729 #if CHECK_FOR_GLUE_IN_ANSWER
6730 static isc_result_t
6731 check_answer(void *arg, const dns_name_t *addname, dns_rdatatype_t type,
6732 	     dns_rdataset_t *found) {
6733 	return check_section(arg, addname, type, found, DNS_SECTION_ANSWER);
6734 }
6735 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
6736 
6737 static bool
6738 is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
6739 			 dns_rdataset_t *rdataset) {
6740 	isc_result_t result;
6741 	dns_rdata_t rdata = DNS_RDATA_INIT;
6742 	struct in_addr ina;
6743 	struct in6_addr in6a;
6744 	isc_netaddr_t netaddr;
6745 	char addrbuf[ISC_NETADDR_FORMATSIZE];
6746 	char namebuf[DNS_NAME_FORMATSIZE];
6747 	char classbuf[64];
6748 	char typebuf[64];
6749 	int match;
6750 
6751 	/* By default, we allow any addresses. */
6752 	if (view->denyansweracl == NULL) {
6753 		return true;
6754 	}
6755 
6756 	/*
6757 	 * If the owner name matches one in the exclusion list, either
6758 	 * exactly or partially, allow it.
6759 	 */
6760 	if (dns_nametree_covered(view->answeracl_exclude, name, NULL, 0)) {
6761 		return true;
6762 	}
6763 
6764 	/*
6765 	 * Otherwise, search the filter list for a match for each
6766 	 * address record.  If a match is found, the address should be
6767 	 * filtered, so should the entire answer.
6768 	 */
6769 	for (result = dns_rdataset_first(rdataset); result == ISC_R_SUCCESS;
6770 	     result = dns_rdataset_next(rdataset))
6771 	{
6772 		dns_rdata_reset(&rdata);
6773 		dns_rdataset_current(rdataset, &rdata);
6774 		if (rdataset->type == dns_rdatatype_a) {
6775 			INSIST(rdata.length == sizeof(ina.s_addr));
6776 			memmove(&ina.s_addr, rdata.data, sizeof(ina.s_addr));
6777 			isc_netaddr_fromin(&netaddr, &ina);
6778 		} else {
6779 			INSIST(rdata.length == sizeof(in6a.s6_addr));
6780 			memmove(in6a.s6_addr, rdata.data, sizeof(in6a.s6_addr));
6781 			isc_netaddr_fromin6(&netaddr, &in6a);
6782 		}
6783 
6784 		result = dns_acl_match(&netaddr, NULL, view->denyansweracl,
6785 				       view->aclenv, &match, NULL);
6786 		if (result == ISC_R_SUCCESS && match > 0) {
6787 			isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
6788 			dns_name_format(name, namebuf, sizeof(namebuf));
6789 			dns_rdatatype_format(rdataset->type, typebuf,
6790 					     sizeof(typebuf));
6791 			dns_rdataclass_format(rdataset->rdclass, classbuf,
6792 					      sizeof(classbuf));
6793 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
6794 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
6795 				      "answer address %s denied for %s/%s/%s",
6796 				      addrbuf, namebuf, typebuf, classbuf);
6797 			return false;
6798 		}
6799 	}
6800 
6801 	return true;
6802 }
6803 
6804 static bool
6805 is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
6806 			dns_rdataset_t *rdataset, bool *chainingp) {
6807 	isc_result_t result;
6808 	dns_name_t *tname = NULL;
6809 	dns_rdata_cname_t cname;
6810 	dns_rdata_dname_t dname;
6811 	dns_view_t *view = fctx->res->view;
6812 	dns_rdata_t rdata = DNS_RDATA_INIT;
6813 	unsigned int nlabels;
6814 	dns_fixedname_t fixed;
6815 	dns_name_t prefix;
6816 	int order;
6817 
6818 	REQUIRE(rdataset != NULL);
6819 	REQUIRE(rdataset->type == dns_rdatatype_cname ||
6820 		rdataset->type == dns_rdatatype_dname);
6821 
6822 	/*
6823 	 * By default, we allow any target name.
6824 	 * If newqname != NULL we also need to extract the newqname.
6825 	 */
6826 	if (chainingp == NULL && view->denyanswernames == NULL) {
6827 		return true;
6828 	}
6829 
6830 	result = dns_rdataset_first(rdataset);
6831 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
6832 	dns_rdataset_current(rdataset, &rdata);
6833 	switch (rdataset->type) {
6834 	case dns_rdatatype_cname:
6835 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
6836 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
6837 		tname = &cname.cname;
6838 		break;
6839 	case dns_rdatatype_dname:
6840 		if (dns_name_fullcompare(qname, rname, &order, &nlabels) !=
6841 		    dns_namereln_subdomain)
6842 		{
6843 			return true;
6844 		}
6845 		result = dns_rdata_tostruct(&rdata, &dname, NULL);
6846 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
6847 		dns_name_init(&prefix, NULL);
6848 		tname = dns_fixedname_initname(&fixed);
6849 		nlabels = dns_name_countlabels(rname);
6850 		dns_name_split(qname, nlabels, &prefix, NULL);
6851 		result = dns_name_concatenate(&prefix, &dname.dname, tname,
6852 					      NULL);
6853 		if (result == DNS_R_NAMETOOLONG) {
6854 			SET_IF_NOT_NULL(chainingp, true);
6855 			return true;
6856 		}
6857 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
6858 		break;
6859 	default:
6860 		UNREACHABLE();
6861 	}
6862 
6863 	SET_IF_NOT_NULL(chainingp, true);
6864 
6865 	if (view->denyanswernames == NULL) {
6866 		return true;
6867 	}
6868 
6869 	/*
6870 	 * If the owner name matches one in the exclusion list, either
6871 	 * exactly or partially, allow it.
6872 	 */
6873 	if (dns_nametree_covered(view->answernames_exclude, qname, NULL, 0)) {
6874 		return true;
6875 	}
6876 
6877 	/*
6878 	 * If the target name is a subdomain of the search domain, allow
6879 	 * it.
6880 	 *
6881 	 * Note that if BIND is configured as a forwarding DNS server,
6882 	 * the search domain will always match the root domain ("."), so
6883 	 * we must also check whether forwarding is enabled so that
6884 	 * filters can be applied; see GL #1574.
6885 	 */
6886 	if (!fctx->forwarding && dns_name_issubdomain(tname, fctx->domain)) {
6887 		return true;
6888 	}
6889 
6890 	/*
6891 	 * Otherwise, apply filters.
6892 	 */
6893 	if (dns_nametree_covered(view->denyanswernames, tname, NULL, 0)) {
6894 		char qnamebuf[DNS_NAME_FORMATSIZE];
6895 		char tnamebuf[DNS_NAME_FORMATSIZE];
6896 		char classbuf[64];
6897 		char typebuf[64];
6898 		dns_name_format(qname, qnamebuf, sizeof(qnamebuf));
6899 		dns_name_format(tname, tnamebuf, sizeof(tnamebuf));
6900 		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
6901 		dns_rdataclass_format(view->rdclass, classbuf,
6902 				      sizeof(classbuf));
6903 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
6904 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
6905 			      "%s target %s denied for %s/%s", typebuf,
6906 			      tnamebuf, qnamebuf, classbuf);
6907 		return false;
6908 	}
6909 
6910 	return true;
6911 }
6912 
6913 static void
6914 trim_ns_ttl(fetchctx_t *fctx, dns_name_t *name, dns_rdataset_t *rdataset) {
6915 	if (fctx->ns_ttl_ok && rdataset->ttl > fctx->ns_ttl) {
6916 		char ns_namebuf[DNS_NAME_FORMATSIZE];
6917 		char namebuf[DNS_NAME_FORMATSIZE];
6918 		char tbuf[DNS_RDATATYPE_FORMATSIZE];
6919 
6920 		dns_name_format(name, ns_namebuf, sizeof(ns_namebuf));
6921 		dns_name_format(fctx->name, namebuf, sizeof(namebuf));
6922 		dns_rdatatype_format(fctx->type, tbuf, sizeof(tbuf));
6923 
6924 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
6925 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(10),
6926 			      "fctx %p: trimming ttl of %s/NS for %s/%s: "
6927 			      "%u -> %u",
6928 			      fctx, ns_namebuf, namebuf, tbuf, rdataset->ttl,
6929 			      fctx->ns_ttl);
6930 		rdataset->ttl = fctx->ns_ttl;
6931 	}
6932 }
6933 
6934 static bool
6935 validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) {
6936 	if (rdataset->type == dns_rdatatype_nsec3) {
6937 		/*
6938 		 * NSEC3 records are not allowed to
6939 		 * appear in the answer section.
6940 		 */
6941 		log_formerr(fctx, "NSEC3 in answer");
6942 		return false;
6943 	}
6944 	if (rdataset->type == dns_rdatatype_tkey) {
6945 		/*
6946 		 * TKEY is not a valid record in a
6947 		 * response to any query we can make.
6948 		 */
6949 		log_formerr(fctx, "TKEY in answer");
6950 		return false;
6951 	}
6952 	if (rdataset->rdclass != fctx->res->rdclass) {
6953 		log_formerr(fctx, "Mismatched class in answer");
6954 		return false;
6955 	}
6956 	return true;
6957 }
6958 
6959 #if DNS_RESOLVER_TRACE
6960 ISC_REFCOUNT_TRACE_IMPL(fetchctx, fctx_destroy);
6961 #else
6962 ISC_REFCOUNT_IMPL(fetchctx, fctx_destroy);
6963 #endif
6964 
6965 static uint32_t
6966 fctx_hash(fetchctx_t *fctx) {
6967 	isc_hash32_t hash32;
6968 	isc_hash32_init(&hash32);
6969 	isc_hash32_hash(&hash32, fctx->name->ndata, fctx->name->length, false);
6970 	isc_hash32_hash(&hash32, &fctx->options, sizeof(fctx->options), true);
6971 	isc_hash32_hash(&hash32, &fctx->type, sizeof(fctx->type), true);
6972 	return isc_hash32_finalize(&hash32);
6973 }
6974 
6975 static bool
6976 fctx_match(void *node, const void *key) {
6977 	const fetchctx_t *fctx0 = node;
6978 	const fetchctx_t *fctx1 = key;
6979 
6980 	return fctx0->options == fctx1->options && fctx0->type == fctx1->type &&
6981 	       dns_name_equal(fctx0->name, fctx1->name);
6982 }
6983 
6984 /* Must be fctx locked */
6985 static void
6986 release_fctx(fetchctx_t *fctx) {
6987 	isc_result_t result;
6988 	dns_resolver_t *res = fctx->res;
6989 
6990 	if (!fctx->hashed) {
6991 		return;
6992 	}
6993 
6994 	RWLOCK(&res->fctxs_lock, isc_rwlocktype_write);
6995 	result = isc_hashmap_delete(res->fctxs, fctx_hash(fctx), match_ptr,
6996 				    fctx);
6997 	INSIST(result == ISC_R_SUCCESS);
6998 	fctx->hashed = false;
6999 	RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write);
7000 }
7001 
7002 static void
7003 resume_dslookup(void *arg) {
7004 	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
7005 	fetchctx_t *fctx = resp->arg;
7006 	isc_loop_t *loop = resp->loop;
7007 	isc_result_t result;
7008 	dns_resolver_t *res = NULL;
7009 	dns_rdataset_t *frdataset = NULL, *nsrdataset = NULL;
7010 	dns_rdataset_t nameservers;
7011 	dns_fixedname_t fixed;
7012 	dns_name_t *domain = NULL;
7013 	unsigned int n;
7014 	dns_fetch_t *fetch = NULL;
7015 
7016 	REQUIRE(VALID_FCTX(fctx));
7017 
7018 	res = fctx->res;
7019 
7020 	REQUIRE(fctx->tid == isc_tid());
7021 
7022 	FCTXTRACE("resume_dslookup");
7023 
7024 	if (resp->node != NULL) {
7025 		dns_db_detachnode(resp->db, &resp->node);
7026 	}
7027 	if (resp->db != NULL) {
7028 		dns_db_detach(&resp->db);
7029 	}
7030 
7031 	/* Preserve data from resp before freeing it. */
7032 	frdataset = resp->rdataset; /* a.k.a. fctx->nsrrset */
7033 	result = resp->result;
7034 	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
7035 
7036 	LOCK(&fctx->lock);
7037 	if (SHUTTINGDOWN(fctx)) {
7038 		result = ISC_R_SHUTTINGDOWN;
7039 	}
7040 	UNLOCK(&fctx->lock);
7041 
7042 	fetch = fctx->nsfetch;
7043 	fctx->nsfetch = NULL;
7044 
7045 	FTRACE("resume_dslookup");
7046 
7047 	switch (result) {
7048 	case ISC_R_SUCCESS:
7049 		FCTXTRACE("resuming DS lookup");
7050 
7051 		if (dns_rdataset_isassociated(&fctx->nameservers)) {
7052 			dns_rdataset_disassociate(&fctx->nameservers);
7053 		}
7054 		dns_rdataset_clone(frdataset, &fctx->nameservers);
7055 
7056 		/*
7057 		 * Disassociate now the NS's are saved.
7058 		 */
7059 		if (dns_rdataset_isassociated(frdataset)) {
7060 			dns_rdataset_disassociate(frdataset);
7061 		}
7062 
7063 		fctx->ns_ttl = fctx->nameservers.ttl;
7064 		fctx->ns_ttl_ok = true;
7065 		log_ns_ttl(fctx, "resume_dslookup");
7066 
7067 		fcount_decr(fctx);
7068 		dns_name_copy(fctx->nsname, fctx->domain);
7069 		result = fcount_incr(fctx, true);
7070 		if (result != ISC_R_SUCCESS) {
7071 			goto cleanup;
7072 		}
7073 
7074 		/* Try again. */
7075 		fctx_try(fctx, true);
7076 		break;
7077 
7078 	case ISC_R_SHUTTINGDOWN:
7079 	case ISC_R_CANCELED:
7080 		/* Don't try anymore. */
7081 		/* Can't be done in cleanup. */
7082 		if (dns_rdataset_isassociated(frdataset)) {
7083 			dns_rdataset_disassociate(frdataset);
7084 		}
7085 		goto cleanup;
7086 
7087 	default:
7088 		/*
7089 		 * Disassociate for the next dns_resolver_createfetch call.
7090 		 */
7091 		if (dns_rdataset_isassociated(frdataset)) {
7092 			dns_rdataset_disassociate(frdataset);
7093 		}
7094 
7095 		/*
7096 		 * If the chain of resume_dslookup() invocations managed to
7097 		 * chop off enough labels from the original DS owner name to
7098 		 * reach the top of the namespace, no further progress can be
7099 		 * made.  Interrupt the DS chasing process, returning SERVFAIL.
7100 		 */
7101 		if (dns_name_equal(fctx->nsname, fetch->private->domain)) {
7102 			result = DNS_R_SERVFAIL;
7103 			goto cleanup;
7104 		}
7105 
7106 		/* Get nameservers from fetch before we destroy it. */
7107 		dns_rdataset_init(&nameservers);
7108 		if (dns_rdataset_isassociated(&fetch->private->nameservers)) {
7109 			dns_rdataset_clone(&fetch->private->nameservers,
7110 					   &nameservers);
7111 			nsrdataset = &nameservers;
7112 
7113 			/* Get domain from fetch before we destroy it. */
7114 			domain = dns_fixedname_initname(&fixed);
7115 			dns_name_copy(fetch->private->domain, domain);
7116 		}
7117 
7118 		n = dns_name_countlabels(fctx->nsname);
7119 		dns_name_getlabelsequence(fctx->nsname, 1, n - 1, fctx->nsname);
7120 
7121 		FCTXTRACE("continuing to look for parent's NS records");
7122 
7123 		fetchctx_ref(fctx);
7124 		result = dns_resolver_createfetch(
7125 			res, fctx->nsname, dns_rdatatype_ns, domain, nsrdataset,
7126 			NULL, NULL, 0, fctx->options, 0, fctx->qc, loop,
7127 			resume_dslookup, fctx, &fctx->nsrrset, NULL,
7128 			&fctx->nsfetch);
7129 		if (result != ISC_R_SUCCESS) {
7130 			fetchctx_unref(fctx);
7131 			if (result == DNS_R_DUPLICATE) {
7132 				result = DNS_R_SERVFAIL;
7133 			}
7134 		}
7135 
7136 		if (dns_rdataset_isassociated(&nameservers)) {
7137 			dns_rdataset_disassociate(&nameservers);
7138 		}
7139 	}
7140 
7141 cleanup:
7142 	dns_resolver_destroyfetch(&fetch);
7143 
7144 	if (result != ISC_R_SUCCESS) {
7145 		/* An error occurred, tear down whole fctx */
7146 		fctx_done_unref(fctx, result);
7147 	}
7148 
7149 	fetchctx_detach(&fctx);
7150 }
7151 
7152 static void
7153 checknamessection(dns_message_t *message, dns_section_t section) {
7154 	isc_result_t result;
7155 	dns_name_t *name;
7156 	dns_rdata_t rdata = DNS_RDATA_INIT;
7157 	dns_rdataset_t *rdataset;
7158 
7159 	for (result = dns_message_firstname(message, section);
7160 	     result == ISC_R_SUCCESS;
7161 	     result = dns_message_nextname(message, section))
7162 	{
7163 		name = NULL;
7164 		dns_message_currentname(message, section, &name);
7165 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
7166 		     rdataset = ISC_LIST_NEXT(rdataset, link))
7167 		{
7168 			for (result = dns_rdataset_first(rdataset);
7169 			     result == ISC_R_SUCCESS;
7170 			     result = dns_rdataset_next(rdataset))
7171 			{
7172 				dns_rdataset_current(rdataset, &rdata);
7173 				if (!dns_rdata_checkowner(name, rdata.rdclass,
7174 							  rdata.type, false) ||
7175 				    !dns_rdata_checknames(&rdata, name, NULL))
7176 				{
7177 					rdataset->attributes |=
7178 						DNS_RDATASETATTR_CHECKNAMES;
7179 				}
7180 				dns_rdata_reset(&rdata);
7181 			}
7182 		}
7183 	}
7184 }
7185 
7186 static void
7187 checknames(dns_message_t *message) {
7188 	checknamessection(message, DNS_SECTION_ANSWER);
7189 	checknamessection(message, DNS_SECTION_AUTHORITY);
7190 	checknamessection(message, DNS_SECTION_ADDITIONAL);
7191 }
7192 
7193 /*
7194  * Log server NSID at log level 'level'
7195  */
7196 static void
7197 log_nsid(isc_buffer_t *opt, size_t nsid_len, resquery_t *query, int level,
7198 	 isc_mem_t *mctx) {
7199 	static const char hex[17] = "0123456789abcdef";
7200 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
7201 	size_t buflen;
7202 	unsigned char *p, *nsid;
7203 	unsigned char *buf = NULL, *pbuf = NULL;
7204 
7205 	REQUIRE(nsid_len <= UINT16_MAX);
7206 
7207 	/* Allocate buffer for storing hex version of the NSID */
7208 	buflen = nsid_len * 2 + 1;
7209 	buf = isc_mem_get(mctx, buflen);
7210 	pbuf = isc_mem_get(mctx, nsid_len + 1);
7211 
7212 	/* Convert to hex */
7213 	p = buf;
7214 	nsid = isc_buffer_current(opt);
7215 	for (size_t i = 0; i < nsid_len; i++) {
7216 		*p++ = hex[(nsid[i] >> 4) & 0xf];
7217 		*p++ = hex[nsid[i] & 0xf];
7218 	}
7219 	*p = '\0';
7220 
7221 	/* Make printable version */
7222 	p = pbuf;
7223 	for (size_t i = 0; i < nsid_len; i++) {
7224 		*p++ = isprint(nsid[i]) ? nsid[i] : '.';
7225 	}
7226 	*p = '\0';
7227 
7228 	isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
7229 			    sizeof(addrbuf));
7230 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_NSID, DNS_LOGMODULE_RESOLVER,
7231 		      level, "received NSID %s (\"%s\") from %s", buf, pbuf,
7232 		      addrbuf);
7233 
7234 	isc_mem_put(mctx, pbuf, nsid_len + 1);
7235 	isc_mem_put(mctx, buf, buflen);
7236 }
7237 
7238 static bool
7239 iscname(dns_message_t *message, dns_name_t *name) {
7240 	isc_result_t result;
7241 
7242 	result = dns_message_findname(message, DNS_SECTION_ANSWER, name,
7243 				      dns_rdatatype_cname, 0, NULL, NULL);
7244 	return result == ISC_R_SUCCESS ? true : false;
7245 }
7246 
7247 static bool
7248 betterreferral(respctx_t *rctx) {
7249 	isc_result_t result;
7250 	dns_name_t *name;
7251 	dns_rdataset_t *rdataset;
7252 
7253 	for (result = dns_message_firstname(rctx->query->rmessage,
7254 					    DNS_SECTION_AUTHORITY);
7255 	     result == ISC_R_SUCCESS;
7256 	     result = dns_message_nextname(rctx->query->rmessage,
7257 					   DNS_SECTION_AUTHORITY))
7258 	{
7259 		name = NULL;
7260 		dns_message_currentname(rctx->query->rmessage,
7261 					DNS_SECTION_AUTHORITY, &name);
7262 		if (!isstrictsubdomain(name, rctx->fctx->domain)) {
7263 			continue;
7264 		}
7265 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
7266 		     rdataset = ISC_LIST_NEXT(rdataset, link))
7267 		{
7268 			if (rdataset->type == dns_rdatatype_ns) {
7269 				return true;
7270 			}
7271 		}
7272 	}
7273 	return false;
7274 }
7275 
7276 /*
7277  * Handles responses received in response to iterative queries sent by
7278  * resquery_send(). Sets up a response context (respctx_t).
7279  */
7280 static void
7281 resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
7282 	isc_result_t result;
7283 	resquery_t *query = (resquery_t *)arg;
7284 	fetchctx_t *fctx = NULL;
7285 	respctx_t *rctx = NULL;
7286 
7287 	if (eresult == ISC_R_CANCELED) {
7288 		return;
7289 	}
7290 
7291 	REQUIRE(VALID_QUERY(query));
7292 	fctx = query->fctx;
7293 	REQUIRE(VALID_FCTX(fctx));
7294 	REQUIRE(fctx->tid == isc_tid());
7295 
7296 	QTRACE("response");
7297 
7298 	if (isc_sockaddr_pf(&query->addrinfo->sockaddr) == PF_INET) {
7299 		inc_stats(fctx->res, dns_resstatscounter_responsev4);
7300 	} else {
7301 		inc_stats(fctx->res, dns_resstatscounter_responsev6);
7302 	}
7303 
7304 	rctx = isc_mem_get(fctx->mctx, sizeof(*rctx));
7305 	rctx_respinit(query, fctx, eresult, region, rctx);
7306 
7307 	if (eresult == ISC_R_SHUTTINGDOWN ||
7308 	    atomic_load_acquire(&fctx->res->exiting))
7309 	{
7310 		result = ISC_R_SHUTTINGDOWN;
7311 		FCTXTRACE("resolver shutting down");
7312 		rctx->finish = NULL;
7313 		rctx_done(rctx, result);
7314 		goto cleanup;
7315 	}
7316 
7317 	result = rctx_timedout(rctx);
7318 	if (result == ISC_R_COMPLETE) {
7319 		goto cleanup;
7320 	}
7321 
7322 	fctx->addrinfo = query->addrinfo;
7323 	fctx->timeout = false;
7324 	fctx->timeouts = 0;
7325 
7326 	/*
7327 	 * Check whether the dispatcher has failed; if so we're done
7328 	 */
7329 	result = rctx_dispfail(rctx);
7330 	if (result == ISC_R_COMPLETE) {
7331 		goto cleanup;
7332 	}
7333 
7334 	if (query->tsig != NULL) {
7335 		dns_message_setquerytsig(query->rmessage, query->tsig);
7336 	}
7337 
7338 	if (query->tsigkey != NULL) {
7339 		result = dns_message_settsigkey(query->rmessage,
7340 						query->tsigkey);
7341 		if (result != ISC_R_SUCCESS) {
7342 			FCTXTRACE3("unable to set tsig key", result);
7343 			rctx_done(rctx, result);
7344 			goto cleanup;
7345 		}
7346 	}
7347 
7348 	dns_message_setclass(query->rmessage, fctx->res->rdclass);
7349 
7350 	if ((rctx->retryopts & DNS_FETCHOPT_TCP) == 0) {
7351 		if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) {
7352 			dns_adb_setudpsize(
7353 				fctx->adb, query->addrinfo,
7354 				isc_buffer_usedlength(&rctx->buffer));
7355 		} else {
7356 			dns_adb_plainresponse(fctx->adb, query->addrinfo);
7357 		}
7358 	}
7359 
7360 	/*
7361 	 * Parse response message.
7362 	 */
7363 	result = rctx_parse(rctx);
7364 	if (result == ISC_R_COMPLETE) {
7365 		goto cleanup;
7366 	}
7367 
7368 	/*
7369 	 * Log the incoming packet.
7370 	 */
7371 	rctx_logpacket(rctx);
7372 
7373 	if (query->rmessage->rdclass != fctx->res->rdclass) {
7374 		rctx->resend = true;
7375 		FCTXTRACE("bad class");
7376 		rctx_done(rctx, result);
7377 		goto cleanup;
7378 	}
7379 
7380 	/*
7381 	 * Process receive opt record.
7382 	 */
7383 	rctx->opt = dns_message_getopt(query->rmessage);
7384 	if (rctx->opt != NULL) {
7385 		rctx_opt(rctx);
7386 	}
7387 
7388 	if (query->rmessage->cc_bad &&
7389 	    (rctx->retryopts & DNS_FETCHOPT_TCP) == 0)
7390 	{
7391 		/*
7392 		 * If the COOKIE is bad, assume it is an attack and
7393 		 * keep listening for a good answer.
7394 		 */
7395 		rctx->nextitem = true;
7396 		if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) {
7397 			char addrbuf[ISC_SOCKADDR_FORMATSIZE];
7398 			isc_sockaddr_format(&query->addrinfo->sockaddr, addrbuf,
7399 					    sizeof(addrbuf));
7400 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
7401 				      DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
7402 				      "bad cookie from %s", addrbuf);
7403 		}
7404 		rctx_done(rctx, result);
7405 		goto cleanup;
7406 	}
7407 
7408 	/*
7409 	 * Is the question the same as the one we asked?
7410 	 * NOERROR/NXDOMAIN/YXDOMAIN/REFUSED/SERVFAIL/BADCOOKIE must
7411 	 * have the same question. FORMERR/NOTIMP if they have a
7412 	 * question section then it must match.
7413 	 */
7414 	switch (query->rmessage->rcode) {
7415 	case dns_rcode_notimp:
7416 	case dns_rcode_formerr:
7417 		if (query->rmessage->counts[DNS_SECTION_QUESTION] == 0) {
7418 			break;
7419 		}
7420 		FALLTHROUGH;
7421 	case dns_rcode_nxrrset: /* Not expected. */
7422 	case dns_rcode_badcookie:
7423 	case dns_rcode_noerror:
7424 	case dns_rcode_nxdomain:
7425 	case dns_rcode_yxdomain:
7426 	case dns_rcode_refused:
7427 	case dns_rcode_servfail:
7428 	default:
7429 		result = same_question(fctx, query->rmessage);
7430 		if (result != ISC_R_SUCCESS) {
7431 			FCTXTRACE3("question section invalid", result);
7432 			rctx->nextitem = true;
7433 			rctx_done(rctx, result);
7434 			goto cleanup;
7435 		}
7436 		break;
7437 	}
7438 
7439 	if (query->rmessage->tsigkey == NULL && query->rmessage->tsig == NULL &&
7440 	    query->rmessage->sig0 != NULL)
7441 	{
7442 		/*
7443 		 * If the message is not TSIG-signed (which has priorty) and is
7444 		 * SIG(0)-signed (which consumes more resources), then run an
7445 		 * asynchronous check.
7446 		 */
7447 		result = dns_message_checksig_async(
7448 			query->rmessage, fctx->res->view, fctx->loop,
7449 			resquery_response_continue, rctx);
7450 		INSIST(result == DNS_R_WAIT);
7451 	} else {
7452 		/*
7453 		 * If the message is signed, check the signature.  If not, this
7454 		 * returns success anyway.
7455 		 */
7456 		result = dns_message_checksig(query->rmessage, fctx->res->view);
7457 		resquery_response_continue(rctx, result);
7458 	}
7459 
7460 	return;
7461 
7462 cleanup:
7463 	isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx));
7464 }
7465 
7466 static void
7467 resquery_response_continue(void *arg, isc_result_t result) {
7468 	respctx_t *rctx = arg;
7469 	fetchctx_t *fctx = rctx->fctx;
7470 	resquery_t *query = rctx->query;
7471 
7472 	if (result != ISC_R_SUCCESS) {
7473 		FCTXTRACE3("signature check failed", result);
7474 		if (result == DNS_R_UNEXPECTEDTSIG ||
7475 		    result == DNS_R_EXPECTEDTSIG)
7476 		{
7477 			rctx->nextitem = true;
7478 		}
7479 		rctx_done(rctx, result);
7480 		goto cleanup;
7481 	}
7482 
7483 	/*
7484 	 * The dispatcher should ensure we only get responses with QR
7485 	 * set.
7486 	 */
7487 	INSIST((query->rmessage->flags & DNS_MESSAGEFLAG_QR) != 0);
7488 
7489 	/*
7490 	 * If we have had a server cookie and don't get one retry over
7491 	 * TCP. This may be a misconfigured anycast server or an attempt
7492 	 * to send a spoofed response.  Additionally retry over TCP if
7493 	 * require-cookie is true and we don't have a got client cookie.
7494 	 * Skip if we have a valid TSIG.
7495 	 */
7496 	if (dns_message_gettsig(query->rmessage, NULL) == NULL &&
7497 	    !query->rmessage->cc_ok && !query->rmessage->cc_bad &&
7498 	    (rctx->retryopts & DNS_FETCHOPT_TCP) == 0)
7499 	{
7500 		if (dns_adb_getcookie(query->addrinfo, NULL, 0) >
7501 		    CLIENT_COOKIE_SIZE)
7502 		{
7503 			if (isc_log_wouldlog(dns_lctx, ISC_LOG_INFO)) {
7504 				char addrbuf[ISC_SOCKADDR_FORMATSIZE];
7505 				isc_sockaddr_format(&query->addrinfo->sockaddr,
7506 						    addrbuf, sizeof(addrbuf));
7507 				isc_log_write(
7508 					dns_lctx, DNS_LOGCATEGORY_RESOLVER,
7509 					DNS_LOGMODULE_RESOLVER, ISC_LOG_INFO,
7510 					"missing expected cookie "
7511 					"from %s",
7512 					addrbuf);
7513 			}
7514 			rctx->retryopts |= DNS_FETCHOPT_TCP;
7515 			rctx->resend = true;
7516 			rctx_done(rctx, result);
7517 			goto cleanup;
7518 		} else if (fctx->res->view->peers != NULL) {
7519 			dns_peer_t *peer = NULL;
7520 			isc_netaddr_t netaddr;
7521 			isc_netaddr_fromsockaddr(&netaddr,
7522 						 &query->addrinfo->sockaddr);
7523 			result = dns_peerlist_peerbyaddr(fctx->res->view->peers,
7524 							 &netaddr, &peer);
7525 			if (result == ISC_R_SUCCESS) {
7526 				bool required = false;
7527 				result = dns_peer_getrequirecookie(peer,
7528 								   &required);
7529 				if (result == ISC_R_SUCCESS && required) {
7530 					if (isc_log_wouldlog(dns_lctx,
7531 							     ISC_LOG_INFO))
7532 					{
7533 						char addrbuf
7534 							[ISC_SOCKADDR_FORMATSIZE];
7535 						isc_sockaddr_format(
7536 							&query->addrinfo
7537 								 ->sockaddr,
7538 							addrbuf,
7539 							sizeof(addrbuf));
7540 						isc_log_write(
7541 							dns_lctx,
7542 							DNS_LOGCATEGORY_RESOLVER,
7543 							DNS_LOGMODULE_RESOLVER,
7544 							ISC_LOG_INFO,
7545 							"missing required "
7546 							"cookie "
7547 							"from %s",
7548 							addrbuf);
7549 					}
7550 					rctx->retryopts |= DNS_FETCHOPT_TCP;
7551 					rctx->resend = true;
7552 					rctx_done(rctx, result);
7553 					goto cleanup;
7554 				}
7555 			}
7556 		}
7557 	}
7558 
7559 	rctx_edns(rctx);
7560 
7561 	/*
7562 	 * Deal with truncated responses by retrying using TCP.
7563 	 */
7564 	if ((query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0) {
7565 		rctx->truncated = true;
7566 	}
7567 
7568 	if (rctx->truncated) {
7569 		inc_stats(fctx->res, dns_resstatscounter_truncated);
7570 		if ((rctx->retryopts & DNS_FETCHOPT_TCP) != 0) {
7571 			rctx->broken_server = DNS_R_TRUNCATEDTCP;
7572 			rctx->next_server = true;
7573 		} else {
7574 			rctx->retryopts |= DNS_FETCHOPT_TCP;
7575 			rctx->resend = true;
7576 		}
7577 		FCTXTRACE3("message truncated", result);
7578 		rctx_done(rctx, result);
7579 		goto cleanup;
7580 	}
7581 
7582 	/*
7583 	 * Is it a query response?
7584 	 */
7585 	if (query->rmessage->opcode != dns_opcode_query) {
7586 		rctx->broken_server = DNS_R_UNEXPECTEDOPCODE;
7587 		rctx->next_server = true;
7588 		FCTXTRACE("invalid message opcode");
7589 		rctx_done(rctx, result);
7590 		goto cleanup;
7591 	}
7592 
7593 	/*
7594 	 * Update statistics about erroneous responses.
7595 	 */
7596 	switch (query->rmessage->rcode) {
7597 	case dns_rcode_noerror:
7598 		/* no error */
7599 		break;
7600 	case dns_rcode_nxdomain:
7601 		inc_stats(fctx->res, dns_resstatscounter_nxdomain);
7602 		break;
7603 	case dns_rcode_servfail:
7604 		inc_stats(fctx->res, dns_resstatscounter_servfail);
7605 		break;
7606 	case dns_rcode_formerr:
7607 		inc_stats(fctx->res, dns_resstatscounter_formerr);
7608 		break;
7609 	case dns_rcode_refused:
7610 		inc_stats(fctx->res, dns_resstatscounter_refused);
7611 		break;
7612 	case dns_rcode_badvers:
7613 		inc_stats(fctx->res, dns_resstatscounter_badvers);
7614 		break;
7615 	case dns_rcode_badcookie:
7616 		inc_stats(fctx->res, dns_resstatscounter_badcookie);
7617 		break;
7618 	default:
7619 		inc_stats(fctx->res, dns_resstatscounter_othererror);
7620 		break;
7621 	}
7622 
7623 	/*
7624 	 * Bad server?
7625 	 */
7626 	result = rctx_badserver(rctx, result);
7627 	if (result == ISC_R_COMPLETE) {
7628 		goto cleanup;
7629 	}
7630 
7631 	/*
7632 	 * Lame server?
7633 	 */
7634 	result = rctx_lameserver(rctx);
7635 	if (result == ISC_R_COMPLETE) {
7636 		goto cleanup;
7637 	}
7638 
7639 	/*
7640 	 * Optionally call dns_rdata_checkowner() and
7641 	 * dns_rdata_checknames() to validate the names in the response
7642 	 * message.
7643 	 */
7644 	if ((fctx->res->options & DNS_RESOLVER_CHECKNAMES) != 0) {
7645 		checknames(query->rmessage);
7646 	}
7647 
7648 	/*
7649 	 * Clear cache bits.
7650 	 */
7651 	FCTX_ATTR_CLR(fctx, (FCTX_ATTR_WANTNCACHE | FCTX_ATTR_WANTCACHE));
7652 
7653 	/*
7654 	 * Did we get any answers?
7655 	 */
7656 	if (query->rmessage->counts[DNS_SECTION_ANSWER] > 0 &&
7657 	    (query->rmessage->rcode == dns_rcode_noerror ||
7658 	     query->rmessage->rcode == dns_rcode_yxdomain ||
7659 	     query->rmessage->rcode == dns_rcode_nxdomain))
7660 	{
7661 		result = rctx_answer(rctx);
7662 		if (result == ISC_R_COMPLETE) {
7663 			goto cleanup;
7664 		}
7665 	} else if (query->rmessage->counts[DNS_SECTION_AUTHORITY] > 0 ||
7666 		   query->rmessage->rcode == dns_rcode_noerror ||
7667 		   query->rmessage->rcode == dns_rcode_nxdomain)
7668 	{
7669 		/*
7670 		 * This might be an NXDOMAIN, NXRRSET, or referral.
7671 		 * Call rctx_answer_none() to determine which it is.
7672 		 */
7673 		result = rctx_answer_none(rctx);
7674 		switch (result) {
7675 		case ISC_R_SUCCESS:
7676 		case DNS_R_CHASEDSSERVERS:
7677 			break;
7678 		case DNS_R_DELEGATION:
7679 			/*
7680 			 * With NOFOLLOW we want to pass return
7681 			 * DNS_R_DELEGATION to resume_qmin.
7682 			 */
7683 			if ((fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) {
7684 				result = ISC_R_SUCCESS;
7685 			}
7686 			break;
7687 		default:
7688 			/*
7689 			 * Something has gone wrong.
7690 			 */
7691 			if (result == DNS_R_FORMERR) {
7692 				rctx->next_server = true;
7693 			}
7694 			FCTXTRACE3("rctx_answer_none", result);
7695 			rctx_done(rctx, result);
7696 			goto cleanup;
7697 		}
7698 	} else {
7699 		/*
7700 		 * The server is insane.
7701 		 */
7702 		/* XXXRTH Log */
7703 		rctx->broken_server = DNS_R_UNEXPECTEDRCODE;
7704 		rctx->next_server = true;
7705 		FCTXTRACE("broken server: unexpected rcode");
7706 		rctx_done(rctx, result);
7707 		goto cleanup;
7708 	}
7709 
7710 	/*
7711 	 * Follow additional section data chains.
7712 	 */
7713 	rctx_additional(rctx);
7714 
7715 	/*
7716 	 * Cache the cacheable parts of the message.  This may also
7717 	 * cause work to be queued to the DNSSEC validator.
7718 	 */
7719 	if (WANTCACHE(fctx)) {
7720 		isc_result_t tresult;
7721 		tresult = cache_message(fctx, query->rmessage, query->addrinfo,
7722 					rctx->now);
7723 		if (tresult != ISC_R_SUCCESS) {
7724 			FCTXTRACE3("cache_message complete", tresult);
7725 			rctx_done(rctx, tresult);
7726 			goto cleanup;
7727 		}
7728 	}
7729 
7730 	/*
7731 	 * Negative caching
7732 	 */
7733 	rctx_ncache(rctx);
7734 
7735 	FCTXTRACE("resquery_response done");
7736 	rctx_done(rctx, result);
7737 
7738 cleanup:
7739 	isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx));
7740 }
7741 
7742 /*
7743  * rctx_respinit():
7744  * Initialize the response context structure 'rctx' to all zeroes, then
7745  * set the loop, event, query and fctx information from
7746  * resquery_response().
7747  */
7748 static void
7749 rctx_respinit(resquery_t *query, fetchctx_t *fctx, isc_result_t result,
7750 	      isc_region_t *region, respctx_t *rctx) {
7751 	*rctx = (respctx_t){ .result = result,
7752 			     .query = query,
7753 			     .fctx = fctx,
7754 			     .broken_type = badns_response,
7755 			     .retryopts = query->options };
7756 	if (result == ISC_R_SUCCESS) {
7757 		REQUIRE(region != NULL);
7758 		isc_buffer_init(&rctx->buffer, region->base, region->length);
7759 		isc_buffer_add(&rctx->buffer, region->length);
7760 	} else {
7761 		isc_buffer_initnull(&rctx->buffer);
7762 	}
7763 	rctx->tnow = isc_time_now();
7764 	rctx->finish = &rctx->tnow;
7765 	rctx->now = (isc_stdtime_t)isc_time_seconds(&rctx->tnow);
7766 	isc_mem_attach(fctx->mctx, &rctx->mctx);
7767 }
7768 
7769 /*
7770  * rctx_answer_init():
7771  * Clear and reinitialize those portions of 'rctx' that will be needed
7772  * when scanning the answer section of the response message. This can be
7773  * called more than once if scanning needs to be restarted (though
7774  * currently there are no cases in which this occurs).
7775  */
7776 static void
7777 rctx_answer_init(respctx_t *rctx) {
7778 	fetchctx_t *fctx = rctx->fctx;
7779 
7780 	rctx->aa = ((rctx->query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0);
7781 	if (rctx->aa) {
7782 		rctx->trust = dns_trust_authanswer;
7783 	} else {
7784 		rctx->trust = dns_trust_answer;
7785 	}
7786 
7787 	/*
7788 	 * There can be multiple RRSIG and SIG records at a name so
7789 	 * we treat these types as a subset of ANY.
7790 	 */
7791 	rctx->type = fctx->type;
7792 	if (rctx->type == dns_rdatatype_rrsig ||
7793 	    rctx->type == dns_rdatatype_sig)
7794 	{
7795 		rctx->type = dns_rdatatype_any;
7796 	}
7797 
7798 	/*
7799 	 * Bigger than any valid DNAME label count.
7800 	 */
7801 	rctx->dname_labels = dns_name_countlabels(fctx->name);
7802 	rctx->domain_labels = dns_name_countlabels(fctx->domain);
7803 
7804 	rctx->found_type = dns_rdatatype_none;
7805 
7806 	rctx->aname = NULL;
7807 	rctx->ardataset = NULL;
7808 
7809 	rctx->cname = NULL;
7810 	rctx->crdataset = NULL;
7811 
7812 	rctx->dname = NULL;
7813 	rctx->drdataset = NULL;
7814 
7815 	rctx->ns_name = NULL;
7816 	rctx->ns_rdataset = NULL;
7817 
7818 	rctx->soa_name = NULL;
7819 	rctx->ds_name = NULL;
7820 	rctx->found_name = NULL;
7821 }
7822 
7823 /*
7824  * rctx_dispfail():
7825  * Handle the case where the dispatcher failed
7826  */
7827 static isc_result_t
7828 rctx_dispfail(respctx_t *rctx) {
7829 	fetchctx_t *fctx = rctx->fctx;
7830 
7831 	if (rctx->result == ISC_R_SUCCESS) {
7832 		return ISC_R_SUCCESS;
7833 	}
7834 
7835 	/*
7836 	 * There's no hope for this response.
7837 	 */
7838 	rctx->next_server = true;
7839 
7840 	/*
7841 	 * If this is a network failure, the operation is cancelled,
7842 	 * or the network manager is being shut down, we mark the server
7843 	 * as bad so that we won't try it for this fetch again. Also
7844 	 * adjust finish and no_response so that we penalize this
7845 	 * address in SRTT adjustments later.
7846 	 */
7847 	switch (rctx->result) {
7848 	case ISC_R_EOF:
7849 	case ISC_R_HOSTDOWN:
7850 	case ISC_R_HOSTUNREACH:
7851 	case ISC_R_NETDOWN:
7852 	case ISC_R_NETUNREACH:
7853 	case ISC_R_CONNREFUSED:
7854 	case ISC_R_CONNECTIONRESET:
7855 	case ISC_R_INVALIDPROTO:
7856 	case ISC_R_CANCELED:
7857 	case ISC_R_SHUTTINGDOWN:
7858 		rctx->broken_server = rctx->result;
7859 		rctx->broken_type = badns_unreachable;
7860 		rctx->finish = NULL;
7861 		rctx->no_response = true;
7862 		break;
7863 	default:
7864 		break;
7865 	}
7866 
7867 	FCTXTRACE3("dispatcher failure", rctx->result);
7868 	rctx_done(rctx, ISC_R_SUCCESS);
7869 	return ISC_R_COMPLETE;
7870 }
7871 
7872 /*
7873  * rctx_timedout():
7874  * Handle the case where a dispatch read timed out.
7875  */
7876 static isc_result_t
7877 rctx_timedout(respctx_t *rctx) {
7878 	fetchctx_t *fctx = rctx->fctx;
7879 
7880 	if (rctx->result == ISC_R_TIMEDOUT) {
7881 		isc_time_t now;
7882 
7883 		inc_stats(fctx->res, dns_resstatscounter_querytimeout);
7884 		FCTX_ATTR_CLR(fctx, FCTX_ATTR_ADDRWAIT);
7885 		fctx->timeout = true;
7886 		fctx->timeouts++;
7887 
7888 		now = isc_time_now();
7889 		/* netmgr timeouts are accurate to the millisecond */
7890 		if (isc_time_microdiff(&fctx->expires, &now) < US_PER_MS) {
7891 			FCTXTRACE("query timed out; stopped trying to make "
7892 				  "fetch happen");
7893 		} else {
7894 			FCTXTRACE("query timed out; trying next server");
7895 			/* try next server */
7896 			rctx->no_response = true;
7897 			rctx->finish = NULL;
7898 			rctx->next_server = true;
7899 		}
7900 
7901 		rctx_done(rctx, rctx->result);
7902 		return ISC_R_COMPLETE;
7903 	}
7904 
7905 	return ISC_R_SUCCESS;
7906 }
7907 
7908 /*
7909  * rctx_parse():
7910  * Parse the response message.
7911  */
7912 static isc_result_t
7913 rctx_parse(respctx_t *rctx) {
7914 	isc_result_t result;
7915 	fetchctx_t *fctx = rctx->fctx;
7916 	resquery_t *query = rctx->query;
7917 
7918 	result = dns_message_parse(query->rmessage, &rctx->buffer, 0);
7919 	if (result == ISC_R_SUCCESS) {
7920 		return ISC_R_SUCCESS;
7921 	}
7922 
7923 	FCTXTRACE3("message failed to parse", result);
7924 
7925 	switch (result) {
7926 	case ISC_R_UNEXPECTEDEND:
7927 		if (query->rmessage->question_ok &&
7928 		    (query->rmessage->flags & DNS_MESSAGEFLAG_TC) != 0 &&
7929 		    (rctx->retryopts & DNS_FETCHOPT_TCP) == 0)
7930 		{
7931 			/*
7932 			 * We defer retrying via TCP for a bit so we can
7933 			 * check out this message further.
7934 			 */
7935 			rctx->truncated = true;
7936 			return ISC_R_SUCCESS;
7937 		}
7938 
7939 		/*
7940 		 * Either the message ended prematurely,
7941 		 * and/or wasn't marked as being truncated,
7942 		 * and/or this is a response to a query we
7943 		 * sent over TCP.  In all of these cases,
7944 		 * something is wrong with the remote
7945 		 * server and we don't want to retry using
7946 		 * TCP.
7947 		 */
7948 		if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) {
7949 			/*
7950 			 * The problem might be that they
7951 			 * don't understand EDNS0.  Turn it
7952 			 * off and try again.
7953 			 */
7954 			rctx->retryopts |= DNS_FETCHOPT_NOEDNS0;
7955 			rctx->resend = true;
7956 			add_bad_edns(fctx, &query->addrinfo->sockaddr);
7957 			inc_stats(fctx->res, dns_resstatscounter_edns0fail);
7958 		} else {
7959 			rctx->broken_server = result;
7960 			rctx->next_server = true;
7961 		}
7962 
7963 		rctx_done(rctx, result);
7964 		break;
7965 	case DNS_R_FORMERR:
7966 		if ((rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0) {
7967 			/*
7968 			 * The problem might be that they
7969 			 * don't understand EDNS0.  Turn it
7970 			 * off and try again.
7971 			 */
7972 			rctx->retryopts |= DNS_FETCHOPT_NOEDNS0;
7973 			rctx->resend = true;
7974 			add_bad_edns(fctx, &query->addrinfo->sockaddr);
7975 			inc_stats(fctx->res, dns_resstatscounter_edns0fail);
7976 		} else {
7977 			rctx->broken_server = DNS_R_UNEXPECTEDRCODE;
7978 			rctx->next_server = true;
7979 		}
7980 
7981 		rctx_done(rctx, result);
7982 		break;
7983 	default:
7984 		/*
7985 		 * Something bad has happened.
7986 		 */
7987 		rctx_done(rctx, result);
7988 		break;
7989 	}
7990 
7991 	return ISC_R_COMPLETE;
7992 }
7993 
7994 /*
7995  * rctx_opt():
7996  * Process the OPT record in the response.
7997  */
7998 static void
7999 rctx_opt(respctx_t *rctx) {
8000 	resquery_t *query = rctx->query;
8001 	fetchctx_t *fctx = rctx->fctx;
8002 	dns_rdata_t rdata;
8003 	isc_buffer_t optbuf;
8004 	isc_result_t result;
8005 	bool seen_cookie = false;
8006 	bool seen_nsid = false;
8007 
8008 	result = dns_rdataset_first(rctx->opt);
8009 	if (result != ISC_R_SUCCESS) {
8010 		return;
8011 	}
8012 
8013 	dns_rdata_init(&rdata);
8014 	dns_rdataset_current(rctx->opt, &rdata);
8015 	isc_buffer_init(&optbuf, rdata.data, rdata.length);
8016 	isc_buffer_add(&optbuf, rdata.length);
8017 
8018 	while (isc_buffer_remaininglength(&optbuf) >= 4) {
8019 		uint16_t optcode;
8020 		uint16_t optlen;
8021 		unsigned char *optvalue;
8022 		unsigned char cookie[CLIENT_COOKIE_SIZE];
8023 		optcode = isc_buffer_getuint16(&optbuf);
8024 		optlen = isc_buffer_getuint16(&optbuf);
8025 		INSIST(optlen <= isc_buffer_remaininglength(&optbuf));
8026 		switch (optcode) {
8027 		case DNS_OPT_NSID:
8028 			if (seen_nsid) {
8029 				break;
8030 			}
8031 			seen_nsid = true;
8032 
8033 			if ((query->options & DNS_FETCHOPT_WANTNSID) != 0) {
8034 				log_nsid(&optbuf, optlen, query, ISC_LOG_INFO,
8035 					 fctx->mctx);
8036 			}
8037 			break;
8038 		case DNS_OPT_COOKIE:
8039 			/* Only process the first cookie option. */
8040 			if (seen_cookie) {
8041 				break;
8042 			}
8043 			seen_cookie = true;
8044 
8045 			optvalue = isc_buffer_current(&optbuf);
8046 			compute_cc(query, cookie, sizeof(cookie));
8047 			INSIST(query->rmessage->cc_bad == 0 &&
8048 			       query->rmessage->cc_ok == 0);
8049 
8050 			inc_stats(fctx->res, dns_resstatscounter_cookiein);
8051 
8052 			if (optlen < CLIENT_COOKIE_SIZE ||
8053 			    memcmp(cookie, optvalue, CLIENT_COOKIE_SIZE) != 0)
8054 			{
8055 				query->rmessage->cc_bad = 1;
8056 				break;
8057 			}
8058 
8059 			/* Cookie OK */
8060 			if (optlen == CLIENT_COOKIE_SIZE) {
8061 				query->rmessage->cc_echoed = 1;
8062 			} else {
8063 				query->rmessage->cc_ok = 1;
8064 				inc_stats(fctx->res,
8065 					  dns_resstatscounter_cookieok);
8066 				dns_adb_setcookie(fctx->adb, query->addrinfo,
8067 						  optvalue, optlen);
8068 			}
8069 			break;
8070 		default:
8071 			break;
8072 		}
8073 		isc_buffer_forward(&optbuf, optlen);
8074 	}
8075 	INSIST(isc_buffer_remaininglength(&optbuf) == 0U);
8076 }
8077 
8078 /*
8079  * rctx_edns():
8080  * Determine whether the remote server is using EDNS correctly or
8081  * incorrectly and record that information if needed.
8082  */
8083 static void
8084 rctx_edns(respctx_t *rctx) {
8085 	resquery_t *query = rctx->query;
8086 	fetchctx_t *fctx = rctx->fctx;
8087 
8088 	/*
8089 	 * We have an affirmative response to the query and we have
8090 	 * previously got a response from this server which indicated
8091 	 * EDNS may not be supported so we can now cache the lack of
8092 	 * EDNS support.
8093 	 */
8094 	if (rctx->opt == NULL && !EDNSOK(query->addrinfo) &&
8095 	    (query->rmessage->rcode == dns_rcode_noerror ||
8096 	     query->rmessage->rcode == dns_rcode_nxdomain ||
8097 	     query->rmessage->rcode == dns_rcode_refused ||
8098 	     query->rmessage->rcode == dns_rcode_yxdomain) &&
8099 	    bad_edns(fctx, &query->addrinfo->sockaddr))
8100 	{
8101 		dns_message_logpacket(
8102 			query->rmessage, "received packet (bad edns) from",
8103 			&query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
8104 			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx);
8105 		dns_adb_changeflags(fctx->adb, query->addrinfo,
8106 				    FCTX_ADDRINFO_NOEDNS0,
8107 				    FCTX_ADDRINFO_NOEDNS0);
8108 	} else if (rctx->opt == NULL &&
8109 		   (query->rmessage->flags & DNS_MESSAGEFLAG_TC) == 0 &&
8110 		   !EDNSOK(query->addrinfo) &&
8111 		   (query->rmessage->rcode == dns_rcode_noerror ||
8112 		    query->rmessage->rcode == dns_rcode_nxdomain) &&
8113 		   (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0)
8114 	{
8115 		/*
8116 		 * We didn't get a OPT record in response to a EDNS
8117 		 * query.
8118 		 *
8119 		 * Old versions of named incorrectly drop the OPT record
8120 		 * when there is a signed, truncated response so we
8121 		 * check that TC is not set.
8122 		 *
8123 		 * Record that the server is not talking EDNS.  While
8124 		 * this should be safe to do for any rcode we limit it
8125 		 * to NOERROR and NXDOMAIN.
8126 		 */
8127 		dns_message_logpacket(
8128 			query->rmessage, "received packet (no opt) from",
8129 			&query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
8130 			DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3), fctx->mctx);
8131 		dns_adb_changeflags(fctx->adb, query->addrinfo,
8132 				    FCTX_ADDRINFO_NOEDNS0,
8133 				    FCTX_ADDRINFO_NOEDNS0);
8134 	}
8135 
8136 	/*
8137 	 * If we get a non error EDNS response record the fact so we
8138 	 * won't fallback to plain DNS in the future for this server.
8139 	 */
8140 	if (rctx->opt != NULL && !EDNSOK(query->addrinfo) &&
8141 	    (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0 &&
8142 	    (query->rmessage->rcode == dns_rcode_noerror ||
8143 	     query->rmessage->rcode == dns_rcode_nxdomain ||
8144 	     query->rmessage->rcode == dns_rcode_refused ||
8145 	     query->rmessage->rcode == dns_rcode_yxdomain))
8146 	{
8147 		dns_adb_changeflags(fctx->adb, query->addrinfo,
8148 				    FCTX_ADDRINFO_EDNSOK, FCTX_ADDRINFO_EDNSOK);
8149 	}
8150 }
8151 
8152 /*
8153  * rctx_answer():
8154  * We might have answers, or we might have a malformed delegation with
8155  * records in the answer section. Call rctx_answer_positive() or
8156  * rctx_answer_none() as appropriate.
8157  */
8158 static isc_result_t
8159 rctx_answer(respctx_t *rctx) {
8160 	isc_result_t result;
8161 	fetchctx_t *fctx = rctx->fctx;
8162 	resquery_t *query = rctx->query;
8163 
8164 	if ((query->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0 ||
8165 	    ISFORWARDER(query->addrinfo))
8166 	{
8167 		result = rctx_answer_positive(rctx);
8168 		if (result != ISC_R_SUCCESS) {
8169 			FCTXTRACE3("rctx_answer_positive (AA/fwd)", result);
8170 		}
8171 	} else if (iscname(query->rmessage, fctx->name) &&
8172 		   fctx->type != dns_rdatatype_any &&
8173 		   fctx->type != dns_rdatatype_cname)
8174 	{
8175 		/*
8176 		 * A BIND8 server could return a non-authoritative
8177 		 * answer when a CNAME is followed.  We should treat
8178 		 * it as a valid answer.
8179 		 */
8180 		result = rctx_answer_positive(rctx);
8181 		if (result != ISC_R_SUCCESS) {
8182 			FCTXTRACE3("rctx_answer_positive (!ANY/!CNAME)",
8183 				   result);
8184 		}
8185 	} else if (fctx->type != dns_rdatatype_ns && !betterreferral(rctx)) {
8186 		result = rctx_answer_positive(rctx);
8187 		if (result != ISC_R_SUCCESS) {
8188 			FCTXTRACE3("rctx_answer_positive (!NS)", result);
8189 		}
8190 	} else {
8191 		/*
8192 		 * This may be a delegation. First let's check for
8193 		 */
8194 
8195 		if (fctx->type == dns_rdatatype_ns) {
8196 			/*
8197 			 * A BIND 8 server could incorrectly return a
8198 			 * non-authoritative answer to an NS query
8199 			 * instead of a referral. Since this answer
8200 			 * lacks the SIGs necessary to do DNSSEC
8201 			 * validation, we must invoke the following
8202 			 * special kludge to treat it as a referral.
8203 			 */
8204 			rctx->ns_in_answer = true;
8205 			result = rctx_answer_none(rctx);
8206 			if (result != ISC_R_SUCCESS) {
8207 				FCTXTRACE3("rctx_answer_none (NS)", result);
8208 			}
8209 		} else {
8210 			/*
8211 			 * Some other servers may still somehow include
8212 			 * an answer when it should return a referral
8213 			 * with an empty answer.  Check to see if we can
8214 			 * treat this as a referral by ignoring the
8215 			 * answer.  Further more, there may be an
8216 			 * implementation that moves A/AAAA glue records
8217 			 * to the answer section for that type of
8218 			 * delegation when the query is for that glue
8219 			 * record. glue_in_answer will handle
8220 			 * such a corner case.
8221 			 */
8222 			rctx->glue_in_answer = true;
8223 			result = rctx_answer_none(rctx);
8224 			if (result != ISC_R_SUCCESS) {
8225 				FCTXTRACE3("rctx_answer_none", result);
8226 			}
8227 		}
8228 
8229 		if (result == DNS_R_DELEGATION) {
8230 			/*
8231 			 * With NOFOLLOW we want to return DNS_R_DELEGATION to
8232 			 * resume_qmin.
8233 			 */
8234 			if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) != 0)
8235 			{
8236 				return result;
8237 			}
8238 			result = ISC_R_SUCCESS;
8239 		} else {
8240 			/*
8241 			 * At this point, AA is not set, the response
8242 			 * is not a referral, and the server is not a
8243 			 * forwarder.  It is technically lame and it's
8244 			 * easier to treat it as such than to figure out
8245 			 * some more elaborate course of action.
8246 			 */
8247 			rctx->broken_server = DNS_R_LAME;
8248 			rctx->next_server = true;
8249 			FCTXTRACE3("rctx_answer lame", result);
8250 			rctx_done(rctx, result);
8251 			return ISC_R_COMPLETE;
8252 		}
8253 	}
8254 
8255 	if (result != ISC_R_SUCCESS) {
8256 		if (result == DNS_R_FORMERR) {
8257 			rctx->next_server = true;
8258 		}
8259 		FCTXTRACE3("rctx_answer failed", result);
8260 		rctx_done(rctx, result);
8261 		return ISC_R_COMPLETE;
8262 	}
8263 
8264 	return ISC_R_SUCCESS;
8265 }
8266 
8267 /*
8268  * rctx_answer_positive():
8269  * Handles positive responses. Depending which type of answer this is
8270  * (matching QNAME/QTYPE, CNAME, DNAME, ANY) calls the proper routine
8271  * to handle it (rctx_answer_match(), rctx_answer_cname(),
8272  * rctx_answer_dname(), rctx_answer_any()).
8273  */
8274 static isc_result_t
8275 rctx_answer_positive(respctx_t *rctx) {
8276 	isc_result_t result;
8277 	fetchctx_t *fctx = rctx->fctx;
8278 
8279 	FCTXTRACE("rctx_answer_positive");
8280 
8281 	rctx_answer_init(rctx);
8282 	rctx_answer_scan(rctx);
8283 
8284 	/*
8285 	 * Determine which type of positive answer this is:
8286 	 * type ANY, CNAME, DNAME, or an answer matching QNAME/QTYPE.
8287 	 * Call the appropriate routine to handle the answer type.
8288 	 */
8289 	if (rctx->aname != NULL && rctx->type == dns_rdatatype_any) {
8290 		result = rctx_answer_any(rctx);
8291 		if (result == ISC_R_COMPLETE) {
8292 			return rctx->result;
8293 		}
8294 	} else if (rctx->aname != NULL) {
8295 		result = rctx_answer_match(rctx);
8296 		if (result == ISC_R_COMPLETE) {
8297 			return rctx->result;
8298 		}
8299 	} else if (rctx->cname != NULL) {
8300 		result = rctx_answer_cname(rctx);
8301 		if (result == ISC_R_COMPLETE) {
8302 			return rctx->result;
8303 		}
8304 	} else if (rctx->dname != NULL) {
8305 		result = rctx_answer_dname(rctx);
8306 		if (result == ISC_R_COMPLETE) {
8307 			return rctx->result;
8308 		}
8309 	} else {
8310 		log_formerr(fctx, "reply has no answer");
8311 		return DNS_R_FORMERR;
8312 	}
8313 
8314 	/*
8315 	 * This response is now potentially cacheable.
8316 	 */
8317 	FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE);
8318 
8319 	/*
8320 	 * Did chaining end before we got the final answer?
8321 	 */
8322 	if (rctx->chaining) {
8323 		return ISC_R_SUCCESS;
8324 	}
8325 
8326 	/*
8327 	 * We didn't end with an incomplete chain, so the rcode should
8328 	 * be "no error".
8329 	 */
8330 	if (rctx->query->rmessage->rcode != dns_rcode_noerror) {
8331 		log_formerr(fctx, "CNAME/DNAME chain complete, but RCODE "
8332 				  "indicates error");
8333 		return DNS_R_FORMERR;
8334 	}
8335 
8336 	/*
8337 	 * Cache records in the authority section, if
8338 	 * there are any suitable for caching.
8339 	 */
8340 	rctx_authority_positive(rctx);
8341 
8342 	log_ns_ttl(fctx, "rctx_answer");
8343 
8344 	if (rctx->ns_rdataset != NULL &&
8345 	    dns_name_equal(fctx->domain, rctx->ns_name) &&
8346 	    !dns_name_equal(rctx->ns_name, dns_rootname))
8347 	{
8348 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
8349 	}
8350 
8351 	return ISC_R_SUCCESS;
8352 }
8353 
8354 /*
8355  * rctx_answer_scan():
8356  * Perform a single pass over the answer section of a response, looking
8357  * for an answer that matches QNAME/QTYPE, or a CNAME matching QNAME, or
8358  * a covering DNAME. If more than one rdataset is found matching these
8359  * criteria, then only one is kept. Order of preference is 1) the
8360  * shortest DNAME, 2) the first matching answer, or 3) the first CNAME.
8361  */
8362 static void
8363 rctx_answer_scan(respctx_t *rctx) {
8364 	isc_result_t result;
8365 	fetchctx_t *fctx = rctx->fctx;
8366 	dns_rdataset_t *rdataset = NULL;
8367 
8368 	for (result = dns_message_firstname(rctx->query->rmessage,
8369 					    DNS_SECTION_ANSWER);
8370 	     result == ISC_R_SUCCESS;
8371 	     result = dns_message_nextname(rctx->query->rmessage,
8372 					   DNS_SECTION_ANSWER))
8373 	{
8374 		int order;
8375 		unsigned int nlabels;
8376 		dns_namereln_t namereln;
8377 		dns_name_t *name = NULL;
8378 
8379 		dns_message_currentname(rctx->query->rmessage,
8380 					DNS_SECTION_ANSWER, &name);
8381 		namereln = dns_name_fullcompare(fctx->name, name, &order,
8382 						&nlabels);
8383 		switch (namereln) {
8384 		case dns_namereln_equal:
8385 			for (rdataset = ISC_LIST_HEAD(name->list);
8386 			     rdataset != NULL;
8387 			     rdataset = ISC_LIST_NEXT(rdataset, link))
8388 			{
8389 				if (rdataset->type == rctx->type ||
8390 				    rctx->type == dns_rdatatype_any)
8391 				{
8392 					rctx->aname = name;
8393 					if (rctx->type != dns_rdatatype_any) {
8394 						rctx->ardataset = rdataset;
8395 					}
8396 					break;
8397 				}
8398 				if (rdataset->type == dns_rdatatype_cname) {
8399 					rctx->cname = name;
8400 					rctx->crdataset = rdataset;
8401 					break;
8402 				}
8403 			}
8404 			break;
8405 
8406 		case dns_namereln_subdomain:
8407 			/*
8408 			 * Don't accept DNAME from parent namespace.
8409 			 */
8410 			if (name_external(name, dns_rdatatype_dname, fctx)) {
8411 				continue;
8412 			}
8413 
8414 			/*
8415 			 * In-scope DNAME records must have at least
8416 			 * as many labels as the domain being queried.
8417 			 * They also must be less that qname's labels
8418 			 * and any previously found dname.
8419 			 */
8420 			if (nlabels >= rctx->dname_labels ||
8421 			    nlabels < rctx->domain_labels)
8422 			{
8423 				continue;
8424 			}
8425 
8426 			/*
8427 			 * We are looking for the shortest DNAME if
8428 			 * there are multiple ones (which there
8429 			 * shouldn't be).
8430 			 */
8431 			for (rdataset = ISC_LIST_HEAD(name->list);
8432 			     rdataset != NULL;
8433 			     rdataset = ISC_LIST_NEXT(rdataset, link))
8434 			{
8435 				if (rdataset->type != dns_rdatatype_dname) {
8436 					continue;
8437 				}
8438 				rctx->dname = name;
8439 				rctx->drdataset = rdataset;
8440 				rctx->dname_labels = nlabels;
8441 				break;
8442 			}
8443 			break;
8444 		default:
8445 			break;
8446 		}
8447 	}
8448 
8449 	/*
8450 	 * If a DNAME was found, then any CNAME or other answer matching
8451 	 * QNAME that may also have been found must be ignored.
8452 	 * Similarly, if a matching answer was found along with a CNAME,
8453 	 * the CNAME must be ignored.
8454 	 */
8455 	if (rctx->dname != NULL) {
8456 		rctx->aname = NULL;
8457 		rctx->ardataset = NULL;
8458 		rctx->cname = NULL;
8459 		rctx->crdataset = NULL;
8460 	} else if (rctx->aname != NULL) {
8461 		rctx->cname = NULL;
8462 		rctx->crdataset = NULL;
8463 	}
8464 }
8465 
8466 /*
8467  * rctx_answer_any():
8468  * Handle responses to queries of type ANY. Scan the answer section,
8469  * and as long as each RRset is of a type that is valid in the answer
8470  * section, and the rdata isn't filtered, cache it.
8471  */
8472 static isc_result_t
8473 rctx_answer_any(respctx_t *rctx) {
8474 	dns_rdataset_t *rdataset = NULL;
8475 	fetchctx_t *fctx = rctx->fctx;
8476 
8477 	for (rdataset = ISC_LIST_HEAD(rctx->aname->list); rdataset != NULL;
8478 	     rdataset = ISC_LIST_NEXT(rdataset, link))
8479 	{
8480 		if (!validinanswer(rdataset, fctx)) {
8481 			rctx->result = DNS_R_FORMERR;
8482 			return ISC_R_COMPLETE;
8483 		}
8484 
8485 		if ((fctx->type == dns_rdatatype_sig ||
8486 		     fctx->type == dns_rdatatype_rrsig) &&
8487 		    rdataset->type != fctx->type)
8488 		{
8489 			continue;
8490 		}
8491 
8492 		if ((rdataset->type == dns_rdatatype_a ||
8493 		     rdataset->type == dns_rdatatype_aaaa) &&
8494 		    !is_answeraddress_allowed(fctx->res->view, rctx->aname,
8495 					      rdataset))
8496 		{
8497 			rctx->result = DNS_R_SERVFAIL;
8498 			return ISC_R_COMPLETE;
8499 		}
8500 
8501 		if ((rdataset->type == dns_rdatatype_cname ||
8502 		     rdataset->type == dns_rdatatype_dname) &&
8503 		    !is_answertarget_allowed(fctx, fctx->name, rctx->aname,
8504 					     rdataset, NULL))
8505 		{
8506 			rctx->result = DNS_R_SERVFAIL;
8507 			return ISC_R_COMPLETE;
8508 		}
8509 
8510 		rctx->aname->attributes.cache = true;
8511 		rctx->aname->attributes.answer = true;
8512 		rdataset->attributes |= DNS_RDATASETATTR_ANSWER;
8513 		rdataset->attributes |= DNS_RDATASETATTR_CACHE;
8514 		rdataset->trust = rctx->trust;
8515 
8516 		(void)dns_rdataset_additionaldata(rdataset, rctx->aname,
8517 						  check_related, rctx);
8518 	}
8519 
8520 	return ISC_R_SUCCESS;
8521 }
8522 
8523 /*
8524  * rctx_answer_match():
8525  * Handle responses that match the QNAME/QTYPE of the resolver query.
8526  * If QTYPE is valid in the answer section and the rdata isn't filtered,
8527  * the answer can be cached. If there is additional section data related
8528  * to the answer, it can be cached as well.
8529  */
8530 static isc_result_t
8531 rctx_answer_match(respctx_t *rctx) {
8532 	dns_rdataset_t *sigrdataset = NULL;
8533 	fetchctx_t *fctx = rctx->fctx;
8534 
8535 	if (!validinanswer(rctx->ardataset, fctx)) {
8536 		rctx->result = DNS_R_FORMERR;
8537 		return ISC_R_COMPLETE;
8538 	}
8539 
8540 	if ((rctx->ardataset->type == dns_rdatatype_a ||
8541 	     rctx->ardataset->type == dns_rdatatype_aaaa) &&
8542 	    !is_answeraddress_allowed(fctx->res->view, rctx->aname,
8543 				      rctx->ardataset))
8544 	{
8545 		rctx->result = DNS_R_SERVFAIL;
8546 		return ISC_R_COMPLETE;
8547 	}
8548 	if ((rctx->ardataset->type == dns_rdatatype_cname ||
8549 	     rctx->ardataset->type == dns_rdatatype_dname) &&
8550 	    rctx->type != rctx->ardataset->type &&
8551 	    rctx->type != dns_rdatatype_any &&
8552 	    !is_answertarget_allowed(fctx, fctx->name, rctx->aname,
8553 				     rctx->ardataset, NULL))
8554 	{
8555 		rctx->result = DNS_R_SERVFAIL;
8556 		return ISC_R_COMPLETE;
8557 	}
8558 
8559 	rctx->aname->attributes.cache = true;
8560 	rctx->aname->attributes.answer = true;
8561 	rctx->ardataset->attributes |= DNS_RDATASETATTR_ANSWER;
8562 	rctx->ardataset->attributes |= DNS_RDATASETATTR_CACHE;
8563 	rctx->ardataset->trust = rctx->trust;
8564 	(void)dns_rdataset_additionaldata(rctx->ardataset, rctx->aname,
8565 					  check_related, rctx);
8566 
8567 	for (sigrdataset = ISC_LIST_HEAD(rctx->aname->list);
8568 	     sigrdataset != NULL;
8569 	     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
8570 	{
8571 		if (!validinanswer(sigrdataset, fctx)) {
8572 			rctx->result = DNS_R_FORMERR;
8573 			return ISC_R_COMPLETE;
8574 		}
8575 
8576 		if (sigrdataset->type != dns_rdatatype_rrsig ||
8577 		    sigrdataset->covers != rctx->type)
8578 		{
8579 			continue;
8580 		}
8581 
8582 		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
8583 		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
8584 		sigrdataset->trust = rctx->trust;
8585 		break;
8586 	}
8587 
8588 	return ISC_R_SUCCESS;
8589 }
8590 
8591 /*
8592  * rctx_answer_cname():
8593  * Handle answers containing a CNAME. Cache the CNAME, and flag that
8594  * there may be additional chain answers to find.
8595  */
8596 static isc_result_t
8597 rctx_answer_cname(respctx_t *rctx) {
8598 	dns_rdataset_t *sigrdataset = NULL;
8599 	fetchctx_t *fctx = rctx->fctx;
8600 
8601 	if (!validinanswer(rctx->crdataset, fctx)) {
8602 		rctx->result = DNS_R_FORMERR;
8603 		return ISC_R_COMPLETE;
8604 	}
8605 
8606 	if (rctx->type == dns_rdatatype_rrsig ||
8607 	    rctx->type == dns_rdatatype_key || rctx->type == dns_rdatatype_nsec)
8608 	{
8609 		char buf[DNS_RDATATYPE_FORMATSIZE];
8610 		dns_rdatatype_format(rctx->type, buf, sizeof(buf));
8611 		log_formerr(fctx, "CNAME response for %s RR", buf);
8612 		rctx->result = DNS_R_FORMERR;
8613 		return ISC_R_COMPLETE;
8614 	}
8615 
8616 	if (!is_answertarget_allowed(fctx, fctx->name, rctx->cname,
8617 				     rctx->crdataset, NULL))
8618 	{
8619 		rctx->result = DNS_R_SERVFAIL;
8620 		return ISC_R_COMPLETE;
8621 	}
8622 
8623 	rctx->cname->attributes.cache = true;
8624 	rctx->cname->attributes.answer = true;
8625 	rctx->cname->attributes.chaining = true;
8626 	rctx->crdataset->attributes |= DNS_RDATASETATTR_ANSWER;
8627 	rctx->crdataset->attributes |= DNS_RDATASETATTR_CACHE;
8628 	rctx->crdataset->attributes |= DNS_RDATASETATTR_CHAINING;
8629 	rctx->crdataset->trust = rctx->trust;
8630 
8631 	for (sigrdataset = ISC_LIST_HEAD(rctx->cname->list);
8632 	     sigrdataset != NULL;
8633 	     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
8634 	{
8635 		if (!validinanswer(sigrdataset, fctx)) {
8636 			rctx->result = DNS_R_FORMERR;
8637 			return ISC_R_COMPLETE;
8638 		}
8639 
8640 		if (sigrdataset->type != dns_rdatatype_rrsig ||
8641 		    sigrdataset->covers != dns_rdatatype_cname)
8642 		{
8643 			continue;
8644 		}
8645 
8646 		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
8647 		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
8648 		sigrdataset->trust = rctx->trust;
8649 		break;
8650 	}
8651 
8652 	rctx->chaining = true;
8653 	return ISC_R_SUCCESS;
8654 }
8655 
8656 /*
8657  * rctx_answer_dname():
8658  * Handle responses with covering DNAME records.
8659  */
8660 static isc_result_t
8661 rctx_answer_dname(respctx_t *rctx) {
8662 	dns_rdataset_t *sigrdataset = NULL;
8663 	fetchctx_t *fctx = rctx->fctx;
8664 
8665 	if (!validinanswer(rctx->drdataset, fctx)) {
8666 		rctx->result = DNS_R_FORMERR;
8667 		return ISC_R_COMPLETE;
8668 	}
8669 
8670 	if (!is_answertarget_allowed(fctx, fctx->name, rctx->dname,
8671 				     rctx->drdataset, &rctx->chaining))
8672 	{
8673 		rctx->result = DNS_R_SERVFAIL;
8674 		return ISC_R_COMPLETE;
8675 	}
8676 
8677 	rctx->dname->attributes.cache = true;
8678 	rctx->dname->attributes.answer = true;
8679 	rctx->dname->attributes.chaining = true;
8680 	rctx->drdataset->attributes |= DNS_RDATASETATTR_ANSWER;
8681 	rctx->drdataset->attributes |= DNS_RDATASETATTR_CACHE;
8682 	rctx->drdataset->attributes |= DNS_RDATASETATTR_CHAINING;
8683 	rctx->drdataset->trust = rctx->trust;
8684 
8685 	for (sigrdataset = ISC_LIST_HEAD(rctx->dname->list);
8686 	     sigrdataset != NULL;
8687 	     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
8688 	{
8689 		if (!validinanswer(sigrdataset, fctx)) {
8690 			rctx->result = DNS_R_FORMERR;
8691 			return ISC_R_COMPLETE;
8692 		}
8693 
8694 		if (sigrdataset->type != dns_rdatatype_rrsig ||
8695 		    sigrdataset->covers != dns_rdatatype_dname)
8696 		{
8697 			continue;
8698 		}
8699 
8700 		sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
8701 		sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
8702 		sigrdataset->trust = rctx->trust;
8703 		break;
8704 	}
8705 
8706 	return ISC_R_SUCCESS;
8707 }
8708 
8709 /*
8710  * rctx_authority_positive():
8711  * Examine the records in the authority section (if there are any) for a
8712  * positive answer.  We expect the names for all rdatasets in this
8713  * section to be subdomains of the domain being queried; any that are
8714  * not are skipped.  We expect to find only *one* owner name; any names
8715  * after the first one processed are ignored. We expect to find only
8716  * rdatasets of type NS, RRSIG, or SIG; all others are ignored. Whatever
8717  * remains can be cached at trust level authauthority or additional
8718  * (depending on whether the AA bit was set on the answer).
8719  */
8720 static void
8721 rctx_authority_positive(respctx_t *rctx) {
8722 	fetchctx_t *fctx = rctx->fctx;
8723 	bool done = false;
8724 	isc_result_t result;
8725 
8726 	result = dns_message_firstname(rctx->query->rmessage,
8727 				       DNS_SECTION_AUTHORITY);
8728 	while (!done && result == ISC_R_SUCCESS) {
8729 		dns_name_t *name = NULL;
8730 
8731 		dns_message_currentname(rctx->query->rmessage,
8732 					DNS_SECTION_AUTHORITY, &name);
8733 
8734 		if (!name_external(name, dns_rdatatype_ns, fctx)) {
8735 			dns_rdataset_t *rdataset = NULL;
8736 
8737 			/*
8738 			 * We expect to find NS or SIG NS rdatasets, and
8739 			 * nothing else.
8740 			 */
8741 			for (rdataset = ISC_LIST_HEAD(name->list);
8742 			     rdataset != NULL;
8743 			     rdataset = ISC_LIST_NEXT(rdataset, link))
8744 			{
8745 				if (rdataset->type == dns_rdatatype_ns ||
8746 				    (rdataset->type == dns_rdatatype_rrsig &&
8747 				     rdataset->covers == dns_rdatatype_ns))
8748 				{
8749 					name->attributes.cache = true;
8750 					rdataset->attributes |=
8751 						DNS_RDATASETATTR_CACHE;
8752 
8753 					if (rctx->aa) {
8754 						rdataset->trust =
8755 							dns_trust_authauthority;
8756 					} else {
8757 						rdataset->trust =
8758 							dns_trust_additional;
8759 					}
8760 
8761 					if (rdataset->type == dns_rdatatype_ns)
8762 					{
8763 						rctx->ns_name = name;
8764 						rctx->ns_rdataset = rdataset;
8765 					}
8766 					/*
8767 					 * Mark any additional data
8768 					 * related to this rdataset.
8769 					 */
8770 					(void)dns_rdataset_additionaldata(
8771 						rdataset, name, check_related,
8772 						rctx);
8773 					done = true;
8774 				}
8775 			}
8776 		}
8777 
8778 		result = dns_message_nextname(rctx->query->rmessage,
8779 					      DNS_SECTION_AUTHORITY);
8780 	}
8781 }
8782 
8783 /*
8784  * rctx_answer_none():
8785  * Handles a response without an answer: this is either a negative
8786  * response (NXDOMAIN or NXRRSET) or a referral. Determine which it is,
8787  * then either scan the authority section for negative caching and
8788  * DNSSEC proof of nonexistence, or else call rctx_referral().
8789  */
8790 static isc_result_t
8791 rctx_answer_none(respctx_t *rctx) {
8792 	isc_result_t result;
8793 	fetchctx_t *fctx = rctx->fctx;
8794 
8795 	FCTXTRACE("rctx_answer_none");
8796 
8797 	rctx_answer_init(rctx);
8798 
8799 	/*
8800 	 * Sometimes we can tell if its a negative response by looking
8801 	 * at the message header.
8802 	 */
8803 	if (rctx->query->rmessage->rcode == dns_rcode_nxdomain ||
8804 	    (rctx->query->rmessage->counts[DNS_SECTION_ANSWER] == 0 &&
8805 	     rctx->query->rmessage->counts[DNS_SECTION_AUTHORITY] == 0))
8806 	{
8807 		rctx->negative = true;
8808 	}
8809 
8810 	/*
8811 	 * Process the authority section
8812 	 */
8813 	result = rctx_authority_negative(rctx);
8814 	if (result == ISC_R_COMPLETE) {
8815 		return rctx->result;
8816 	}
8817 
8818 	log_ns_ttl(fctx, "rctx_answer_none");
8819 
8820 	if (rctx->ns_rdataset != NULL &&
8821 	    dns_name_equal(fctx->domain, rctx->ns_name) &&
8822 	    !dns_name_equal(rctx->ns_name, dns_rootname))
8823 	{
8824 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
8825 	}
8826 
8827 	/*
8828 	 * A negative response has a SOA record (Type 2)
8829 	 * and a optional NS RRset (Type 1) or it has neither
8830 	 * a SOA or a NS RRset (Type 3, handled above) or
8831 	 * rcode is NXDOMAIN (handled above) in which case
8832 	 * the NS RRset is allowed (Type 4).
8833 	 */
8834 	if (rctx->soa_name != NULL) {
8835 		rctx->negative = true;
8836 	}
8837 
8838 	if (!rctx->ns_in_answer && !rctx->glue_in_answer) {
8839 		/*
8840 		 * Process DNSSEC records in the authority section.
8841 		 */
8842 		result = rctx_authority_dnssec(rctx);
8843 		if (result == ISC_R_COMPLETE) {
8844 			return rctx->result;
8845 		}
8846 	}
8847 
8848 	/*
8849 	 * Trigger lookups for DNS nameservers.
8850 	 */
8851 	if (rctx->negative &&
8852 	    rctx->query->rmessage->rcode == dns_rcode_noerror &&
8853 	    fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL &&
8854 	    dns_name_equal(rctx->soa_name, fctx->name) &&
8855 	    !dns_name_equal(fctx->name, dns_rootname))
8856 	{
8857 		return DNS_R_CHASEDSSERVERS;
8858 	}
8859 
8860 	/*
8861 	 * Did we find anything?
8862 	 */
8863 	if (!rctx->negative && rctx->ns_name == NULL) {
8864 		/*
8865 		 * The responder is insane.
8866 		 */
8867 		if (rctx->found_name == NULL) {
8868 			log_formerr(fctx, "invalid response");
8869 			return DNS_R_FORMERR;
8870 		}
8871 		if (!dns_name_issubdomain(rctx->found_name, fctx->domain)) {
8872 			char nbuf[DNS_NAME_FORMATSIZE];
8873 			char dbuf[DNS_NAME_FORMATSIZE];
8874 			char tbuf[DNS_RDATATYPE_FORMATSIZE];
8875 
8876 			dns_rdatatype_format(rctx->found_type, tbuf,
8877 					     sizeof(tbuf));
8878 			dns_name_format(rctx->found_name, nbuf, sizeof(nbuf));
8879 			dns_name_format(fctx->domain, dbuf, sizeof(dbuf));
8880 
8881 			log_formerr(fctx,
8882 				    "Name %s (%s) not subdomain"
8883 				    " of zone %s -- invalid response",
8884 				    nbuf, tbuf, dbuf);
8885 		} else {
8886 			log_formerr(fctx, "invalid response");
8887 		}
8888 		return DNS_R_FORMERR;
8889 	}
8890 
8891 	/*
8892 	 * If we found both NS and SOA, they should be the same name.
8893 	 */
8894 	if (rctx->ns_name != NULL && rctx->soa_name != NULL &&
8895 	    rctx->ns_name != rctx->soa_name)
8896 	{
8897 		log_formerr(fctx, "NS/SOA mismatch");
8898 		return DNS_R_FORMERR;
8899 	}
8900 
8901 	/*
8902 	 * Handle a referral.
8903 	 */
8904 	result = rctx_referral(rctx);
8905 	if (result == ISC_R_COMPLETE) {
8906 		return rctx->result;
8907 	}
8908 
8909 	/*
8910 	 * Since we're not doing a referral, we don't want to cache any
8911 	 * NS RRs we may have found.
8912 	 */
8913 	if (rctx->ns_name != NULL) {
8914 		rctx->ns_name->attributes.cache = false;
8915 	}
8916 
8917 	if (rctx->negative) {
8918 		FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTNCACHE);
8919 	}
8920 
8921 	return ISC_R_SUCCESS;
8922 }
8923 
8924 /*
8925  * rctx_authority_negative():
8926  * Scan the authority section of a negative answer, handling
8927  * NS and SOA records. (Note that this function does *not* handle
8928  * DNSSEC records; those are addressed separately in
8929  * rctx_authority_dnssec() below.)
8930  */
8931 static isc_result_t
8932 rctx_authority_negative(respctx_t *rctx) {
8933 	isc_result_t result;
8934 	fetchctx_t *fctx = rctx->fctx;
8935 	dns_section_t section;
8936 	dns_rdataset_t *rdataset = NULL;
8937 	bool finished = false;
8938 
8939 	if (rctx->ns_in_answer) {
8940 		INSIST(fctx->type == dns_rdatatype_ns);
8941 		section = DNS_SECTION_ANSWER;
8942 	} else {
8943 		section = DNS_SECTION_AUTHORITY;
8944 	}
8945 
8946 	result = dns_message_firstname(rctx->query->rmessage, section);
8947 	if (result != ISC_R_SUCCESS) {
8948 		return ISC_R_SUCCESS;
8949 	}
8950 
8951 	while (!finished) {
8952 		dns_name_t *name = NULL;
8953 
8954 		dns_message_currentname(rctx->query->rmessage, section, &name);
8955 		result = dns_message_nextname(rctx->query->rmessage, section);
8956 		if (result != ISC_R_SUCCESS) {
8957 			finished = true;
8958 		}
8959 
8960 		if (!dns_name_issubdomain(name, fctx->domain)) {
8961 			continue;
8962 		}
8963 
8964 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
8965 		     rdataset = ISC_LIST_NEXT(rdataset, link))
8966 		{
8967 			dns_rdatatype_t type = rdataset->type;
8968 			if (type == dns_rdatatype_rrsig) {
8969 				type = rdataset->covers;
8970 			}
8971 			if ((type == dns_rdatatype_ns ||
8972 			     type == dns_rdatatype_soa) &&
8973 			    !dns_name_issubdomain(fctx->name, name))
8974 			{
8975 				char qbuf[DNS_NAME_FORMATSIZE];
8976 				char nbuf[DNS_NAME_FORMATSIZE];
8977 				char tbuf[DNS_RDATATYPE_FORMATSIZE];
8978 				dns_rdatatype_format(type, tbuf, sizeof(tbuf));
8979 				dns_name_format(name, nbuf, sizeof(nbuf));
8980 				dns_name_format(fctx->name, qbuf, sizeof(qbuf));
8981 				log_formerr(fctx,
8982 					    "unrelated %s %s in "
8983 					    "%s authority section",
8984 					    tbuf, nbuf, qbuf);
8985 				break;
8986 			}
8987 
8988 			switch (type) {
8989 			case dns_rdatatype_ns:
8990 				/*
8991 				 * NS or RRSIG NS.
8992 				 *
8993 				 * Only one set of NS RRs is allowed.
8994 				 */
8995 				if (rdataset->type == dns_rdatatype_ns) {
8996 					if (rctx->ns_name != NULL &&
8997 					    name != rctx->ns_name)
8998 					{
8999 						log_formerr(fctx, "multiple NS "
9000 								  "RRsets "
9001 								  "in "
9002 								  "authority "
9003 								  "section");
9004 						rctx->result = DNS_R_FORMERR;
9005 						return ISC_R_COMPLETE;
9006 					}
9007 					rctx->ns_name = name;
9008 					rctx->ns_rdataset = rdataset;
9009 				}
9010 				name->attributes.cache = true;
9011 				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
9012 				rdataset->trust = dns_trust_glue;
9013 				break;
9014 			case dns_rdatatype_soa:
9015 				/*
9016 				 * SOA, or RRSIG SOA.
9017 				 *
9018 				 * Only one SOA is allowed.
9019 				 */
9020 				if (rdataset->type == dns_rdatatype_soa) {
9021 					if (rctx->soa_name != NULL &&
9022 					    name != rctx->soa_name)
9023 					{
9024 						log_formerr(fctx, "multiple "
9025 								  "SOA RRs "
9026 								  "in "
9027 								  "authority "
9028 								  "section");
9029 						rctx->result = DNS_R_FORMERR;
9030 						return ISC_R_COMPLETE;
9031 					}
9032 					rctx->soa_name = name;
9033 				}
9034 				name->attributes.ncache = true;
9035 				rdataset->attributes |= DNS_RDATASETATTR_NCACHE;
9036 				if (rctx->aa) {
9037 					rdataset->trust =
9038 						dns_trust_authauthority;
9039 				} else if (ISFORWARDER(fctx->addrinfo)) {
9040 					rdataset->trust = dns_trust_answer;
9041 				} else {
9042 					rdataset->trust = dns_trust_additional;
9043 				}
9044 				break;
9045 			default:
9046 				continue;
9047 			}
9048 		}
9049 	}
9050 
9051 	return ISC_R_SUCCESS;
9052 }
9053 
9054 /*
9055  * rctx_ncache():
9056  * Cache the negatively cacheable parts of the message.  This may
9057  * also cause work to be queued to the DNSSEC validator.
9058  */
9059 static void
9060 rctx_ncache(respctx_t *rctx) {
9061 	isc_result_t result;
9062 	dns_rdatatype_t covers;
9063 	fetchctx_t *fctx = rctx->fctx;
9064 
9065 	if (!WANTNCACHE(fctx)) {
9066 		return;
9067 	}
9068 
9069 	/*
9070 	 * Cache DS NXDOMAIN separately to other types.
9071 	 */
9072 	if (rctx->query->rmessage->rcode == dns_rcode_nxdomain &&
9073 	    fctx->type != dns_rdatatype_ds)
9074 	{
9075 		covers = dns_rdatatype_any;
9076 	} else {
9077 		covers = fctx->type;
9078 	}
9079 
9080 	/*
9081 	 * Cache any negative cache entries in the message.
9082 	 */
9083 	result = ncache_message(fctx, rctx->query->rmessage,
9084 				rctx->query->addrinfo, covers, rctx->now);
9085 	if (result != ISC_R_SUCCESS) {
9086 		FCTXTRACE3("ncache_message complete", result);
9087 	}
9088 }
9089 
9090 /*
9091  * rctx_authority_dnssec():
9092  *
9093  * Scan the authority section of a negative answer or referral,
9094  * handling DNSSEC records (i.e. NSEC, NSEC3, DS).
9095  */
9096 static isc_result_t
9097 rctx_authority_dnssec(respctx_t *rctx) {
9098 	isc_result_t result;
9099 	fetchctx_t *fctx = rctx->fctx;
9100 	dns_rdataset_t *rdataset = NULL;
9101 	bool finished = false;
9102 
9103 	REQUIRE(!rctx->ns_in_answer && !rctx->glue_in_answer);
9104 
9105 	result = dns_message_firstname(rctx->query->rmessage,
9106 				       DNS_SECTION_AUTHORITY);
9107 	if (result != ISC_R_SUCCESS) {
9108 		return ISC_R_SUCCESS;
9109 	}
9110 
9111 	while (!finished) {
9112 		dns_name_t *name = NULL;
9113 
9114 		dns_message_currentname(rctx->query->rmessage,
9115 					DNS_SECTION_AUTHORITY, &name);
9116 		result = dns_message_nextname(rctx->query->rmessage,
9117 					      DNS_SECTION_AUTHORITY);
9118 		if (result != ISC_R_SUCCESS) {
9119 			finished = true;
9120 		}
9121 
9122 		if (!dns_name_issubdomain(name, fctx->domain)) {
9123 			/*
9124 			 * Invalid name found; preserve it for logging
9125 			 * later.
9126 			 */
9127 			rctx->found_name = name;
9128 			rctx->found_type = ISC_LIST_HEAD(name->list)->type;
9129 			continue;
9130 		}
9131 
9132 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
9133 		     rdataset = ISC_LIST_NEXT(rdataset, link))
9134 		{
9135 			bool checknta = true;
9136 			bool secure_domain = false;
9137 			dns_rdatatype_t type = rdataset->type;
9138 
9139 			if (type == dns_rdatatype_rrsig) {
9140 				type = rdataset->covers;
9141 			}
9142 
9143 			switch (type) {
9144 			case dns_rdatatype_nsec:
9145 			case dns_rdatatype_nsec3:
9146 				if (rctx->negative) {
9147 					name->attributes.ncache = true;
9148 					rdataset->attributes |=
9149 						DNS_RDATASETATTR_NCACHE;
9150 				} else if (type == dns_rdatatype_nsec) {
9151 					name->attributes.cache = true;
9152 					rdataset->attributes |=
9153 						DNS_RDATASETATTR_CACHE;
9154 				}
9155 
9156 				if (rctx->aa) {
9157 					rdataset->trust =
9158 						dns_trust_authauthority;
9159 				} else if (ISFORWARDER(fctx->addrinfo)) {
9160 					rdataset->trust = dns_trust_answer;
9161 				} else {
9162 					rdataset->trust = dns_trust_additional;
9163 				}
9164 				/*
9165 				 * No additional data needs to be
9166 				 * marked.
9167 				 */
9168 				break;
9169 			case dns_rdatatype_ds:
9170 				/*
9171 				 * DS or SIG DS.
9172 				 *
9173 				 * These should only be here if this is
9174 				 * a referral, and there should only be
9175 				 * one DS RRset.
9176 				 */
9177 				if (rctx->ns_name == NULL) {
9178 					log_formerr(fctx, "DS with no "
9179 							  "referral");
9180 					rctx->result = DNS_R_FORMERR;
9181 					return ISC_R_COMPLETE;
9182 				}
9183 
9184 				if (rdataset->type == dns_rdatatype_ds) {
9185 					if (rctx->ds_name != NULL &&
9186 					    name != rctx->ds_name)
9187 					{
9188 						log_formerr(fctx, "DS doesn't "
9189 								  "match "
9190 								  "referral "
9191 								  "(NS)");
9192 						rctx->result = DNS_R_FORMERR;
9193 						return ISC_R_COMPLETE;
9194 					}
9195 					rctx->ds_name = name;
9196 				}
9197 
9198 				name->attributes.cache = true;
9199 				rdataset->attributes |= DNS_RDATASETATTR_CACHE;
9200 
9201 				if ((fctx->options & DNS_FETCHOPT_NONTA) != 0) {
9202 					checknta = false;
9203 				}
9204 				if (fctx->res->view->enablevalidation) {
9205 					result = issecuredomain(
9206 						fctx->res->view, name,
9207 						dns_rdatatype_ds, fctx->now,
9208 						checknta, NULL, &secure_domain);
9209 					if (result != ISC_R_SUCCESS) {
9210 						return result;
9211 					}
9212 				}
9213 				if (secure_domain) {
9214 					rdataset->trust =
9215 						dns_trust_pending_answer;
9216 				} else if (rctx->aa) {
9217 					rdataset->trust =
9218 						dns_trust_authauthority;
9219 				} else if (ISFORWARDER(fctx->addrinfo)) {
9220 					rdataset->trust = dns_trust_answer;
9221 				} else {
9222 					rdataset->trust = dns_trust_additional;
9223 				}
9224 				break;
9225 			default:
9226 				continue;
9227 			}
9228 		}
9229 	}
9230 
9231 	return ISC_R_SUCCESS;
9232 }
9233 
9234 /*
9235  * rctx_referral():
9236  * Handles referral responses. Check for sanity, find glue as needed,
9237  * and update the fetch context to follow the delegation.
9238  */
9239 static isc_result_t
9240 rctx_referral(respctx_t *rctx) {
9241 	isc_result_t result;
9242 	fetchctx_t *fctx = rctx->fctx;
9243 
9244 	if (rctx->negative || rctx->ns_name == NULL) {
9245 		return ISC_R_SUCCESS;
9246 	}
9247 
9248 	/*
9249 	 * We already know ns_name is a subdomain of fctx->domain.
9250 	 * If ns_name is equal to fctx->domain, we're not making
9251 	 * progress.  We return DNS_R_FORMERR so that we'll keep
9252 	 * trying other servers.
9253 	 */
9254 	if (dns_name_equal(rctx->ns_name, fctx->domain)) {
9255 		log_formerr(fctx, "non-improving referral");
9256 		rctx->result = DNS_R_FORMERR;
9257 		return ISC_R_COMPLETE;
9258 	}
9259 
9260 	/*
9261 	 * If the referral name is not a parent of the query
9262 	 * name, consider the responder insane.
9263 	 */
9264 	if (!dns_name_issubdomain(fctx->name, rctx->ns_name)) {
9265 		/* Logged twice */
9266 		log_formerr(fctx, "referral to non-parent");
9267 		FCTXTRACE("referral to non-parent");
9268 		rctx->result = DNS_R_FORMERR;
9269 		return ISC_R_COMPLETE;
9270 	}
9271 
9272 	/*
9273 	 * Mark any additional data related to this rdataset.
9274 	 * It's important that we do this before we change the
9275 	 * query domain.
9276 	 */
9277 	INSIST(rctx->ns_rdataset != NULL);
9278 	FCTX_ATTR_SET(fctx, FCTX_ATTR_GLUING);
9279 	(void)dns_rdataset_additionaldata(rctx->ns_rdataset, rctx->ns_name,
9280 					  check_related, rctx);
9281 #if CHECK_FOR_GLUE_IN_ANSWER
9282 	/*
9283 	 * Look in the answer section for "glue" that is incorrectly
9284 	 * returned as a answer.  This is needed if the server also
9285 	 * minimizes the response size by not adding records to the
9286 	 * additional section that are in the answer section or if
9287 	 * the record gets dropped due to message size constraints.
9288 	 */
9289 	if (rctx->glue_in_answer &&
9290 	    (fctx->type == dns_rdatatype_aaaa || fctx->type == dns_rdatatype_a))
9291 	{
9292 		(void)dns_rdataset_additionaldata(
9293 			rctx->ns_rdataset, rctx->ns_name, check_answer, fctx);
9294 	}
9295 #endif /* if CHECK_FOR_GLUE_IN_ANSWER */
9296 	FCTX_ATTR_CLR(fctx, FCTX_ATTR_GLUING);
9297 
9298 	/*
9299 	 * NS rdatasets with 0 TTL cause problems.
9300 	 * dns_view_findzonecut() will not find them when we
9301 	 * try to follow the referral, and we'll SERVFAIL
9302 	 * because the best nameservers are now above QDOMAIN.
9303 	 * We force the TTL to 1 second to prevent this.
9304 	 */
9305 	if (rctx->ns_rdataset->ttl == 0) {
9306 		rctx->ns_rdataset->ttl = 1;
9307 	}
9308 
9309 	/*
9310 	 * Set the current query domain to the referral name.
9311 	 *
9312 	 * XXXRTH  We should check if we're in forward-only mode, and
9313 	 *		if so we should bail out.
9314 	 */
9315 	INSIST(dns_name_countlabels(fctx->domain) > 0);
9316 	fcount_decr(fctx);
9317 
9318 	if (dns_rdataset_isassociated(&fctx->nameservers)) {
9319 		dns_rdataset_disassociate(&fctx->nameservers);
9320 	}
9321 
9322 	dns_name_copy(rctx->ns_name, fctx->domain);
9323 
9324 	if ((fctx->options & DNS_FETCHOPT_QMINIMIZE) != 0) {
9325 		dns_name_copy(rctx->ns_name, fctx->qmindcname);
9326 
9327 		fctx_minimize_qname(fctx);
9328 	}
9329 
9330 	result = fcount_incr(fctx, true);
9331 	if (result != ISC_R_SUCCESS) {
9332 		rctx->result = result;
9333 		return ISC_R_COMPLETE;
9334 	}
9335 
9336 	FCTX_ATTR_SET(fctx, FCTX_ATTR_WANTCACHE);
9337 	fctx->ns_ttl_ok = false;
9338 	log_ns_ttl(fctx, "DELEGATION");
9339 	rctx->result = DNS_R_DELEGATION;
9340 
9341 	/*
9342 	 * Reinitialize 'rctx' to prepare for following the delegation:
9343 	 * set the get_nameservers and next_server flags appropriately
9344 	 * and reset the fetch context counters.
9345 	 *
9346 	 */
9347 	if ((rctx->fctx->options & DNS_FETCHOPT_NOFOLLOW) == 0) {
9348 		rctx->get_nameservers = true;
9349 		rctx->next_server = true;
9350 		rctx->fctx->restarts = 0;
9351 		rctx->fctx->referrals++;
9352 		rctx->fctx->querysent = 0;
9353 		rctx->fctx->lamecount = 0;
9354 		rctx->fctx->quotacount = 0;
9355 		rctx->fctx->neterr = 0;
9356 		rctx->fctx->badresp = 0;
9357 		rctx->fctx->adberr = 0;
9358 	}
9359 
9360 	return ISC_R_COMPLETE;
9361 }
9362 
9363 /*
9364  * rctx_additional():
9365  * Scan the additional section of a response to find records related
9366  * to answers we were interested in.
9367  */
9368 static void
9369 rctx_additional(respctx_t *rctx) {
9370 	bool rescan;
9371 	dns_section_t section = DNS_SECTION_ADDITIONAL;
9372 	isc_result_t result;
9373 
9374 again:
9375 	rescan = false;
9376 
9377 	for (result = dns_message_firstname(rctx->query->rmessage, section);
9378 	     result == ISC_R_SUCCESS;
9379 	     result = dns_message_nextname(rctx->query->rmessage, section))
9380 	{
9381 		dns_name_t *name = NULL;
9382 		dns_rdataset_t *rdataset;
9383 		dns_message_currentname(rctx->query->rmessage,
9384 					DNS_SECTION_ADDITIONAL, &name);
9385 		if (!name->attributes.chase) {
9386 			continue;
9387 		}
9388 		name->attributes.chase = false;
9389 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
9390 		     rdataset = ISC_LIST_NEXT(rdataset, link))
9391 		{
9392 			if (CHASE(rdataset)) {
9393 				rdataset->attributes &= ~DNS_RDATASETATTR_CHASE;
9394 				(void)dns_rdataset_additionaldata(
9395 					rdataset, name, check_related, rctx);
9396 				rescan = true;
9397 			}
9398 		}
9399 	}
9400 	if (rescan) {
9401 		goto again;
9402 	}
9403 }
9404 
9405 /*
9406  * rctx_nextserver():
9407  * We found something wrong with the remote server, but it may be
9408  * useful to try another one.
9409  */
9410 static void
9411 rctx_nextserver(respctx_t *rctx, dns_message_t *message,
9412 		dns_adbaddrinfo_t *addrinfo, isc_result_t result) {
9413 	fetchctx_t *fctx = rctx->fctx;
9414 	bool retrying = true;
9415 
9416 	if (result == DNS_R_FORMERR) {
9417 		rctx->broken_server = DNS_R_FORMERR;
9418 	}
9419 	if (rctx->broken_server != ISC_R_SUCCESS) {
9420 		/*
9421 		 * Add this server to the list of bad servers for
9422 		 * this fctx.
9423 		 */
9424 		add_bad(fctx, message, addrinfo, rctx->broken_server,
9425 			rctx->broken_type);
9426 	}
9427 
9428 	if (rctx->get_nameservers) {
9429 		dns_fixedname_t foundname, founddc;
9430 		dns_name_t *name, *fname, *dcname;
9431 		unsigned int findoptions = 0;
9432 
9433 		fname = dns_fixedname_initname(&foundname);
9434 		dcname = dns_fixedname_initname(&founddc);
9435 
9436 		if (result != ISC_R_SUCCESS) {
9437 			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
9438 			return;
9439 		}
9440 		if (dns_rdatatype_atparent(fctx->type)) {
9441 			findoptions |= DNS_DBFIND_NOEXACT;
9442 		}
9443 		/* FIXME: Why??? */
9444 		if ((rctx->retryopts & DNS_FETCHOPT_UNSHARED) == 0) {
9445 			name = fctx->name;
9446 		} else {
9447 			name = fctx->domain;
9448 		}
9449 		result = dns_view_findzonecut(
9450 			fctx->res->view, name, fname, dcname, fctx->now,
9451 			findoptions, true, true, &fctx->nameservers, NULL);
9452 		if (result != ISC_R_SUCCESS) {
9453 			FCTXTRACE("couldn't find a zonecut");
9454 			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
9455 			return;
9456 		}
9457 		if (!dns_name_issubdomain(fname, fctx->domain)) {
9458 			/*
9459 			 * The best nameservers are now above our
9460 			 * QDOMAIN.
9461 			 */
9462 			FCTXTRACE("nameservers now above QDOMAIN");
9463 			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
9464 			return;
9465 		}
9466 
9467 		fcount_decr(fctx);
9468 
9469 		dns_name_copy(fname, fctx->domain);
9470 		dns_name_copy(dcname, fctx->qmindcname);
9471 
9472 		result = fcount_incr(fctx, true);
9473 		if (result != ISC_R_SUCCESS) {
9474 			fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
9475 			return;
9476 		}
9477 		fctx->ns_ttl = fctx->nameservers.ttl;
9478 		fctx->ns_ttl_ok = true;
9479 		fctx_cancelqueries(fctx, true, false);
9480 		fctx_cleanup(fctx);
9481 		retrying = false;
9482 	}
9483 
9484 	/*
9485 	 * Try again.
9486 	 */
9487 	fctx_try(fctx, retrying);
9488 }
9489 
9490 /*
9491  * rctx_resend():
9492  *
9493  * Resend the query, probably with the options changed. Calls
9494  * fctx_query(), passing rctx->retryopts (which is based on
9495  * query->options, but may have been updated since the last time
9496  * fctx_query() was called).
9497  */
9498 static void
9499 rctx_resend(respctx_t *rctx, dns_adbaddrinfo_t *addrinfo) {
9500 	fetchctx_t *fctx = rctx->fctx;
9501 	isc_result_t result;
9502 
9503 	FCTXTRACE("resend");
9504 	inc_stats(fctx->res, dns_resstatscounter_retry);
9505 	result = fctx_query(fctx, addrinfo, rctx->retryopts);
9506 	if (result != ISC_R_SUCCESS) {
9507 		fctx_done_detach(&rctx->fctx, result);
9508 	}
9509 }
9510 
9511 /*
9512  * rctx_next():
9513  * We got what appeared to be a response but it didn't match the
9514  * question or the cookie; it may have been meant for someone else, or
9515  * it may be a spoofing attack. Drop it and continue listening for the
9516  * response we wanted.
9517  */
9518 static isc_result_t
9519 rctx_next(respctx_t *rctx) {
9520 	fetchctx_t *fctx = rctx->fctx;
9521 	isc_result_t result;
9522 
9523 	FCTXTRACE("nextitem");
9524 	inc_stats(rctx->fctx->res, dns_resstatscounter_nextitem);
9525 	INSIST(rctx->query->dispentry != NULL);
9526 	dns_message_reset(rctx->query->rmessage, DNS_MESSAGE_INTENTPARSE);
9527 	result = dns_dispatch_getnext(rctx->query->dispentry);
9528 	return result;
9529 }
9530 
9531 /*
9532  * rctx_chaseds():
9533  * Look up the parent zone's NS records so that DS records can be
9534  * fetched.
9535  */
9536 static void
9537 rctx_chaseds(respctx_t *rctx, dns_message_t *message,
9538 	     dns_adbaddrinfo_t *addrinfo, isc_result_t result) {
9539 	fetchctx_t *fctx = rctx->fctx;
9540 	unsigned int n;
9541 
9542 	add_bad(fctx, message, addrinfo, result, rctx->broken_type);
9543 	fctx_cancelqueries(fctx, true, false);
9544 	fctx_cleanup(fctx);
9545 
9546 	n = dns_name_countlabels(fctx->name);
9547 	dns_name_getlabelsequence(fctx->name, 1, n - 1, fctx->nsname);
9548 
9549 	FCTXTRACE("suspending DS lookup to find parent's NS records");
9550 
9551 	fetchctx_ref(fctx);
9552 	result = dns_resolver_createfetch(
9553 		fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL,
9554 		NULL, 0, fctx->options, 0, fctx->qc, fctx->loop,
9555 		resume_dslookup, fctx, &fctx->nsrrset, NULL, &fctx->nsfetch);
9556 	if (result != ISC_R_SUCCESS) {
9557 		if (result == DNS_R_DUPLICATE) {
9558 			result = DNS_R_SERVFAIL;
9559 		}
9560 		fctx_done_detach(&rctx->fctx, result);
9561 		fetchctx_detach(&fctx);
9562 		return;
9563 	}
9564 }
9565 
9566 /*
9567  * rctx_done():
9568  * This resolver query response is finished, either because we
9569  * encountered a problem or because we've gotten all the information
9570  * from it that we can.  We either wait for another response, resend the
9571  * query to the same server, resend to a new server, or clean up and
9572  * shut down the fetch.
9573  */
9574 static void
9575 rctx_done(respctx_t *rctx, isc_result_t result) {
9576 	resquery_t *query = rctx->query;
9577 	fetchctx_t *fctx = rctx->fctx;
9578 	dns_adbaddrinfo_t *addrinfo = query->addrinfo;
9579 	dns_message_t *message = NULL;
9580 
9581 	/*
9582 	 * Need to attach to the message until the scope
9583 	 * of this function ends, since there are many places
9584 	 * where the message is used and/or may be destroyed
9585 	 * before this function ends.
9586 	 */
9587 	dns_message_attach(query->rmessage, &message);
9588 
9589 	FCTXTRACE4("query canceled in rctx_done();",
9590 		   rctx->no_response ? "no response" : "responding", result);
9591 
9592 #ifdef ENABLE_AFL
9593 	if (dns_fuzzing_resolver &&
9594 	    (rctx->next_server || rctx->resend || rctx->nextitem))
9595 	{
9596 		fctx_cancelquery(&query, rctx->finish, rctx->no_response,
9597 				 false);
9598 		fctx_done_detach(&rctx->fctx, DNS_R_SERVFAIL);
9599 		goto detach;
9600 	}
9601 #endif /* ifdef ENABLE_AFL */
9602 
9603 	if (rctx->nextitem) {
9604 		REQUIRE(!rctx->next_server);
9605 		REQUIRE(!rctx->resend);
9606 
9607 		result = rctx_next(rctx);
9608 		if (result == ISC_R_SUCCESS) {
9609 			goto detach;
9610 		}
9611 	}
9612 
9613 	/* Cancel the query */
9614 	fctx_cancelquery(&query, rctx->finish, rctx->no_response, false);
9615 
9616 	/*
9617 	 * If nobody's waiting for results, don't resend or try next server.
9618 	 */
9619 	LOCK(&fctx->lock);
9620 	if (ISC_LIST_EMPTY(fctx->resps)) {
9621 		rctx->next_server = false;
9622 		rctx->resend = false;
9623 	}
9624 	UNLOCK(&fctx->lock);
9625 
9626 	if (rctx->next_server) {
9627 		rctx_nextserver(rctx, message, addrinfo, result);
9628 	} else if (rctx->resend) {
9629 		rctx_resend(rctx, addrinfo);
9630 	} else if (result == DNS_R_CHASEDSSERVERS) {
9631 		rctx_chaseds(rctx, message, addrinfo, result);
9632 	} else if (result == ISC_R_SUCCESS && !HAVE_ANSWER(fctx)) {
9633 		/*
9634 		 * All has gone well so far, but we are waiting for the DNSSEC
9635 		 * validator to validate the answer.
9636 		 */
9637 		FCTXTRACE("wait for validator");
9638 		fctx_cancelqueries(fctx, true, false);
9639 	} else {
9640 		/*
9641 		 * We're done.
9642 		 */
9643 		fctx_done_detach(&rctx->fctx, result);
9644 	}
9645 
9646 detach:
9647 	dns_message_detach(&message);
9648 }
9649 
9650 /*
9651  * rctx_logpacket():
9652  * Log the incoming packet; also log to DNSTAP if configured.
9653  */
9654 static void
9655 rctx_logpacket(respctx_t *rctx) {
9656 	fetchctx_t *fctx = rctx->fctx;
9657 #ifdef HAVE_DNSTAP
9658 	isc_result_t result;
9659 	isc_sockaddr_t localaddr, *la = NULL;
9660 	unsigned char zone[DNS_NAME_MAXWIRE];
9661 	dns_transport_type_t transport_type;
9662 	dns_dtmsgtype_t dtmsgtype;
9663 	dns_compress_t cctx;
9664 	isc_region_t zr;
9665 	isc_buffer_t zb;
9666 #endif /* HAVE_DNSTAP */
9667 
9668 	dns_message_logfmtpacket(
9669 		rctx->query->rmessage, "received packet from",
9670 		&rctx->query->addrinfo->sockaddr, DNS_LOGCATEGORY_RESOLVER,
9671 		DNS_LOGMODULE_PACKETS, &dns_master_style_comment,
9672 		ISC_LOG_DEBUG(10), fctx->mctx);
9673 
9674 #ifdef HAVE_DNSTAP
9675 	/*
9676 	 * Log the response via dnstap.
9677 	 */
9678 	memset(&zr, 0, sizeof(zr));
9679 	dns_compress_init(&cctx, fctx->mctx, 0);
9680 	dns_compress_setpermitted(&cctx, false);
9681 	isc_buffer_init(&zb, zone, sizeof(zone));
9682 	result = dns_name_towire(fctx->domain, &cctx, &zb, NULL);
9683 	if (result == ISC_R_SUCCESS) {
9684 		isc_buffer_usedregion(&zb, &zr);
9685 	}
9686 	dns_compress_invalidate(&cctx);
9687 
9688 	if ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0) {
9689 		dtmsgtype = DNS_DTTYPE_FR;
9690 	} else {
9691 		dtmsgtype = DNS_DTTYPE_RR;
9692 	}
9693 
9694 	result = dns_dispentry_getlocaladdress(rctx->query->dispentry,
9695 					       &localaddr);
9696 	if (result == ISC_R_SUCCESS) {
9697 		la = &localaddr;
9698 	}
9699 
9700 	if (rctx->query->addrinfo->transport != NULL) {
9701 		transport_type = dns_transport_get_type(
9702 			rctx->query->addrinfo->transport);
9703 	} else if ((rctx->query->options & DNS_FETCHOPT_TCP) != 0) {
9704 		transport_type = DNS_TRANSPORT_TCP;
9705 	} else {
9706 		transport_type = DNS_TRANSPORT_UDP;
9707 	}
9708 
9709 	dns_dt_send(fctx->res->view, dtmsgtype, la,
9710 		    &rctx->query->addrinfo->sockaddr, transport_type, &zr,
9711 		    &rctx->query->start, NULL, &rctx->buffer);
9712 #endif /* HAVE_DNSTAP */
9713 }
9714 
9715 /*
9716  * rctx_badserver():
9717  * Is the remote server broken, or does it dislike us?
9718  */
9719 static isc_result_t
9720 rctx_badserver(respctx_t *rctx, isc_result_t result) {
9721 	fetchctx_t *fctx = rctx->fctx;
9722 	resquery_t *query = rctx->query;
9723 	isc_buffer_t b;
9724 	char code[64];
9725 	dns_rcode_t rcode = rctx->query->rmessage->rcode;
9726 
9727 	if (rcode == dns_rcode_noerror || rcode == dns_rcode_yxdomain ||
9728 	    rcode == dns_rcode_nxdomain)
9729 	{
9730 		return ISC_R_SUCCESS;
9731 	}
9732 
9733 	if ((rcode == dns_rcode_formerr) && rctx->opt == NULL &&
9734 	    (rctx->retryopts & DNS_FETCHOPT_NOEDNS0) == 0)
9735 	{
9736 		/*
9737 		 * It's very likely they don't like EDNS0.
9738 		 */
9739 		rctx->retryopts |= DNS_FETCHOPT_NOEDNS0;
9740 		rctx->resend = true;
9741 		/*
9742 		 * Remember that they may not like EDNS0.
9743 		 */
9744 		add_bad_edns(fctx, &query->addrinfo->sockaddr);
9745 		inc_stats(fctx->res, dns_resstatscounter_edns0fail);
9746 	} else if (rcode == dns_rcode_formerr) {
9747 		if (query->rmessage->cc_echoed) {
9748 			/*
9749 			 * Retry without DNS COOKIE.
9750 			 */
9751 			query->addrinfo->flags |= FCTX_ADDRINFO_NOCOOKIE;
9752 			rctx->resend = true;
9753 			log_formerr(fctx, "server sent FORMERR with echoed DNS "
9754 					  "COOKIE");
9755 		} else {
9756 			/*
9757 			 * The server (or forwarder) doesn't understand us,
9758 			 * but others might.
9759 			 */
9760 			rctx->next_server = true;
9761 			rctx->broken_server = DNS_R_REMOTEFORMERR;
9762 			log_formerr(fctx, "server sent FORMERR");
9763 		}
9764 	} else if (rcode == dns_rcode_badvers) {
9765 		unsigned int version;
9766 #if DNS_EDNS_VERSION > 0
9767 		unsigned int flags, mask;
9768 #endif /* if DNS_EDNS_VERSION > 0 */
9769 
9770 		INSIST(rctx->opt != NULL);
9771 		version = (rctx->opt->ttl >> 16) & 0xff;
9772 #if DNS_EDNS_VERSION > 0
9773 		flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) |
9774 			DNS_FETCHOPT_EDNSVERSIONSET;
9775 		mask = DNS_FETCHOPT_EDNSVERSIONMASK |
9776 		       DNS_FETCHOPT_EDNSVERSIONSET;
9777 #endif /* if DNS_EDNS_VERSION > 0 */
9778 
9779 		/*
9780 		 * Record that we got a good EDNS response.
9781 		 */
9782 		if (query->ednsversion > (int)version &&
9783 		    !EDNSOK(query->addrinfo))
9784 		{
9785 			dns_adb_changeflags(fctx->adb, query->addrinfo,
9786 					    FCTX_ADDRINFO_EDNSOK,
9787 					    FCTX_ADDRINFO_EDNSOK);
9788 		}
9789 
9790 		/*
9791 		 * RFC 2671 was not clear that unknown options should
9792 		 * be ignored.  RFC 6891 is clear that that they
9793 		 * should be ignored. If we are supporting the
9794 		 * experimental EDNS > 0 then perform strict
9795 		 * version checking of badvers responses.  We won't
9796 		 * be sending COOKIE etc. in that case.
9797 		 */
9798 #if DNS_EDNS_VERSION > 0
9799 		if ((int)version < query->ednsversion) {
9800 			dns_adb_changeflags(fctx->adb, query->addrinfo, flags,
9801 					    mask);
9802 			rctx->resend = true;
9803 		} else {
9804 			rctx->broken_server = DNS_R_BADVERS;
9805 			rctx->next_server = true;
9806 		}
9807 #else  /* if DNS_EDNS_VERSION > 0 */
9808 		rctx->broken_server = DNS_R_BADVERS;
9809 		rctx->next_server = true;
9810 #endif /* if DNS_EDNS_VERSION > 0 */
9811 	} else if (rcode == dns_rcode_badcookie && rctx->query->rmessage->cc_ok)
9812 	{
9813 		/*
9814 		 * We have recorded the new cookie.
9815 		 */
9816 		if (BADCOOKIE(query->addrinfo)) {
9817 			rctx->retryopts |= DNS_FETCHOPT_TCP;
9818 		}
9819 		query->addrinfo->flags |= FCTX_ADDRINFO_BADCOOKIE;
9820 		rctx->resend = true;
9821 	} else {
9822 		rctx->broken_server = DNS_R_UNEXPECTEDRCODE;
9823 		rctx->next_server = true;
9824 	}
9825 
9826 	isc_buffer_init(&b, code, sizeof(code) - 1);
9827 	dns_rcode_totext(rcode, &b);
9828 	code[isc_buffer_usedlength(&b)] = '\0';
9829 	FCTXTRACE2("remote server broken: returned ", code);
9830 	rctx_done(rctx, result);
9831 
9832 	return ISC_R_COMPLETE;
9833 }
9834 
9835 /*
9836  * rctx_lameserver():
9837  * Is the server lame?
9838  */
9839 static isc_result_t
9840 rctx_lameserver(respctx_t *rctx) {
9841 	isc_result_t result = ISC_R_SUCCESS;
9842 	fetchctx_t *fctx = rctx->fctx;
9843 	resquery_t *query = rctx->query;
9844 
9845 	if (ISFORWARDER(query->addrinfo) || !is_lame(fctx, query->rmessage)) {
9846 		return ISC_R_SUCCESS;
9847 	}
9848 
9849 	inc_stats(fctx->res, dns_resstatscounter_lame);
9850 	log_lame(fctx, query->addrinfo);
9851 	rctx->broken_server = DNS_R_LAME;
9852 	rctx->next_server = true;
9853 	FCTXTRACE("lame server");
9854 	rctx_done(rctx, result);
9855 
9856 	return ISC_R_COMPLETE;
9857 }
9858 
9859 /***
9860  *** Resolver Methods
9861  ***/
9862 static void
9863 dns_resolver__destroy(dns_resolver_t *res) {
9864 	alternate_t *a = NULL;
9865 
9866 	REQUIRE(!atomic_load_acquire(&res->priming));
9867 	REQUIRE(res->primefetch == NULL);
9868 
9869 	RTRACE("destroy");
9870 
9871 	REQUIRE(atomic_load_acquire(&res->nfctx) == 0);
9872 
9873 	res->magic = 0;
9874 
9875 	dns_nametree_detach(&res->algorithms);
9876 	dns_nametree_detach(&res->digests);
9877 	dns_nametree_detach(&res->mustbesecure);
9878 
9879 	if (res->querystats != NULL) {
9880 		dns_stats_detach(&res->querystats);
9881 	}
9882 	if (res->stats != NULL) {
9883 		isc_stats_detach(&res->stats);
9884 	}
9885 
9886 	isc_mutex_destroy(&res->primelock);
9887 	isc_mutex_destroy(&res->lock);
9888 
9889 	INSIST(isc_hashmap_count(res->fctxs) == 0);
9890 	isc_hashmap_destroy(&res->fctxs);
9891 	isc_rwlock_destroy(&res->fctxs_lock);
9892 
9893 	INSIST(isc_hashmap_count(res->counters) == 0);
9894 	isc_hashmap_destroy(&res->counters);
9895 	isc_rwlock_destroy(&res->counters_lock);
9896 
9897 	if (res->dispatches4 != NULL) {
9898 		dns_dispatchset_destroy(&res->dispatches4);
9899 	}
9900 	if (res->dispatches6 != NULL) {
9901 		dns_dispatchset_destroy(&res->dispatches6);
9902 	}
9903 	while ((a = ISC_LIST_HEAD(res->alternates)) != NULL) {
9904 		ISC_LIST_UNLINK(res->alternates, a, link);
9905 		if (!a->isaddress) {
9906 			dns_name_free(&a->_u._n.name, res->mctx);
9907 		}
9908 		isc_mem_put(res->mctx, a, sizeof(*a));
9909 	}
9910 
9911 	dns_view_weakdetach(&res->view);
9912 
9913 	for (size_t i = 0; i < res->nloops; i++) {
9914 		dns_message_destroypools(&res->namepools[i], &res->rdspools[i]);
9915 	}
9916 	isc_mem_cput(res->mctx, res->rdspools, res->nloops,
9917 		     sizeof(res->rdspools[0]));
9918 	isc_mem_cput(res->mctx, res->namepools, res->nloops,
9919 		     sizeof(res->namepools[0]));
9920 
9921 	isc_mem_putanddetach(&res->mctx, res, sizeof(*res));
9922 }
9923 
9924 static void
9925 spillattimer_countdown(void *arg) {
9926 	dns_resolver_t *res = (dns_resolver_t *)arg;
9927 	unsigned int spillat = 0;
9928 
9929 	REQUIRE(VALID_RESOLVER(res));
9930 
9931 	if (atomic_load(&res->exiting)) {
9932 		isc_timer_destroy(&res->spillattimer);
9933 		return;
9934 	}
9935 
9936 	LOCK(&res->lock);
9937 	INSIST(!atomic_load_acquire(&res->exiting));
9938 	if (res->spillat > res->spillatmin) {
9939 		spillat = --res->spillat;
9940 	}
9941 	if (res->spillat <= res->spillatmin) {
9942 		isc_timer_destroy(&res->spillattimer);
9943 	}
9944 	UNLOCK(&res->lock);
9945 	if (spillat > 0) {
9946 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
9947 			      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
9948 			      "clients-per-query decreased to %u", spillat);
9949 	}
9950 }
9951 
9952 isc_result_t
9953 dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr, isc_nm_t *nm,
9954 		    unsigned int options, isc_tlsctx_cache_t *tlsctx_cache,
9955 		    dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
9956 		    dns_resolver_t **resp) {
9957 	dns_resolver_t *res = NULL;
9958 
9959 	/*
9960 	 * Create a resolver.
9961 	 */
9962 
9963 	REQUIRE(DNS_VIEW_VALID(view));
9964 	REQUIRE(resp != NULL && *resp == NULL);
9965 	REQUIRE(tlsctx_cache != NULL);
9966 	REQUIRE(dispatchv4 != NULL || dispatchv6 != NULL);
9967 
9968 	res = isc_mem_get(view->mctx, sizeof(*res));
9969 	*res = (dns_resolver_t){
9970 		.loopmgr = loopmgr,
9971 		.rdclass = view->rdclass,
9972 		.nm = nm,
9973 		.options = options,
9974 		.tlsctx_cache = tlsctx_cache,
9975 		.spillatmin = 10,
9976 		.spillat = 10,
9977 		.spillatmax = 100,
9978 		.retryinterval = 800,
9979 		.nonbackofftries = 3,
9980 		.query_timeout = DEFAULT_QUERY_TIMEOUT,
9981 		.maxdepth = DEFAULT_RECURSION_DEPTH,
9982 		.maxqueries = DEFAULT_MAX_QUERIES,
9983 		.alternates = ISC_LIST_INITIALIZER,
9984 		.nloops = isc_loopmgr_nloops(loopmgr),
9985 		.maxvalidations = DEFAULT_MAX_VALIDATIONS,
9986 		.maxvalidationfails = DEFAULT_MAX_VALIDATION_FAILURES,
9987 	};
9988 
9989 	RTRACE("create");
9990 
9991 	dns_view_weakattach(view, &res->view);
9992 	isc_mem_attach(view->mctx, &res->mctx);
9993 
9994 	res->quotaresp[dns_quotatype_zone] = DNS_R_DROP;
9995 	res->quotaresp[dns_quotatype_server] = DNS_R_SERVFAIL;
9996 
9997 #if DNS_RESOLVER_TRACE
9998 	fprintf(stderr, "dns_resolver__init:%s:%s:%d:%p->references = 1\n",
9999 		__func__, __FILE__, __LINE__, res);
10000 #endif
10001 	isc_refcount_init(&res->references, 1);
10002 
10003 	isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->fctxs);
10004 	isc_rwlock_init(&res->fctxs_lock);
10005 
10006 	isc_hashmap_create(view->mctx, RES_DOMAIN_HASH_BITS, &res->counters);
10007 	isc_rwlock_init(&res->counters_lock);
10008 
10009 	if (dispatchv4 != NULL) {
10010 		dns_dispatchset_create(res->mctx, dispatchv4, &res->dispatches4,
10011 				       res->nloops);
10012 	}
10013 
10014 	if (dispatchv6 != NULL) {
10015 		dns_dispatchset_create(res->mctx, dispatchv6, &res->dispatches6,
10016 				       res->nloops);
10017 	}
10018 
10019 	isc_mutex_init(&res->lock);
10020 	isc_mutex_init(&res->primelock);
10021 
10022 	dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "algorithms",
10023 			    &res->algorithms);
10024 	dns_nametree_create(res->mctx, DNS_NAMETREE_BITS, "ds-digests",
10025 			    &res->digests);
10026 	dns_nametree_create(res->mctx, DNS_NAMETREE_BOOL,
10027 			    "dnssec-must-be-secure", &res->mustbesecure);
10028 
10029 	res->namepools = isc_mem_cget(res->mctx, res->nloops,
10030 				      sizeof(res->namepools[0]));
10031 	res->rdspools = isc_mem_cget(res->mctx, res->nloops,
10032 				     sizeof(res->rdspools[0]));
10033 	for (size_t i = 0; i < res->nloops; i++) {
10034 		isc_loop_t *loop = isc_loop_get(res->loopmgr, i);
10035 		isc_mem_t *pool_mctx = isc_loop_getmctx(loop);
10036 
10037 		dns_message_createpools(pool_mctx, &res->namepools[i],
10038 					&res->rdspools[i]);
10039 	}
10040 
10041 	res->magic = RES_MAGIC;
10042 
10043 	*resp = res;
10044 
10045 	return ISC_R_SUCCESS;
10046 }
10047 
10048 static void
10049 prime_done(void *arg) {
10050 	dns_fetchresponse_t *resp = (dns_fetchresponse_t *)arg;
10051 	dns_resolver_t *res = resp->arg;
10052 	dns_fetch_t *fetch = NULL;
10053 	dns_db_t *db = NULL;
10054 
10055 	REQUIRE(VALID_RESOLVER(res));
10056 
10057 	int level = (resp->result == ISC_R_SUCCESS) ? ISC_LOG_DEBUG(1)
10058 						    : ISC_LOG_NOTICE;
10059 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
10060 		      DNS_LOGMODULE_RESOLVER, level,
10061 		      "resolver priming query complete: %s",
10062 		      isc_result_totext(resp->result));
10063 
10064 	LOCK(&res->primelock);
10065 	fetch = res->primefetch;
10066 	res->primefetch = NULL;
10067 	UNLOCK(&res->primelock);
10068 
10069 	atomic_compare_exchange_enforced(&res->priming, &(bool){ true }, false);
10070 
10071 	if (resp->result == ISC_R_SUCCESS && res->view->cache != NULL &&
10072 	    res->view->hints != NULL)
10073 	{
10074 		dns_cache_attachdb(res->view->cache, &db);
10075 		dns_root_checkhints(res->view, res->view->hints, db);
10076 		dns_db_detach(&db);
10077 	}
10078 
10079 	if (resp->node != NULL) {
10080 		dns_db_detachnode(resp->db, &resp->node);
10081 	}
10082 	if (resp->db != NULL) {
10083 		dns_db_detach(&resp->db);
10084 	}
10085 	if (dns_rdataset_isassociated(resp->rdataset)) {
10086 		dns_rdataset_disassociate(resp->rdataset);
10087 	}
10088 	INSIST(resp->sigrdataset == NULL);
10089 
10090 	isc_mem_put(res->mctx, resp->rdataset, sizeof(*resp->rdataset));
10091 	isc_mem_putanddetach(&resp->mctx, resp, sizeof(*resp));
10092 	dns_resolver_destroyfetch(&fetch);
10093 }
10094 
10095 void
10096 dns_resolver_prime(dns_resolver_t *res) {
10097 	bool want_priming = false;
10098 	isc_result_t result;
10099 
10100 	REQUIRE(VALID_RESOLVER(res));
10101 	REQUIRE(res->frozen);
10102 
10103 	RTRACE("dns_resolver_prime");
10104 
10105 	if (!atomic_load_acquire(&res->exiting)) {
10106 		want_priming = atomic_compare_exchange_strong_acq_rel(
10107 			&res->priming, &(bool){ false }, true);
10108 	}
10109 
10110 	if (want_priming) {
10111 		/*
10112 		 * To avoid any possible recursive locking problems, we
10113 		 * start the priming fetch like any other fetch, and
10114 		 * holding no resolver locks.  No one else will try to
10115 		 * start it because we're the ones who set res->priming
10116 		 * to true. Any other callers of dns_resolver_prime()
10117 		 * while we're running will see that res->priming is
10118 		 * already true and do nothing.
10119 		 */
10120 		RTRACE("priming");
10121 
10122 		dns_rdataset_t *rdataset = isc_mem_get(res->mctx,
10123 						       sizeof(*rdataset));
10124 		dns_rdataset_init(rdataset);
10125 
10126 		LOCK(&res->primelock);
10127 		result = dns_resolver_createfetch(
10128 			res, dns_rootname, dns_rdatatype_ns, NULL, NULL, NULL,
10129 			NULL, 0, DNS_FETCHOPT_NOFORWARD, 0, NULL, isc_loop(),
10130 			prime_done, res, rdataset, NULL, &res->primefetch);
10131 		UNLOCK(&res->primelock);
10132 
10133 		if (result != ISC_R_SUCCESS) {
10134 			isc_mem_put(res->mctx, rdataset, sizeof(*rdataset));
10135 			atomic_compare_exchange_enforced(
10136 				&res->priming, &(bool){ true }, false);
10137 		}
10138 		inc_stats(res, dns_resstatscounter_priming);
10139 	}
10140 }
10141 
10142 void
10143 dns_resolver_freeze(dns_resolver_t *res) {
10144 	/*
10145 	 * Freeze resolver.
10146 	 */
10147 
10148 	REQUIRE(VALID_RESOLVER(res));
10149 
10150 	res->frozen = true;
10151 }
10152 
10153 void
10154 dns_resolver_shutdown(dns_resolver_t *res) {
10155 	isc_result_t result;
10156 	bool is_false = false;
10157 
10158 	REQUIRE(VALID_RESOLVER(res));
10159 
10160 	RTRACE("shutdown");
10161 
10162 	if (atomic_compare_exchange_strong(&res->exiting, &is_false, true)) {
10163 		isc_hashmap_iter_t *it = NULL;
10164 
10165 		RTRACE("exiting");
10166 
10167 		RWLOCK(&res->fctxs_lock, isc_rwlocktype_write);
10168 		isc_hashmap_iter_create(res->fctxs, &it);
10169 		for (result = isc_hashmap_iter_first(it);
10170 		     result == ISC_R_SUCCESS;
10171 		     result = isc_hashmap_iter_next(it))
10172 		{
10173 			fetchctx_t *fctx = NULL;
10174 
10175 			isc_hashmap_iter_current(it, (void **)&fctx);
10176 			INSIST(fctx != NULL);
10177 
10178 			fetchctx_ref(fctx);
10179 			isc_async_run(fctx->loop, fctx_shutdown, fctx);
10180 		}
10181 		isc_hashmap_iter_destroy(&it);
10182 		RWUNLOCK(&res->fctxs_lock, isc_rwlocktype_write);
10183 
10184 		LOCK(&res->lock);
10185 		if (res->spillattimer != NULL) {
10186 			isc_timer_async_destroy(&res->spillattimer);
10187 		}
10188 		UNLOCK(&res->lock);
10189 	}
10190 }
10191 
10192 #if DNS_RESOLVER_TRACE
10193 ISC_REFCOUNT_TRACE_IMPL(dns_resolver, dns_resolver__destroy);
10194 #else
10195 ISC_REFCOUNT_IMPL(dns_resolver, dns_resolver__destroy);
10196 #endif
10197 
10198 static void
10199 log_fetch(const dns_name_t *name, dns_rdatatype_t type) {
10200 	char namebuf[DNS_NAME_FORMATSIZE];
10201 	char typebuf[DNS_RDATATYPE_FORMATSIZE];
10202 	int level = ISC_LOG_DEBUG(1);
10203 
10204 	/*
10205 	 * If there's no chance of logging it, don't render (format) the
10206 	 * name and RDATA type (further below), and return early.
10207 	 */
10208 	if (!isc_log_wouldlog(dns_lctx, level)) {
10209 		return;
10210 	}
10211 
10212 	dns_name_format(name, namebuf, sizeof(namebuf));
10213 	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
10214 
10215 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
10216 		      DNS_LOGMODULE_RESOLVER, level, "fetch: %s/%s", namebuf,
10217 		      typebuf);
10218 }
10219 
10220 static void
10221 fctx_minimize_qname(fetchctx_t *fctx) {
10222 	isc_result_t result;
10223 	unsigned int dlabels, nlabels;
10224 	dns_name_t name;
10225 
10226 	REQUIRE(VALID_FCTX(fctx));
10227 
10228 	dns_name_init(&name, NULL);
10229 
10230 	dlabels = dns_name_countlabels(fctx->qmindcname);
10231 	nlabels = dns_name_countlabels(fctx->name);
10232 
10233 	if (dlabels > fctx->qmin_labels) {
10234 		fctx->qmin_labels = dlabels + 1;
10235 	} else {
10236 		fctx->qmin_labels++;
10237 	}
10238 
10239 	if (fctx->ip6arpaskip) {
10240 		/*
10241 		 * For ip6.arpa we want to skip some of the labels, with
10242 		 * boundaries at /16, /32, /48, /56, /64 and /128
10243 		 * In 'label count' terms that's equal to
10244 		 *    7    11   15   17   19      35
10245 		 * We fix fctx->qmin_labels to point to the nearest
10246 		 * boundary
10247 		 */
10248 		if (fctx->qmin_labels < 7) {
10249 			fctx->qmin_labels = 7;
10250 		} else if (fctx->qmin_labels < 11) {
10251 			fctx->qmin_labels = 11;
10252 		} else if (fctx->qmin_labels < 15) {
10253 			fctx->qmin_labels = 15;
10254 		} else if (fctx->qmin_labels < 17) {
10255 			fctx->qmin_labels = 17;
10256 		} else if (fctx->qmin_labels < 19) {
10257 			fctx->qmin_labels = 19;
10258 		} else if (fctx->qmin_labels < 35) {
10259 			fctx->qmin_labels = 35;
10260 		} else {
10261 			fctx->qmin_labels = nlabels;
10262 		}
10263 	} else if (fctx->qmin_labels > DNS_QMIN_MAXLABELS) {
10264 		fctx->qmin_labels = DNS_NAME_MAXLABELS;
10265 	}
10266 
10267 	if (fctx->qmin_labels < nlabels) {
10268 		dns_rdataset_t rdataset;
10269 		dns_fixedname_t fixed;
10270 		dns_name_t *fname = dns_fixedname_initname(&fixed);
10271 		dns_rdataset_init(&rdataset);
10272 		do {
10273 			/*
10274 			 * We want to query for qmin_labels from fctx->name.
10275 			 */
10276 			dns_name_split(fctx->name, fctx->qmin_labels, NULL,
10277 				       &name);
10278 			/*
10279 			 * Look to see if we have anything cached about NS
10280 			 * RRsets at this name and if so skip this name and
10281 			 * try with an additional label prepended.
10282 			 */
10283 			result = dns_db_find(fctx->cache, &name, NULL,
10284 					     dns_rdatatype_ns, 0, 0, NULL,
10285 					     fname, &rdataset, NULL);
10286 			if (dns_rdataset_isassociated(&rdataset)) {
10287 				dns_rdataset_disassociate(&rdataset);
10288 			}
10289 			switch (result) {
10290 			case ISC_R_SUCCESS:
10291 			case DNS_R_CNAME:
10292 			case DNS_R_DNAME:
10293 			case DNS_R_NCACHENXDOMAIN:
10294 			case DNS_R_NCACHENXRRSET:
10295 				fctx->qmin_labels++;
10296 				continue;
10297 			default:
10298 				break;
10299 			}
10300 			break;
10301 		} while (fctx->qmin_labels < nlabels);
10302 	}
10303 
10304 	if (fctx->qmin_labels < nlabels) {
10305 		dns_name_copy(&name, fctx->qminname);
10306 		fctx->qmintype = dns_rdatatype_ns;
10307 		fctx->minimized = true;
10308 	} else {
10309 		/* Minimization is done, we'll ask for whole qname */
10310 		dns_name_copy(fctx->name, fctx->qminname);
10311 		fctx->qmintype = fctx->type;
10312 		fctx->minimized = false;
10313 	}
10314 
10315 	char domainbuf[DNS_NAME_FORMATSIZE];
10316 	dns_name_format(fctx->qminname, domainbuf, sizeof(domainbuf));
10317 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
10318 		      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(5),
10319 		      "QNAME minimization - %s minimized, qmintype %d "
10320 		      "qminname %s",
10321 		      fctx->minimized ? "" : "not", fctx->qmintype, domainbuf);
10322 }
10323 
10324 static isc_result_t
10325 get_attached_fctx(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
10326 		  dns_rdatatype_t type, const dns_name_t *domain,
10327 		  dns_rdataset_t *nameservers, const isc_sockaddr_t *client,
10328 		  unsigned int options, unsigned int depth, isc_counter_t *qc,
10329 		  fetchctx_t **fctxp, bool *new_fctx) {
10330 	isc_result_t result;
10331 	fetchctx_t key = {
10332 		.name = UNCONST(name),
10333 		.options = options,
10334 		.type = type,
10335 	};
10336 	fetchctx_t *fctx = NULL;
10337 	isc_rwlocktype_t locktype = isc_rwlocktype_read;
10338 	uint32_t hashval = fctx_hash(&key);
10339 
10340 again:
10341 	RWLOCK(&res->fctxs_lock, locktype);
10342 	result = isc_hashmap_find(res->fctxs, hashval, fctx_match, &key,
10343 				  (void **)&fctx);
10344 	switch (result) {
10345 	case ISC_R_SUCCESS:
10346 		break;
10347 	case ISC_R_NOTFOUND:
10348 		result = fctx_create(res, loop, name, type, domain, nameservers,
10349 				     client, options, depth, qc, &fctx);
10350 		if (result != ISC_R_SUCCESS) {
10351 			goto unlock;
10352 		}
10353 
10354 		UPGRADELOCK(&res->fctxs_lock, locktype);
10355 
10356 		void *found = NULL;
10357 		result = isc_hashmap_add(res->fctxs, hashval, fctx_match, fctx,
10358 					 fctx, &found);
10359 		if (result == ISC_R_SUCCESS) {
10360 			*new_fctx = true;
10361 			fctx->hashed = true;
10362 		} else {
10363 			fctx_done_detach(&fctx, result);
10364 			fctx = found;
10365 			result = ISC_R_SUCCESS;
10366 		}
10367 		INSIST(result == ISC_R_SUCCESS);
10368 		break;
10369 	default:
10370 		UNREACHABLE();
10371 	}
10372 	fetchctx_ref(fctx);
10373 unlock:
10374 	RWUNLOCK(&res->fctxs_lock, locktype);
10375 	if (result == ISC_R_SUCCESS) {
10376 		LOCK(&fctx->lock);
10377 		if (SHUTTINGDOWN(fctx) || fctx->cloned) {
10378 			/*
10379 			 * This is the single place where fctx might get
10380 			 * accesses from a different thread, so we need to
10381 			 * double check whether fctxs is done (or cloned) and
10382 			 * help with the release if the fctx has been cloned.
10383 			 */
10384 			release_fctx(fctx);
10385 			UNLOCK(&fctx->lock);
10386 			fetchctx_detach(&fctx);
10387 			goto again;
10388 		}
10389 
10390 		INSIST(!SHUTTINGDOWN(fctx));
10391 		*fctxp = fctx;
10392 	}
10393 
10394 	return result;
10395 }
10396 
10397 isc_result_t
10398 dns_resolver_createfetch(dns_resolver_t *res, const dns_name_t *name,
10399 			 dns_rdatatype_t type, const dns_name_t *domain,
10400 			 dns_rdataset_t *nameservers,
10401 			 dns_forwarders_t *forwarders,
10402 			 const isc_sockaddr_t *client, dns_messageid_t id,
10403 			 unsigned int options, unsigned int depth,
10404 			 isc_counter_t *qc, isc_loop_t *loop, isc_job_cb cb,
10405 			 void *arg, dns_rdataset_t *rdataset,
10406 			 dns_rdataset_t *sigrdataset, dns_fetch_t **fetchp) {
10407 	dns_fetch_t *fetch = NULL;
10408 	fetchctx_t *fctx = NULL;
10409 	isc_result_t result = ISC_R_SUCCESS;
10410 	bool new_fctx = false;
10411 	unsigned int count = 0;
10412 	unsigned int spillat;
10413 	unsigned int spillatmin;
10414 	isc_mem_t *mctx = isc_loop_getmctx(loop);
10415 
10416 	UNUSED(forwarders);
10417 
10418 	REQUIRE(VALID_RESOLVER(res));
10419 	REQUIRE(res->frozen);
10420 	/* XXXRTH  Check for meta type */
10421 	if (domain != NULL) {
10422 		REQUIRE(DNS_RDATASET_VALID(nameservers));
10423 		REQUIRE(nameservers->type == dns_rdatatype_ns);
10424 	} else {
10425 		REQUIRE(nameservers == NULL);
10426 	}
10427 	REQUIRE(forwarders == NULL);
10428 	REQUIRE(!dns_rdataset_isassociated(rdataset));
10429 	REQUIRE(sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset));
10430 	REQUIRE(fetchp != NULL && *fetchp == NULL);
10431 
10432 	if (atomic_load_acquire(&res->exiting)) {
10433 		return ISC_R_SHUTTINGDOWN;
10434 	}
10435 
10436 	log_fetch(name, type);
10437 
10438 	fetch = isc_mem_get(mctx, sizeof(*fetch));
10439 	*fetch = (dns_fetch_t){ 0 };
10440 
10441 	dns_resolver_attach(res, &fetch->res);
10442 	isc_mem_attach(mctx, &fetch->mctx);
10443 
10444 	if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
10445 		/*
10446 		 * We don't save the unshared fetch context to a bucket because
10447 		 * we also would never match it again.
10448 		 */
10449 
10450 		LOCK(&res->lock);
10451 		spillat = res->spillat;
10452 		spillatmin = res->spillatmin;
10453 		UNLOCK(&res->lock);
10454 
10455 		result = get_attached_fctx(res, loop, name, type, domain,
10456 					   nameservers, client, options, depth,
10457 					   qc, &fctx, &new_fctx);
10458 		if (result != ISC_R_SUCCESS) {
10459 			goto fail;
10460 		}
10461 
10462 		/* On success, the fctx is locked in get_attached_fctx() */
10463 		INSIST(!SHUTTINGDOWN(fctx));
10464 
10465 		/* Is this a duplicate? */
10466 		if (client != NULL) {
10467 			dns_fetchresponse_t *resp = NULL;
10468 			for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
10469 			     resp = ISC_LIST_NEXT(resp, link))
10470 			{
10471 				if (resp->client != NULL && resp->id == id &&
10472 				    isc_sockaddr_equal(resp->client, client))
10473 				{
10474 					result = DNS_R_DUPLICATE;
10475 					goto unlock;
10476 				}
10477 
10478 				count++;
10479 			}
10480 		}
10481 		if (count >= spillatmin && spillatmin != 0) {
10482 			if (count >= spillat) {
10483 				fctx->spilled = true;
10484 			}
10485 			if (fctx->spilled) {
10486 				inc_stats(res, dns_resstatscounter_clientquota);
10487 				result = DNS_R_DROP;
10488 				goto unlock;
10489 			}
10490 		}
10491 	} else {
10492 		result = fctx_create(res, loop, name, type, domain, nameservers,
10493 				     client, options, depth, qc, &fctx);
10494 		if (result != ISC_R_SUCCESS) {
10495 			goto unlock;
10496 		}
10497 		new_fctx = true;
10498 	}
10499 
10500 	RUNTIME_CHECK(fctx != NULL);
10501 
10502 	if (fctx->depth > depth) {
10503 		fctx->depth = depth;
10504 	}
10505 
10506 	fctx_join(fctx, loop, client, id, cb, arg, rdataset, sigrdataset,
10507 		  fetch);
10508 
10509 	if (new_fctx) {
10510 		fetchctx_ref(fctx);
10511 		isc_async_run(fctx->loop, fctx_start, fctx);
10512 	}
10513 
10514 unlock:
10515 	if ((options & DNS_FETCHOPT_UNSHARED) == 0) {
10516 		UNLOCK(&fctx->lock);
10517 		fetchctx_unref(fctx);
10518 	}
10519 
10520 fail:
10521 	if (result != ISC_R_SUCCESS) {
10522 		dns_resolver_detach(&fetch->res);
10523 		isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
10524 		return result;
10525 	}
10526 
10527 	FTRACE("created");
10528 	*fetchp = fetch;
10529 
10530 	return ISC_R_SUCCESS;
10531 }
10532 
10533 void
10534 dns_resolver_cancelfetch(dns_fetch_t *fetch) {
10535 	fetchctx_t *fctx = NULL;
10536 
10537 	REQUIRE(DNS_FETCH_VALID(fetch));
10538 	fctx = fetch->private;
10539 	REQUIRE(VALID_FCTX(fctx));
10540 
10541 	FTRACE("cancelfetch");
10542 
10543 	LOCK(&fctx->lock);
10544 
10545 	/*
10546 	 * Find the completion event associated with this fetch (as opposed
10547 	 * to those for other fetches that have joined the same fctx) and run
10548 	 * the callback asynchronously with a ISC_R_CANCELED result.
10549 	 */
10550 	if (fctx->state != fetchstate_done) {
10551 		dns_fetchresponse_t *next = NULL;
10552 		for (dns_fetchresponse_t *resp = ISC_LIST_HEAD(fctx->resps);
10553 		     resp != NULL; resp = next)
10554 		{
10555 			next = ISC_LIST_NEXT(resp, link);
10556 
10557 			if (resp->fetch == fetch) {
10558 				resp->result = ISC_R_CANCELED;
10559 				ISC_LIST_UNLINK(fctx->resps, resp, link);
10560 				isc_async_run(resp->loop, resp->cb, resp);
10561 				break;
10562 			}
10563 		}
10564 	}
10565 
10566 	/*
10567 	 * The fctx continues running even if no fetches remain;
10568 	 * the answer is still cached.
10569 	 */
10570 	UNLOCK(&fctx->lock);
10571 }
10572 
10573 void
10574 dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
10575 	dns_fetch_t *fetch = NULL;
10576 	dns_resolver_t *res = NULL;
10577 	fetchctx_t *fctx = NULL;
10578 
10579 	REQUIRE(fetchp != NULL);
10580 	fetch = *fetchp;
10581 	*fetchp = NULL;
10582 	REQUIRE(DNS_FETCH_VALID(fetch));
10583 	fctx = fetch->private;
10584 	REQUIRE(VALID_FCTX(fctx));
10585 	res = fetch->res;
10586 
10587 	FTRACE("destroyfetch");
10588 
10589 	fetch->magic = 0;
10590 
10591 	LOCK(&fctx->lock);
10592 	/*
10593 	 * Sanity check: the caller should have gotten its event before
10594 	 * trying to destroy the fetch.
10595 	 */
10596 	if (fctx->state != fetchstate_done) {
10597 		dns_fetchresponse_t *resp = NULL, *next = NULL;
10598 		for (resp = ISC_LIST_HEAD(fctx->resps); resp != NULL;
10599 		     resp = next)
10600 		{
10601 			next = ISC_LIST_NEXT(resp, link);
10602 			RUNTIME_CHECK(resp->fetch != fetch);
10603 		}
10604 	}
10605 	UNLOCK(&fctx->lock);
10606 
10607 	isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
10608 
10609 	fetchctx_detach(&fctx);
10610 	dns_resolver_detach(&res);
10611 }
10612 
10613 void
10614 dns_resolver_logfetch(dns_fetch_t *fetch, isc_log_t *lctx,
10615 		      isc_logcategory_t *category, isc_logmodule_t *module,
10616 		      int level, bool duplicateok) {
10617 	fetchctx_t *fctx = NULL;
10618 
10619 	REQUIRE(DNS_FETCH_VALID(fetch));
10620 	fctx = fetch->private;
10621 	REQUIRE(VALID_FCTX(fctx));
10622 
10623 	LOCK(&fctx->lock);
10624 
10625 	if (!fctx->logged || duplicateok) {
10626 		char domainbuf[DNS_NAME_FORMATSIZE];
10627 		dns_name_format(fctx->domain, domainbuf, sizeof(domainbuf));
10628 		isc_log_write(lctx, category, module, level,
10629 			      "fetch completed for %s in "
10630 			      "%" PRIu64 "."
10631 			      "%06" PRIu64 ": %s/%s "
10632 			      "[domain:%s,referral:%u,restart:%u,qrysent:%u,"
10633 			      "timeout:%u,lame:%u,quota:%u,neterr:%u,"
10634 			      "badresp:%u,adberr:%u,findfail:%u,valfail:%u]",
10635 			      fctx->info, fctx->duration / US_PER_SEC,
10636 			      fctx->duration % US_PER_SEC,
10637 			      isc_result_totext(fctx->result),
10638 			      isc_result_totext(fctx->vresult), domainbuf,
10639 			      fctx->referrals, fctx->restarts, fctx->querysent,
10640 			      fctx->timeouts, fctx->lamecount, fctx->quotacount,
10641 			      fctx->neterr, fctx->badresp, fctx->adberr,
10642 			      fctx->findfail, fctx->valfail);
10643 		fctx->logged = true;
10644 	}
10645 
10646 	UNLOCK(&fctx->lock);
10647 }
10648 
10649 dns_dispatch_t *
10650 dns_resolver_dispatchv4(dns_resolver_t *resolver) {
10651 	REQUIRE(VALID_RESOLVER(resolver));
10652 	return dns_dispatchset_get(resolver->dispatches4);
10653 }
10654 
10655 dns_dispatch_t *
10656 dns_resolver_dispatchv6(dns_resolver_t *resolver) {
10657 	REQUIRE(VALID_RESOLVER(resolver));
10658 	return dns_dispatchset_get(resolver->dispatches6);
10659 }
10660 
10661 void
10662 dns_resolver_addalternate(dns_resolver_t *res, const isc_sockaddr_t *alt,
10663 			  const dns_name_t *name, in_port_t port) {
10664 	alternate_t *a;
10665 
10666 	REQUIRE(VALID_RESOLVER(res));
10667 	REQUIRE(!res->frozen);
10668 	REQUIRE((alt == NULL) ^ (name == NULL));
10669 
10670 	a = isc_mem_get(res->mctx, sizeof(*a));
10671 	if (alt != NULL) {
10672 		a->isaddress = true;
10673 		a->_u.addr = *alt;
10674 	} else {
10675 		a->isaddress = false;
10676 		a->_u._n.port = port;
10677 		dns_name_init(&a->_u._n.name, NULL);
10678 		dns_name_dup(name, res->mctx, &a->_u._n.name);
10679 	}
10680 	ISC_LINK_INIT(a, link);
10681 	ISC_LIST_APPEND(res->alternates, a, link);
10682 }
10683 
10684 isc_result_t
10685 dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name,
10686 			       unsigned int alg) {
10687 	REQUIRE(VALID_RESOLVER(resolver));
10688 
10689 	if (alg > 255) {
10690 		return ISC_R_RANGE;
10691 	}
10692 
10693 	return dns_nametree_add(resolver->algorithms, name, alg);
10694 }
10695 
10696 isc_result_t
10697 dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
10698 			       unsigned int digest_type) {
10699 	REQUIRE(VALID_RESOLVER(resolver));
10700 
10701 	if (digest_type > 255) {
10702 		return ISC_R_RANGE;
10703 	}
10704 
10705 	return dns_nametree_add(resolver->digests, name, digest_type);
10706 }
10707 
10708 bool
10709 dns_resolver_algorithm_supported(dns_resolver_t *resolver,
10710 				 const dns_name_t *name, unsigned int alg) {
10711 	REQUIRE(VALID_RESOLVER(resolver));
10712 
10713 	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT)) {
10714 		return false;
10715 	}
10716 
10717 	if (dns_nametree_covered(resolver->algorithms, name, NULL, alg)) {
10718 		return false;
10719 	}
10720 
10721 	return dst_algorithm_supported(alg);
10722 }
10723 
10724 bool
10725 dns_resolver_ds_digest_supported(dns_resolver_t *resolver,
10726 				 const dns_name_t *name,
10727 				 unsigned int digest_type) {
10728 	REQUIRE(VALID_RESOLVER(resolver));
10729 
10730 	if (dns_nametree_covered(resolver->digests, name, NULL, digest_type)) {
10731 		return false;
10732 	}
10733 
10734 	return dst_ds_digest_supported(digest_type);
10735 }
10736 
10737 isc_result_t
10738 dns_resolver_setmustbesecure(dns_resolver_t *resolver, const dns_name_t *name,
10739 			     bool value) {
10740 	isc_result_t result;
10741 
10742 	REQUIRE(VALID_RESOLVER(resolver));
10743 
10744 	result = dns_nametree_add(resolver->mustbesecure, name, value);
10745 	return result;
10746 }
10747 
10748 bool
10749 dns_resolver_getmustbesecure(dns_resolver_t *resolver, const dns_name_t *name) {
10750 	REQUIRE(VALID_RESOLVER(resolver));
10751 
10752 	return dns_nametree_covered(resolver->mustbesecure, name, NULL, 0);
10753 }
10754 
10755 void
10756 dns_resolver_getclientsperquery(dns_resolver_t *resolver, uint32_t *cur,
10757 				uint32_t *min, uint32_t *max) {
10758 	REQUIRE(VALID_RESOLVER(resolver));
10759 
10760 	LOCK(&resolver->lock);
10761 	SET_IF_NOT_NULL(cur, resolver->spillat);
10762 	SET_IF_NOT_NULL(min, resolver->spillatmin);
10763 	SET_IF_NOT_NULL(max, resolver->spillatmax);
10764 	UNLOCK(&resolver->lock);
10765 }
10766 
10767 void
10768 dns_resolver_setclientsperquery(dns_resolver_t *resolver, uint32_t min,
10769 				uint32_t max) {
10770 	REQUIRE(VALID_RESOLVER(resolver));
10771 
10772 	LOCK(&resolver->lock);
10773 	resolver->spillatmin = resolver->spillat = min;
10774 	resolver->spillatmax = max;
10775 	UNLOCK(&resolver->lock);
10776 }
10777 
10778 void
10779 dns_resolver_setfetchesperzone(dns_resolver_t *resolver, uint32_t clients) {
10780 	REQUIRE(VALID_RESOLVER(resolver));
10781 
10782 	atomic_store_release(&resolver->zspill, clients);
10783 }
10784 
10785 uint32_t
10786 dns_resolver_getfetchesperzone(dns_resolver_t *resolver) {
10787 	REQUIRE(VALID_RESOLVER(resolver));
10788 
10789 	return atomic_load_relaxed(&resolver->zspill);
10790 }
10791 
10792 bool
10793 dns_resolver_getzeronosoattl(dns_resolver_t *resolver) {
10794 	REQUIRE(VALID_RESOLVER(resolver));
10795 
10796 	return resolver->zero_no_soa_ttl;
10797 }
10798 
10799 void
10800 dns_resolver_setzeronosoattl(dns_resolver_t *resolver, bool state) {
10801 	REQUIRE(VALID_RESOLVER(resolver));
10802 
10803 	resolver->zero_no_soa_ttl = state;
10804 }
10805 
10806 unsigned int
10807 dns_resolver_getoptions(dns_resolver_t *resolver) {
10808 	REQUIRE(VALID_RESOLVER(resolver));
10809 
10810 	return resolver->options;
10811 }
10812 
10813 unsigned int
10814 dns_resolver_gettimeout(dns_resolver_t *resolver) {
10815 	REQUIRE(VALID_RESOLVER(resolver));
10816 
10817 	return resolver->query_timeout;
10818 }
10819 
10820 void
10821 dns_resolver_settimeout(dns_resolver_t *resolver, unsigned int timeout) {
10822 	REQUIRE(VALID_RESOLVER(resolver));
10823 
10824 	if (timeout < MINIMUM_QUERY_TIMEOUT) {
10825 		timeout *= 1000;
10826 	}
10827 
10828 	if (timeout == 0) {
10829 		timeout = DEFAULT_QUERY_TIMEOUT;
10830 	}
10831 	if (timeout > MAXIMUM_QUERY_TIMEOUT) {
10832 		timeout = MAXIMUM_QUERY_TIMEOUT;
10833 	}
10834 	if (timeout < MINIMUM_QUERY_TIMEOUT) {
10835 		timeout = MINIMUM_QUERY_TIMEOUT;
10836 	}
10837 
10838 	resolver->query_timeout = timeout;
10839 }
10840 
10841 void
10842 dns_resolver_setmaxvalidations(dns_resolver_t *resolver, uint32_t max) {
10843 	REQUIRE(VALID_RESOLVER(resolver));
10844 	atomic_store(&resolver->maxvalidations, max);
10845 }
10846 
10847 void
10848 dns_resolver_setmaxvalidationfails(dns_resolver_t *resolver, uint32_t max) {
10849 	REQUIRE(VALID_RESOLVER(resolver));
10850 	atomic_store(&resolver->maxvalidationfails, max);
10851 }
10852 
10853 void
10854 dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) {
10855 	REQUIRE(VALID_RESOLVER(resolver));
10856 	resolver->maxdepth = maxdepth;
10857 }
10858 
10859 unsigned int
10860 dns_resolver_getmaxdepth(dns_resolver_t *resolver) {
10861 	REQUIRE(VALID_RESOLVER(resolver));
10862 	return resolver->maxdepth;
10863 }
10864 
10865 void
10866 dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries) {
10867 	REQUIRE(VALID_RESOLVER(resolver));
10868 	resolver->maxqueries = queries;
10869 }
10870 
10871 unsigned int
10872 dns_resolver_getmaxqueries(dns_resolver_t *resolver) {
10873 	REQUIRE(VALID_RESOLVER(resolver));
10874 	return resolver->maxqueries;
10875 }
10876 
10877 void
10878 dns_resolver_dumpfetches(dns_resolver_t *res, isc_statsformat_t format,
10879 			 FILE *fp) {
10880 	isc_result_t result;
10881 	isc_hashmap_iter_t *it = NULL;
10882 
10883 	REQUIRE(VALID_RESOLVER(res));
10884 	REQUIRE(fp != NULL);
10885 	REQUIRE(format == isc_statsformat_file);
10886 
10887 	RWLOCK(&res->counters_lock, isc_rwlocktype_read);
10888 	isc_hashmap_iter_create(res->counters, &it);
10889 	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
10890 	     result = isc_hashmap_iter_next(it))
10891 	{
10892 		fctxcount_t *counter = NULL;
10893 		isc_hashmap_iter_current(it, (void **)&counter);
10894 
10895 		dns_name_print(counter->domain, fp);
10896 		fprintf(fp,
10897 			": %" PRIuFAST32 " active (%" PRIuFAST32
10898 			" spilled, %" PRIuFAST32 " allowed)\n",
10899 			counter->count, counter->dropped, counter->allowed);
10900 	}
10901 	RWUNLOCK(&res->counters_lock, isc_rwlocktype_read);
10902 	isc_hashmap_iter_destroy(&it);
10903 }
10904 
10905 isc_result_t
10906 dns_resolver_dumpquota(dns_resolver_t *res, isc_buffer_t **buf) {
10907 	isc_result_t result;
10908 	isc_hashmap_iter_t *it = NULL;
10909 	uint_fast32_t spill;
10910 
10911 	REQUIRE(VALID_RESOLVER(res));
10912 
10913 	spill = atomic_load_acquire(&res->zspill);
10914 	if (spill == 0) {
10915 		return ISC_R_SUCCESS;
10916 	}
10917 
10918 	RWLOCK(&res->counters_lock, isc_rwlocktype_read);
10919 	isc_hashmap_iter_create(res->counters, &it);
10920 	for (result = isc_hashmap_iter_first(it); result == ISC_R_SUCCESS;
10921 	     result = isc_hashmap_iter_next(it))
10922 	{
10923 		fctxcount_t *counter = NULL;
10924 		uint_fast32_t count, dropped, allowed;
10925 		char nb[DNS_NAME_FORMATSIZE];
10926 		char text[DNS_NAME_FORMATSIZE + BUFSIZ];
10927 
10928 		isc_hashmap_iter_current(it, (void **)&counter);
10929 
10930 		LOCK(&counter->lock);
10931 		count = counter->count;
10932 		dropped = counter->dropped;
10933 		allowed = counter->allowed;
10934 		UNLOCK(&counter->lock);
10935 
10936 		if (count < spill) {
10937 			continue;
10938 		}
10939 
10940 		dns_name_format(counter->domain, nb, sizeof(nb));
10941 		snprintf(text, sizeof(text),
10942 			 "\n- %s: %" PRIuFAST32 " active (allowed %" PRIuFAST32
10943 			 " spilled %" PRIuFAST32 ")",
10944 			 nb, count, allowed, dropped);
10945 
10946 		result = isc_buffer_reserve(*buf, strlen(text));
10947 		if (result != ISC_R_SUCCESS) {
10948 			goto cleanup;
10949 		}
10950 		isc_buffer_putstr(*buf, text);
10951 	}
10952 	if (result == ISC_R_NOMORE) {
10953 		result = ISC_R_SUCCESS;
10954 	}
10955 
10956 cleanup:
10957 	RWUNLOCK(&res->counters_lock, isc_rwlocktype_read);
10958 	isc_hashmap_iter_destroy(&it);
10959 	return result;
10960 }
10961 
10962 void
10963 dns_resolver_setquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which,
10964 			      isc_result_t resp) {
10965 	REQUIRE(VALID_RESOLVER(resolver));
10966 	REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server);
10967 	REQUIRE(resp == DNS_R_DROP || resp == DNS_R_SERVFAIL);
10968 
10969 	resolver->quotaresp[which] = resp;
10970 }
10971 
10972 isc_result_t
10973 dns_resolver_getquotaresponse(dns_resolver_t *resolver, dns_quotatype_t which) {
10974 	REQUIRE(VALID_RESOLVER(resolver));
10975 	REQUIRE(which == dns_quotatype_zone || which == dns_quotatype_server);
10976 
10977 	return resolver->quotaresp[which];
10978 }
10979 
10980 void
10981 dns_resolver_setstats(dns_resolver_t *res, isc_stats_t *stats) {
10982 	REQUIRE(VALID_RESOLVER(res));
10983 	REQUIRE(res->stats == NULL);
10984 
10985 	isc_stats_attach(stats, &res->stats);
10986 
10987 	/* initialize the bucket "counter"; it's a static value */
10988 	set_stats(res, dns_resstatscounter_buckets,
10989 		  isc_loopmgr_nloops(res->loopmgr));
10990 }
10991 
10992 void
10993 dns_resolver_getstats(dns_resolver_t *res, isc_stats_t **statsp) {
10994 	REQUIRE(VALID_RESOLVER(res));
10995 	REQUIRE(statsp != NULL && *statsp == NULL);
10996 
10997 	if (res->stats != NULL) {
10998 		isc_stats_attach(res->stats, statsp);
10999 	}
11000 }
11001 
11002 void
11003 dns_resolver_incstats(dns_resolver_t *res, isc_statscounter_t counter) {
11004 	REQUIRE(VALID_RESOLVER(res));
11005 
11006 	isc_stats_increment(res->stats, counter);
11007 }
11008 
11009 void
11010 dns_resolver_setquerystats(dns_resolver_t *res, dns_stats_t *stats) {
11011 	REQUIRE(VALID_RESOLVER(res));
11012 	REQUIRE(res->querystats == NULL);
11013 
11014 	dns_stats_attach(stats, &res->querystats);
11015 }
11016 
11017 void
11018 dns_resolver_getquerystats(dns_resolver_t *res, dns_stats_t **statsp) {
11019 	REQUIRE(VALID_RESOLVER(res));
11020 	REQUIRE(statsp != NULL && *statsp == NULL);
11021 
11022 	if (res->querystats != NULL) {
11023 		dns_stats_attach(res->querystats, statsp);
11024 	}
11025 }
11026