OpenGrok

73 #include <ns/client.h>
121 /*% Client presented a bad COOKIE. */
123 /*% Client presented a valid COOKIE. */
125 /*% Client presented a COOKIE. */
127 /*% Client presented a CLIENT-SUBNET option. */
144 /*% Was the client already sent a response? */
161 client_trace(ns_client_t *client, int level, const char *message) {
162 	if (client != NULL && client->query.qname != NULL) {
166 			dns_name_format(client->query.qname, qbuf,
168 			dns_rdatatype_format(client->query.qtype, tbuf,
172 				      "query client=%p thread=0x%" PRIxPTR
174 				      client, isc_thread_self(), qbuf, tbuf,
180 			      "query client=%p thread=0x%" PRIxPTR
182 			      client, isc_thread_self(), message);
185 #define CTRACE(l, m)  client_trace(client, l, m)
186 #define CCTRACE(l, m) client_trace(qctx->client, l, m)
230 validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
235 		       dns_dbversion_t *version, ns_client_t *client,
240 log_queryerror(ns_client_t *client, isc_result_t result, int line, int level);
243 rpz_st_clear(ns_client_t *client);
246 rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
260 acquire_recursionquota(ns_client_t *client);
263 release_recursionquota(ns_client_t *client);
342  * 1. Set up query context and other resources for a client
374  *    otherwise go to 15 to clean up and return the delegation to the client.
378  *     query_addauth()), then go to 15 to return NXDOMAIN to client.
383  *     NOERROR/ANCOUNT=0 to client.
396  *     return it to the client.
407 qctx_init(ns_client_t *client, dns_fetchresponse_t **respp,
420 query_setup(ns_client_t *client, dns_rdatatype_t qtype);
533 inc_stats(ns_client_t *client, isc_statscounter_t counter) {
534 	dns_zone_t *zone = client->query.authzone;
540 	ns_stats_increment(client->manager->sctx->nsstats, counter);
561 			rdataset = ISC_LIST_HEAD(client->query.qname->list);
573 ns_client_log_flags(ns_client_t *client, unsigned int flags,
578 	isc_buffer_putuint8(&b, WANTRECURSION(client) ? '+' : '-');
579 	if (client->ednsversion >= 0) {
583 			 (unsigned char)client->ednsversion);
586 	if (client->signer != NULL) {
589 	if (TCP(client)) {
598 	if (HAVECOOKIE(client)) {
600 	} else if (WANTCOOKIE(client)) {
609 ns_client_log_ecs(ns_client_t *client, char *ecsbuf, size_t len) {
611 	dns_ecs_format(&client->ecs, ecsbuf + 6, len - 6);
616 log_response(ns_client_t *client, dns_rcode_t rcode) {
631 	dns_name_format(client->query.origqname, namebuf, sizeof(namebuf));
632 	dns_rdataclass_format(client->message->rdclass, classbuf,
634 	dns_rdatatype_format(client->query.qtype, typebuf, sizeof(typebuf));
638 	isc_netaddr_format(&client->destaddr, onbuf, sizeof(onbuf));
640 	if (HAVEECS(client)) {
641 		ns_client_log_ecs(client, ecsbuf, sizeof(ecsbuf));
644 	ns_client_log_flags(client, client->message->flags, client->extflags,
646 	ns_client_log(client, NS_LOGCATEGORY_RESPONSES, NS_LOGMODULE_QUERY,
649 		      client->message->counts[DNS_SECTION_ANSWER],
650 		      client->message->counts[DNS_SECTION_AUTHORITY],
651 		      client->message->counts[DNS_SECTION_ADDITIONAL], flagsbuf,
656 query_send(ns_client_t *client) {
659 	if ((client->message->flags & DNS_MESSAGEFLAG_AA) == 0) {
660 		inc_stats(client, ns_statscounter_nonauthans);
662 		inc_stats(client, ns_statscounter_authans);
665 	if (client->message->rcode == dns_rcode_noerror) {
667 		if (ISC_LIST_EMPTY(client->message->sections[answer])) {
668 			if (client->query.isreferral) {
676 	} else if (client->message->rcode == dns_rcode_nxdomain) {
678 	} else if (client->message->rcode == dns_rcode_badcookie) {
684 	inc_stats(client, counter);
685 	ns_client_send(client);
687 	if ((client->manager->sctx->options & NS_SERVER_LOGRESPONSES) != 0) {
688 		log_response(client, client->message->rcode);
691 	isc_nmhandle_detach(&client->reqhandle);
695 query_error(ns_client_t *client, isc_result_t result, int line) {
703 		inc_stats(client, ns_statscounter_servfail);
706 		inc_stats(client, ns_statscounter_formerr);
709 		inc_stats(client, ns_statscounter_failure);
713 	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
717 	log_queryerror(client, result, line, loglevel);
719 	ns_client_error(client, result);
721 	if (client->query.origqname != NULL &&
722 	    (client->manager->sctx->options & NS_SERVER_LOGRESPONSES) != 0)
724 		log_response(client, rcode);
727 	isc_nmhandle_detach(&client->reqhandle);
731 query_next(ns_client_t *client, isc_result_t result) {
733 		inc_stats(client, ns_statscounter_duplicate);
735 		inc_stats(client, ns_statscounter_dropped);
737 		inc_stats(client, ns_statscounter_failure);
739 	ns_client_drop(client, result);
740 	isc_nmhandle_detach(&client->reqhandle);
744 query_freefreeversions(ns_client_t *client, bool everything) {
748 	for (dbversion = ISC_LIST_HEAD(client->query.freeversions), i = 0;
757 			ISC_LIST_UNLINK(client->query.freeversions, dbversion,
759 			isc_mem_put(client->manager->mctx, dbversion,
766 ns_query_cancel(ns_client_t *client) {
767 	REQUIRE(NS_CLIENT_VALID(client));
769 	LOCK(&client->query.fetchlock);
771 		dns_fetch_t **fetchp = &client->query.recursions[i].fetch;
777 	if (client->query.hookactx != NULL) {
778 		client->query.hookactx->cancel(client->query.hookactx);
779 		client->query.hookactx = NULL;
781 	UNLOCK(&client->query.fetchlock);
785 query_reset(ns_client_t *client, bool everything) {
792 	 * Reset the query state of a client to its default state.
798 	ns_query_cancel(client);
803 	for (dbversion = ISC_LIST_HEAD(client->query.activeversions);
809 		ISC_LIST_INITANDAPPEND(client->query.freeversions, dbversion,
812 	ISC_LIST_INIT(client->query.activeversions);
814 	if (client->query.authdb != NULL) {
815 		dns_db_detach(&client->query.authdb);
817 	if (client->query.authzone != NULL) {
818 		dns_zone_detach(&client->query.authzone);
821 	if (client->query.dns64_aaaa != NULL) {
822 		ns_client_putrdataset(client, &client->query.dns64_aaaa);
824 	if (client->query.dns64_sigaaaa != NULL) {
825 		ns_client_putrdataset(client, &client->query.dns64_sigaaaa);
827 	if (client->query.dns64_aaaaok != NULL) {
828 		isc_mem_cput(client->manager->mctx, client->query.dns64_aaaaok,
829 			     client->query.dns64_aaaaoklen, sizeof(bool));
830 		client->query.dns64_aaaaok = NULL;
831 		client->query.dns64_aaaaoklen = 0;
834 	ns_client_putrdataset(client, &client->query.redirect.rdataset);
835 	ns_client_putrdataset(client, &client->query.redirect.sigrdataset);
836 	if (client->query.redirect.db != NULL) {
837 		if (client->query.redirect.node != NULL) {
838 			dns_db_detachnode(client->query.redirect.db,
839 					  &client->query.redirect.node);
841 		dns_db_detach(&client->query.redirect.db);
843 	if (client->query.redirect.zone != NULL) {
844 		dns_zone_detach(&client->query.redirect.zone);
847 	query_freefreeversions(client, everything);
849 	for (dbuf = ISC_LIST_HEAD(client->query.namebufs); dbuf != NULL;
854 			ISC_LIST_UNLINK(client->query.namebufs, dbuf, link);
859 	if (client->query.restarts > 0) {
861 		 * client->query.qname was dynamically allocated.
863 		dns_message_puttempname(client->message, &client->query.qname);
865 	client->query.qname = NULL;
866 	client->query.attributes = (NS_QUERYATTR_RECURSIONOK |
868 	client->query.restarts = 0;
869 	client->query.timerset = false;
870 	if (client->query.rpz_st != NULL) {
871 		rpz_st_clear(client);
873 			INSIST(client->query.rpz_st->rpsdb == NULL);
874 			isc_mem_put(client->manager->mctx, client->query.rpz_st,
875 				    sizeof(*client->query.rpz_st));
876 			client->query.rpz_st = NULL;
879 	if (client->query.qc != NULL) {
880 		isc_counter_detach(&client->query.qc);
882 	client->query.origqname = NULL;
883 	client->query.dboptions = 0;
884 	client->query.fetchoptions = 0;
885 	client->query.gluedb = NULL;
886 	client->query.authdbset = false;
887 	client->query.isreferral = false;
888 	client->query.dns64_options = 0;
889 	client->query.dns64_ttl = UINT32_MAX;
890 	recparam_update(&client->query.recparam, 0, NULL, NULL);
891 	client->query.root_key_sentinel_keyid = 0;
892 	client->query.root_key_sentinel_is_ta = false;
893 	client->query.root_key_sentinel_not_ta = false;
897 query_cleanup(ns_client_t *client) {
898 	query_reset(client, false);
902 ns_query_free(ns_client_t *client) {
903 	REQUIRE(NS_CLIENT_VALID(client));
905 	query_reset(client, true);
909 ns_query_init(ns_client_t *client) {
910 	REQUIRE(NS_CLIENT_VALID(client));
912 	client->query = (ns_query_t){ 0 };
914 	ISC_LIST_INIT(client->query.namebufs);
915 	ISC_LIST_INIT(client->query.activeversions);
916 	ISC_LIST_INIT(client->query.freeversions);
919 	 * This mutex is destroyed when the client is destroyed in
922 	isc_mutex_init(&client->query.fetchlock);
923 	client->query.redirect.fname =
924 		dns_fixedname_initname(&client->query.redirect.fixed);
925 	query_reset(client, false);
926 	ns_client_newdbversion(client, 3);
927 	ns_client_newnamebuf(client);
931  * Check if 'client' is allowed to query the cache of its associated view.
935  * The cache ACL is only evaluated once for each client and then the result is
936  * cached: if NS_QUERYATTR_CACHEACLOKVALID is set in client->query.attributes,
938  * also stored in client->query.attributes: if NS_QUERYATTR_CACHEACLOK is set,
939  * the client is allowed cache access.
943  *\li	#ISC_R_SUCCESS	'client' is allowed to access cache
944  *\li	#DNS_R_REFUSED	'client' is not allowed to access cache
947 query_checkcacheaccess(ns_client_t *client, const dns_name_t *name,
951 	if ((client->query.attributes & NS_QUERYATTR_CACHEACLOKVALID) == 0) {
969 		result = ns_client_checkaclsilent(client, NULL,
970 						  client->view->cacheacl, true);
974 				client, &client->destaddr,
975 				client->view->cacheonacl, true);
981 			client->query.attributes |= NS_QUERYATTR_CACHEACLOK;
986 						 client->view->rdclass, msg,
988 				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
1000 			dns_ede_add(&client->edectx, DNS_EDE_PROHIBITED, NULL);
1004 						 client->view->rdclass, msg,
1006 				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
1015 		 * NS_QUERYATTR_CACHEACLOK for this client from now on.
1017 		client->query.attributes |= NS_QUERYATTR_CACHEACLOKVALID;
1020 	return (client->query.attributes & NS_QUERYATTR_CACHEACLOK) != 0
1026 query_validatezonedb(ns_client_t *client, const dns_name_t *name,
1041 		return query_checkcacheaccess(client, name, qtype, options);
1051 	if (client->query.rpz_st == NULL &&
1052 	    !(WANTRECURSION(client) && RECURSIONOK(client)) &&
1053 	    client->query.authdbset && db != client->query.authdb)
1064 	    !RECURSIONOK(client))
1080 	dbversion = ns_client_findversion(client, db);
1098 		queryacl = client->view->queryacl;
1099 		if ((client->query.attributes & NS_QUERYATTR_QUERYOKVALID) != 0)
1103 			 * NS_QUERYATTR_QUERYOK is set, then the client is
1108 			if ((client->query.attributes & NS_QUERYATTR_QUERYOK) ==
1119 	result = ns_client_checkaclsilent(client, NULL, queryacl, true);
1125 						 client->view->rdclass, msg,
1127 				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
1134 					 client->view->rdclass, msg,
1136 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
1139 			dns_ede_add(&client->edectx, DNS_EDE_PROHIBITED, NULL);
1143 	if (queryacl == client->view->queryacl) {
1150 			client->query.attributes |= NS_QUERYATTR_QUERYOK;
1156 		client->query.attributes |= NS_QUERYATTR_QUERYOKVALID;
1163 			queryonacl = client->view->queryonacl;
1166 		result = ns_client_checkaclsilent(client, &client->destaddr,
1169 			dns_ede_add(&client->edectx, DNS_EDE_PROHIBITED, NULL);
1172 			ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
1192 query_getzonedb(ns_client_t *client, const dns_name_t *name,
1213 	result = dns_view_findzone(client->view, name, ztoptions, &zone);
1226 	result = query_validatezonedb(client, name, qtype, options, zone, db,
1254 rpz_log_rewrite(ns_client_t *client, bool disabled, dns_rpz_policy_t policy,
1272 		ns_stats_increment(client->manager->sctx->nsstats,
1287 	st = client->query.rpz_st;
1292 	dns_name_format(client->query.qname, qname_buf, sizeof(qname_buf));
1304 	rdataset = ISC_LIST_HEAD(client->query.origqname->list);
1314 	ns_client_log(client, log_cat, NS_LOGMODULE_QUERY, DNS_RPZ_INFO_LEVEL,
1322 rpz_log_fail_helper(ns_client_t *client, int level, dns_name_t *p_name,
1355 	dns_name_format(client->query.qname, qnamebuf, sizeof(qnamebuf));
1365 	ns_client_log(client, NS_LOGCATEGORY_QUERY_ERRORS, NS_LOGMODULE_QUERY,
1372 rpz_log_fail(ns_client_t *client, int level, dns_name_t *p_name,
1374 	rpz_log_fail_helper(client, level, p_name, rpz_type, DNS_RPZ_TYPE_BAD,
1382 rpz_getdb(ns_client_t *client, dns_name_t *p_name, dns_rpz_type_t rpz_type,
1392 	result = query_getzonedb(client, p_name, dns_rdatatype_any, options,
1395 		dns_rpz_st_t *st = client->query.rpz_st;
1404 			dns_name_format(client->query.qname, qnamebuf,
1407 			ns_client_log(client, DNS_LOGCATEGORY_RPZ,
1416 	rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, p_name, rpz_type,
1423  * if the client is not allowed to use the cache.
1426 query_getcachedb(ns_client_t *client, const dns_name_t *name,
1434 	if (!USECACHE(client)) {
1438 	dns_db_attach(client->view->cachedb, &db);
1440 	result = query_checkcacheaccess(client, name, qtype, options);
1455 query_getdb(ns_client_t *client, dns_name_t *name, dns_rdatatype_t qtype,
1471 	result = query_getzonedb(client, name, qtype, options, &zone, dbp,
1484 	    !ISC_LIST_EMPTY(client->view->dlz_searched))
1491 		dns_clientinfo_init(&ci, client, NULL);
1492 		dns_clientinfo_setecs(&ci, &client->ecs);
1495 		tresult = dns_view_searchdlz(client->view, name, zonelabels,
1521 			dbversion = ns_client_findversion(client, tdbp);
1549 			result = query_getcachedb(client, name, qtype, dbp,
1558 query_isduplicate(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
1569 		result = dns_message_findname(client->message, section, name,
1599  * 'client'. Called from query_additionalauth().
1623 			 ns_client_t *client, dns_dbnode_t **nodep,
1632 	dns_clientinfo_init(&ci, client, NULL);
1640 				client->query.dboptions, client->now, &node,
1699 	ns_client_t *client = qctx->client;
1711 	if (!client->query.authdbset || client->query.authdb == NULL) {
1715 	dbversion = ns_client_findversion(client, client->query.authdb);
1720 	dns_db_attach(client->query.authdb, &db);
1725 	result = query_additionalauthfind(db, version, name, type, client,
1729 	    RECURSIONOK(client))
1738 		result = query_getzonedb(client, name, type, options, &zone,
1748 						  client, &node, fname,
1769 	ns_client_t *client = qctx->client;
1787 	REQUIRE(NS_CLIENT_VALID(client));
1790 	if (!WANTDNSSEC(client) && dns_rdatatype_isdnssec(qtype)) {
1797 	dns_clientinfo_init(&ci, client, NULL);
1814 	dbuf = ns_client_getnamebuf(client);
1815 	fname = ns_client_newname(client, dbuf, &b);
1816 	rdataset = ns_client_newrdataset(client);
1817 	if (WANTDNSSEC(client)) {
1818 		sigrdataset = ns_client_newrdataset(client);
1826 	    client->query.qtype != dns_rdatatype_ns)
1849 	result = query_getcachedb(client, name, qtype, &db, options);
1852 		 * Most likely the client isn't allowed to query the cache.
1860 		sigrdataset = ns_client_newrdataset(client);
1865 				client->query.dboptions | DNS_DBFIND_GLUEOK |
1867 				client->now, &node, fname, &cm, &ci, rdataset,
1871 	if (!WANTDNSSEC(client)) {
1872 		ns_client_putrdataset(client, &sigrdataset);
1902 	 * case (identified by client->query.gluedb being set).
1905 	if (client->query.gluedb == NULL) {
1912 	if (!dns_name_issubdomain(name, dns_db_origin(client->query.gluedb))) {
1916 	dbversion = ns_client_findversion(client, client->query.gluedb);
1921 	dns_db_attach(client->query.gluedb, &db);
1925 				client->query.dboptions | DNS_DBFIND_GLUEOK,
1926 				client->now, &node, fname, &cm, &ci, rdataset,
1939 	ns_client_keepname(client, fname, dbuf);
1954 	    !query_isduplicate(client, fname, type, &mname))
1958 			ns_client_releasename(client, &fname);
1992 			rdataset = ns_client_newrdataset(client);
1998 		} else if (WANTDNSSEC(client)) {
1999 			sigrdataset = ns_client_newrdataset(client);
2001 		if (query_isduplicate(client, fname, dns_rdatatype_a, NULL)) {
2005 					     0, client->now, rdataset,
2025 				invalid = !validate(client, db, fname, rdataset,
2035 			} else if (!query_isduplicate(client, fname,
2040 						ns_client_releasename(client,
2055 						ns_client_newrdataset(client);
2057 				rdataset = ns_client_newrdataset(client);
2068 		if (query_isduplicate(client, fname, dns_rdatatype_aaaa, NULL))
2073 					     dns_rdatatype_aaaa, 0, client->now,
2094 				invalid = !validate(client, db, fname, rdataset,
2105 			} else if (!query_isduplicate(client, fname,
2111 						ns_client_releasename(client,
2147 		dns_message_addname(client->message, fname,
2157 		if (client->additionaldepth++ < client->view->max_restarts) {
2162 		client->additionaldepth--;
2172 	ns_client_putrdataset(client, &rdataset);
2174 		ns_client_putrdataset(client, &sigrdataset);
2177 		ns_client_releasename(client, &fname);
2203 	ns_client_t *client = qctx->client;
2204 	dns_order_t *order = client->view->order;
2208 	UNUSED(client);
2223 	ns_client_t *client = qctx->client;
2228 	if (NOADDITIONAL(client)) {
2236 	    client->query.gluedb != NULL && dns_db_iszone(client->query.gluedb))
2240 		dbversion = ns_client_findversion(client, client->query.gluedb);
2246 					client->message);
2267 	ns_client_t *client = qctx->client;
2281 	 * To the current response for 'client', add the answer RRset
2291 	result = dns_message_findname(client->message, section, name,
2301 			ns_client_releasename(client, namep);
2312 			ns_client_keepname(client, name, dbuf);
2314 		dns_message_addname(client->message, name, section);
2320 			ns_client_releasename(client, namep);
2327 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
2365 mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,
2377 	dns_clientinfo_init(&ci, client, NULL);
2389 			     client->view->acceptexpired);
2391 	(void)dns_db_addrdataset(db, node, NULL, client->now, rdataset, 0,
2393 	(void)dns_db_addrdataset(db, node, NULL, client->now, sigrdataset, 0,
2405 get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
2414 	dns_clientinfo_init(&ci, client, NULL);
2425 					     client->now, keyrdataset, NULL);
2449 					 client->manager->mctx, keyp);
2467        dns_rdata_t *rdata, ns_client_t *client) {
2476 				   client->view->maxbits, client->manager->mctx,
2478 	if (result == DNS_R_SIGEXPIRED && client->view->acceptexpired) {
2492 validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
2511 		if (!dns_resolver_algorithm_supported(client->view->resolver,
2525 			dns_ede_add(&client->edectx, DNS_EDE_DNSKEYALG,
2534 			if (!get_key(client, db, &rrsig, &keyrdataset, &key)) {
2537 			if (verify(key, name, rdataset, &rdata, client)) {
2540 				mark_secure(client, db, name, &rrsig, rdataset,
2554 fixrdataset(ns_client_t *client, dns_rdataset_t **rdataset) {
2556 		*rdataset = ns_client_newrdataset(client);
2563 fixfname(ns_client_t *client, dns_name_t **fname, isc_buffer_t **dbuf,
2566 		*dbuf = ns_client_getnamebuf(client);
2567 		*fname = ns_client_newname(client, *dbuf, nbuf);
2572 free_fresp(ns_client_t *client, dns_fetchresponse_t **frespp) {
2587 		ns_client_putrdataset(client, &fresp->rdataset);
2590 		ns_client_putrdataset(client, &fresp->sigrdataset);
2597 recursionquotatype_attach(ns_client_t *client, bool soft_limit) {
2601 	result = isc_quota_acquire(&client->manager->sctx->recursionquota);
2615 		isc_quota_release(&client->manager->sctx->recursionquota);
2621 	recurscount = ns_stats_increment(client->manager->sctx->nsstats,
2624 	ns_stats_update_if_greater(client->manager->sctx->nsstats,
2632 recursionquotatype_attach_hard(ns_client_t *client) {
2633 	return recursionquotatype_attach(client, false);
2637 recursionquotatype_attach_soft(ns_client_t *client) {
2638 	return recursionquotatype_attach(client, true);
2642 recursionquotatype_detach(ns_client_t *client) {
2643 	isc_quota_release(&client->manager->sctx->recursionquota);
2644 	ns_stats_decrement(client->manager->sctx->nsstats,
2649 stale_refresh_aftermath(ns_client_t *client, isc_result_t result) {
2681 		dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
2682 		dns_rdatatype_format(client->query.qtype, typebuf,
2684 		ns_client_log(client, NS_LOGCATEGORY_SERVE_STALE,
2695 		client->now = isc_stdtime_now();
2696 		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
2697 		qctx_init(client, NULL, 0, &qctx);
2700 		dns_clientinfo_init(&ci, qctx.client, NULL);
2701 		if (HAVEECS(qctx.client)) {
2702 			dns_clientinfo_setecs(&ci, &qctx.client->ecs);
2710 		dboptions = qctx.client->query.dboptions;
2714 		dns_db_attach(qctx.client->view->cachedb, &db);
2715 		(void)dns_db_findext(db, qctx.client->query.qname, NULL,
2716 				     qctx.client->query.qtype, dboptions,
2717 				     qctx.client->now, &qctx.node, qctx.fname,
2733 	ns_client_t *client = resp->arg;
2738 	REQUIRE(NS_CLIENT_VALID(client));
2742 	handlep = &client->query.recursions[recursion_type].handle;
2743 	fetchp = &client->query.recursions[recursion_type].fetch;
2746 	LOCK(&client->query.fetchlock);
2751 	UNLOCK(&client->query.fetchlock);
2755 		stale_refresh_aftermath(client, result);
2758 	recursionquotatype_detach(client);
2759 	free_fresp(client, &resp);
2781  * associated with 'client'.  If the recursive clients quota (or even soft
2787 fetch_and_forget(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t qtype,
2797 	result = recursionquotatype_attach_hard(client);
2802 	tmprdataset = ns_client_newrdataset(client);
2804 	if (!TCP(client)) {
2805 		peeraddr = &client->peeraddr;
2812 		options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
2816 		options = client->query.fetchoptions;
2820 		options = client->query.fetchoptions;
2827 	handlep = &client->query.recursions[recursion_type].handle;
2828 	fetchp = &client->query.recursions[recursion_type].fetch;
2830 	isc_nmhandle_attach(client->handle, handlep);
2832 		client->view->resolver, qname, qtype, NULL, NULL, NULL,
2833 		peeraddr, client->message->id, options, 0, NULL,
2834 		client->query.qc, NULL, client->manager->loop, cb, client, NULL,
2837 		ns_client_putrdataset(client, &tmprdataset);
2839 		recursionquotatype_detach(client);
2844 query_stale_refresh(ns_client_t *client, dns_name_t *qname,
2853 					(client->query.dboptions &
2858 	if (FETCH_RECTYPE_STALE_REFRESH(client) != NULL ||
2859 	    (client->query.dboptions & DNS_DBFIND_STALETIMEOUT) == 0 ||
2868 	dns_rdatatype_format(client->query.qtype, typebuf, sizeof(typebuf));
2876 	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
2880 	fetch_and_forget(client, qname, client->query.qtype,
2885 query_stale_refresh_ncache(ns_client_t *client) {
2888 	if (client->query.origqname != NULL) {
2889 		qname = client->query.origqname;
2891 		qname = client->query.qname;
2893 	query_stale_refresh(client, qname, NULL);
2897 query_prefetch(ns_client_t *client, dns_name_t *qname,
2901 	if (FETCH_RECTYPE_PREFETCH(client) != NULL ||
2902 	    client->view->prefetch_trigger == 0U ||
2903 	    rdataset->ttl > client->view->prefetch_trigger ||
2907 		query_stale_refresh(client, qname, rdataset);
2911 	fetch_and_forget(client, qname, rdataset->type, RECTYPE_PREFETCH);
2914 	ns_stats_increment(client->manager->sctx->nsstats,
2947 rpz_ready(ns_client_t *client, dns_rdataset_t **rdatasetp) {
2953 		*rdatasetp = ns_client_newrdataset(client);
2961 rpz_st_clear(ns_client_t *client) {
2962 	dns_rpz_st_t *st = client->query.rpz_st;
2967 		ns_client_putrdataset(client, &st->m.rdataset);
2973 		ns_client_putrdataset(client, &st->r.ns_rdataset);
2976 		ns_client_putrdataset(client, &st->r.r_rdataset);
2981 		ns_client_putrdataset(client, &st->q.rdataset);
2984 		ns_client_putrdataset(client, &st->q.sigrdataset);
2995 rpz_get_zbits(ns_client_t *client, dns_rdatatype_t ip_type,
3000 	REQUIRE(client != NULL);
3001 	REQUIRE(client->query.rpz_st != NULL);
3003 	st = client->query.rpz_st;
3067 	 * If the client wants recursion, allow only compatible policies.
3069 	if (!RECURSIONOK(client)) {
3077 query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
3080 	if (FETCH_RECTYPE_RPZ(client) != NULL) {
3084 	fetch_and_forget(client, qname, type, RECTYPE_RPZ);
3088  * Get an NS, A, or AAAA rrset related to the response for the client
3092 rpz_rrset_find(ns_client_t *client, dns_name_t *name, dns_rdatatype_t type,
3107 	st = client->query.rpz_st;
3116 			ns_client_putrdataset(client, rdatasetp);
3122 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, name,
3130 	result = rpz_ready(client, rdatasetp);
3142 		result = query_getdb(client, name, type,
3146 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, name,
3162 	dns_clientinfo_init(&ci, client, NULL);
3163 	result = dns_db_findext(*dbp, name, version, type, options, client->now,
3165 	if (result == DNS_R_DELEGATION && is_zone && USECACHE(client)) {
3172 		dns_db_attach(client->view->cachedb, dbp);
3174 					client->now, &node, found, &cm, &ci,
3186 		} else if (!client->view->rpzs->p.nsip_wait_recurse ||
3187 			   (!client->view->rpzs->p.nsdname_wait_recurse &&
3190 			query_rpzfetch(client, name, type);
3194 			result = ns_query_recurse(client, type, st->r_name,
3210 rpz_get_p_name(ns_client_t *client, dns_name_t *p_name, dns_rpz_zone_t *rpz,
3264 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, suffix,
3272 			rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL1, suffix,
3282  * The self-name (usually the client qname or an NS name) is compared with
3289  * If it is best, the caller records it in client->query.rpz_st->m.
3292 rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
3309 	dns_clientinfo_init(&ci, client, NULL);
3316 	result = rpz_ready(client, rdatasetp);
3322 	result = rpz_getdb(client, p_name, rpz_type, zonep, dbp, versionp);
3329 				client->now, nodep, found, &cm, &ci, *rdatasetp,
3341 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, p_name,
3348 		    !ISC_LIST_EMPTY(client->view->dns64))
3376 				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL,
3398 							qtype, 0, client->now,
3442 		rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, p_name, rpz_type, "",
3489 dnsrps_ck(librpz_emsg_t *emsg, ns_client_t *client, dns_rpsdb_t *rpsdb,
3523 	dns_name_fromregion(client
3524 	rpz_log_rewrite(client, true, dns_dnsrps_2policy(rpsdb->result.zpolicy),
3526 			client->query.rpz_st->p_name, NULL,
3541 dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
3585 	result = rpz_ready(client, p_rdatasetp);
3643 	rpz_save_p(st, client->view->rpzs->zones[rpsdb->result.cznum],
3653 dnsrps_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
3665 	st = client->query.rpz_st;
3668 	result = rpz_ready(client, p_rdatasetp);
3699 		    (res = dnsrps_ck(&emsg, client, rpsdb, recursed)) < 0)
3701 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
3711 dnsrps_rewrite_name(ns_client_t *client, dns_name_t *trig_name, bool recursed,
3723 	st = client->query.rpz_st;
3726 	result = rpz_ready(client, p_rdatasetp);
3748 		    (res = dnsrps_ck(&emsg, client, rpsdb, recursed)) < 0)
3750 			rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
3764 rpz_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
3783 	rpzs = client->view->rpzs;
3784 	st = client->query.rpz_st;
3787 		return dnsrps_rewrite_ip(client, netaddr, rpz_type,
3829 		result = rpz_get_p_name(client, p_name, rpz, rpz_type, ip_name);
3833 		result = rpz_find_p(client, ip_name, qtype, p_name, rpz,
3861 			 * client-IP over QNAME over IP over NSDNAME over NSIP,
3897 			rpz_log_rewrite(client, true, policy, rpz_type, p_zone,
3911 rpz_rewrite_ip_rrset(ns_client_t *client, dns_name_t *name,
3921 	unsigned int options = client->query.dboptions | DNS_DBFIND_GLUEOK;
3927 		zbits = rpz_get_zbits(client, ip_type, rpz_type);
3935 		result = rpz_rrset_find(client, name, ip_type, options,
3957 			rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL1, name,
3962 			if (client->query.rpz_st->m.policy !=
3965 				client->query.rpz_st->m.policy =
3967 				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, name,
3983 			options = client->query.dboptions;
3985 			options = client->query.dboptions | DNS_DBFIND_GLUEOK;
4013 			result = rpz_rewrite_ip(client, &netaddr, qtype,
4020 		 client->query.rpz_st->m.policy == DNS_RPZ_POLICY_MISS);
4030 rpz_rewrite_ip_rrsets(ns_client_t *client, dns_name_t *name,
4041 	st = client->query.rpz_st;
4054 			client, name, qtype, rpz_type, dns_rdatatype_a, &ip_db,
4070 		result = rpz_rewrite_ip_rrset(client, name, qtype, rpz_type,
4078 	ns_client_putrdataset(client, &p_rdataset);
4086  * in client->query.rpz_st.
4090 rpz_rewrite_name(ns_client_t *client, dns_name_t *trig_name,
4114 	rpzs = client->view->rpzs;
4115 	st = client->query.rpz_st;
4119 		return dnsrps_rewrite_name(client, trig_name, recursed,
4124 	zbits = rpz_get_zbits(client, qtype, rpz_type);
4178 		result = rpz_get_p_name(client, p_name, rpz, rpz_type,
4183 		result = rpz_find_p(client, trig_name, qtype, p_name, rpz,
4206 			 * client-IP over QNAME over IP over NSDNAME over NSIP,
4237 			rpz_log_rewrite(client, true, policy, rpz_type, p_zone,
4248 rpz_rewrite_ns_skip(ns_client_t *client, dns_name_t *nsname,
4254 	st = client->query.rpz_st;
4257 		rpz_log_fail_helper(client, level, nsname, DNS_RPZ_TYPE_NSIP,
4282 rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
4306 	rpzs = client->view->rpzs;
4307 	st = client->query.rpz_st;
4315 	if (RECURSING(client)) {
4321 	    (!RECURSIONOK(client) && rpzs->p.no_rd_ok == 0) ||
4322 	    !rpz_ck_dnssec(client, qresult, ordataset, osigset))
4340 		st = isc_mem_get(client->manager->mctx, sizeof(*st));
4358 		client->query.rpz_st = st;
4366 				&emsg, st, rpzs, client->query.qname,
4367 				client->manager->mctx, RECURSIONOK(client));
4369 				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
4384 		client->attributes |= NS_CLIENTATTR_NOSETFC;
4387 			rpz_log_fail(client, DNS_RPZ_INFO_LEVEL, NULL,
4423 		if (RECURSIONOK(client)) {
4433 		rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL3, NULL,
4438 		rpz_log_fail(client, DNS_RPZ_DEBUG_LEVEL1, NULL,
4468 		 * Check once for triggers for the client IP address.
4471 			zbits = rpz_get_zbits(client, dns_rdatatype_none,
4476 							 &client->peeraddr);
4477 				result = rpz_rewrite_ip(client, &netaddr, qtype,
4493 			result = rpz_rewrite_name(client, client->query.qname,
4504 			st->r.label = dns_name_countlabels(client->query.qname);
4511 		 * client-IP trigger before recursion.
4541 	    rpz_get_zbits(client, qtype, DNS_RPZ_TYPE_IP) != 0)
4543 		result = rpz_rewrite_ip_rrsets(client, client->query.qname,
4561 	if (rpz_get_zbits(client, dns_rdatatype_any, DNS_RPZ_TYPE_NSDNAME) ==
4563 	    rpz_get_zbits(client, dns_rdatatype_any, DNS_RPZ_TYPE_NSIP) == 0)
4570 	dns_name_clone(client->query.qname, dns_fixedname_name(&nsnamef));
4571 	options = client->query.dboptions | DNS_DBFIND_GLUEOK;
4577 		if (st->r.label == dns_name_countlabels(client->query.qname)) {
4578 			nsname = client->query.qname;
4581 			dns_name_split(client->query.qname, st->r.label, NULL,
4588 			result = rpz_rrset_find(client, nsname,
4623 				rpz_rewrite_ns_skip(client, nsname, result, 0,
4629 				rpz_rewrite_ns_skip(client, nsname, result,
4634 				rpz_rewrite_ns_skip(client, nsname, result,
4668 					client, &ns.name, qtype,
4680 			result = rpz_rewrite_ip_rrsets(client, &ns.name, qtype,
4698 			options = client->query.dboptions;
4700 			options = client->query.dboptions | DNS_DBFIND_GLUEOK;
4704 		if (rpz_get_zbits(client, dns_rdatatype_any,
4706 		    rpz_get_zbits(client, dns_rdatatype_any,
4721 	    !dnsrps_set_p(&emsg, client, st, qtype, &rdataset,
4724 		rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
4742 			rpz_log_rewrite(client, false, st->m.policy, st->m.type,
4753 	ns_client_putrdataset(client, &rdataset);
4763  * by the client in DNSSEC or a lack of signatures.
4766 rpz_ck_dnssec(ns_client_t *client, isc_result_t qresult,
4776 	if (client->view->rpzs->p.break_dnssec || !WANTDNSSEC(client)) {
4922 warn_rfc1918(ns_client_t *client, dns_name_t *fname, dns_rdataset_t *rdataset) {
4949 				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
4964 		       dns_dbversion_t *version, ns_client_t *client,
4993 	dns_clientinfo_init(&ci, client, NULL);
5011 	dboptions = client->query.dboptions | DNS_DBFIND_FORCENSEC3;
5013 				dns_rdatatype_nsec3, dboptions, client->now,
5037 			ns_client_log(client, DNS_LOGCATEGORY_DNSSEC,
5043 			ns_client_log(client, DNS_LOGCATEGORY_DNSSEC,
5051 		ns_client_log(client, DNS_LOGCATEGORY_DNSSEC,
5108 dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
5111 	dns_aclenv_t *env = client->manager->aclenv;
5112 	dns_dns64_t *dns64 = ISC_LIST_HEAD(client->view->dns64);
5117 	INSIST(client->query.dns64_aaaaok == NULL);
5118 	INSIST(client->query.dns64_aaaaoklen == 0);
5119 	INSIST(client->query.dns64_aaaa == NULL);
5120 	INSIST(client->query.dns64_sigaaaa == NULL);
5126 	if (RECURSIONOK(client)) {
5130 	if (WANTDNSSEC(client) && sigrdataset != NULL &&
5137 	aaaaok = isc_mem_cget(client->manager->mctx, count, sizeof(bool));
5139 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
5140 	if (dns_dns64_aaaaok(dns64, &netaddr, client->signer, env, flags,
5145 				SAVE(client->query.dns64_aaaaok, aaaaok);
5146 				client->query.dns64_aaaaoklen = count;
5151 			isc_mem_cput(client->manager->mctx, aaaaok, count,
5157 		isc_mem_cput(client->manager->mctx, aaaaok, count,
5168  * Only perform the update if the client is in the allow query acl and
5172 redirect(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
5188 	if (client->view->redirect == NULL) {
5196 	dns_clientinfo_init(&ci, client, NULL);
5197 	dns_clientinfo_setecs(&ci, &client->ecs);
5199 	if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp))
5204 	if (WANTDNSSEC(client) && dns_rdataset_isassociated(rdataset)) {
5233 		client, NULL, dns_zone_getqueryacl(client->view->redirect),
5239 	result = dns_zone_getdb(client->view->redirect, &db);
5244 	dbversion = ns_client_findversion(client, db);
5253 	result = dns_db_findext(db, client->query.qname, dbversion->version,
5254 				qtype, DNS_DBFIND_NOZONECUT, client->now, &node,
5295 	client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
5302 redirect2(ns_client_t *client, dns_name_t *name, dns_rdataset_t *rdataset,
5319 	bool redirected = REDIRECT(client);
5323 	client->query.attributes &= ~NS_QUERYATTR_REDIRECT;
5325 	if (client->view->redirectzone == NULL) {
5329 	if (dns_name_issubdomain(name, client->view->redirectzone)) {
5337 	dns_clientinfo_init(&ci, client, NULL);
5338 	dns_clientinfo_setecs(&ci, &client->ecs);
5340 	if (WANTDNSSEC(client) && dns_db_iszone(*dbp) && dns_db_issecure(*dbp))
5345 	if (WANTDNSSEC(client) && dns_rdataset_isassociated(rdataset)) {
5374 	labels = dns_name_countlabels(client->query.qname);
5379 		dns_name_getlabelsequence(client->query.qname, 0, labels - 1,
5382 					      client->view->redirectzone,
5388 		dns_name_copy(client->view->redirectzone, redirectname);
5391 	result = query_getdb(client, redirectname, qtype,
5405 				client->now, &node, found, &cm, &ci, &trdataset,
5431 			result = ns_query_recurse(client, qtype, redirectname,
5434 				client->query.attributes |=
5456 	dns_name_split(found, dns_name_countlabels(client->view->redirectzone),
5484 	client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
5492  * first handling a client query, and by query_resume() when
5499 qctx_init(ns_client_t *client, dns_fetchresponse_t **frespp,
5502 	REQUIRE(client != NULL);
5507 	qctx->client = client;
5509 	dns_view_attach(client->view, &qctx->view);
5552 	if (qctx->client != NULL && qctx->client->query.gluedb != NULL) {
5553 		dns_db_detach(&qctx->client->query.gluedb);
5563 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
5567 		ns_client_putrdataset(qctx->client, &qctx->sigrdataset);
5571 		ns_client_releasename(qctx->client, &qctx->fname);
5584 		ns_client_putrdataset(qctx->client, &qctx->zsigrdataset);
5585 		ns_client_putrdataset(qctx->client, &qctx->zrdataset);
5586 		ns_client_releasename(qctx->client, &qctx->zfname);
5593 		free_fresp(qctx->client, &qctx->fresp);
5617  * Note: this function doesn't attach to the client's handle.  It's the caller's
5625 	/* Then "move" pointers (except client and view) */
5652  * the client request or a return from recursion.
5660 	if (qctx->client->query.origqname != NULL) {
5661 		dns_name_format(qctx->client->query.origqname, qbuf,
5668 		 "client attr:0x%x, query attr:0x%X, restarts:%u, "
5670 		 qctx->client->attributes, qctx->client->query.attributes,
5671 		 qctx->client->query.restarts, qbuf,
5672 		 (int)qctx->client->query.timerset,
5673 		 (int)qctx->client->query.authdbset,
5674 		 (int)qctx->client->query.isreferral);
5682  * Set up query processing for the current query of 'client'.
5693 query_setup(ns_client_t *client, dns_rdatatype_t qtype) {
5697 	qctx_init(client, NULL, qtype, &qctx);
5731 	qctx->client->query.root_key_sentinel_keyid = v;
5743 	const char *ndata = (const char *)qctx->client->query.qname->ndata;
5745 	if (qctx->client->query.qname->length > 30 && ndata[0] == 29 &&
5751 		qctx->client->query.root_key_sentinel_is_ta = true;
5757 		ns_client_log(qctx->client, NS_LOGCATEGORY_TAT,
5760 	} else if (qctx->client->query.qname->length > 31 && ndata[0] == 30 &&
5766 		qctx->client->query.root_key_sentinel_not_ta = true;
5772 		ns_client_log(qctx->client, NS_LOGCATEGORY_TAT,
5779  * Starting point for a client query or a chaining query.
5788 	ns_client_t *client = qctx->client;
5802 	client->query.dboptions &= ~(DNS_DBFIND_STALETIMEOUT |
5812 	if (!TCP(qctx->client) &&
5813 	    (BADCOOKIE(qctx->client) ||
5814 	     (qctx->view->requireservercookie && WANTCOOKIE(qctx->client) &&
5815 	      !HAVECOOKIE(qctx->client))))
5817 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AA;
5818 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
5819 		qctx->client->message->rcode = dns_rcode_badcookie;
5824 	    !dns_rdata_checkowner(qctx->client->query.qname,
5825 				  qctx->client->message->rdclass, qctx->qtype,
5832 		dns_name_format(qctx->client->query.qname, namebuf,
5835 		dns_rdataclass_format(qctx->client->message->rdclass, classbuf,
5837 		ns_client_log(qctx->client, DNS_LOGCATEGORY_SECURITY,
5849 	    qctx->client->query.restarts == 0 &&
5852 	    (qctx->client->message->flags & DNS_MESSAGEFLAG_CD) == 0)
5863 	    !dns_name_equal(qctx->client->query.qname, dns_rootname))
5874 	result = query_getdb(qctx->client, qctx->client->query.qname,
5878 	    qctx->qtype == dns_rdatatype_ds && !RECURSIONOK(qctx->client) &&
5894 			qctx->client, qctx->client->query.qname, qctx->qtype,
5902 			ns_client_putrdataset(qctx->client, &qctx->rdataset);
5935 			if (WANTRECURSION(qctx->client)) {
5936 				dns_ede_add(&qctx->client->edectx,
5939 				inc_stats(qctx->client,
5942 				inc_stats(qctx->client,
5945 			if (!PARTIALANSWER(qctx->client)) {
5979 	if (qctx->fresp == NULL && qctx->client->query.restarts == 0) {
5987 						&qctx->client->query.authzone);
5989 			dns_db_attach(qctx->db, &qctx->client->query.authdb);
5991 		qctx->client->query.authdbset = true;
5994 		if (TCP(qctx->client)) {
5995 			inc_stats(qctx->client, ns_statscounter_tcp);
5997 			inc_stats(qctx->client, ns_statscounter_udp);
6002 	 * If stale answers are enabled and stale-answer-client-timeout is zero,
6026 	ns_client_t *client = qctx->client;
6027 	isc_nmhandle_t *handle = client->restarthandle;
6029 	client->restarthandle = NULL;
6036 	isc_mem_put(client->manager->mctx, qctx, sizeof(*qctx));
6049 	REQUIRE(qctx->client != NULL);
6052 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
6053 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, buffer);
6054 	qctx->rdataset = ns_client_newrdataset(qctx->client);
6056 	if ((WANTDNSSEC(qctx->client) || qctx->findcoveringnsec) &&
6059 		qctx->sigrdataset = ns_client_newrdataset(qctx->client);
6067  * client this stale answer.
6114 	dns_clientinfo_init(&ci, qctx->client, NULL);
6115 	if (HAVEECS(qctx->client)) {
6116 		dns_clientinfo_setecs(&ci, &qctx->client->ecs);
6132 		rpzqname = qctx->client->query.rpz_st->p_name;
6134 		rpzqname = qctx->client->query.qname;
6137 	qctx->client->query.dboptions &= ~DNS_DBFIND_STALETIMEOUT;
6146 		qctx->client->query.dboptions |= DNS_DBFIND_STALETIMEOUT;
6149 	(void)dns_db_getservestalerefresh(qctx->client->view->cachedb,
6152 	    dns_view_staleanswerenabled(qctx->client->view))
6154 		qctx->client->query.dboptions |= DNS_DBFIND_STALEENABLED;
6157 	dboptions = qctx->client->query.dboptions;
6165 				dboptions, qctx->client->now, &qctx->node,
6173 		dns_name_copy(qctx->client->query.qname, qctx->fname);
6203 	 * This can happen if 'stale-answer-client-timeout' is enabled.
6205 	 * If a stale answer is found, send it to the client, and try to refresh
6218 		dns_name_format(qctx->client->query.qname, namebuf,
6222 		inc_stats(qctx->client, ns_statscounter_trystale);
6237 			inc_stats(qctx->client, ns_statscounter_usedstale);
6251 			dns_ede_add(&qctx->client->edectx, ede,
6275 			dns_ede_add(&qctx->client->edectx, ede,
6301 				dns_db_attach(qctx->client->view->cachedb,
6304 				if (FETCH_RECTYPE_NORMAL(qctx->client) != NULL)
6308 							qctx->client));
6318 						&qctx->client->edectx, ede,
6336  * client timeout is triggered. If the query has timed out or been cancelled
6337  * or the system is shutting down, clean up and exit. If a client timeout is
6344 	ns_client_t *client = resp->arg;
6352 	REQUIRE(NS_CLIENT_VALID(client));
6353 	REQUIRE(RECURSING(client));
6359 	 * that a lookup due to stale-answer-client-timeout may have set.
6361 	if (client->view->cachedb != NULL && client->view->recursion) {
6362 		client->query.attributes |= NS_QUERYATTR_RECURSIONOK;
6364 	client->query.dboptions &= ~DNS_DBFIND_STALETIMEOUT;
6365 	client->query.dboptions &= ~DNS_DBFIND_STALEENABLED;
6367 	LOCK(&client->query.fetchlock);
6368 	INSIST(FETCH_RECTYPE_NORMAL(client) == resp->fetch ||
6369 	       FETCH_RECTYPE_NORMAL(client) == NULL);
6370 	if (FETCH_RECTYPE_NORMAL(client) != NULL) {
6374 		INSIST(FETCH_RECTYPE_NORMAL(client) == resp->fetch);
6375 		FETCH_RECTYPE_NORMAL(client) = NULL;
6378 		 * Update client->now.
6380 		client->now = isc_stdtime_now();
6388 	UNLOCK(&client->query.fetchlock);
6396 	release_recursionquota(client);
6398 	isc_nmhandle_detach(&HANDLE_RECTYPE_NORMAL(client));
6400 	client->query.attributes &= ~NS_QUERYATTR_RECURSING;
6401 	client->state = NS_CLIENTSTATE_WORKING;
6408 	qctx_init(client, &resp, 0, &qctx);
6415 		 * client, which we still need for a moment.
6420 		 * Return an error to the client.
6423 		query_error(client, DNS_R_SERVFAIL, __LINE__);
6427 		 * service the client, then detach the client object.
6500 recursionquota_log(ns_client_t *client, atomic_uint_fast32_t *last_log_time,
6508 	ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
6516  * Acquire recursion quota before making the current client "recursing".
6519 acquire_recursionquota(ns_client_t *client) {
6522 	result = recursionquotatype_attach_soft(client);
6525 		recursionquota_log(client, &last_soft,
6528 				   &client->manager->sctx->recursionquota);
6529 		ns_client_killoldestquery(client);
6534 		recursionquota_log(client, &last_hard,
6536 				   &client->manager->sctx->recursionquota);
6537 		ns_client_killoldestquery(client);
6543 	dns_message_clonebuffer(client->message);
6544 	ns_client_recursing(client);
6550  * Release recursion quota and remove the client from the "recursing" list.
6553 release_recursionquota(ns_client_t *client) {
6554 	recursionquotatype_detach(client);
6556 	LOCK(&client->manager->reclock);
6557 	if (ISC_LINK_LINKED(client, rlink)) {
6558 		ISC_LIST_UNLINK(client->manager->recursing, client, rlink);
6560 	UNLOCK(&client->manager->reclock);
6564 ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
6577 	if (recparam_match(&client->query.recparam, qtype, qname, qdomain)) {
6578 		ns_client_log(client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
6583 	recparam_update(&client->query.recparam, qtype, qname, qdomain);
6586 		inc_stats(client, ns_statscounter_recursion);
6589 	result = acquire_recursionquota(client);
6598 	REQUIRE(FETCH_RECTYPE_NORMAL(client) == NULL);
6600 	rdataset = ns_client_newrdataset(client);
6602 	if (WANTDNSSEC(client)) {
6603 		sigrdataset = ns_client_newrdataset(client);
6608 	if (!client->query.timerset) {
6609 		ns_client_settimeout(client, 60);
6612 	if (!TCP(client)) {
6613 		peeraddr = &client->peeraddr;
6616 	isc_nmhandle_attach(client->handle, &HANDLE_RECTYPE_NORMAL(client));
6618 		client->view->resolver, qname, qtype, qdomain, nameservers,
6619 		NULL, peeraddr, client->message->id, client->query.fetchoptions,
6620 		0, NULL, client->query.qc, NULL, client->manager->loop,
6621 		fetch_callback, client, &client->edectx, rdataset, sigrdataset,
6622 		&FETCH_RECTYPE_NORMAL(client));
6624 		release_recursionquota(client);
6626 		ns_client_putrdataset(client, &rdataset);
6628 			ns_client_putrdataset(client, &sigrdataset);
6631 		isc_nmhandle_detach(&HANDLE_RECTYPE_NORMAL(client));
6635 	 * We're now waiting for a fetch event. A client which is
6657 	bool redirect = REDIRECT(qctx->client);
6665 	qctx->rpz_st = qctx->client->query.rpz_st;
6712 		ns_client_putrdataset(qctx->client, &qctx->fresp->sigrdataset);
6719 		dns_name_format(qctx->client->query.redirect.fname, qbuf,
6721 		dns_rdatatype_format(qctx->client->query.redirect.qtype, tbuf,
6725 			 tbuf, qctx->client->query.redirect.authoritative);
6728 		qctx->qtype = qctx->client->query.redirect.qtype;
6729 		INSIST(qctx->client->query.redirect.rdataset != NULL);
6730 		RESTORE(qctx->rdataset, qctx->client->query.redirect.rdataset);
6732 			qctx->client->query.redirect.sigrdataset);
6733 		RESTORE(qctx->db, qctx->client->query.redirect.db);
6734 		RESTORE(qctx->node, qctx->client->query.redirect.node);
6735 		RESTORE(qctx->zone, qctx->client->query.redirect.zone);
6737 			qctx->client->query.redirect.authoritative;
6742 		ns_client_putrdataset(qctx->client, &qctx->fresp->rdataset);
6743 		ns_client_putrdataset(qctx->client, &qctx->fresp->sigrdataset);
6772 	if (DNS64(qctx->client)) {
6773 		qctx->client->query.attributes &= ~NS_QUERYATTR_DNS64;
6777 	if (DNS64EXCLUDE(qctx->client)) {
6778 		qctx->client->query.attributes &= ~NS_QUERYATTR_DNS64EXCLUDE;
6789 			ns_client_log(qctx->client, NS_LOGCATEGORY_CLIENT,
6801 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
6802 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
6807 		tname = qctx->client->query.redirect.fname;
6817 		free_fresp(qctx->client, &qctx->fresp);
6819 		result = qctx->client->query.redirect.result;
6830 			qctx->client->query.attributes &=
6849 	ns_client_t *client = rev->arg;
6855 	REQUIRE(NS_CLIENT_VALID(client));
6857 	LOCK(&client->query.fetchlock);
6858 	if (client->query.hookactx != NULL) {
6859 		INSIST(rev->ctx == client->query.hookactx);
6860 		client->query.hookactx = NULL;
6862 		client->now = isc_stdtime_now();
6866 	UNLOCK(&client->query.fetchlock);
6869 	release_recursionquota(client);
6876 	isc_nmhandle_detach(&HANDLE_RECTYPE_HOOK(client));
6878 	client->state = NS_CLIENTSTATE_WORKING;
6886 		query_error(client, DNS_R_SERVFAIL, __LINE__);
6896 		 * As we're almost done with this client, make sure any internal
6904 			query_setup(client, qctx->qtype);
6978 	isc_mem_put(client->manager->mctx, qctx, sizeof(*qctx));
6985 	ns_client_t *client = qctx->client;
6990 	REQUIRE(NS_CLIENT_VALID(client));
6991 	REQUIRE(client->query.hookactx == NULL);
6992 	REQUIRE(FETCH_RECTYPE_NORMAL(client) == NULL);
6994 	result = acquire_recursionquota(client);
6999 	saved_qctx = isc_mem_get(client->manager->mctx, sizeof(*saved_qctx));
7001 	result = runasync(saved_qctx, client->manager->mctx, arg,
7002 			  client->manager->loop, query_hookresume, client,
7003 			  &client->query.hookactx);
7020 	 * the client task or pausing it.
7022 	isc_nmhandle_attach(client->handle, &HANDLE_RECTYPE_HOOK(client));
7026 	release_recursionquota(client);
7033 	query_error(client, DNS_R_SERVFAIL, __LINE__);
7045 		isc_mem_put(client->manager->mctx, saved_qctx,
7067 	if (!RECURSIONOK(qctx->client)) {
7073 	if (qctx->client->manager->sctx->fuzztype == isc_fuzz_resolver) {
7079 			qctx->view->failcache, qctx->client->query.qname,
7081 			isc_time_seconds(&qctx->client->tnow));
7089 	    ((qctx->client->message->flags & DNS_MESSAGEFLAG_CD) == 0))
7095 			dns_name_format(qctx->client->query.qname, namebuf,
7099 			ns_client_log(qctx->client, NS_LOGCATEGORY_CLIENT,
7108 		qctx->client->attributes |= NS_CLIENTATTR_NOSETFC;
7125 	isc_netaddr_fromsockaddr(&peer, &qctx->client->peeraddr);
7130 	dns_name_format(qctx->client->query.qname, qnamebuf, sizeof(qnamebuf));
7141 	 * Rate limit these responses to this client.
7157 		qctx->client, DNS_LOGCATEGORY_RRL, NS_LOGMODULE_QUERY,
7162 		qctx->client->view->rrl, HAVECOOKIE(qctx->client),
7165 		qctx->is_zone, RECURSIONOK(qctx->client),
7166 		qctx->client->query.rpz_st,
7167 		qctx->client->query.rpz_st != NULL
7168 			? ((qctx->client->query.rpz_st->state &
7171 		(qctx->client->query.attributes & NS_QUERYATTR_RRL_CHECKED) !=
7174 	if (qctx->view->rrl != NULL && !HAVECOOKIE(qctx->client) &&
7176 	     (result == ISC_R_NOTFOUND && !RECURSIONOK(qctx->client))) &&
7178 	      RECURSIONOK(qctx->client)) &&
7179 	    (qctx->client->query.rpz_st == NULL ||
7180 	     (qctx->client->query.rpz_st->state & DNS_RPZ_REWRITTEN) == 0) &&
7181 	    (qctx->client->query.attributes & NS_QUERYATTR_RRL_CHECKED) == 0)
7191 		qctx->client->query.attributes |= NS_QUERYATTR_RRL_CHECKED;
7247 			qctx->view, qctx->zone, &qctx->client->peeraddr,
7248 			TCP(qctx->client), qctx->client->message->rdclass,
7249 			qctx->qtype, constname, resp_result, qctx->client->now,
7263 				ns_client_log(qctx->client,
7281 					inc_stats(qctx->client,
7289 					inc_stats(qctx->client,
7291 					if (WANTCOOKIE(qctx->client)) {
7292 						qctx->client->message->flags &=
7294 						qctx->client->message->flags &=
7296 						qctx->client->message->rcode =
7299 						qctx->client->message->flags |=
7304 							qctx->client->message
7323 		dns_ede_add(&qctx->client->edectx, qctx->rpz_st->m.rpz->ede,
7337 	rresult = rpz_rewrite(qctx->client, qctx->qtype, result, qctx->resuming,
7339 	qctx->rpz_st = qctx->client->query.rpz_st;
7351 		INSIST(!RECURSING(qctx->client));
7362 		qctx->client->query.attributes |= NS_QUERYATTR_RECURSING;
7376 	     !TCP(qctx->client)) &&
7385 		dns_name_copy(qctx->client->query.qname, qctx->fname);
7388 			ns_client_putrdataset(qctx->client, &qctx->rdataset);
7414 			qctx->client->message->flags |= DNS_MESSAGEFLAG_TC;
7418 				qctx->client->message->rcode =
7421 			rpz_log_rewrite(qctx->client, false,
7429 			rpz_log_rewrite(qctx->client, false,
7514 		qctx->client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
7516 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
7517 		ns_client_putrdataset(qctx->client, &qctx->sigrdataset);
7520 		rpz_log_rewrite(qctx->client, false, qctx->rpz_st->m.policy,
7537 	ns_client_t *client;
7542 	REQUIRE(qctx != NULL && qctx->client != NULL);
7544 	client = qctx->client;
7551 		dns_name_split(client->query.qname, 1,
7560 			client->message->rcode = dns_rcode_yxdomain;
7568 	ns_client_keepname(client, qctx->fname, qctx->dbuf);
7571 	rpz_log_rewrite(client, false, qctx->rpz_st->m.policy,
7576 	ns_client_qnamereplace(client, qctx->fname);
7582 	client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
7590  * with a key id that matches qctx->client->query.root_key_sentinel_keyid.
7599 	dns_keytag_t sentinel = qctx->client->query.root_key_sentinel_keyid;
7656 	if (!qctx->client->query.root_key_sentinel_is_ta &&
7657 	    !qctx->client->query.root_key_sentinel_not_ta)
7681 	    ((qctx->client->query.root_key_sentinel_is_ta && !has_ta(qctx)) ||
7682 	     (qctx->client->query.root_key_sentinel_not_ta && has_ta(qctx))))
7691 	qctx->client->query.root_key_sentinel_is_ta = false;
7692 	qctx->client->query.root_key_sentinel_not_ta = false;
7703 	if ((qctx->client->query.dboptions & DNS_DBFIND_STALEOK) != 0) {
7722 	if (dns_view_staleanswerenabled(qctx->client->view)) {
7724 		ret = query_getdb(qctx->client, qctx->client->query.qname,
7725 				  qctx->client->query.qtype, qctx->options,
7736 		qctx->client->query.dboptions |= DNS_DBFIND_STALEOK;
7737 		if (FETCH_RECTYPE_NORMAL(qctx->client) != NULL) {
7739 				&FETCH_RECTYPE_NORMAL(qctx->client));
7747 			qctx->client->query.dboptions |= DNS_DBFIND_STALESTART;
7772 	if (!dns_name_equal(qctx->client->query.qname, dns_rootname)) {
7780 		if (RECURSING(qctx->client) && result == DNS_R_DISALLOWED) {
7784 			 * "stale-answer-client-timeout" lookup. In this case,
7804 		qctx->client->attributes |= NS_CLIENTATTR_NOSETFC;
7872 		qctx->client->rcode_override = dns_rcode_servfail;
7884 	ns_client_t *client = qctx->client;
7896 	dbuf = ns_client_getnamebuf(client);
7897 	fname = ns_client_newname(client, dbuf, &b);
7898 	neg = ns_client_newrdataset(client);
7899 	negsig = ns_client_newrdataset(client);
7912 		dbuf = ns_client_getnamebuf(client);
7913 		fname = ns_client_newname(client, dbuf, &b);
7917 		neg = ns_client_newrdataset(client);
7923 		negsig = ns_client_newrdataset(client);
7936 		ns_client_putrdataset(client, &neg);
7939 		ns_client_putrdataset(client, &negsig);
7942 		ns_client_releasename(client, &fname);
7981 	ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
8013 		} else if (qctx->view->minimal_any && !TCP(qctx->client) &&
8014 			   !WANTDNSSEC(qctx->client) &&
8022 		} else if (qctx->view->minimal_any && !TCP(qctx->client) &&
8033 			if (NOQNAME(qctx->rdataset) && WANTDNSSEC(qctx->client))
8040 			qctx->rpz_st = qctx->client->query.rpz_st;
8050 			if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
8054 				query_prefetch(qctx->client, name,
8086 				ns_client_putrdataset(qctx->client,
8090 			qctx->rdataset = ns_client_newrdataset(qctx->client);
8120 		dns_message_puttempname(qctx->client->message, &qctx->fname);
8137 			qctx->client->attributes &= ~NS_CLIENTATTR_RA;
8146 			dns_name_format(qctx->client->query.qname, namebuf,
8148 			ns_client_log(qctx->client, DNS_LOGCATEGORY_DNSSEC,
8153 		qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
8181 	    qctx->client->query.restarts != 0 ||
8182 	    (qctx->client->attributes & NS_CLIENTATTR_WANTEXPIRE) == 0)
8197 		if (secs >= qctx->client->now && qctx->result == ISC_R_SUCCESS)
8199 			qctx->client->attributes |= NS_CLIENTATTR_HAVEEXPIRE;
8200 			qctx->client->expire = secs - qctx->client->now;
8214 		qctx->client->expire = soa.expire;
8215 		qctx->client->attributes |= NS_CLIENTATTR_HAVEEXPIRE;
8239 		dns_message_puttemprdataset(qctx->client->message,
8264 	} else if (qctx->client->query.dns64_aaaaok != NULL) {
8266 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
8267 		isc_mem_cput(qctx->client->manager->mctx,
8268 			     qctx->client->query.dns64_aaaaok,
8269 			     qctx->client->query.dns64_aaaaoklen, sizeof(bool));
8270 		qctx->client->query.dns64_aaaaoklen = 0;
8272 		if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
8273 			query_prefetch(qctx->client, qctx->fname,
8276 		if (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL) {
8303 	INSIST(qctx->client->query.dns64_aaaaok == NULL);
8307 	    qctx->client->message->rdclass == dns_rdataclass_in &&
8308 	    !dns64_aaaaok(qctx->client, qctx->rdataset, qctx->sigrdataset))
8313 		qctx->client->query.dns64_ttl = qctx->rdataset->ttl;
8314 		SAVE(qctx->client->query.dns64_aaaa, qctx->rdataset);
8315 		SAVE(qctx->client->query.dns64_sigaaaa, qctx->sigrdataset);
8316 		ns_client_releasename(qctx->client, &qctx->fname);
8334 	if (NOQNAME(qctx->rdataset) && WANTDNSSEC(qctx->client)) {
8348 		if (dns_name_equal(qctx->client->query.qname,
8358 		if (dns_name_equal(qctx->client->query.qname, dns_rootname)) {
8359 			qctx->client->query.attributes &=
8361 			dns_db_attach(qctx->db, &qctx->client->query.gluedb);
8379 	 * the message to be sent to the client already contains an RRset with
8383 	 * to be the final answer to the client's query, but we have no way of
8399 	ns_client_t *client = qctx->client;
8400 	dns_aclenv_t *env = client->manager->aclenv;
8410 	dns_view_t *view = client->view;
8417 	 * To the current response for 'qctx->client', add the answer RRset
8439 		client->message, section, name, dns_rdatatype_aaaa,
8449 			ns_client_releasename(client, &qctx->fname);
8457 			ns_client_keepname(client, name, qctx->dbuf);
8459 		dns_message_addname(client->message, name, section);
8465 			ns_client_releasename(client, &qctx->fname);
8470 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
8473 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
8475 	isc_buffer_allocate(client->manager->mctx, &buffer,
8478 	dns_message_gettemprdataset(client->message, &dns64_rdataset);
8479 	dns_message_gettemprdatalist(client->message, &dns64_rdatalist);
8484 	if (client->query.dns64_ttl != UINT32_MAX) {
8486 					       client->query.dns64_ttl);
8491 	if (RECURSIONOK(client)) {
8499 	if (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
8509 		for (dns64 = ISC_LIST_HEAD(client->view->dns64); dns64 != NULL;
8516 						     client->signer, env, flags,
8525 			dns_message_gettemprdata(client->message, &dns64_rdata);
8545 	client->query.attributes |= NS_QUERYATTR_NOADDITIONAL;
8553 	dns_message_takebuffer(client->message, &buffer);
8554 	inc_stats(client, ns_statscounter_dns64);
8563 		dns_message_puttemprdataset(client->message, &dns64_rdataset);
8573 			dns_message_puttemprdata(client->message, &dns64_rdata);
8575 		dns_message_puttemprdatalist(client->message, &dns64_rdatalist);
8584 	ns_client_t *client = qctx->client;
8598 	INSIST(client->query.dns64_aaaaok != NULL);
8599 	INSIST(client->query.dns64_aaaaoklen ==
8609 		client->message, section, name, dns_rdatatype_aaaa,
8619 			ns_client_releasename(client, &qctx->fname);
8628 			ns_client_releasename(client, &qctx->fname);
8634 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
8637 	isc_buffer_allocate(client->manager->mctx, &buffer,
8639 	dns_message_gettemprdataset(client->message, &myrdataset);
8640 	dns_message_gettemprdatalist(client->message, &myrdatalist);
8652 		if (!client->query.dns64_aaaaok[i++]) {
8660 		dns_message_gettemprdata(client->message, &myrdata);
8674 	client->query.attributes |= NS_QUERYATTR_NOADDITIONAL;
8677 			ns_client_keepname(client, name, qctx->dbuf);
8679 		dns_message_addname(client->message, name, section);
8689 	dns_message_takebuffer(client->message, &buffer);
8697 		dns_message_puttemprdataset(client->message, &myrdataset);
8706 			dns_message_puttemprdata(client->message, &myrdata);
8708 		dns_message_puttemprdatalist(client->message, &myrdatalist);
8712 		ns_client_releasename(client, &name);
8746 		dns_clientinfo_init(&ci, qctx->client, NULL);
8750 					dns_rdatatype_ns, 0, qctx->client->now,
8768 		if (RECURSIONOK(qctx->client)) {
8769 			INSIST(!REDIRECT(qctx->client));
8770 			result = ns_query_recurse(qctx->client, qctx->qtype,
8771 						  qctx->client->query.qname,
8775 				qctx->client->query.attributes |=
8779 					qctx->client->query.attributes |=
8783 					qctx->client->query.attributes |=
8814  * to the client.
8834 	qctx->client->query.isreferral = true;
8836 	if (!dns_db_iscache(qctx->db) && qctx->client->query.gluedb == NULL) {
8837 		dns_db_attach(qctx->db, &qctx->client->query.gluedb);
8845 	qctx->client->query.attributes &= ~NS_QUERYATTR_NOADDITIONAL;
8846 	if (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL) {
8852 		dns_db_detach(&qctx->client->query.gluedb);
8870  * delegation to the client and call ns_query_done().
8882 	if (!RECURSIONOK(qctx->client) &&
8889 		result = query_getzonedb(qctx->client,
8890 					 qctx->client->query.qname, qctx->qtype,
8901 			ns_client_putrdataset(qctx->client, &qctx->rdataset);
8903 				ns_client_putrdataset(qctx->client,
8907 				ns_client_releasename(qctx->client,
8929 	if (USECACHE(qctx->client) &&
8930 	    (RECURSIONOK(qctx->client) ||
8943 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
8984  * client and call ns_query_done().
9020 		ns_client_releasename(qctx->client, &qctx->fname);
9029 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
9031 			ns_client_putrdataset(qctx->client, &qctx->sigrdataset);
9063 	dns_name_t *qname = qctx->client->query.qname;
9067 	if (!RECURSIONOK(qctx->client)) {
9081 	INSIST(!REDIRECT(qctx->client));
9087 		result = ns_query_recurse(qctx->client, qctx->qtype, qname,
9093 		result = ns_query_recurse(qctx->client, dns_rdatatype_a, qname,
9099 		result = ns_query_recurse(qctx->client, qctx->qtype, qname,
9105 		qctx->client->query.attributes |= NS_QUERYATTR_RECURSING;
9107 			qctx->client->query.attributes |= NS_QUERYATTR_DNS64;
9110 			qctx->client->query.attributes |=
9134 	ns_client_t *client = qctx->client;
9149 	if (!WANTDNSSEC(client)) {
9156 	rdataset = ns_client_newrdataset(client);
9157 	sigrdataset = ns_client_newrdataset(client);
9163 				     dns_rdatatype_ds, 0, client->now, rdataset,
9171 			0, client->now, rdataset, sigrdataset);
9186 	result = dns_message_firstname(client->message, DNS_SECTION_AUTHORITY);
9198 		dns_message_currentname(client->message, DNS_SECTION_AUTHORITY,
9204 		result = dns_message_nextname(client->message,
9226 	dbuf = ns_client_getnamebuf(client);
9227 	fname = ns_client_newname(client, dbuf, &b);
9236 	query_findclosestnsec3(name, qctx->db, qctx->version, client, rdataset,
9253 		fixfname(client, &fname, &dbuf, &b);
9254 		fixrdataset(client, &rdataset);
9255 		fixrdataset(client, &sigrdataset);
9260 				       qctx->version, client, rdataset,
9271 		ns_client_putrdataset(client, &rdataset);
9274 		ns_client_putrdataset(client, &sigrdataset);
9277 		ns_client_releasename(client, &fname);
9303 			ns_client_putrdataset(qctx->client, &qctx->rdataset);
9306 			ns_client_putrdataset(qctx->client, &qctx->sigrdataset);
9308 		RESTORE(qctx->rdataset, qctx->client->query.dns64_aaaa);
9309 		RESTORE(qctx->sigrdataset, qctx->client->query.dns64_sigaaaa);
9311 			qctx->dbuf = ns_client_getnamebuf(qctx->client);
9312 			qctx->fname = ns_client_newname(qctx->client,
9315 		dns_name_copy(qctx->client->query.qname, qctx->fname);
9328 		   qctx->client->message->rdclass == dns_rdataclass_in &&
9343 				qctx->client->query.dns64_ttl =
9349 				qctx->client->query.dns64_ttl = 0;
9353 			qctx->client->query.dns64_ttl =
9360 		SAVE(qctx->client->query.dns64_aaaa, qctx->rdataset);
9361 		SAVE(qctx->client->query.dns64_sigaaaa, qctx->sigrdataset);
9362 		ns_client_releasename(qctx->client, &qctx->fname);
9377 			ns_client_keepname(qctx->client, qctx->fname,
9379 			dns_message_addname(qctx->client->message, qctx->fname,
9410 	    WANTDNSSEC(qctx->client))
9419 			qname = qctx->client->query.qname;
9422 					       qctx->client, qctx->rdataset,
9432 			    (((qctx->client->manager->sctx->options &
9452 				fixfname(qctx->client, &qctx->fname,
9454 				fixrdataset(qctx->client, &qctx->rdataset);
9455 				fixrdataset(qctx->client, &qctx->sigrdataset);
9475 					qctx->client, qctx->rdataset,
9480 			ns_client_releasename(qctx->client, &qctx->fname);
9490 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
9497 		ns_client_releasename(qctx->client, &qctx->fname);
9515 	if (WANTDNSSEC(qctx->client) &&
9526 	ns_client_t *client = qctx->client;
9567 	dbuf = ns_client_getnamebuf(client);
9568 	fname = ns_client_newname(client, dbuf, &b);
9604 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
9611 		ns_client_releasename(qctx->client, &qctx->fname);
9641 	if (WANTDNSSEC(qctx->client)) {
9657 		qctx->client->message->rcode = dns_rcode_noerror;
9659 		qctx->client->message->rcode = dns_rcode_nxdomain;
9689 	result = redirect(qctx->client, qctx->fname, qctx->rdataset,
9693 		inc_stats(qctx->client, ns_statscounter_nxdomainredirect);
9707 	result = redirect2(qctx->client, qctx->fname, qctx->rdataset,
9712 		inc_stats(qctx->client, ns_statscounter_nxdomainredirect);
9715 		inc_stats(qctx->client,
9717 		SAVE(qctx->client->query.redirect.db, qctx->db);
9718 		SAVE(qctx->client->query.redirect.node, qctx->node);
9719 		SAVE(qctx->client->query.redirect.zone, qctx->zone);
9720 		qctx->client->query.redirect.qtype = qctx->qtype;
9722 		SAVE(qctx->client->query.redirect.rdataset, qctx->rdataset);
9723 		SAVE(qctx->client->query.redirect.sigrdataset,
9725 		qctx->client->query.redirect.result = saved_result;
9726 		dns_name_copy(qctx->fname, qctx->client->query.redirect.fname);
9727 		qctx->client->query.redirect.authoritative =
9729 		qctx->client->query.redirect.is_zone = qctx->is_zone;
9755 	ns_client_logv(qctx->client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY,
9816 	if (WANTDNSSEC(qctx->client)) {
9817 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
9819 		ns_client_releasename(qctx->client, &qctx->fname);
9822 	dbuf = ns_client_getnamebuf(qctx->client);
9823 	name = ns_client_newname(qctx->client, dbuf, &b);
9829 	if (!WANTDNSSEC(qctx->client)) {
9835 	if (WANTDNSSEC(qctx->client)) {
9843 	inc_stats(qctx->client, ns_statscounter_nodatasynth);
9846 		ns_client_releasename(qctx->client, &name);
9869 	if (WANTDNSSEC(qctx->client)) {
9870 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
9872 		ns_client_releasename(qctx->client, &qctx->fname);
9875 	dbuf = ns_client_getnamebuf(qctx->client);
9876 	name = ns_client_newname(qctx->client, dbuf, &b);
9877 	dns_name_copy(qctx->client->query.qname, name);
9879 	cloneset = ns_client_newrdataset(qctx->client);
9885 	if (WANTDNSSEC(qctx->client)) {
9886 		clonesigset = ns_client_newrdataset(qctx->client);
9896 	if (WANTDNSSEC(qctx->client)) {
9904 	inc_stats(qctx->client, ns_statscounter_wildcardsynth);
9907 		ns_client_releasename(qctx->client, &name);
9910 		ns_client_putrdataset(qctx->client, &cloneset);
9913 		ns_client_putrdataset(qctx->client, &clonesigset);
9936 	qctx->client->query.attributes |= NS_QUERYATTR_PARTIALANSWER;
9942 	dns_message_gettempname(qctx->client->message, &tname);
9946 		dns_message_puttempname(qctx->client->message, &tname);
9955 	if (dns_name_equal(qctx->client->query.qname, &cname.cname)) {
9956 		dns_message_puttempname(qctx->client->message, &tname);
9964 	ns_client_qnamereplace(qctx->client, tname);
9966 	if (!WANTRECURSION(qctx->client)) {
10005 	if (WANTDNSSEC(qctx->client)) {
10006 		ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
10008 		ns_client_releasename(qctx->client, &qctx->fname);
10011 client);
10012 	name = ns_client_newname(qctx->client, dbuf, &b);
10018 	if (!WANTDNSSEC(qctx->client)) {
10024 	if (WANTDNSSEC(qctx->client)) {
10031 		dbuf = ns_client_getnamebuf(qctx->client);
10032 		name = ns_client_newname(qctx->client, dbuf, &b);
10035 		cloneset = ns_client_newrdataset(qctx->client);
10036 		clonesigset = ns_client_newrdataset(qctx->client);
10049 		inc_stats(qctx->client, ns_statscounter_nodatasynth);
10051 		qctx->client->message->rcode = dns_rcode_nxdomain;
10052 		inc_stats(qctx->client, ns_statscounter_nxdomainsynth);
10056 		ns_client_releasename(qctx->client, &name);
10059 		ns_client_putrdataset(qctx->client, &cloneset);
10062 		ns_client_putrdataset(qctx->client, &clonesigset);
10137 	unsigned int dboptions = qctx->client->query.dboptions;
10152 	dns_name_clone(qctx->client->query.qname, &qname);
10175 	dns_clientinfo_init(&ci, qctx->client, NULL);
10197 	result = dns_nsec_noexistnodata(qctx->qtype, qctx->client->query.qname,
10216 		    qctx->rdataset->ttl == 0 && RECURSIONOK(qctx->client))
10221 		soardataset = ns_client_newrdataset(qctx->client);
10222 		sigsoardataset = ns_client_newrdataset(qctx->client);
10230 					qctx->client->now, &node, fname, &cm,
10248 				qctx->client->now, &node, nowild, &cm, &ci,
10278 		    RECURSIONOK(qctx->client))
10346 	soardataset = ns_client_newrdataset(qctx->client);
10347 	sigsoardataset = ns_client_newrdataset(qctx->client);
10353 				dboptions, qctx->client->now, &node, fname, &cm,
10372 		ns_client_putrdataset(qctx->client, &soardataset);
10375 		ns_client_putrdataset(qctx->client, &sigsoardataset);
10394 			ns_client_releasename(qctx->client, &qctx->fname);
10399 		ns_client_putrdataset(qctx->client, &qctx->rdataset);
10401 			ns_client_putrdataset(qctx->client, &qctx->sigrdataset);
10433 		qctx->client->message->rcode = dns_rcode_nxdomain;
10437 		    qctx->client->message->rdclass == dns_rdataclass_in &&
10440 			warn_rfc1918(qctx->client, qctx->fname, qctx->rdataset);
10444 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
10445 		query_stale_refresh_ncache(qctx->client);
10464 	    qctx->rdataset->ttl != 0 || !RECURSIONOK(qctx->client))
10471 	INSIST(!REDIRECT(qctx->client));
10473 	result = ns_query_recurse(qctx->client, qctx->qtype,
10474 				  qctx->client->query.qname, NULL, NULL,
10478 		qctx->client->query.attributes |= NS_QUERYATTR_RECURSING;
10481 			qctx->client->query.attributes |= NS_QUERYATTR_DNS64;
10484 			qctx->client->query.attributes |=
10532 	if (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL) {
10536 	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
10543 	if (NOQNAME(qctx->rdataset) && WANTDNSSEC(qctx->client)) {
10549 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
10550 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
10562 	qctx->client->query.attributes |= NS_QUERYATTR_PARTIALANSWER;
10568 	dns_message_gettempname(qctx->client->message, &tname);
10572 		dns_message_puttempname(qctx->client->message, &tname);
10585 	ns_client_qnamereplace(qctx->client, tname);
10587 	if (!WANTRECURSION(qctx->client)) {
10625 	namereln = dns_name_fullcompare(qctx->client->query.qname, qctx->fname,
10639 	if (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL) {
10643 	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
10650 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
10651 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
10660 	qctx->client->query.attributes |= NS_QUERYATTR_PARTIALANSWER;
10666 	dns_message_gettempname(qctx->client->message, &tname);
10670 		dns_message_puttempname(qctx->client->message, &tname);
10688 	dns_name_split(qctx->client->query.qname, nlabels, prefix, NULL);
10690 	qctx->dbuf = ns_client_getnamebuf(qctx->client);
10691 	qctx->fname = ns_client_newname(qctx->client, qctx->dbuf, &b);
10693 	dns_message_puttempname(qctx->client->message, &tname);
10701 		qctx->client->message->rcode = dns_rcode_yxdomain;
10708 	ns_client_keepname(qctx->client, qctx->fname, qctx->dbuf);
10736 		ns_client_qnamereplace(qctx->client, qctx->fname);
10739 		if (!WANTRECURSION(qctx->client)) {
10757 	ns_client_t *client = qctx->client;
10764 	dns_message_gettempname(client->message, &aname);
10766 	dns_name_copy(client->query.qname, aname);
10768 	dns_message_gettemprdatalist(client->message, &rdatalist);
10770 	dns_message_gettemprdata(client->message, &rdata);
10772 	dns_message_gettemprdataset(client->message, &rdataset);
10775 	rdatalist->rdclass = client->message->rdclass;
10781 	rdata->rdclass = client->message->rdclass;
10794 		dns_message_puttemprdataset(client->message, &rdataset);
10797 		dns_message_puttempname(client->message, &aname);
10814 	if (WANTDNSSEC(qctx->client) && qctx->fname->attributes.wildcard) {
10844 	ns_client_t *client = qctx->client;
10856 	dns_clientinfo_init(&ci, client, NULL);
10861 	if (((client->manager->sctx->options & NS_SERVER_NOSOA) != 0) &&
10862 	    (!WANTDNSSEC(client) || !dns_rdataset_isassociated(qctx->rdataset)))
10870 	dns_message_gettempname(client->message, &name);
10878 	rdataset = ns_client_newrdataset(client);
10879 	if (WANTDNSSEC(client) && dns_db_issecure(qctx->db)) {
10880 		sigrdataset = ns_client_newrdataset(client);
10889 					     dns_rdatatype_soa, 0, client->now,
10899 					client->query.dboptions, 0, &node,
10953 	ns_client_putrdataset(client, &rdataset);
10955 		ns_client_putrdataset(client, &sigrdataset);
10958 		ns_client_releasename(client, &name);
10972 	ns_client_t *client = qctx->client;
10991 	dns_clientinfo_init(&ci, client, NULL);
10996 	dns_message_gettempname(client->message, &name);
10998 	rdataset = ns_client_newrdataset(client);
11000 	if (WANTDNSSEC(client) && dns_db_issecure(qctx->db)) {
11001 		sigrdataset = ns_client_newrdataset(client);
11010 					     dns_rdatatype_ns, 0, client->now,
11015 					client->query.dboptions, 0, &node,
11037 	ns_client_putrdataset(client, &rdataset);
11039 		ns_client_putrdataset(client, &sigrdataset);
11042 		ns_client_releasename(client, &name);
11057 	ns_client_t *client = qctx->client;
11076 	dns_clientinfo_init(&ci, client, NULL);
11079 	dns_name_clone(client->query.qname, &qname);
11085 		result = query_getdb(client, &qname, dns_rdatatype_ns,
11107 			if (!USECACHE(client)) {
11110 			dns_db_attach(client->view->cachedb, &db);
11120 	dbuf = ns_client_getnamebuf(client);
11121 	fname = ns_client_newname(client, dbuf, &b);
11122 	rdataset = ns_client_newrdataset(client);
11125 	 * Get the RRSIGs if the client requested them or if we may
11128 	if (WANTDNSSEC(client) || !is_zone) {
11129 		sigrdataset = ns_client_newrdataset(client);
11137 			db, client->query.qname, version, dns_rdatatype_ns,
11138 			client->query.dboptions, client->now, &node, fname, &cm,
11143 		if (USECACHE(client)) {
11144 			ns_client_keepname(client, fname, dbuf);
11151 			dns_db_attach(client->view->cachedb, &db);
11157 			db, client->query.qname, client->query.dboptions,
11158 			client->now, &node, fname, NULL, rdataset, sigrdataset);
11181 		ns_client_releasename(client, &fname);
11189 		ns_client_putrdataset(client, &rdataset);
11191 			ns_client_putrdataset(client, &sigrdataset);
11210 	    !validate(client, db, fname, rdataset, sigrdataset) &&
11211 	    !PENDINGOK(client->query.dboptions))
11218 	    !validate(client, db, fname, rdataset, sigrdataset) &&
11219 	    SECURE(client) && WANTDNSSEC(client))
11226 	 * when the client may be looking for AD in the response.
11228 	if (SECURE(client) && (WANTDNSSEC(client) || WANTAD(client)) &&
11236 	 * If the client doesn't want DNSSEC we can discard the sigrdataset
11239 	if (!WANTDNSSEC(client)) {
11240 		ns_client_putrdataset(client, &sigrdataset);
11248 		ns_client_putrdataset(client, &rdataset);
11251 		ns_client_putrdataset(client, &sigrdataset);
11254 		ns_client_releasename(client, &fname);
11266 		ns_client_putrdataset(client, &zrdataset);
11268 			ns_client_putrdataset(client, &zsigrdataset);
11271 			ns_client_releasename(client, &zfname);
11279 	ns_client_t *client = qctx->client;
11302 	dns_clientinfo_init(&ci, client, NULL);
11307 	 * qctx->wildcardname. Otherwise we just use the client
11313 		name = client->query.qname;
11358 	options = client->query.dboptions | DNS_DBFIND_NOWILD;
11365 	dbuf = ns_client_getnamebuf(client);
11366 	fname = ns_client_newname(client, dbuf, &b);
11367 	rdataset = ns_client_newrdataset(client);
11368 	sigrdataset = ns_client_newrdataset(client);
11403 		query_findclosestnsec3(cname, qctx->db, qctx->version, client,
11418 			dbuf = ns_client_getnamebuf(client);
11419 			fname = ns_client_newname(client, dbuf, &b);
11423 			rdataset = ns_client_newrdataset(client);
11429 			sigrdataset = ns_client_newrdataset(client);
11444 		query_findclosestnsec3(wname, qctx->db, qctx->version, client,
11461 			dbuf = ns_client_getnamebuf(client);
11462 			fname = ns_client_newname(client, dbuf, &b);
11466 			rdataset = ns_client_newrdataset(client);
11472 			sigrdataset = ns_client_newrdataset(client);
11486 		query_findclosestnsec3(wname, qctx->db, qctx->version, client,
11532 		ns_client_putrdataset(client, &rdataset);
11535 		ns_client_putrdataset(client, &sigrdataset);
11538 		ns_client_releasename(client, &fname);
11549 		ns_client_putrdataset(client, &rdataset);
11552 		ns_client_putrdataset(client, &sigrdataset);
11555 		ns_client_releasename(client, &fname);
11570 	if (!qctx->want_restart && !NOAUTHORITY(qctx->client)) {
11579 				ns_client_releasename(qctx->client,
11625  * Find the sortlist statement that applies to 'client' and set up
11626  * the sortlist info in in client->message appropriately.
11631 	ns_client_t *client = qctx->client;
11632 	dns_aclenv_t *env = client->manager->aclenv;
11637 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
11638 	switch (ns_sortlist_setup(client->view->sortlist, env, &netaddr,
11643 		dns_message_setsortorder(client->message,
11649 		dns_message_setsortorder(client->message,
11667 	const dns_namelist_t *secs = qctx->client->message->sections;
11674 	    qctx->client->message->rcode != dns_rcode_noerror ||
11681 	msg = qctx->client->message;
11685 		if (dns_name_equal(name, qctx->client->query.qname)) {
11709 	const dns_namelist_t *secs = qctx->client->message->sections;
11719 	qctx->rpz_st = qctx->client->query.rpz_st;
11733 	if (qctx->client->query.restarts == 0 && !qctx->authoritative) {
11734 		qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AA;
11741 		if (qctx->client->query.restarts <
11742 		    qctx->client->view->max_restarts)
11745 			qctx->client->query.restarts++;
11746 			saved_qctx = isc_mem_get(qctx->client->manager->mctx,
11749 			isc_nmhandle_attach(qctx->client->handle,
11750 					    &qctx->client->restarthandle);
11751 			isc_async_run(qctx->client->manager->loop,
11758 			qctx->client->query.attributes |=
11760 			qctx->client->message->rcode = dns_rcode_servfail;
11769 			dns_ede_add(&qctx->client->edectx, DNS_EDE_OTHER,
11771 			ns_client_log(qctx->client, NS_LOGCATEGORY_CLIENT,
11778 	    (!PARTIALANSWER(qctx->client) ||
11779 	     (WANTRECURSION(qctx->client) && !partial_result_with_servfail) ||
11791 			query_next(qctx->client, qctx->result);
11794 			 * If we don't have any answer to give the client,
11795 			 * or if the client requested recursion and thus wanted
11799 			query_error(qctx->client, qctx->result, qctx->line);
11810 	if (RECURSING(qctx->client) &&
11811 	    (!QUERY_STALETIMEOUT(&qctx->client->query) ||
11827 	if (qctx->client->message->rcode == dns_rcode_nxdomain &&
11830 		qctx->client->message->flags |= DNS_MESSAGEFLAG_AA;
11834 	 * If the response is somehow unexpected for the client and this
11840 	     qctx->client->message->rcode != dns_rcode_noerror))
11847 	query_send(qctx->client);
11863 		query_error(qctx->client, DNS_R_SERVFAIL, __LINE__);
11869 log_tat(ns_client_t *client) {
11881 	if ((client->query.qtype != dns_rdatatype_null ||
11882 	     !dns_name_istat(client->query.qname)) &&
11883 	    (client->keytag == NULL ||
11884 	     client->query.qtype != dns_rdatatype_dnskey))
11889 	isc_netaddr_fromsockaddr(&netaddr, &client
11890 	dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
11892 	dns_rdataclass_format(client->view->rdclass, classbuf,
11895 	if (client->query.qtype == dns_rdatatype_dnskey) {
11896 		uint16_t keytags = client->keytag_len / 2;
11898 		char *cp = tags = isc_mem_get(client->manager->mctx, taglen);
11901 		INSIST(client->keytag != NULL);
11906 				keytag = (client->keytag[i * 2] << 8) |
11907 					 client->keytag[i * 2 + 1];
11924 		isc_mem_put(client->manager->mctx, tags, taglen);
11929 log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
11943 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
11945 	dns_name_format(client->query.qname, namebuf, sizeof(namebuf));
11948 	isc_netaddr_format(&client->destaddr, onbuf, sizeof(onbuf));
11950 	if (HAVEECS(client)) {
11951 		ns_client_log_ecs(client, ecsbuf, sizeof(ecsbuf));
11953 	ns_client_log_flags(client, flags, extflags, flagsbuf,
11956 	ns_client_log(client, NS_LOGCATEGORY_QUERIES, NS_LOGMODULE_QUERY, level,
11962 log_queryerror(ns_client_t *client, isc_result_t result, int line, int level) {
11980 	if (client->query.origqname != NULL) {
11981 		dns_name_format(client->query.origqname, namebuf,
11986 		rdataset = ISC_LIST_HEAD(client->query.origqname->list);
11998 	ns_client_log(client, NS_LOGCATEGORY_QUERY_ERRORS, NS_LOGMODULE_QUERY,
12005 ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
12013 	REQUIRE(NS_CLIENT_VALID(client));
12018 	isc_nmhandle_attach(handle, &client->reqhandle);
12020 	message = client->message;
12021 	saved_extflags = client->extflags;
12022 	saved_flags = client->message->flags;
12029 	client->cleanup = query_cleanup;
12032 		client->query.attributes |= NS_QUERYATTR_WANTRECURSION;
12035 	if ((client->extflags & DNS_MESSAGEEXTFLAG_DO) != 0) {
12036 		client->attributes |= NS_CLIENTATTR_WANTDNSSEC;
12039 	switch (client->view->minimalresponses) {
12043 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
12047 		client->query.attributes |= NS_QUERYATTR_NOAUTHORITY;
12051 			client->query.attributes |= NS_QUERYATTR_NOAUTHORITY;
12056 	if (client->view->cachedb == NULL || !client->view->recursion) {
12061 		client->query.attributes &= ~(NS_QUERYATTR_RECURSIONOK |
12063 		client->attributes |= NS_CLIENTATTR_NOSETFC;
12064 	} else if ((client->attributes & NS_CLIENTATTR_RA) == 0 ||
12068 		 * If the client isn't allowed to recurse (due to
12073 		client->query.attributes &= ~NS_QUERYATTR_RECURSIONOK;
12074 		client->attributes |= NS_CLIENTATTR_NOSETFC;
12081 		query_error(client, DNS_R_FORMERR, __LINE__);
12090 		query_error(client, result, __LINE__);
12094 				&client->query.qname);
12095 	client->query.origqname = client->query.qname;
12103 			query_error(client, DNS_R_FORMERR, __LINE__);
12105 			query_error(client, result, __LINE__);
12110 	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
12111 		log_query(client, saved_flags, saved_extflags);
12117 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
12119 	client->query.qtype = qtype = rdataset->type;
12120 	dns_rdatatypestats_increment(client->manager->sctx->rcvquerystats,
12123 	log_tat(client);
12147 				query_error(client, DNS_R_NOTIMP, __LINE__);
12163 					query_error(client, DNS_R_NOALPN,
12167 					query_error(client, DNS_R_REFUSED,
12172 			ns_xfr_start(client, rdataset->type);
12176 			query_error(client, DNS_R_NOTIMP, __LINE__);
12180 				client->message, client->manager->sctx->tkeyctx,
12181 				client->view->dynamickeys);
12183 				query_send(client);
12185 				query_error(client, result, __LINE__);
12189 			query_error(client, DNS_R_FORMERR, __LINE__);
12198 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
12204 		client->query.attributes &= ~(NS_QUERYATTR_NOAUTHORITY |
12211 	if (qtype == dns_rdatatype_any && client->view->minimal_any &&
12212 	    !TCP(client))
12214 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
12221 	if (client->ednsversion >= 0 && client->udpsize <= 512U && !TCP(client))
12223 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
12228 	 * If the client has requested that DNSSEC checking be disabled,
12238 		client->query.dboptions |= DNS_DBFIND_PENDINGOK;
12239 		client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
12240 	} else if (!client->view->enablevalidation) {
12241 		client->query.fetchoptions |= DNS_FETCHOPT_NOVALIDATE;
12244 	if (client->view->qminimization) {
12245 		client->query.fetchoptions |= DNS_FETCHOPT_QMINIMIZE |
12247 		if (client->view->qmin_strict) {
12248 			client->query.fetchoptions |= DNS_FETCHOPT_QMIN_STRICT;
12257 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
12261 	 * Set NS_CLIENTATTR_WANTAD if the client has set AD in the query.
12265 		client->attributes |= NS_CLIENTATTR_WANTAD;
12273 		query_next(client, result);
12284 	if ((client->manager->sctx->options & NS_SERVER_NOAA) == 0) {
12292 	if (WANTDNSSEC(client) || WANTAD(client)) {
12299 	result = isc_counter_create(client->manager->mctx,
12300 				    client->view->max_queries,
12301 				    &client->query.qc);
12303 		query_next(client, result);
12307 	query_setup(client, qtype);

Indexes created Mon Aug 03 00:25:36 UTC 2026