diff --git a/bin/named/config.c b/bin/named/config.c index 23df890193..e3aaecdd3e 100644 --- a/bin/named/config.c +++ b/bin/named/config.c @@ -232,6 +232,7 @@ options {\n\ max-transfer-time-out 120;\n\ min-refresh-time 300;\n\ min-retry-time 500;\n\ + min-transfer-rate-in 10240 5;\n\ multi-master no;\n\ notify yes;\n\ notify-delay 5;\n\ diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c index 00be0fe2a6..43a4943b8d 100644 --- a/bin/named/zoneconf.c +++ b/bin/named/zoneconf.c @@ -1874,6 +1874,33 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig, } dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi); + obj = NULL; + result = named_config_get(maps, "min-transfer-rate-in", &obj); + INSIST(result == ISC_R_SUCCESS && obj != NULL); + uint32_t traffic_bytes = + cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes")); + uint32_t time_minutes = + cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes")); + if (traffic_bytes == 0) { + cfg_obj_log(obj, ISC_LOG_ERROR, + "zone '%s': 'min-transfer-rate-in' bytes" + "value can not be '0'", + zname); + CHECK(ISC_R_FAILURE); + } + /* Max. 28 days (in minutes). */ + const unsigned int time_minutes_max = 28 * 24 * 60; + if (time_minutes < 1 || time_minutes > time_minutes_max) { + cfg_obj_log(obj, ISC_LOG_ERROR, + "zone '%s': 'min-transfer-rate-in' minutes" + "value is out of range (1..%u)", + zname, time_minutes_max); + CHECK(ISC_R_FAILURE); + } + dns_zone_setminxfrratein(mayberaw, traffic_bytes, + transferinsecs ? time_minutes + : time_minutes * 60); + obj = NULL; result = named_config_get(maps, "max-transfer-time-in", &obj); INSIST(result == ISC_R_SUCCESS && obj != NULL); diff --git a/doc/misc/mirror.zoneopt b/doc/misc/mirror.zoneopt index 99f1212643..b1c5c08ea7 100644 --- a/doc/misc/mirror.zoneopt +++ b/doc/misc/mirror.zoneopt @@ -26,6 +26,7 @@ zone [ ] { max-types-per-name ; min-refresh-time ; min-retry-time ; + min-transfer-rate-in ; multi-master ; notify ( explicit | master-only | primary-only | ); notify-delay ; diff --git a/doc/misc/options b/doc/misc/options index baa4e3696f..f49c0a8800 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -202,6 +202,7 @@ options { min-ncache-ttl ; min-refresh-time ; min-retry-time ; + min-transfer-rate-in ; minimal-any ; minimal-responses ( no-auth | no-auth-recursive | ); multi-master ; @@ -484,6 +485,7 @@ view [ ] { min-ncache-ttl ; min-refresh-time ; min-retry-time ; + min-transfer-rate-in ; minimal-any ; minimal-responses ( no-auth | no-auth-recursive | ); multi-master ; diff --git a/doc/misc/secondary.zoneopt b/doc/misc/secondary.zoneopt index e5bbb1816c..6fbe1fbaf5 100644 --- a/doc/misc/secondary.zoneopt +++ b/doc/misc/secondary.zoneopt @@ -38,6 +38,7 @@ zone [ ] { max-types-per-name ; min-refresh-time ; min-retry-time ; + min-transfer-rate-in ; multi-master ; notify ( explicit | master-only | primary-only | ); notify-delay ; diff --git a/doc/misc/stub.zoneopt b/doc/misc/stub.zoneopt index 4781f4d720..97b9ba0578 100644 --- a/doc/misc/stub.zoneopt +++ b/doc/misc/stub.zoneopt @@ -18,6 +18,7 @@ zone [ ] { max-types-per-name ; min-refresh-time ; min-retry-time ; + min-transfer-rate-in ; multi-master ; primaries [ port ] [ source ( | * ) ] [ source-v6 ( | * ) ] { ( | [ port ] | [ port ] ) [ key ] [ tls ]; ... }; transfer-source ( | * ); diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h index 4524142525..63b39eb1b8 100644 --- a/lib/dns/include/dns/zone.h +++ b/lib/dns/include/dns/zone.h @@ -1233,6 +1233,36 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from, *\li DNS_R_SUCCESS */ +void +dns_zone_setminxfrratein(dns_zone_t *zone, uint32_t bytes, uint32_t seconds); +/*%< + * Set the minumum traffic rate (in bytes per seconds) that a zone transfer in + * (AXFR/IXFR) of this zone will use before being aborted. + * + * Requires: + * \li 'zone' to be valid initialised zone. + */ + +uint32_t +dns_zone_getminxfrratebytesin(dns_zone_t *zone); +/*%< + * Returns the 'bytes' portion of the minimum traffic rate for the transfer in + * for this zone. + * + * Requires: + *\li 'zone' to be valid initialised zone. + */ + +uint32_t +dns_zone_getminxfrratesecondsin(dns_zone_t *zone); +/*%< + * Returns the 'seconds' portion of the minimum traffic rate for the transfer in + * for this zone. + * + * Requires: + *\li 'zone' to be valid initialised zone. + */ + void dns_zone_setmaxxfrin(dns_zone_t *zone, uint32_t maxxfrin); /*%< diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index cefb35f634..c6167900c4 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -159,6 +159,7 @@ struct dns_xfrin { unsigned int maxrecords; /*%< The maximum number of * records set for the zone */ + uint64_t nbytes_saved; /*%< For enforcing the minimum transfer rate */ dns_tsigkey_t *tsigkey; /*%< Key used to create TSIG */ isc_buffer_t *lasttsig; /*%< The last TSIG */ @@ -192,6 +193,7 @@ struct dns_xfrin { isc_loop_t *loop; + isc_timer_t *min_rate_timer; isc_timer_t *max_time_timer; isc_timer_t *max_idle_timer; @@ -269,6 +271,8 @@ xfrin_timedout(void *); static void xfrin_idledout(void *); static void +xfrin_minratecheck(void *); +static void xfrin_fail(dns_xfrin_t *xfr, isc_result_t result, const char *msg); static isc_result_t render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf); @@ -963,6 +967,24 @@ xfrin_idledout(void *xfr) { xfrin_fail(xfr, ISC_R_TIMEDOUT, "maximum idle time exceeded"); } +static void +xfrin_minratecheck(void *arg) { + dns_xfrin_t *xfr = arg; + + REQUIRE(VALID_XFRIN(xfr)); + + const uint64_t nbytes = atomic_load_relaxed(&xfr->nbytes); + const uint64_t min = dns_zone_getminxfrratebytesin(xfr->zone); + + if (nbytes - xfr->nbytes_saved < min) { + isc_timer_stop(xfr->min_rate_timer); + xfrin_fail(xfr, ISC_R_TIMEDOUT, + "minimum transfer rate reached"); + } else { + xfr->nbytes_saved = nbytes; + } +} + isc_time_t dns_xfrin_getstarttime(dns_xfrin_t *xfr) { REQUIRE(VALID_XFRIN(xfr)); @@ -1326,6 +1348,15 @@ xfrin_start(dns_xfrin_t *xfr) { isc_interval_set(&interval, dns_zone_getidlein(xfr->zone), 0); isc_timer_start(xfr->max_idle_timer, isc_timertype_once, &interval); + /* Set the minimum transfer rate checking timer */ + if (xfr->min_rate_timer == NULL) { + isc_timer_create(dns_zone_getloop(xfr->zone), + xfrin_minratecheck, xfr, &xfr->min_rate_timer); + } + isc_interval_set(&interval, dns_zone_getminxfrratesecondsin(xfr->zone), + 0); + isc_timer_start(xfr->min_rate_timer, isc_timertype_ticker, &interval); + /* * The connect has to be the last thing that is called before returning, * as it can end synchronously and destroy the xfr object. @@ -1606,6 +1637,8 @@ xfrin_send_request(dns_xfrin_t *xfr) { atomic_store_relaxed(&xfr->nbytes, 0); atomic_store_relaxed(&xfr->start, isc_time_now()); + xfr->nbytes_saved = 0; + msg->id = xfr->id; if (xfr->tsigctx != NULL) { dst_context_destroy(&xfr->tsigctx); @@ -1724,6 +1757,10 @@ xfrin_end(dns_xfrin_t *xfr, isc_result_t result) { isc_timer_stop(xfr->max_idle_timer); isc_timer_destroy(&xfr->max_idle_timer); } + if (xfr->min_rate_timer != NULL) { + isc_timer_stop(xfr->min_rate_timer); + isc_timer_destroy(&xfr->min_rate_timer); + } if (xfr->shutdown_result == ISC_R_UNSET) { xfr->shutdown_result = result; @@ -2017,6 +2054,7 @@ xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) { case XFRST_AXFR_END: case XFRST_IXFR_END: /* We are at the end, cancel the timers and IO */ + isc_timer_stop(xfr->min_rate_timer); isc_timer_stop(xfr->max_idle_timer); isc_timer_stop(xfr->max_time_timer); xfrin_cancelio(xfr); @@ -2182,6 +2220,7 @@ xfrin_destroy(dns_xfrin_t *xfr) { INSIST(xfr->max_time_timer == NULL); INSIST(xfr->max_idle_timer == NULL); + INSIST(xfr->min_rate_timer == NULL); isc_loop_detach(&xfr->loop); diff --git a/lib/dns/zone.c b/lib/dns/zone.c index ac41eb3601..9c3eafb95d 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -361,6 +361,8 @@ struct dns_zone { dns_request_t *request; dns_loadctx_t *loadctx; dns_dumpctx_t *dumpctx; + uint32_t minxfrratebytesin; + uint32_t minxfrratesecondsin; uint32_t maxxfrin; uint32_t maxxfrout; uint32_t idlein; @@ -16154,6 +16156,28 @@ message_count(dns_message_t *msg, dns_section_t section, dns_rdatatype_t type) { return count; } +void +dns_zone_setminxfrratein(dns_zone_t *zone, uint32_t bytes, uint32_t seconds) { + REQUIRE(DNS_ZONE_VALID(zone)); + + zone->minxfrratebytesin = bytes; + zone->minxfrratesecondsin = seconds; +} + +uint32_t +dns_zone_getminxfrratebytesin(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + + return zone->minxfrratebytesin; +} + +uint32_t +dns_zone_getminxfrratesecondsin(dns_zone_t *zone) { + REQUIRE(DNS_ZONE_VALID(zone)); + + return zone->minxfrratesecondsin; +} + void dns_zone_setmaxxfrin(dns_zone_t *zone, uint32_t maxxfrin) { REQUIRE(DNS_ZONE_VALID(zone)); diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index e6bef96e3c..6319d0df8f 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -2211,6 +2211,20 @@ static cfg_clausedef_t dnssecpolicy_clauses[] = { { NULL, NULL, 0 } }; +/* + * For min-transfer-rate-in. + */ +static cfg_tuplefielddef_t min_transfer_rate_fields[] = { + { "traffic_bytes", &cfg_type_uint32, 0 }, + { "time_minutes", &cfg_type_uint32, 0 }, + { NULL, NULL, 0 } +}; + +static cfg_type_t cfg_type_min_transfer_rate_in = { + "min-transfer-rate-in", cfg_parse_tuple, cfg_print_tuple, + cfg_doc_tuple, &cfg_rep_tuple, min_transfer_rate_fields +}; + /*% * Clauses that can be found in a 'zone' statement, * with defaults in the 'view' or 'options' statement. @@ -2304,6 +2318,8 @@ static cfg_clausedef_t zone_clauses[] = { CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB }, { "max-retry-time", &cfg_type_uint32, CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB }, + { "min-transfer-rate-in", &cfg_type_min_transfer_rate_in, + CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB }, { "max-transfer-idle-in", &cfg_type_uint32, CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB }, { "max-transfer-idle-out", &cfg_type_uint32,