Make qp-trie write transactions more lightweight

Check dns_name_countlabels() wrt DNS_NAME_MAXLABELS

Closes #3998

See merge request isc-projects/bind9!7822

CHANGES

@@ -1,3 +1,17 @@
+6150.	[bug]		If the zones have active upstream forwards, the
+			shutting down the server might cause assertion
+			failures as the forward were all canceled from
+			the main loop instead from the loops associated
+			with the zone. [GL #4015]
+
+6149.	[test]		As a workaround, include an OpenSSL header file before
+			including cmocka.h in the unit tests, because OpenSSL
+			3.1.0 uses __attribute__(malloc), conflicting with a
+			redefined malloc in cmocka.h. [GL #4000]
+
+6148.	[bug]		Fix a use-after-free bug in dns_xfrin_create().
+			[GL !7832]
+
 6147.	[performance]	Fix the TCP server parent quota use. [GL #3985]
 
 6146.	[performance]	Replace the zone table red-black tree and associated

bin/named/include/named/globals.h

@@ -53,6 +53,7 @@ EXTERN unsigned int named_g_cpus	      INIT(0);
 EXTERN unsigned int named_g_udpdisp	      INIT(0);
 EXTERN isc_loop_t *named_g_mainloop	      INIT(NULL);
 EXTERN isc_loopmgr_t *named_g_loopmgr	      INIT(NULL);
+EXTERN bool named_g_loopmgr_running	      INIT(false);
 EXTERN dns_dispatchmgr_t *named_g_dispatchmgr INIT(NULL);
 EXTERN unsigned int named_g_cpus_detected     INIT(1);
 

bin/named/main.c

@@ -1506,6 +1506,10 @@ main(int argc, char *argv[]) {
 	 */
 	isc_signal_start(named_g_server->sighup);
 
+	/*
+	 * Pause the loop manager in fatal.
+	 */
+	named_g_loopmgr_running = true;
 	isc_loopmgr_run(named_g_loopmgr);
 
 #ifdef HAVE_LIBSCF

bin/named/server.c

@@ -10286,7 +10286,9 @@ named_server_destroy(named_server_t **serverp) {
 
 static void
 fatal(const char *msg, isc_result_t result) {
-	isc_loopmgr_pause(named_g_loopmgr);
+	if (named_g_loopmgr_running) {
+		isc_loopmgr_pause(named_g_loopmgr);
+	}
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL, "%s: %s", msg,
 		      isc_result_totext(result));

bin/named/statschannel.c

@@ -848,6 +848,7 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 			      values, options));
 }
 
+#if defined(EXTENDED_STATS)
 static isc_result_t
 dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	   const char *category, const char **desc, int ncounters, int *indices,
@@ -863,6 +864,7 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	return (dump_counters(type, arg, category, desc, ncounters, indices,
 			      values, options));
 }
+#endif /* defined(EXTENDED_STATS) */
 
 static isc_result_t
 dump_counters(isc_statsformat_t type, void *arg, const char *category,

bin/tests/system/keymgr2kasp/ns3/kasp.conf.in

@@ -82,3 +82,23 @@ dnssec-policy "migrate-nomatch-alglen" {
 	parent-propagation-delay pt1h;
 	parent-ds-ttl 7200;
 };
+
+/*
+ * This policy tests migration from existing KSK and ZSK to CSK.
+ * The keys clause matches the default policy.
+ */
+dnssec-policy "migrate-nomatch-kzc" {
+	dnskey-ttl 300;
+
+	keys {
+		csk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
+	};
+
+	// Together 12h
+	zone-propagation-delay 3600;
+	max-zone-ttl 11h;
+
+	// Together 3h
+	parent-propagation-delay pt1h;
+	parent-ds-ttl 7200;
+};

bin/tests/system/keymgr2kasp/ns3/named.conf.in

@@ -96,3 +96,10 @@ zone "migrate-nomatch-alglen.kasp" {
 	dnssec-dnskey-kskonly yes;
 	update-check-ksk yes;
 };
+
+zone "migrate-nomatch-kzc.kasp" {
+	type primary;
+	file "migrate-nomatch-kzc.kasp.db";
+	auto-dnssec maintain;
+	inline-signing yes;
+};

bin/tests/system/keymgr2kasp/ns3/named2.conf.in

@@ -85,3 +85,10 @@ zone "migrate-nomatch-alglen.kasp" {
 	allow-update { any; };
 	dnssec-policy "migrate-nomatch-alglen";
 };
+
+zone "migrate-nomatch-kzc.kasp" {
+	type primary;
+	file "migrate-nomatch-kzc.kasp.db";
+	inline-signing yes;
+	dnssec-policy "migrate-nomatch-kzc";
+};

bin/tests/system/keymgr2kasp/ns3/setup.sh

@@ -96,6 +96,23 @@ private_type_record $zone 5 "$KSK" >> "$infile"
 private_type_record $zone 5 "$ZSK" >> "$infile"
 $SIGNER -S -x -s now-1h -e now+2w -o $zone -O full -f $zonefile $infile > signer.out.$zone.1 2>&1
 
+# Set up a zone with auto-dnssec maintain to migrate to default dnssec-policy.
+# The zone is signed with KSK/ZSK split, but the dnssec-policy uses CSK.
+setup migrate-nomatch-kzc.kasp
+echo "$zone" >> zones
+Tds="now-3h"     # Time according to dnssec-policy that DS will be OMNIPRESENT
+Tkey="now-3900s" # DNSKEY TTL + propagation delay
+Tsig="now-12h"   # Zone's maximum TTL + propagation delay
+ksktimes="-P ${Tkey} -A ${Tkey} -P sync ${Tds}"
+zsktimes="-P ${Tkey} -A ${Tsig}"
+KSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300 -f KSK $ksktimes $zone 2> keygen.out.$zone.1)
+ZSK=$($KEYGEN -a $DEFAULT_ALGORITHM -L 300        $zsktimes $zone 2> keygen.out.$zone.2)
+cat template.db.in "${KSK}.key" "${ZSK}.key" > "$infile"
+cp $infile $zonefile
+private_type_record $zone 5 "$KSK" >> "$infile"
+private_type_record $zone 5 "$ZSK" >> "$infile"
+$SIGNER -PS -x -s now-1h -e now+2w -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
 #
 # Set up zones to test time metadata correctly sets state.
 #

bin/tests/system/keymgr2kasp/tests.sh

@@ -346,6 +346,43 @@ dnssec_verify
 _migratenomatch_alglen_ksk=$(key_get KEY1 ID)
 _migratenomatch_alglen_zsk=$(key_get KEY2 ID)
 
+#
+# Testing migration with unmatched existing keys (different roles KSK/ZSK -> CSK).
+#
+set_zone "migrate-nomatch-kzc.kasp"
+set_policy "none" "2" "300"
+set_server "ns3" "10.53.0.3"
+
+init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
+init_migration_states "omnipresent" "omnipresent"
+
+# Make sure the zone is signed with legacy keys.
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# Set expected key times:
+# - The KSK is immediately published and activated.
+#   P     : now-3900s
+#   P sync: now-3h
+#   A     : now-3900s
+created=$(key_get KEY1 CREATED)
+set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
+set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
+# - The ZSK is immediately published and activated.
+#   P: now-3900s
+#   A: now-12h
+created=$(key_get KEY2 CREATED)
+set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
+set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
+check_keytimes
+check_apex
+check_subdomain
+dnssec_verify
+
+# Remember legacy key tags.
+_migratenomatch_kzc_ksk=$(key_get KEY1 ID)
+_migratenomatch_kzc_zsk=$(key_get KEY2 ID)
 
 #############
 # Reconfig. #
@@ -791,6 +828,106 @@ ret=0
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+#
+# Test migration to dnssec-policy, existing keys do not match role (KSK/ZSK -> CSK).
+#
+set_zone "migrate-nomatch-kzc.kasp"
+set_policy "migrate-nomatch-kzc" "3" "300"
+set_server "ns3" "10.53.0.3"
+
+# The legacy keys need to be retired, but otherwise stay present until the
+# new keys are omnipresent, and can be used to construct a chain of trust.
+init_migration_keys "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS" "$DEFAULT_BITS"
+init_migration_states "hidden" "omnipresent"
+key_set "KEY1" "LEGACY" "no"
+key_set "KEY2" "LEGACY" "no"
+
+set_keyrole      "KEY3" "csk"
+set_keylifetime  "KEY3" "0"
+set_keyalgorithm "KEY3" "$DEFAULT_ALGORITHM_NUMBER" "$DEFAULT_ALGORITHM" "$DEFAULT_BITS"
+set_keysigning   "KEY3" "yes"
+set_zonesigning  "KEY3" "no"
+
+set_keystate "KEY3" "GOAL"         "omnipresent"
+set_keystate "KEY3" "STATE_DNSKEY" "rumoured"
+set_keystate "KEY3" "STATE_KRRSIG" "rumoured"
+# This key is considered to be prepublished, so it is not yet signing.
+set_keystate "KEY3" "STATE_ZRRSIG" "hidden"
+set_keystate "KEY3" "STATE_DS"     "hidden"
+
+# Various signing policy checks.
+check_keys
+wait_for_done_signing
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+
+# Set expected key times:
+# - KSK must be retired since it no longer matches the policy.
+#   P     : now-3900s
+#   P sync: now-3h
+#   A     : now-3900s
+# - The key is removed after the retire interval:
+#   IretKSK = TTLds + DprpP + retire_safety.
+#   TTLds:         2h (7200 seconds)
+#   Dprp:          1h (3600 seconds)
+#   retire-safety: 1h (3600 seconds)
+#   IretKSK:       4h (14400 seconds)
+IretKSK=14400
+created=$(key_get KEY1 CREATED)
+set_addkeytime "KEY1" "PUBLISHED"   "${created}" -3900
+set_addkeytime "KEY1" "ACTIVE"      "${created}" -3900
+set_addkeytime "KEY1" "SYNCPUBLISH" "${created}" -10800
+keyfile=$(key_get KEY1 BASEFILE)
+grep "; Inactive:" "${keyfile}.key" > retired.test${n}.ksk
+retired=$(awk '{print $3}' < retired.test${n}.ksk)
+set_keytime    "KEY1" "RETIRED" "${retired}"
+set_addkeytime "KEY1" "REMOVED" "${retired}" "${IretKSK}"
+# - ZSK must be retired since it no longer matches the policy.
+#   P: now-3900s
+#   A: now-12h
+# - The key is removed after the retire interval:
+#   IretZSK = TTLsig + Dprp + Dsgn + retire-safety.
+#   TTLsig:         11h (39600 seconds)
+#   Dprp:           1h (3600 seconds)
+#   Dsgn:           9d (777600 seconds)
+#   publish-safety: 1h (3600 seconds)
+#   IretZSK:        9d13h (824400 seconds)
+IretZSK=824400
+Lzsk=5184000
+created=$(key_get KEY2 CREATED)
+set_addkeytime "KEY2" "PUBLISHED"   "${created}" -3900
+set_addkeytime "KEY2" "ACTIVE"      "${created}" -43200
+keyfile=$(key_get KEY2 BASEFILE)
+grep "; Inactive:" "${keyfile}.key" > retired.test${n}.zsk
+retired=$(awk '{print $3}' < retired.test${n}.zsk)
+set_keytime    "KEY2" "RETIRED" "${retired}"
+set_addkeytime "KEY2" "REMOVED" "${retired}" "${IretZSK}"
+# - The new KSK is immediately published and activated.
+created=$(key_get KEY3 CREATED)
+set_keytime    "KEY3" "PUBLISHED"   "${created}"
+set_keytime    "KEY3" "ACTIVE"      "${created}"
+# - It takes TTLsig + Dprp + publish-safety hours to propagate the zone.
+#   TTLsig:         11h (39600 seconds)
+#   Dprp:           1h (3600 seconds)
+#   publish-safety: 1h (3600 seconds)
+#   Ipub:           13h (46800 seconds)
+Ipub=46800
+set_addkeytime "KEY3" "SYNCPUBLISH" "${created}" "${Ipub}"
+
+# Continue signing policy checks.
+check_keytimes
+check_apex
+check_subdomain
+dnssec_verify
+
+# Check key tags, should be the same.
+n=$((n+1))
+echo_i "check that of zone ${ZONE} migration to dnssec-policy keeps existing keys ($n)"
+ret=0
+[ $_migratenomatch_kzc_ksk = $(key_get KEY1 ID) ] || log_error "mismatch ksk tag"
+[ $_migratenomatch_kzc_zsk = $(key_get KEY2 ID) ] || log_error "mismatch zsk tag"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 ########################################################
 # Testing key states derived from key timing metadata. #
 ########################################################

bin/tests/system/xfer/tests.sh

@@ -576,7 +576,7 @@ status=$((status+tmp))
 n=$((n+1))
 echo_i "test that transfer-source uses port option correctly ($n)"
 tmp=0
-grep "10.53.0.3#${EXTRAPORT1} (primary): query 'primary/SOA/IN' approved" ns6/named.run > /dev/null || ret=1
+grep "10.53.0.3#${EXTRAPORT1} (primary): query 'primary/SOA/IN' approved" ns6/named.run > /dev/null || tmp=1
 if test $tmp != 0 ; then echo_i "failed"; fi
 status=$((status+tmp))
 

configure.ac

@@ -16,7 +16,7 @@
 #
 m4_define([bind_VERSION_MAJOR], 9)dnl
 m4_define([bind_VERSION_MINOR], 19)dnl
-m4_define([bind_VERSION_PATCH], 12)dnl
+m4_define([bind_VERSION_PATCH], 13)dnl
 m4_define([bind_VERSION_EXTRA], -dev)dnl
 m4_define([bind_DESCRIPTION], [(Development Release)])dnl
 m4_define([bind_SRCID], [m4_esyscmd_s([git rev-parse --short HEAD | cut -b1-7])])dnl

doc/notes/notes-current.rst

@@ -9,7 +9,7 @@
 .. See the COPYRIGHT file distributed with this work for additional
 .. information regarding copyright ownership.
 
-Notes for BIND 9.19.12
+Notes for BIND 9.19.13
 ----------------------
 
 Security Fixes
@@ -20,41 +20,12 @@ Security Fixes
 New Features
 ~~~~~~~~~~~~
 
-- BIND now depends on ``liburcu``, Userspace RCU, for lock-free data
-  structures. :gl:`#3934`
-
-- The new ``delv +ns`` option activates name server mode, in which ``delv``
-  sets up an internal recursive resolver and uses that, rather than an
-  external server, to look up the requested query name and type. All messages
-  sent and received during the resolution and validation process are logged.
-  This can be used in place of ``dig +trace``: it more accurately
-  reproduces the behavior of ``named`` when resolving a query.
-
-  The log message ``resolver priming query complete`` was moved from the
-  INFO log level to the DEBUG(1) log level, to prevent ``delv`` from
-  emitting that message when setting up its internal resolver. :gl:`#3842`
-
-- A new configuration option :any:`checkds` is introduced that when set to
-  ``yes`` will detect :any:`parental-agents` automatically by resolving the
-  parent NS records. These name servers will be used to check the DS RRset
-  during a KSK rollover initiated by :any:`dnssec-policy`. :gl:`#3901`
+- None.
 
 Removed Features
 ~~~~~~~~~~~~~~~~
 
-- The TKEY Mode 2 (Diffie-Hellman Exchanged Keying Mode) has been removed and
-  using TKEY Mode 2 is now a fatal error.  Users are advised to switch to TKEY
-  Mode 3 (GSS-API). :gl:`#3905`
-
-- Zone type ``delegation-only``, and the ``delegation-only`` and
-  ``root-delegation-only`` options, have been removed. Using them
-  is a configuration error.
-
-  These options were created to address the SiteFinder controversy, in
-  which certain top-level domains redirected misspelled queries to other
-  sites instead of returning NXDOMAIN responses. Since top-level domains are
-  now DNSSEC signed, and DNSSEC validation is active by default, the
-  options are no longer needed. :gl:`#3953`
+- None.
 
 Feature Changes
 ~~~~~~~~~~~~~~~
@@ -64,8 +35,7 @@ Feature Changes
 Bug Fixes
 ~~~~~~~~~
 
-- Performance of DNSSEC validation in zones with many DNSKEY records
-  has been improved. :gl:`#3981`
+- None.
 
 Known Issues
 ~~~~~~~~~~~~

lib/dns/keymgr.c

@@ -44,13 +44,28 @@
  * Set key state to `target` state and change last changed
  * to `time`, only if key state has not been set before.
  */
-#define INITIALIZE_STATE(key, state, timing, target, time)                    \
-	do {                                                                  \
-		dst_key_state_t s;                                            \
-		if (dst_key_getstate((key), (state), &s) == ISC_R_NOTFOUND) { \
-			dst_key_setstate((key), (state), (target));           \
-			dst_key_settime((key), (timing), time);               \
-		}                                                             \
+#define INITIALIZE_STATE(key, state, timing, target, time)                     \
+	do {                                                                   \
+		dst_key_state_t s;                                             \
+		char keystr[DST_KEY_FORMATSIZE];                               \
+		if (dst_key_getstate((key), (state), &s) == ISC_R_NOTFOUND) {  \
+			dst_key_setstate((key), (state), (target));            \
+			dst_key_settime((key), (timing), time);                \
+                                                                               \
+			if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {    \
+				dst_key_format((key), keystr, sizeof(keystr)); \
+				isc_log_write(                                 \
+					dns_lctx, DNS_LOGCATEGORY_DNSSEC,      \
+					DNS_LOGMODULE_DNSSEC,                  \
+					ISC_LOG_DEBUG(3),                      \
+					"keymgr: DNSKEY %s (%s) initialize "   \
+					"%s state to %s (policy %s)",          \
+					keystr, keymgr_keyrole((key)),         \
+					keystatetags[state],                   \
+					keystatestrings[target],               \
+					dns_kasp_getname(kasp));               \
+			}                                                      \
+		}                                                              \
 	} while (0)
 
 /* Shorter keywords for better readability. */

lib/dns/qp.c

@@ -73,8 +73,15 @@ static atomic_uint_fast64_t rollback_time;
 #define LOG_STATS(...)                                                      \
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_QP, \
 		      ISC_LOG_DEBUG(1), __VA_ARGS__)
+#define LOG_SIZES(qp, time)                                              \
+	LOG_STATS("%s(%" PRIu64 " ns) chunk %u max %u leaf %u"           \
+		  " live %u used %u free %u hold %u",                    \
+		  __func__, time, (qp)->chunk_count, (qp)->chunk_max,    \
+		  (qp)->leaf_count, (qp)->used_count - (qp)->free_count, \
+		  (qp)->used_count, (qp)->free_count, (qp)->hold_count)
 #else
 #define LOG_STATS(...)
+#define LOG_SIZES(...)
 #endif
 
 #if DNS_QP_TRACE
@@ -406,6 +413,7 @@ chunk_alloc(dns_qp_t *qp, qp_chunk_t chunk, qp_weight_t size) {
 	qp->base->ptr[chunk] = chunk_get_raw(qp);
 	qp->usage[chunk] = (qp_usage_t){ .exists = true, .used = size };
 	qp->used_count += size;
+	qp->chunk_count += 1;
 	qp->bump = chunk;
 	qp->fender = 0;
 
@@ -560,6 +568,7 @@ chunk_discount(dns_qp_t *qp, qp_chunk_t chunk) {
 		INSIST(qp->free_count >= qp->usage[chunk].free);
 		qp->used_count -= qp->usage[chunk].used;
 		qp->free_count -= qp->usage[chunk].free;
+		qp->chunk_count -= 1;
 	}
 }
 
@@ -615,9 +624,7 @@ recycle(dns_qp_t *qp) {
 
 	if (free > 0) {
 		LOG_STATS("qp recycle" PRItime "free %u chunks", time, free);
-		LOG_STATS("qp recycle leaf %u live %u used %u free %u hold %u",
-			  qp->leaf_count, qp->used_count - qp->free_count,
-			  qp->used_count, qp->free_count, qp->hold_count);
+		LOG_SIZES(qp, time);
 	}
 }
 
@@ -628,21 +635,42 @@ recycle(dns_qp_t *qp) {
 static bool
 defer_chunk_reclamation(dns_qp_t *qp, isc_qsbr_phase_t phase) {
 	unsigned int reclaim = 0;
+	unsigned int free = 0;
+
+	isc_nanosecs_t start = isc_time_monotonic();
 
 	for (qp_chunk_t chunk = 0; chunk < qp->chunk_max; chunk++) {
 		if (chunk != qp->bump && chunk_usage(qp, chunk) == 0 &&
-		    qp->usage[chunk].exists && qp->usage[chunk].immutable &&
-		    qp->usage[chunk].phase == 0)
+		    qp->usage[chunk].exists)
 		{
-			chunk_discount(qp, chunk);
-			qp->usage[chunk].phase = phase;
-			reclaim++;
+			if (!qp->usage[chunk].immutable) {
+				/* clean up empty mutable chunks right now */
+				chunk_free(qp, chunk);
+				free++;
+			} else if (qp->usage[chunk].phase == 0) {
+				/*
+				 * defer cleanup of empty immutable chunks
+				 * that are not already scheduled for cleanup
+				 */
+				chunk_discount(qp, chunk);
+				qp->usage[chunk].phase = phase;
+				reclaim++;
+			}
 		}
 	}
 
+	isc_nanosecs_t time = isc_time_monotonic() - start;
+	atomic_fetch_add_relaxed(&recycle_time, time);
+
+	if (free > 0) {
+		LOG_STATS("qp defer" PRItime "free %u chunks", time, free);
+	}
 	if (reclaim > 0) {
-		LOG_STATS("qp will reclaim %u chunks in phase %u", reclaim,
-			  phase);
+		LOG_STATS("qp defer" PRItime "%u chunks in phase %u", time,
+			  reclaim, phase);
+	}
+	if (free > 0 || reclaim > 0) {
+		LOG_SIZES(qp, time);
 	}
 
 	return (reclaim > 0);
@@ -679,9 +707,7 @@ reclaim_chunks(dns_qp_t *qp, isc_qsbr_phase_t phase) {
 	if (free > 0) {
 		LOG_STATS("qp reclaim" PRItime "phase %u free %u chunks", time,
 			  phase, free);
-		LOG_STATS("qp reclaim leaf %u live %u used %u free %u hold %u",
-			  qp->leaf_count, qp->used_count - qp->free_count,
-			  qp->used_count, qp->free_count, qp->hold_count);
+		LOG_SIZES(qp, time);
 	}
 
 	return (more);
@@ -765,10 +791,7 @@ marksweep_chunks(dns_qpmulti_t *multi) {
 
 	if (free > 0) {
 		LOG_STATS("qp marksweep" PRItime "free %u chunks", time, free);
-		LOG_STATS(
-			"qp marksweep leaf %u live %u used %u free %u hold %u",
-			qpw->leaf_count, qpw->used_count - qpw->free_count,
-			qpw->used_count, qpw->free_count, qpw->hold_count);
+		LOG_SIZES(qpw, time);
 	}
 }
 
@@ -874,9 +897,7 @@ compact_recursive(dns_qp_t *qp, qp_node_t *parent) {
 
 static void
 compact(dns_qp_t *qp) {
-	LOG_STATS("qp compact before leaf %u live %u used %u free %u hold %u",
-		  qp->leaf_count, qp->used_count - qp->free_count,
-		  qp->used_count, qp->free_count, qp->hold_count);
+	LOG_SIZES(qp, 0LU);
 
 	isc_nanosecs_t start = isc_time_monotonic();
 
@@ -892,10 +913,7 @@ compact(dns_qp_t *qp) {
 	isc_nanosecs_t time = isc_time_monotonic() - start;
 	atomic_fetch_add_relaxed(&compact_time, time);
 
-	LOG_STATS("qp compact" PRItime
-		  "leaf %u live %u used %u free %u hold %u",
-		  time, qp->leaf_count, qp->used_count - qp->free_count,
-		  qp->used_count, qp->free_count, qp->hold_count);
+	LOG_SIZES(qp, time);
 }
 
 void
@@ -1182,16 +1200,19 @@ dns_qpmulti_commit(dns_qpmulti_t *multi, dns_qp_t **qptp) {
 	/* reader_open() below has the matching atomic_load_acquire() */
 	atomic_store_release(&multi->reader, reader); /* COMMIT */
 
-	/* clean up what we can right now */
+	/*
+	 * We don't use AUTOGC here because it is for use when we can only
+	 * recycle mutable chunks; in this case we are (or, after a grace
+	 * period, we will be) able to recycle immutable chunks, and NEEDGC
+	 * takes account of immutable as well as mutable chunks.
+	 */
 	if (qp->transaction_mode == QP_UPDATE || QP_NEEDGC(qp)) {
-		recycle(qp);
-	}
-
-	/* the reclamation phase must be sampled after the commit */
-	isc_qsbr_phase_t phase = isc_qsbr_phase(multi->loopmgr);
-	if (defer_chunk_reclamation(qp, phase)) {
-		ISC_ASTACK_ADD(qsbr_work, multi, cleanup);
-		isc_qsbr_activate(multi->loopmgr, phase);
+		/* the reclamation phase must be sampled after the commit */
+		isc_qsbr_phase_t phase = isc_qsbr_phase(multi->loopmgr);
+		if (defer_chunk_reclamation(qp, phase)) {
+			ISC_ASTACK_ADD(qsbr_work, multi, cleanup);
+			isc_qsbr_activate(multi->loopmgr, phase);
+		}
 	}
 
 	*qptp = NULL;

lib/dns/qp_p.h

@@ -489,7 +489,7 @@ struct dns_qp {
 	/*% array of per-chunk allocation counters */
 	qp_usage_t *usage;
 	/*% number of slots in `chunk` and `usage` arrays */
-	qp_chunk_t chunk_max;
+	qp_chunk_t chunk_max, chunk_count;
 	/*% which chunk is used for allocations */
 	qp_chunk_t bump;
 	/*% nodes in the `bump` chunk below `fender` are read only [MT] */

lib/dns/xfrin.c

@@ -723,6 +723,7 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 	if (result != ISC_R_SUCCESS) {
 		atomic_store(&xfr->shuttingdown, true);
 		xfr->shutdown_result = result;
+		xfrin_log(xfr, ISC_LOG_ERROR, "zone transfer setup failed");
 		dns_xfrin_detach(xfrp);
 	}
 
@@ -730,10 +731,6 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		dns_db_detach(&db);
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		xfrin_log(xfr, ISC_LOG_ERROR, "zone transfer setup failed");
-	}
-
 	return (result);
 }
 

lib/dns/zone.c

@@ -11845,6 +11845,13 @@ checkds_cancel(dns_zone_t *zone) {
 	}
 }
 
+static void
+forward_cancel_cb(void *arg) {
+	dns_request_t *request = arg;
+	dns_request_cancel(request);
+	dns_request_detach(&request);
+}
+
 static void
 forward_cancel(dns_zone_t *zone) {
 	dns_forward_t *forward;
@@ -11859,7 +11866,9 @@ forward_cancel(dns_zone_t *zone) {
 	     forward = ISC_LIST_NEXT(forward, link))
 	{
 		if (forward->request != NULL) {
-			dns_request_cancel(forward->request);
+			dns_request_t *request = NULL;
+			dns_request_attach(forward->request, &request);
+			isc_async_run(zone->loop, forward_cancel_cb, request);
 		}
 	}
 }

lib/isc/netmgr/netmgr-int.h

@@ -71,11 +71,6 @@
 		 ? ISC_NETMGR_UDP_RECVBUF_SIZE                      \
 		 : ISC_NETMGR_TCP_RECVBUF_SIZE)
 
-/*
- * Send buffer
- */
-#define ISC_NETMGR_SENDBUF_SIZE (sizeof(uint16_t) + UINT16_MAX)
-
 /*
  * Make sure our RECVBUF size is large enough
  */
@@ -193,7 +188,6 @@ typedef struct isc__networker {
 	bool shuttingdown;
 
 	char *recvbuf;
-	char *sendbuf;
 	bool recvbuf_inuse;
 
 	ISC_LIST(isc_nmsocket_t) active_sockets;

lib/isc/netmgr/netmgr.c

@@ -230,8 +230,6 @@ isc_netmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t **netmgrp) {
 		*worker = (isc__networker_t){
 			.recvbuf = isc_mem_get(loop->mctx,
 					       ISC_NETMGR_RECVBUF_SIZE),
-			.sendbuf = isc_mem_get(loop->mctx,
-					       ISC_NETMGR_SENDBUF_SIZE),
 			.active_sockets = ISC_LIST_INITIALIZER,
 		};
 
@@ -2320,7 +2318,6 @@ isc__networker_destroy(isc__networker_t *worker) {
 
 	isc_mempool_destroy(&worker->uvreq_pool);
 
-	isc_mem_put(worker->mctx, worker->sendbuf, ISC_NETMGR_SENDBUF_SIZE);
 	isc_mem_putanddetach(&worker->mctx, worker->recvbuf,
 			     ISC_NETMGR_RECVBUF_SIZE);
 	isc_nm_detach(&netmgr);

tests/dns/dst_test.c

@@ -19,6 +19,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/dns/name_test.c

@@ -509,7 +509,7 @@ name_attr_zero(struct dns_name_attrs attributes) {
 		  attributes.update | attributes.hasupdaterec));
 }
 
-/* dns_nane_init */
+/* dns_name_init */
 ISC_RUN_TEST_IMPL(init) {
 	dns_name_t name;
 	unsigned char offsets[1];
@@ -526,7 +526,7 @@ ISC_RUN_TEST_IMPL(init) {
 	assert_true(name_attr_zero(name.attributes));
 }
 
-/* dns_nane_invalidate */
+/* dns_name_invalidate */
 ISC_RUN_TEST_IMPL(invalidate) {
 	dns_name_t name;
 	unsigned char offsets[1];
@@ -544,7 +544,7 @@ ISC_RUN_TEST_IMPL(invalidate) {
 	assert_true(name_attr_zero(name.attributes));
 }
 
-/* dns_nane_setbuffer/hasbuffer */
+/* dns_name_setbuffer/hasbuffer */
 ISC_RUN_TEST_IMPL(buffer) {
 	dns_name_t name;
 	unsigned char buf[BUFSIZ];
@@ -559,7 +559,7 @@ ISC_RUN_TEST_IMPL(buffer) {
 	assert_true(dns_name_hasbuffer(&name));
 }
 
-/* dns_nane_isabsolute */
+/* dns_name_isabsolute */
 ISC_RUN_TEST_IMPL(isabsolute) {
 	struct {
 		const char *namestr;
@@ -593,7 +593,7 @@ ISC_RUN_TEST_IMPL(isabsolute) {
 	}
 }
 
-/* dns_nane_hash */
+/* dns_name_hash */
 ISC_RUN_TEST_IMPL(hash) {
 	struct {
 		const char *name1;
@@ -656,7 +656,7 @@ ISC_RUN_TEST_IMPL(hash) {
 	}
 }
 
-/* dns_nane_issubdomain */
+/* dns_name_issubdomain */
 ISC_RUN_TEST_IMPL(issubdomain) {
 	struct {
 		const char *name1;
@@ -699,14 +699,25 @@ ISC_RUN_TEST_IMPL(issubdomain) {
 	}
 }
 
-/* dns_nane_countlabels */
+/* dns_name_countlabels */
 ISC_RUN_TEST_IMPL(countlabels) {
 	struct {
 		const char *namestr;
 		unsigned int expect;
 	} testcases[] = {
-		{ "c.d", 2 },	  { "c.d.", 3 },  { "a.b.c.d.", 5 },
-		{ "a.b.c.d", 4 }, { "a.b.c", 3 }, { ".", 1 },
+		{ "c.d", 2 },
+		{ "c.d.", 3 },
+		{ "a.b.c.d.", 5 },
+		{ "a.b.c.d", 4 },
+		{ "a.b.c", 3 },
+		{ ".", 1 },
+		{ "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y."
+		  "a.b.",
+		  128 },
 	};
 	unsigned int i;
 
@@ -734,7 +745,7 @@ ISC_RUN_TEST_IMPL(countlabels) {
 	}
 }
 
-/* dns_nane_getlabel */
+/* dns_name_getlabel */
 ISC_RUN_TEST_IMPL(getlabel) {
 	struct {
 		const char *name1;
@@ -777,7 +788,7 @@ ISC_RUN_TEST_IMPL(getlabel) {
 	}
 }
 
-/* dns_nane_getlabelsequence */
+/* dns_name_getlabelsequence */
 ISC_RUN_TEST_IMPL(getlabelsequence) {
 	struct {
 		const char *name1;
@@ -845,6 +856,7 @@ ISC_RUN_TEST_IMPL(maxlabels) {
 	result = dns_name_fromstring(name, one_too_many + 2, 0, NULL);
 	assert_int_equal(result, ISC_R_SUCCESS);
 	assert_true(dns_name_isvalid(name));
+	assert_int_equal(dns_name_countlabels(name), DNS_NAME_MAXLABELS);
 }
 
 #ifdef DNS_BENCHMARK_TESTS

tests/dns/rsa_test.c

@@ -20,6 +20,13 @@
 #include <string.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/include/tests/isc.h

@@ -17,9 +17,6 @@
 
 #include <inttypes.h>
 #include <stdbool.h>
-#include <sys/types.h>
-#include <sys/wait.h>
-#include <unistd.h>
 
 #include <isc/buffer.h>
 #include <isc/hash.h>
@@ -169,39 +166,18 @@ teardown_managers(void **state);
 
 #define ISC_TEST_MAIN ISC_TEST_MAIN_CUSTOM(NULL, NULL)
 
-#define ISC_TEST_MAIN_CUSTOM(setup, teardown)                                \
-	static int  __child = 0;                                             \
-	static void __alarm(int sig ISC_ATTR_UNUSED) {                       \
-		kill(__child, SIGABRT);                                      \
-	}                                                                    \
-	int main(void) {                                                     \
-		int r, status;                                               \
-                                                                             \
-		switch ((__child = fork())) {                                \
-		case 0:                                                      \
-			break;                                               \
-		case -1:                                                     \
-			exit(1);                                             \
-		default:                                                     \
-			signal(SIGALRM, __alarm);                            \
-			alarm(1200);                                         \
-			if ((r = waitpid(__child, &status, 0)) == __child) { \
-				/* Pass the exit status to the caller. */    \
-				if (WIFEXITED(status)) {                     \
-					exit(WEXITSTATUS(status));           \
-				}                                            \
-			}                                                    \
-			exit(1);                                             \
-		}                                                            \
-                                                                             \
-		signal(SIGPIPE, SIG_IGN);                                    \
-                                                                             \
-		isc_mem_debugging |= ISC_MEM_DEBUGRECORD;                    \
-		isc_mem_create(&mctx);                                       \
-                                                                             \
-		r = cmocka_run_group_tests(tests, setup, teardown);          \
-                                                                             \
-		isc_mem_destroy(&mctx);                                      \
-                                                                             \
-		return (r);                                                  \
+#define ISC_TEST_MAIN_CUSTOM(setup, teardown)                       \
+	int main(void) {                                            \
+		int r;                                              \
+                                                                    \
+		signal(SIGPIPE, SIG_IGN);                           \
+                                                                    \
+		isc_mem_debugging |= ISC_MEM_DEBUGRECORD;           \
+		isc_mem_create(&mctx);                              \
+                                                                    \
+		r = cmocka_run_group_tests(tests, setup, teardown); \
+                                                                    \
+		isc_mem_destroy(&mctx);                             \
+                                                                    \
+		return (r);                                         \
 	}

tests/isc/doh_test.c

@@ -21,6 +21,13 @@
 #include <time.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/hmac_test.c

@@ -20,6 +20,13 @@
 #include <stdlib.h>
 #include <string.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/netmgr_common.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/tcp_test.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/tcpdns_test.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/tls_test.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/tlsdns_test.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/isc/udp_test.c

@@ -18,6 +18,13 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+/*
+ * As a workaround, include an OpenSSL header file before including cmocka.h,
+ * because OpenSSL 3.1.0 uses __attribute__(malloc), conflicting with a
+ * redefined malloc in cmocka.h.
+ */
+#include <openssl/err.h>
+
 #define UNIT_TESTING
 #include <cmocka.h>
 

tests/unit-test-driver.sh.in

@@ -35,8 +35,8 @@ while [ ${TIMEOUT} -gt 0 ]; do
 	TIMEOUT=$((TIMEOUT - 1))
 done
 if [ ${TIMEOUT} -eq 0 ]; then
-	echo "PID ${TEST_PROGRAM_PID} exceeded run time limit, sending SIGKILL" >&2
-	kill -KILL "${TEST_PROGRAM_PID}" 2>/dev/null
+	echo "PID ${TEST_PROGRAM_PID} exceeded run time limit, sending SIGABRT" >&2
+	kill -ABRT "${TEST_PROGRAM_PID}" 2>/dev/null
 fi
 
 TEST_PROGRAM_NAME=$(basename "${TEST_PROGRAM}")