Merge pull request #8937 from rgacogne/ddist-fstrm-options

dnsdist: Make FrameStream IO parameters configurable

diff --git a/pdns/auth-packetcache.cc b/pdns/auth-packetcache.cc
index fd96a16257336a5436ce4011cffc0f3e2579439a..71dbf134d50abdddf88086eb070266400d712b8a 100644 (file)
--- a/pdns/auth-packetcache.cc
+++ b/pdns/auth-packetcache.cc
@@ -248,11 +248,7 @@ uint64_t AuthPacketCache::purge(const string &match)
                           
 void AuthPacketCache::cleanup()
 {
-  uint64_t maxCached = d_maxEntries;
-  uint64_t cacheSize = *d_statnumentries;
-  uint64_t totErased = 0;
-
-  totErased = pruneLockedCollectionsVector<SequencedTag>(d_maps, maxCached, cacheSize);
+  uint64_t totErased = pruneLockedCollectionsVector<SequencedTag>(d_maps);
   *d_statnumentries -= totErased;
 
   DLOG(g_log<<"Done with cache clean, cacheSize: "<<(*d_statnumentries)<<", totErased"<<totErased<<endl);

diff --git a/pdns/auth-querycache.cc b/pdns/auth-querycache.cc
index 1baa52109229ed0ede439640f419c1f6350bd87b..d4970bd137a8cd7d6851afebb295861ca00327a0 100644 (file)
--- a/pdns/auth-querycache.cc
+++ b/pdns/auth-querycache.cc
@@ -209,13 +209,9 @@ uint64_t AuthQueryCache::purge(const string &match)
 
 void AuthQueryCache::cleanup()
 {
-  uint64_t maxCached = d_maxEntries;
-  uint64_t cacheSize = *d_statnumentries;
-  uint64_t totErased = 0;
-
-  totErased = pruneLockedCollectionsVector<SequencedTag>(d_maps, maxCached, cacheSize);
-
+  uint64_t totErased = pruneLockedCollectionsVector<SequencedTag>(d_maps);
   *d_statnumentries -= totErased;
+
   DLOG(g_log<<"Done with cache clean, cacheSize: "<<*d_statnumentries<<", totErased"<<totErased<<endl);
 }
 

diff --git a/pdns/cachecleaner.hh b/pdns/cachecleaner.hh
index 9b748e8e60bb0344d96b9894ba7f42f4f18285de..18e5ea147494a65d3ec505ff993aab50e1276d58 100644 (file)
--- a/pdns/cachecleaner.hh
+++ b/pdns/cachecleaner.hh
@@ -112,39 +112,25 @@ template <typename S, typename T> void moveCacheItemToBack(T& collection, typena
   moveCacheItemToFrontOrBack<S>(collection, iter, false);
 }
 
-template <typename S, typename T> uint64_t pruneLockedCollectionsVector(vector<T>& maps, uint64_t maxCached, uint64_t cacheSize)
+template <typename S, typename T> uint64_t pruneLockedCollectionsVector(vector<T>& maps)
 {
-  time_t now = time(nullptr);
   uint64_t totErased = 0;
-  uint64_t toTrim = 0;
-  uint64_t lookAt = 0;
-
-  // two modes - if toTrim is 0, just look through 10%  of the cache and nuke everything that is expired
-  // otherwise, scan first 5*toTrim records, and stop once we've nuked enough
-  if (maxCached && cacheSize > maxCached) {
-    toTrim = cacheSize - maxCached;
-    lookAt = 5 * toTrim;
-  } else {
-    lookAt = cacheSize / 10;
-  }
+  time_t now = time(nullptr);
 
   for(auto& mc : maps) {
     WriteLock wl(&mc.d_mut);
+
+    uint64_t lookAt = (mc.d_map.size() + 9) / 10; // Look at 10% of this shard
+    uint64_t erased = 0;
+
     auto& sidx = boost::multi_index::get<S>(mc.d_map);
-    uint64_t erased = 0, lookedAt = 0;
-    for(auto i = sidx.begin(); i != sidx.end(); lookedAt++) {
-      if (i->ttd < now) {
+    for(auto i = sidx.begin(); i != sidx.end() && lookAt > 0; lookAt--) {
+      if(i->ttd < now) {
         i = sidx.erase(i);
         erased++;
       } else {
         ++i;
       }
-
-      if(toTrim && erased > toTrim / maps.size())
-        break;
-
-      if(lookedAt > lookAt / maps.size())
-        break;
     }
     totErased += erased;
   }

diff --git a/pdns/packethandler.cc b/pdns/packethandler.cc
index 197bab40a55d99a5c124b01353a6240938753978..6defb6f1f210d909b5b9bcdc2dfdadb2d02e2e39 100644 (file)
--- a/pdns/packethandler.cc
+++ b/pdns/packethandler.cc
@@ -506,15 +506,18 @@ void PacketHandler::emitNSEC(std::unique_ptr<DNSPacket>& r, const SOAData& sd, c
   nrc.set(QType::RRSIG);
   if(sd.qname == name) {
     nrc.set(QType::SOA); // 1dfd8ad SOA can live outside the records table
-    nrc.set(QType::DNSKEY);
-    string publishCDNSKEY;
-    d_dk.getPublishCDNSKEY(name, publishCDNSKEY);
-    if (publishCDNSKEY == "1")
-      nrc.set(QType::CDNSKEY);
-    string publishCDS;
-    d_dk.getPublishCDS(name, publishCDS);
-    if (! publishCDS.empty())
-      nrc.set(QType::CDS);
+    auto keyset = d_dk.getKeys(name);
+    if (!keyset.empty()) {
+      nrc.set(QType::DNSKEY);
+      string publishCDNSKEY;
+      d_dk.getPublishCDNSKEY(name, publishCDNSKEY);
+      if (publishCDNSKEY == "1")
+        nrc.set(QType::CDNSKEY);
+      string publishCDS;
+      d_dk.getPublishCDS(name, publishCDS);
+      if (! publishCDS.empty())
+        nrc.set(QType::CDS);
+    }
   }
 
   DNSZoneRecord rr;
@@ -555,15 +558,18 @@ void PacketHandler::emitNSEC3(std::unique_ptr<DNSPacket>& r, const SOAData& sd,
     if (sd.qname == name) {
       n3rc.set(QType::SOA); // 1dfd8ad SOA can live outside the records table
       n3rc.set(QType::NSEC3PARAM);
-      n3rc.set(QType::DNSKEY);
-      string publishCDNSKEY;
-      d_dk.getPublishCDNSKEY(name, publishCDNSKEY);
-      if (publishCDNSKEY == "1")
-        n3rc.set(QType::CDNSKEY);
-      string publishCDS;
-      d_dk.getPublishCDS(name, publishCDS);
-      if (! publishCDS.empty())
-        n3rc.set(QType::CDS);
+      auto keyset = d_dk.getKeys(name);
+      if (!keyset.empty()) {
+        n3rc.set(QType::DNSKEY);
+        string publishCDNSKEY;
+        d_dk.getPublishCDNSKEY(name, publishCDNSKEY);
+        if (publishCDNSKEY == "1")
+          n3rc.set(QType::CDNSKEY);
+        string publishCDS;
+        d_dk.getPublishCDS(name, publishCDS);
+        if (! publishCDS.empty())
+          n3rc.set(QType::CDS);
+      }
     }
 
     B.lookup(QType(QType::ANY), name, sd.domain_id);

diff --git a/pdns/recursordist/docs/nod_udr.rst b/pdns/recursordist/docs/nod_udr.rst
index 28d6f65fef5e7df062319c01df53d92e291e3a8a..88abc49a41046cd46c6bf8ba68e67f978adfecf0 100644 (file)
--- a/pdns/recursordist/docs/nod_udr.rst
+++ b/pdns/recursordist/docs/nod_udr.rst
@@ -46,7 +46,7 @@ A similar feature to NOD is Unique Domain Response (UDR). This feature uses the
 * Botnet Command and Control Servers
   etc.
 
-This is because well-behaved domains tend to return fairly stable results to DNS record lookups, and thus domains which don't exhibit this behaviour may be suspsicious or may indicate a domain under attack.
+This is because well-behaved domains tend to return fairly stable results to DNS record lookups, and thus domains which don't exhibit this behaviour may be suspicious or may indicate a domain under attack.
 
 UDR is disabled by default - to enable it, set ``unique-response-tracking=yes`` in recursor.conf.