Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2026-08-20 23:08:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

plugin/timeouts: add maxtcpqueries option to bound queries per TCP/TLS connection (#8376)

Browse Source
This commit is contained in:
Pujitha Paladugu
2026-08-03 16:16:43 -07:00
committed by GitHub
parent 335c8b9a33
commit 4438f6d708
10 changed files with 244 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/dnsserver/config.go
View File

@@ -127,6 +127,11 @@ type Config struct {
WriteTimeout time.Duration
IdleTimeout time.Duration
// MaxTCPQueries defines the maximum number of queries served on a single TCP/TLS
// connection before it is closed. -1 means unlimited. This is nil if not specified,
// allowing for a default to be used.
MaxTCPQueries *int
// TSIG secrets, [name]key.
TsigSecret map[string]string

13
core/dnsserver/config_test.go
View File

@@ -89,3 +89,16 @@ func TestAddPluginToAllServerBlocks(t *testing.T) {
t.Fatalf("second server block has %d plugins, want 1", got)
}
}
func TestPropagateConfigParamsMaxTCPQueries(t *testing.T) {
n := 128
first := &Config{MaxTCPQueries: &n}
first.firstConfigInBlock = first
second := &Config{firstConfigInBlock: first}
propagateConfigParams([]*Config{first, second})
if second.MaxTCPQueries == nil || *second.MaxTCPQueries != n {
t.Fatalf("expected MaxTCPQueries to propagate to second config as %d, got %v", n, second.MaxTCPQueries)
}
}

1
core/dnsserver/register.go
View File

@@ -274,6 +274,7 @@ func propagateConfigParams(configs []*Config) {
c.ReadTimeout = c.firstConfigInBlock.ReadTimeout
c.WriteTimeout = c.firstConfigInBlock.WriteTimeout
c.IdleTimeout = c.firstConfigInBlock.IdleTimeout
c.MaxTCPQueries = c.firstConfigInBlock.MaxTCPQueries
c.TsigSecret = c.firstConfigInBlock.TsigSecret
// Propagate HTTPRequestValidateFunc so that custom path validators work in

29
core/dnsserver/server.go
View File

@@ -34,10 +34,11 @@ import (
// the same address and the listener may be stopped for
// graceful termination (POSIX only).
type Server struct {
Addr string // Address we listen on
IdleTimeout time.Duration // Idle timeout for connection-oriented transports
ReadTimeout time.Duration // Read timeout for connection-oriented transports
WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it
Addr string // Address we listen on
IdleTimeout time.Duration // Idle timeout for connection-oriented transports
ReadTimeout time.Duration // Read timeout for connection-oriented transports
WriteTimeout time.Duration // Write timeout for connection-oriented transports that support it
MaxTCPQueries int // Maximum number of queries served on a single TCP/TLS connection. -1 means unlimited.
connPolicy proxyproto.ConnPolicyFunc // Proxy Protocol connection policy function
udpSessionTrackingTTL time.Duration // TTL for UDP PPv2 session tracking (0 = disabled)
@@ -74,13 +75,14 @@ type MetadataCollector interface {
// queries are blocked unless queries from enableChaos are loaded.
func NewServer(addr string, group []*Config) (*Server, error) {
s := &Server{
Addr: addr,
zones: make(map[string][]*Config),
graceTimeout: 5 * time.Second,
IdleTimeout: 10 * time.Second,
ReadTimeout: 3 * time.Second,
WriteTimeout: 5 * time.Second,
tsigSecret: make(map[string]string),
Addr: addr,
zones: make(map[string][]*Config),
graceTimeout: 5 * time.Second,
IdleTimeout: 10 * time.Second,
ReadTimeout: 3 * time.Second,
WriteTimeout: 5 * time.Second,
MaxTCPQueries: tcpMaxQueries,
tsigSecret: make(map[string]string),
}
for _, site := range group {
@@ -103,6 +105,9 @@ func NewServer(addr string, group []*Config) (*Server, error) {
if site.IdleTimeout != 0 {
s.IdleTimeout = site.IdleTimeout
}
if site.MaxTCPQueries != nil {
s.MaxTCPQueries = *site.MaxTCPQueries
}
// copy tsig secrets
maps.Copy(s.tsigSecret, site.TsigSecret)
@@ -167,7 +172,7 @@ func (s *Server) Serve(l net.Listener) error {
s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp",
TsigSecret: s.tsigSecret,
MaxTCPQueries: tcpMaxQueries,
MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout,
WriteTimeout: s.WriteTimeout,
IdleTimeout: func() time.Duration {

58
core/dnsserver/server_test.go
View File

@@ -200,6 +200,64 @@ func TestGracefulStopTimeout_Internal(t *testing.T) {
}
}
// TestMaxTCPQueriesBoundary proves the user-visible behavior of MaxTCPQueries:
// a persistent TCP connection may serve exactly the configured number of
// queries before the server closes it.
func TestMaxTCPQueriesBoundary(t *testing.T) {
n := 2
config := testConfig("dns", test.ErrorHandler())
config.MaxTCPQueries = &n
s, err := NewServer("127.0.0.1:0", []*Config{config})
if err != nil {
t.Fatalf("NewServer failed: %v", err)
}
defer s.Stop()
l, err := net.Listen("tcp", "127.0.0.1:0")
if err != nil {
t.Fatalf("net.Listen failed: %v", err)
}
defer l.Close()
go s.Serve(l)
conn, err := net.DialTimeout("tcp", l.Addr().String(), 2*time.Second)
if err != nil {
t.Fatalf("net.DialTimeout failed: %v", err)
}
defer conn.Close()
dnsConn := &dns.Conn{Conn: conn}
for i := range n {
m := new(dns.Msg)
m.SetQuestion("example.org.", dns.TypeA)
dnsConn.SetWriteDeadline(time.Now().Add(2 * time.Second))
if err := dnsConn.WriteMsg(m); err != nil {
t.Fatalf("query %d: WriteMsg failed: %v", i, err)
}
dnsConn.SetReadDeadline(time.Now().Add(2 * time.Second))
if _, err := dnsConn.ReadMsg(); err != nil {
t.Fatalf("query %d: ReadMsg failed: %v", i, err)
}
}
// The connection should be closed by the server after serving n queries;
// query n+1 must not succeed on the same connection.
m := new(dns.Msg)
m.SetQuestion("example.org.", dns.TypeA)
dnsConn.SetWriteDeadline(time.Now().Add(2 * time.Second))
if err := dnsConn.WriteMsg(m); err == nil {
dnsConn.SetReadDeadline(time.Now().Add(2 * time.Second))
if _, err := dnsConn.ReadMsg(); err == nil {
t.Fatal("expected query beyond MaxTCPQueries to fail on the same connection, but it succeeded")
}
}
}
func BenchmarkCoreServeDNS(b *testing.B) {
s, err := NewServer("127.0.0.1:53", []*Config{testConfig("dns", testPlugin{})})
if err != nil {

6
core/dnsserver/server_tls.go
View File

@@ -55,7 +55,7 @@ func (s *ServerTLS) Serve(l net.Listener) error {
s.server[tcp] = &dns.Server{Listener: l,
Net: "tcp-tls",
TsigSecret: s.tsigSecret,
MaxTCPQueries: tlsMaxQueries,
MaxTCPQueries: s.MaxTCPQueries,
ReadTimeout: s.ReadTimeout,
WriteTimeout: s.WriteTimeout,
IdleTimeout: func() time.Duration {
@@ -102,7 +102,3 @@ func (s *ServerTLS) OnStartupComplete() {
fmt.Print(out)
}
}
const (
tlsMaxQueries = -1
)

55
core/dnsserver/server_tls_test.go
View File

@@ -54,3 +54,58 @@ func TestServerTLSSetsTsigSecret(t *testing.T) {
t.Fatalf("expected tsig secret %q, got %q", "abcd", got)
}
}
func TestServerSetsMaxTCPQueries(t *testing.T) {
n := 128
t.Run("default is unlimited", func(t *testing.T) {
server, err := NewServer("127.0.0.1:0", []*Config{testConfig("dns", testPlugin{})})
if err != nil {
t.Fatalf("NewServer() failed: %v", err)
}
if err := server.Serve(&stubListener{}); err == nil {
t.Fatal("expected Serve() to return from stub listener")
}
if got := server.server[tcp].MaxTCPQueries; got != -1 {
t.Fatalf("expected default MaxTCPQueries -1, got %d", got)
}
})
t.Run("configured value reaches the TCP server", func(t *testing.T) {
config := testConfig("dns", testPlugin{})
config.MaxTCPQueries = &n
server, err := NewServer("127.0.0.1:0", []*Config{config})
if err != nil {
t.Fatalf("NewServer() failed: %v", err)
}
if err := server.Serve(&stubListener{}); err == nil {
t.Fatal("expected Serve() to return from stub listener")
}
if got := server.server[tcp].MaxTCPQueries; got != n {
t.Fatalf("expected MaxTCPQueries %d, got %d", n, got)
}
})
t.Run("configured value reaches the TLS server", func(t *testing.T) {
config := testConfig("tls", testPlugin{})
config.MaxTCPQueries = &n
server, err := NewServerTLS("tls://127.0.0.1:0", []*Config{config})
if err != nil {
t.Fatalf("NewServerTLS() failed: %v", err)
}
if err := server.Serve(&stubListener{}); err == nil {
t.Fatal("expected Serve() to return from stub listener")
}
if got := server.server[tcp].MaxTCPQueries; got != n {
t.Fatalf("expected MaxTCPQueries %d, got %d", n, got)
}
})
}