xref: /freebsd/contrib/unbound/services/mesh.c (revision 924226fba12cc9a228c73b956e1b7fa24c60b055)
1 /*
2  * services/mesh.c - deal with mesh of query states and handle events for that.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains functions to assist in dealing with a mesh of
40  * query states. This mesh is supposed to be thread-specific.
41  * It consists of query states (per qname, qtype, qclass) and connections
42  * between query states and the super and subquery states, and replies to
43  * send back to clients.
44  */
45 #include "config.h"
46 #include "services/mesh.h"
47 #include "services/outbound_list.h"
48 #include "services/cache/dns.h"
49 #include "services/cache/rrset.h"
50 #include "util/log.h"
51 #include "util/net_help.h"
52 #include "util/module.h"
53 #include "util/regional.h"
54 #include "util/data/msgencode.h"
55 #include "util/timehist.h"
56 #include "util/fptr_wlist.h"
57 #include "util/alloc.h"
58 #include "util/config_file.h"
59 #include "util/edns.h"
60 #include "sldns/sbuffer.h"
61 #include "sldns/wire2str.h"
62 #include "services/localzone.h"
63 #include "util/data/dname.h"
64 #include "respip/respip.h"
65 #include "services/listen_dnsport.h"
66 
67 #ifdef CLIENT_SUBNET
68 #include "edns-subnet/subnetmod.h"
69 #include "edns-subnet/edns-subnet.h"
70 #endif
71 
72 /** subtract timers and the values do not overflow or become negative */
73 static void
74 timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
75 {
76 #ifndef S_SPLINT_S
77 	time_t end_usec = end->tv_usec;
78 	d->tv_sec = end->tv_sec - start->tv_sec;
79 	if(end_usec < start->tv_usec) {
80 		end_usec += 1000000;
81 		d->tv_sec--;
82 	}
83 	d->tv_usec = end_usec - start->tv_usec;
84 #endif
85 }
86 
87 /** add timers and the values do not overflow or become negative */
88 static void
89 timeval_add(struct timeval* d, const struct timeval* add)
90 {
91 #ifndef S_SPLINT_S
92 	d->tv_sec += add->tv_sec;
93 	d->tv_usec += add->tv_usec;
94 	if(d->tv_usec >= 1000000 ) {
95 		d->tv_usec -= 1000000;
96 		d->tv_sec++;
97 	}
98 #endif
99 }
100 
101 /** divide sum of timers to get average */
102 static void
103 timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
104 {
105 #ifndef S_SPLINT_S
106 	size_t leftover;
107 	if(d <= 0) {
108 		avg->tv_sec = 0;
109 		avg->tv_usec = 0;
110 		return;
111 	}
112 	avg->tv_sec = sum->tv_sec / d;
113 	avg->tv_usec = sum->tv_usec / d;
114 	/* handle fraction from seconds divide */
115 	leftover = sum->tv_sec - avg->tv_sec*d;
116 	if(leftover <= 0)
117 		leftover = 0;
118 	avg->tv_usec += (((long long)leftover)*((long long)1000000))/d;
119 	if(avg->tv_sec < 0)
120 		avg->tv_sec = 0;
121 	if(avg->tv_usec < 0)
122 		avg->tv_usec = 0;
123 #endif
124 }
125 
126 /** histogram compare of time values */
127 static int
128 timeval_smaller(const struct timeval* x, const struct timeval* y)
129 {
130 #ifndef S_SPLINT_S
131 	if(x->tv_sec < y->tv_sec)
132 		return 1;
133 	else if(x->tv_sec == y->tv_sec) {
134 		if(x->tv_usec <= y->tv_usec)
135 			return 1;
136 		else	return 0;
137 	}
138 	else	return 0;
139 #endif
140 }
141 
142 /**
143  * Compare two response-ip client info entries for the purpose of mesh state
144  * compare.  It returns 0 if ci_a and ci_b are considered equal; otherwise
145  * 1 or -1 (they mean 'ci_a is larger/smaller than ci_b', respectively, but
146  * in practice it should be only used to mean they are different).
147  * We cannot share the mesh state for two queries if different response-ip
148  * actions can apply in the end, even if those queries are otherwise identical.
149  * For this purpose we compare tag lists and tag action lists; they should be
150  * identical to share the same state.
151  * For tag data, we don't look into the data content, as it can be
152  * expensive; unless tag data are not defined for both or they point to the
153  * exact same data in memory (i.e., they come from the same ACL entry), we
154  * consider these data different.
155  * Likewise, if the client info is associated with views, we don't look into
156  * the views.  They are considered different unless they are exactly the same
157  * even if the views only differ in the names.
158  */
159 static int
160 client_info_compare(const struct respip_client_info* ci_a,
161 	const struct respip_client_info* ci_b)
162 {
163 	int cmp;
164 
165 	if(!ci_a && !ci_b)
166 		return 0;
167 	if(ci_a && !ci_b)
168 		return -1;
169 	if(!ci_a && ci_b)
170 		return 1;
171 	if(ci_a->taglen != ci_b->taglen)
172 		return (ci_a->taglen < ci_b->taglen) ? -1 : 1;
173 	if(ci_a->taglist && !ci_b->taglist)
174 		return -1;
175 	if(!ci_a->taglist && ci_b->taglist)
176 		return 1;
177 	if(ci_a->taglist && ci_b->taglist) {
178 		cmp = memcmp(ci_a->taglist, ci_b->taglist, ci_a->taglen);
179 		if(cmp != 0)
180 			return cmp;
181 	}
182 	if(ci_a->tag_actions_size != ci_b->tag_actions_size)
183 		return (ci_a->tag_actions_size < ci_b->tag_actions_size) ?
184 			-1 : 1;
185 	if(ci_a->tag_actions && !ci_b->tag_actions)
186 		return -1;
187 	if(!ci_a->tag_actions && ci_b->tag_actions)
188 		return 1;
189 	if(ci_a->tag_actions && ci_b->tag_actions) {
190 		cmp = memcmp(ci_a->tag_actions, ci_b->tag_actions,
191 			ci_a->tag_actions_size);
192 		if(cmp != 0)
193 			return cmp;
194 	}
195 	if(ci_a->tag_datas != ci_b->tag_datas)
196 		return ci_a->tag_datas < ci_b->tag_datas ? -1 : 1;
197 	if(ci_a->view != ci_b->view)
198 		return ci_a->view < ci_b->view ? -1 : 1;
199 	/* For the unbound daemon these should be non-NULL and identical,
200 	 * but we check that just in case. */
201 	if(ci_a->respip_set != ci_b->respip_set)
202 		return ci_a->respip_set < ci_b->respip_set ? -1 : 1;
203 	return 0;
204 }
205 
206 int
207 mesh_state_compare(const void* ap, const void* bp)
208 {
209 	struct mesh_state* a = (struct mesh_state*)ap;
210 	struct mesh_state* b = (struct mesh_state*)bp;
211 	int cmp;
212 
213 	if(a->unique < b->unique)
214 		return -1;
215 	if(a->unique > b->unique)
216 		return 1;
217 
218 	if(a->s.is_priming && !b->s.is_priming)
219 		return -1;
220 	if(!a->s.is_priming && b->s.is_priming)
221 		return 1;
222 
223 	if(a->s.is_valrec && !b->s.is_valrec)
224 		return -1;
225 	if(!a->s.is_valrec && b->s.is_valrec)
226 		return 1;
227 
228 	if((a->s.query_flags&BIT_RD) && !(b->s.query_flags&BIT_RD))
229 		return -1;
230 	if(!(a->s.query_flags&BIT_RD) && (b->s.query_flags&BIT_RD))
231 		return 1;
232 
233 	if((a->s.query_flags&BIT_CD) && !(b->s.query_flags&BIT_CD))
234 		return -1;
235 	if(!(a->s.query_flags&BIT_CD) && (b->s.query_flags&BIT_CD))
236 		return 1;
237 
238 	cmp = query_info_compare(&a->s.qinfo, &b->s.qinfo);
239 	if(cmp != 0)
240 		return cmp;
241 	return client_info_compare(a->s.client_info, b->s.client_info);
242 }
243 
244 int
245 mesh_state_ref_compare(const void* ap, const void* bp)
246 {
247 	struct mesh_state_ref* a = (struct mesh_state_ref*)ap;
248 	struct mesh_state_ref* b = (struct mesh_state_ref*)bp;
249 	return mesh_state_compare(a->s, b->s);
250 }
251 
252 struct mesh_area*
253 mesh_create(struct module_stack* stack, struct module_env* env)
254 {
255 	struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));
256 	if(!mesh) {
257 		log_err("mesh area alloc: out of memory");
258 		return NULL;
259 	}
260 	mesh->histogram = timehist_setup();
261 	mesh->qbuf_bak = sldns_buffer_new(env->cfg->msg_buffer_size);
262 	if(!mesh->histogram || !mesh->qbuf_bak) {
263 		free(mesh);
264 		log_err("mesh area alloc: out of memory");
265 		return NULL;
266 	}
267 	mesh->mods = *stack;
268 	mesh->env = env;
269 	rbtree_init(&mesh->run, &mesh_state_compare);
270 	rbtree_init(&mesh->all, &mesh_state_compare);
271 	mesh->num_reply_addrs = 0;
272 	mesh->num_reply_states = 0;
273 	mesh->num_detached_states = 0;
274 	mesh->num_forever_states = 0;
275 	mesh->stats_jostled = 0;
276 	mesh->stats_dropped = 0;
277 	mesh->ans_expired = 0;
278 	mesh->max_reply_states = env->cfg->num_queries_per_thread;
279 	mesh->max_forever_states = (mesh->max_reply_states+1)/2;
280 #ifndef S_SPLINT_S
281 	mesh->jostle_max.tv_sec = (time_t)(env->cfg->jostle_time / 1000);
282 	mesh->jostle_max.tv_usec = (time_t)((env->cfg->jostle_time % 1000)
283 		*1000);
284 #endif
285 	return mesh;
286 }
287 
288 /** help mesh delete delete mesh states */
289 static void
290 mesh_delete_helper(rbnode_type* n)
291 {
292 	struct mesh_state* mstate = (struct mesh_state*)n->key;
293 	/* perform a full delete, not only 'cleanup' routine,
294 	 * because other callbacks expect a clean state in the mesh.
295 	 * For 're-entrant' calls */
296 	mesh_state_delete(&mstate->s);
297 	/* but because these delete the items from the tree, postorder
298 	 * traversal and rbtree rebalancing do not work together */
299 }
300 
301 void
302 mesh_delete(struct mesh_area* mesh)
303 {
304 	if(!mesh)
305 		return;
306 	/* free all query states */
307 	while(mesh->all.count)
308 		mesh_delete_helper(mesh->all.root);
309 	timehist_delete(mesh->histogram);
310 	sldns_buffer_free(mesh->qbuf_bak);
311 	free(mesh);
312 }
313 
314 void
315 mesh_delete_all(struct mesh_area* mesh)
316 {
317 	/* free all query states */
318 	while(mesh->all.count)
319 		mesh_delete_helper(mesh->all.root);
320 	mesh->stats_dropped += mesh->num_reply_addrs;
321 	/* clear mesh area references */
322 	rbtree_init(&mesh->run, &mesh_state_compare);
323 	rbtree_init(&mesh->all, &mesh_state_compare);
324 	mesh->num_reply_addrs = 0;
325 	mesh->num_reply_states = 0;
326 	mesh->num_detached_states = 0;
327 	mesh->num_forever_states = 0;
328 	mesh->forever_first = NULL;
329 	mesh->forever_last = NULL;
330 	mesh->jostle_first = NULL;
331 	mesh->jostle_last = NULL;
332 }
333 
334 int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
335 {
336 	struct mesh_state* m = mesh->jostle_first;
337 	/* free space is available */
338 	if(mesh->num_reply_states < mesh->max_reply_states)
339 		return 1;
340 	/* try to kick out a jostle-list item */
341 	if(m && m->reply_list && m->list_select == mesh_jostle_list) {
342 		/* how old is it? */
343 		struct timeval age;
344 		timeval_subtract(&age, mesh->env->now_tv,
345 			&m->reply_list->start_time);
346 		if(timeval_smaller(&mesh->jostle_max, &age)) {
347 			/* its a goner */
348 			log_nametypeclass(VERB_ALGO, "query jostled out to "
349 				"make space for a new one",
350 				m->s.qinfo.qname, m->s.qinfo.qtype,
351 				m->s.qinfo.qclass);
352 			/* backup the query */
353 			if(qbuf) sldns_buffer_copy(mesh->qbuf_bak, qbuf);
354 			/* notify supers */
355 			if(m->super_set.count > 0) {
356 				verbose(VERB_ALGO, "notify supers of failure");
357 				m->s.return_msg = NULL;
358 				m->s.return_rcode = LDNS_RCODE_SERVFAIL;
359 				mesh_walk_supers(mesh, m);
360 			}
361 			mesh->stats_jostled ++;
362 			mesh_state_delete(&m->s);
363 			/* restore the query - note that the qinfo ptr to
364 			 * the querybuffer is then correct again. */
365 			if(qbuf) sldns_buffer_copy(qbuf, mesh->qbuf_bak);
366 			return 1;
367 		}
368 	}
369 	/* no space for new item */
370 	return 0;
371 }
372 
373 struct dns_msg*
374 mesh_serve_expired_lookup(struct module_qstate* qstate,
375 	struct query_info* lookup_qinfo)
376 {
377 	hashvalue_type h;
378 	struct lruhash_entry* e;
379 	struct dns_msg* msg;
380 	struct reply_info* data;
381 	struct msgreply_entry* key;
382 	time_t timenow = *qstate->env->now;
383 	int must_validate = (!(qstate->query_flags&BIT_CD)
384 		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
385 	/* Lookup cache */
386 	h = query_info_hash(lookup_qinfo, qstate->query_flags);
387 	e = slabhash_lookup(qstate->env->msg_cache, h, lookup_qinfo, 0);
388 	if(!e) return NULL;
389 
390 	key = (struct msgreply_entry*)e->key;
391 	data = (struct reply_info*)e->data;
392 	msg = tomsg(qstate->env, &key->key, data, qstate->region, timenow,
393 		qstate->env->cfg->serve_expired, qstate->env->scratch);
394 	if(!msg)
395 		goto bail_out;
396 
397 	/* Check CNAME chain (if any)
398 	 * This is part of tomsg above; no need to check now. */
399 
400 	/* Check security status of the cached answer.
401 	 * tomsg above has a subset of these checks, so we are leaving
402 	 * these as is.
403 	 * In case of bogus or revalidation we don't care to reply here. */
404 	if(must_validate && (msg->rep->security == sec_status_bogus ||
405 		msg->rep->security == sec_status_secure_sentinel_fail)) {
406 		verbose(VERB_ALGO, "Serve expired: bogus answer found in cache");
407 		goto bail_out;
408 	} else if(msg->rep->security == sec_status_unchecked && must_validate) {
409 		verbose(VERB_ALGO, "Serve expired: unchecked entry needs "
410 			"validation");
411 		goto bail_out; /* need to validate cache entry first */
412 	} else if(msg->rep->security == sec_status_secure &&
413 		!reply_all_rrsets_secure(msg->rep) && must_validate) {
414 			verbose(VERB_ALGO, "Serve expired: secure entry"
415 				" changed status");
416 			goto bail_out; /* rrset changed, re-verify */
417 	}
418 
419 	lock_rw_unlock(&e->lock);
420 	return msg;
421 
422 bail_out:
423 	lock_rw_unlock(&e->lock);
424 	return NULL;
425 }
426 
427 
428 /** Init the serve expired data structure */
429 static int
430 mesh_serve_expired_init(struct mesh_state* mstate, int timeout)
431 {
432 	struct timeval t;
433 
434 	/* Create serve_expired_data if not there yet */
435 	if(!mstate->s.serve_expired_data) {
436 		mstate->s.serve_expired_data = (struct serve_expired_data*)
437 			regional_alloc_zero(
438 				mstate->s.region, sizeof(struct serve_expired_data));
439 		if(!mstate->s.serve_expired_data)
440 			return 0;
441 	}
442 
443 	/* Don't overwrite the function if already set */
444 	mstate->s.serve_expired_data->get_cached_answer =
445 		mstate->s.serve_expired_data->get_cached_answer?
446 		mstate->s.serve_expired_data->get_cached_answer:
447 		&mesh_serve_expired_lookup;
448 
449 	/* In case this timer already popped, start it again */
450 	if(!mstate->s.serve_expired_data->timer) {
451 		mstate->s.serve_expired_data->timer = comm_timer_create(
452 			mstate->s.env->worker_base, mesh_serve_expired_callback, mstate);
453 		if(!mstate->s.serve_expired_data->timer)
454 			return 0;
455 #ifndef S_SPLINT_S
456 		t.tv_sec = timeout/1000;
457 		t.tv_usec = (timeout%1000)*1000;
458 #endif
459 		comm_timer_set(mstate->s.serve_expired_data->timer, &t);
460 	}
461 	return 1;
462 }
463 
464 void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
465 	struct respip_client_info* cinfo, uint16_t qflags,
466 	struct edns_data* edns, struct comm_reply* rep, uint16_t qid,
467 	int rpz_passthru)
468 {
469 	struct mesh_state* s = NULL;
470 	int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
471 	int was_detached = 0;
472 	int was_noreply = 0;
473 	int added = 0;
474 	int timeout = mesh->env->cfg->serve_expired?
475 		mesh->env->cfg->serve_expired_client_timeout:0;
476 	struct sldns_buffer* r_buffer = rep->c->buffer;
477 	if(rep->c->tcp_req_info) {
478 		r_buffer = rep->c->tcp_req_info->spool_buffer;
479 	}
480 	if(!unique)
481 		s = mesh_area_find(mesh, cinfo, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
482 	/* does this create a new reply state? */
483 	if(!s || s->list_select == mesh_no_list) {
484 		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
485 			verbose(VERB_ALGO, "Too many queries. dropping "
486 				"incoming query.");
487 			comm_point_drop_reply(rep);
488 			mesh->stats_dropped++;
489 			return;
490 		}
491 		/* for this new reply state, the reply address is free,
492 		 * so the limit of reply addresses does not stop reply states*/
493 	} else {
494 		/* protect our memory usage from storing reply addresses */
495 		if(mesh->num_reply_addrs > mesh->max_reply_states*16) {
496 			verbose(VERB_ALGO, "Too many requests queued. "
497 				"dropping incoming query.");
498 			comm_point_drop_reply(rep);
499 			mesh->stats_dropped++;
500 			return;
501 		}
502 	}
503 	/* see if it already exists, if not, create one */
504 	if(!s) {
505 #ifdef UNBOUND_DEBUG
506 		struct rbnode_type* n;
507 #endif
508 		s = mesh_state_create(mesh->env, qinfo, cinfo,
509 			qflags&(BIT_RD|BIT_CD), 0, 0);
510 		if(!s) {
511 			log_err("mesh_state_create: out of memory; SERVFAIL");
512 			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
513 				LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
514 					edns->opt_list_inplace_cb_out = NULL;
515 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
516 				qinfo, qid, qflags, edns);
517 			comm_point_send_reply(rep);
518 			return;
519 		}
520 		if(unique)
521 			mesh_state_make_unique(s);
522 		s->s.rpz_passthru = rpz_passthru;
523 		/* copy the edns options we got from the front */
524 		if(edns->opt_list_in) {
525 			s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
526 				s->s.region);
527 			if(!s->s.edns_opts_front_in) {
528 				log_err("mesh_state_create: out of memory; SERVFAIL");
529 				if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,
530 					NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
531 						edns->opt_list_inplace_cb_out = NULL;
532 				error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
533 					qinfo, qid, qflags, edns);
534 				comm_point_send_reply(rep);
535 				return;
536 			}
537 		}
538 
539 #ifdef UNBOUND_DEBUG
540 		n =
541 #else
542 		(void)
543 #endif
544 		rbtree_insert(&mesh->all, &s->node);
545 		log_assert(n != NULL);
546 		/* set detached (it is now) */
547 		mesh->num_detached_states++;
548 		added = 1;
549 	}
550 	if(!s->reply_list && !s->cb_list) {
551 		was_noreply = 1;
552 		if(s->super_set.count == 0) {
553 			was_detached = 1;
554 		}
555 	}
556 	/* add reply to s */
557 	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo)) {
558 		log_err("mesh_new_client: out of memory; SERVFAIL");
559 		goto servfail_mem;
560 	}
561 	if(rep->c->tcp_req_info) {
562 		if(!tcp_req_info_add_meshstate(rep->c->tcp_req_info, mesh, s)) {
563 			log_err("mesh_new_client: out of memory add tcpreqinfo");
564 			goto servfail_mem;
565 		}
566 	}
567 	if(rep->c->use_h2) {
568 		http2_stream_add_meshstate(rep->c->h2_stream, mesh, s);
569 	}
570 	/* add serve expired timer if required and not already there */
571 	if(timeout && !mesh_serve_expired_init(s, timeout)) {
572 		log_err("mesh_new_client: out of memory initializing serve expired");
573 		goto servfail_mem;
574 	}
575 	/* update statistics */
576 	if(was_detached) {
577 		log_assert(mesh->num_detached_states > 0);
578 		mesh->num_detached_states--;
579 	}
580 	if(was_noreply) {
581 		mesh->num_reply_states ++;
582 	}
583 	mesh->num_reply_addrs++;
584 	if(s->list_select == mesh_no_list) {
585 		/* move to either the forever or the jostle_list */
586 		if(mesh->num_forever_states < mesh->max_forever_states) {
587 			mesh->num_forever_states ++;
588 			mesh_list_insert(s, &mesh->forever_first,
589 				&mesh->forever_last);
590 			s->list_select = mesh_forever_list;
591 		} else {
592 			mesh_list_insert(s, &mesh->jostle_first,
593 				&mesh->jostle_last);
594 			s->list_select = mesh_jostle_list;
595 		}
596 	}
597 	if(added)
598 		mesh_run(mesh, s, module_event_new, NULL);
599 	return;
600 
601 servfail_mem:
602 	if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, &s->s,
603 		NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))
604 			edns->opt_list_inplace_cb_out = NULL;
605 	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
606 		qinfo, qid, qflags, edns);
607 	comm_point_send_reply(rep);
608 	if(added)
609 		mesh_state_delete(&s->s);
610 	return;
611 }
612 
613 int
614 mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
615 	uint16_t qflags, struct edns_data* edns, sldns_buffer* buf,
616 	uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru)
617 {
618 	struct mesh_state* s = NULL;
619 	int unique = unique_mesh_state(edns->opt_list_in, mesh->env);
620 	int timeout = mesh->env->cfg->serve_expired?
621 		mesh->env->cfg->serve_expired_client_timeout:0;
622 	int was_detached = 0;
623 	int was_noreply = 0;
624 	int added = 0;
625 	if(!unique)
626 		s = mesh_area_find(mesh, NULL, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
627 
628 	/* there are no limits on the number of callbacks */
629 
630 	/* see if it already exists, if not, create one */
631 	if(!s) {
632 #ifdef UNBOUND_DEBUG
633 		struct rbnode_type* n;
634 #endif
635 		s = mesh_state_create(mesh->env, qinfo, NULL,
636 			qflags&(BIT_RD|BIT_CD), 0, 0);
637 		if(!s) {
638 			return 0;
639 		}
640 		if(unique)
641 			mesh_state_make_unique(s);
642 		s->s.rpz_passthru = rpz_passthru;
643 		if(edns->opt_list_in) {
644 			s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,
645 				s->s.region);
646 			if(!s->s.edns_opts_front_in) {
647 				return 0;
648 			}
649 		}
650 #ifdef UNBOUND_DEBUG
651 		n =
652 #else
653 		(void)
654 #endif
655 		rbtree_insert(&mesh->all, &s->node);
656 		log_assert(n != NULL);
657 		/* set detached (it is now) */
658 		mesh->num_detached_states++;
659 		added = 1;
660 	}
661 	if(!s->reply_list && !s->cb_list) {
662 		was_noreply = 1;
663 		if(s->super_set.count == 0) {
664 			was_detached = 1;
665 		}
666 	}
667 	/* add reply to s */
668 	if(!mesh_state_add_cb(s, edns, buf, cb, cb_arg, qid, qflags)) {
669 		if(added)
670 			mesh_state_delete(&s->s);
671 		return 0;
672 	}
673 	/* add serve expired timer if not already there */
674 	if(timeout && !mesh_serve_expired_init(s, timeout)) {
675 		return 0;
676 	}
677 	/* update statistics */
678 	if(was_detached) {
679 		log_assert(mesh->num_detached_states > 0);
680 		mesh->num_detached_states--;
681 	}
682 	if(was_noreply) {
683 		mesh->num_reply_states ++;
684 	}
685 	mesh->num_reply_addrs++;
686 	if(added)
687 		mesh_run(mesh, s, module_event_new, NULL);
688 	return 1;
689 }
690 
691 /* Internal backend routine of mesh_new_prefetch().  It takes one additional
692  * parameter, 'run', which controls whether to run the prefetch state
693  * immediately.  When this function is called internally 'run' could be
694  * 0 (false), in which case the new state is only made runnable so it
695  * will not be run recursively on top of the current state. */
696 static void mesh_schedule_prefetch(struct mesh_area* mesh,
697 	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
698 	int rpz_passthru)
699 {
700 	struct mesh_state* s = mesh_area_find(mesh, NULL, qinfo,
701 		qflags&(BIT_RD|BIT_CD), 0, 0);
702 #ifdef UNBOUND_DEBUG
703 	struct rbnode_type* n;
704 #endif
705 	/* already exists, and for a different purpose perhaps.
706 	 * if mesh_no_list, keep it that way. */
707 	if(s) {
708 		/* make it ignore the cache from now on */
709 		if(!s->s.blacklist)
710 			sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
711 		if(s->s.prefetch_leeway < leeway)
712 			s->s.prefetch_leeway = leeway;
713 		return;
714 	}
715 	if(!mesh_make_new_space(mesh, NULL)) {
716 		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
717 		mesh->stats_dropped ++;
718 		return;
719 	}
720 
721 	s = mesh_state_create(mesh->env, qinfo, NULL,
722 		qflags&(BIT_RD|BIT_CD), 0, 0);
723 	if(!s) {
724 		log_err("prefetch mesh_state_create: out of memory");
725 		return;
726 	}
727 #ifdef UNBOUND_DEBUG
728 	n =
729 #else
730 	(void)
731 #endif
732 	rbtree_insert(&mesh->all, &s->node);
733 	log_assert(n != NULL);
734 	/* set detached (it is now) */
735 	mesh->num_detached_states++;
736 	/* make it ignore the cache */
737 	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
738 	s->s.prefetch_leeway = leeway;
739 
740 	if(s->list_select == mesh_no_list) {
741 		/* move to either the forever or the jostle_list */
742 		if(mesh->num_forever_states < mesh->max_forever_states) {
743 			mesh->num_forever_states ++;
744 			mesh_list_insert(s, &mesh->forever_first,
745 				&mesh->forever_last);
746 			s->list_select = mesh_forever_list;
747 		} else {
748 			mesh_list_insert(s, &mesh->jostle_first,
749 				&mesh->jostle_last);
750 			s->list_select = mesh_jostle_list;
751 		}
752 	}
753 	s->s.rpz_passthru = rpz_passthru;
754 
755 	if(!run) {
756 #ifdef UNBOUND_DEBUG
757 		n =
758 #else
759 		(void)
760 #endif
761 		rbtree_insert(&mesh->run, &s->run_node);
762 		log_assert(n != NULL);
763 		return;
764 	}
765 
766 	mesh_run(mesh, s, module_event_new, NULL);
767 }
768 
769 #ifdef CLIENT_SUBNET
770 /* Same logic as mesh_schedule_prefetch but tailored to the subnet module logic
771  * like passing along the comm_reply info. This will be faked into an EDNS
772  * option for processing by the subnet module if the client has not already
773  * attached its own ECS data. */
774 static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
775 	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
776 	int rpz_passthru, struct comm_reply* rep, struct edns_option* edns_list)
777 {
778 	struct mesh_state* s = NULL;
779 	struct edns_option* opt = NULL;
780 #ifdef UNBOUND_DEBUG
781 	struct rbnode_type* n;
782 #endif
783 	if(!mesh_make_new_space(mesh, NULL)) {
784 		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
785 		mesh->stats_dropped ++;
786 		return;
787 	}
788 
789 	s = mesh_state_create(mesh->env, qinfo, NULL,
790 		qflags&(BIT_RD|BIT_CD), 0, 0);
791 	if(!s) {
792 		log_err("prefetch_subnet mesh_state_create: out of memory");
793 		return;
794 	}
795 	mesh_state_make_unique(s);
796 
797 	opt = edns_opt_list_find(edns_list, mesh->env->cfg->client_subnet_opcode);
798 	if(opt) {
799 		/* Use the client's ECS data */
800 		if(!edns_opt_list_append(&s->s.edns_opts_front_in, opt->opt_code,
801 			opt->opt_len, opt->opt_data, s->s.region)) {
802 			log_err("prefetch_subnet edns_opt_list_append: out of memory");
803 			return;
804 		}
805 	} else {
806 		/* Fake the ECS data from the client's IP */
807 		struct ecs_data ecs;
808 		memset(&ecs, 0, sizeof(ecs));
809 		subnet_option_from_ss(&rep->addr, &ecs, mesh->env->cfg);
810 		if(ecs.subnet_validdata == 0) {
811 			log_err("prefetch_subnet subnet_option_from_ss: invalid data");
812 			return;
813 		}
814 		subnet_ecs_opt_list_append(&ecs, &s->s.edns_opts_front_in, &s->s);
815 		if(!s->s.edns_opts_front_in) {
816 			log_err("prefetch_subnet subnet_ecs_opt_list_append: out of memory");
817 			return;
818 		}
819 	}
820 #ifdef UNBOUND_DEBUG
821 	n =
822 #else
823 	(void)
824 #endif
825 	rbtree_insert(&mesh->all, &s->node);
826 	log_assert(n != NULL);
827 	/* set detached (it is now) */
828 	mesh->num_detached_states++;
829 	/* make it ignore the cache */
830 	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
831 	s->s.prefetch_leeway = leeway;
832 
833 	if(s->list_select == mesh_no_list) {
834 		/* move to either the forever or the jostle_list */
835 		if(mesh->num_forever_states < mesh->max_forever_states) {
836 			mesh->num_forever_states ++;
837 			mesh_list_insert(s, &mesh->forever_first,
838 				&mesh->forever_last);
839 			s->list_select = mesh_forever_list;
840 		} else {
841 			mesh_list_insert(s, &mesh->jostle_first,
842 				&mesh->jostle_last);
843 			s->list_select = mesh_jostle_list;
844 		}
845 	}
846 	s->s.rpz_passthru = rpz_passthru;
847 
848 	if(!run) {
849 #ifdef UNBOUND_DEBUG
850 		n =
851 #else
852 		(void)
853 #endif
854 		rbtree_insert(&mesh->run, &s->run_node);
855 		log_assert(n != NULL);
856 		return;
857 	}
858 
859 	mesh_run(mesh, s, module_event_new, NULL);
860 }
861 #endif /* CLIENT_SUBNET */
862 
863 void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
864 	uint16_t qflags, time_t leeway, int rpz_passthru,
865 	struct comm_reply* rep, struct edns_option* opt_list)
866 {
867 	(void)opt_list;
868 	(void)rep;
869 #ifdef CLIENT_SUBNET
870 	if(rep)
871 		mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1,
872 			rpz_passthru, rep, opt_list);
873 	else
874 #endif
875 		mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1,
876 			rpz_passthru);
877 }
878 
879 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
880         struct comm_reply* reply, int what)
881 {
882 	enum module_ev event = module_event_reply;
883 	e->qstate->reply = reply;
884 	if(what != NETEVENT_NOERROR) {
885 		event = module_event_noreply;
886 		if(what == NETEVENT_CAPSFAIL)
887 			event = module_event_capsfail;
888 	}
889 	mesh_run(mesh, e->qstate->mesh_info, event, e);
890 }
891 
892 struct mesh_state*
893 mesh_state_create(struct module_env* env, struct query_info* qinfo,
894 	struct respip_client_info* cinfo, uint16_t qflags, int prime,
895 	int valrec)
896 {
897 	struct regional* region = alloc_reg_obtain(env->alloc);
898 	struct mesh_state* mstate;
899 	int i;
900 	if(!region)
901 		return NULL;
902 	mstate = (struct mesh_state*)regional_alloc(region,
903 		sizeof(struct mesh_state));
904 	if(!mstate) {
905 		alloc_reg_release(env->alloc, region);
906 		return NULL;
907 	}
908 	memset(mstate, 0, sizeof(*mstate));
909 	mstate->node = *RBTREE_NULL;
910 	mstate->run_node = *RBTREE_NULL;
911 	mstate->node.key = mstate;
912 	mstate->run_node.key = mstate;
913 	mstate->reply_list = NULL;
914 	mstate->list_select = mesh_no_list;
915 	mstate->replies_sent = 0;
916 	rbtree_init(&mstate->super_set, &mesh_state_ref_compare);
917 	rbtree_init(&mstate->sub_set, &mesh_state_ref_compare);
918 	mstate->num_activated = 0;
919 	mstate->unique = NULL;
920 	/* init module qstate */
921 	mstate->s.qinfo.qtype = qinfo->qtype;
922 	mstate->s.qinfo.qclass = qinfo->qclass;
923 	mstate->s.qinfo.local_alias = NULL;
924 	mstate->s.qinfo.qname_len = qinfo->qname_len;
925 	mstate->s.qinfo.qname = regional_alloc_init(region, qinfo->qname,
926 		qinfo->qname_len);
927 	if(!mstate->s.qinfo.qname) {
928 		alloc_reg_release(env->alloc, region);
929 		return NULL;
930 	}
931 	if(cinfo) {
932 		mstate->s.client_info = regional_alloc_init(region, cinfo,
933 			sizeof(*cinfo));
934 		if(!mstate->s.client_info) {
935 			alloc_reg_release(env->alloc, region);
936 			return NULL;
937 		}
938 	}
939 	/* remove all weird bits from qflags */
940 	mstate->s.query_flags = (qflags & (BIT_RD|BIT_CD));
941 	mstate->s.is_priming = prime;
942 	mstate->s.is_valrec = valrec;
943 	mstate->s.reply = NULL;
944 	mstate->s.region = region;
945 	mstate->s.curmod = 0;
946 	mstate->s.return_msg = 0;
947 	mstate->s.return_rcode = LDNS_RCODE_NOERROR;
948 	mstate->s.env = env;
949 	mstate->s.mesh_info = mstate;
950 	mstate->s.prefetch_leeway = 0;
951 	mstate->s.serve_expired_data = NULL;
952 	mstate->s.no_cache_lookup = 0;
953 	mstate->s.no_cache_store = 0;
954 	mstate->s.need_refetch = 0;
955 	mstate->s.was_ratelimited = 0;
956 
957 	/* init modules */
958 	for(i=0; i<env->mesh->mods.num; i++) {
959 		mstate->s.minfo[i] = NULL;
960 		mstate->s.ext_state[i] = module_state_initial;
961 	}
962 	/* init edns option lists */
963 	mstate->s.edns_opts_front_in = NULL;
964 	mstate->s.edns_opts_back_out = NULL;
965 	mstate->s.edns_opts_back_in = NULL;
966 	mstate->s.edns_opts_front_out = NULL;
967 
968 	return mstate;
969 }
970 
971 int
972 mesh_state_is_unique(struct mesh_state* mstate)
973 {
974 	return mstate->unique != NULL;
975 }
976 
977 void
978 mesh_state_make_unique(struct mesh_state* mstate)
979 {
980 	mstate->unique = mstate;
981 }
982 
983 void
984 mesh_state_cleanup(struct mesh_state* mstate)
985 {
986 	struct mesh_area* mesh;
987 	int i;
988 	if(!mstate)
989 		return;
990 	mesh = mstate->s.env->mesh;
991 	/* Stop and delete the serve expired timer */
992 	if(mstate->s.serve_expired_data && mstate->s.serve_expired_data->timer) {
993 		comm_timer_delete(mstate->s.serve_expired_data->timer);
994 		mstate->s.serve_expired_data->timer = NULL;
995 	}
996 	/* drop unsent replies */
997 	if(!mstate->replies_sent) {
998 		struct mesh_reply* rep = mstate->reply_list;
999 		struct mesh_cb* cb;
1000 		/* in tcp_req_info, the mstates linked are removed, but
1001 		 * the reply_list is now NULL, so the remove-from-empty-list
1002 		 * takes no time and also it does not do the mesh accounting */
1003 		mstate->reply_list = NULL;
1004 		for(; rep; rep=rep->next) {
1005 			comm_point_drop_reply(&rep->query_reply);
1006 			log_assert(mesh->num_reply_addrs > 0);
1007 			mesh->num_reply_addrs--;
1008 		}
1009 		while((cb = mstate->cb_list)!=NULL) {
1010 			mstate->cb_list = cb->next;
1011 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
1012 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
1013 				sec_status_unchecked, NULL, 0);
1014 			log_assert(mesh->num_reply_addrs > 0);
1015 			mesh->num_reply_addrs--;
1016 		}
1017 	}
1018 
1019 	/* de-init modules */
1020 	for(i=0; i<mesh->mods.num; i++) {
1021 		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
1022 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
1023 		mstate->s.minfo[i] = NULL;
1024 		mstate->s.ext_state[i] = module_finished;
1025 	}
1026 	alloc_reg_release(mstate->s.env->alloc, mstate->s.region);
1027 }
1028 
1029 void
1030 mesh_state_delete(struct module_qstate* qstate)
1031 {
1032 	struct mesh_area* mesh;
1033 	struct mesh_state_ref* super, ref;
1034 	struct mesh_state* mstate;
1035 	if(!qstate)
1036 		return;
1037 	mstate = qstate->mesh_info;
1038 	mesh = mstate->s.env->mesh;
1039 	mesh_detach_subs(&mstate->s);
1040 	if(mstate->list_select == mesh_forever_list) {
1041 		mesh->num_forever_states --;
1042 		mesh_list_remove(mstate, &mesh->forever_first,
1043 			&mesh->forever_last);
1044 	} else if(mstate->list_select == mesh_jostle_list) {
1045 		mesh_list_remove(mstate, &mesh->jostle_first,
1046 			&mesh->jostle_last);
1047 	}
1048 	if(!mstate->reply_list && !mstate->cb_list
1049 		&& mstate->super_set.count == 0) {
1050 		log_assert(mesh->num_detached_states > 0);
1051 		mesh->num_detached_states--;
1052 	}
1053 	if(mstate->reply_list || mstate->cb_list) {
1054 		log_assert(mesh->num_reply_states > 0);
1055 		mesh->num_reply_states--;
1056 	}
1057 	ref.node.key = &ref;
1058 	ref.s = mstate;
1059 	RBTREE_FOR(super, struct mesh_state_ref*, &mstate->super_set) {
1060 		(void)rbtree_delete(&super->s->sub_set, &ref);
1061 	}
1062 	(void)rbtree_delete(&mesh->run, mstate);
1063 	(void)rbtree_delete(&mesh->all, mstate);
1064 	mesh_state_cleanup(mstate);
1065 }
1066 
1067 /** helper recursive rbtree find routine */
1068 static int
1069 find_in_subsub(struct mesh_state* m, struct mesh_state* tofind, size_t *c)
1070 {
1071 	struct mesh_state_ref* r;
1072 	if((*c)++ > MESH_MAX_SUBSUB)
1073 		return 1;
1074 	RBTREE_FOR(r, struct mesh_state_ref*, &m->sub_set) {
1075 		if(r->s == tofind || find_in_subsub(r->s, tofind, c))
1076 			return 1;
1077 	}
1078 	return 0;
1079 }
1080 
1081 /** find cycle for already looked up mesh_state */
1082 static int
1083 mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
1084 {
1085 	struct mesh_state* cyc_m = qstate->mesh_info;
1086 	size_t counter = 0;
1087 	if(!dep_m)
1088 		return 0;
1089 	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m, &counter)) {
1090 		if(counter > MESH_MAX_SUBSUB)
1091 			return 2;
1092 		return 1;
1093 	}
1094 	return 0;
1095 }
1096 
1097 void mesh_detach_subs(struct module_qstate* qstate)
1098 {
1099 	struct mesh_area* mesh = qstate->env->mesh;
1100 	struct mesh_state_ref* ref, lookup;
1101 #ifdef UNBOUND_DEBUG
1102 	struct rbnode_type* n;
1103 #endif
1104 	lookup.node.key = &lookup;
1105 	lookup.s = qstate->mesh_info;
1106 	RBTREE_FOR(ref, struct mesh_state_ref*, &qstate->mesh_info->sub_set) {
1107 #ifdef UNBOUND_DEBUG
1108 		n =
1109 #else
1110 		(void)
1111 #endif
1112 		rbtree_delete(&ref->s->super_set, &lookup);
1113 		log_assert(n != NULL); /* must have been present */
1114 		if(!ref->s->reply_list && !ref->s->cb_list
1115 			&& ref->s->super_set.count == 0) {
1116 			mesh->num_detached_states++;
1117 			log_assert(mesh->num_detached_states +
1118 				mesh->num_reply_states <= mesh->all.count);
1119 		}
1120 	}
1121 	rbtree_init(&qstate->mesh_info->sub_set, &mesh_state_ref_compare);
1122 }
1123 
1124 int mesh_add_sub(struct module_qstate* qstate, struct query_info* qinfo,
1125         uint16_t qflags, int prime, int valrec, struct module_qstate** newq,
1126 	struct mesh_state** sub)
1127 {
1128 	/* find it, if not, create it */
1129 	struct mesh_area* mesh = qstate->env->mesh;
1130 	*sub = mesh_area_find(mesh, NULL, qinfo, qflags,
1131 		prime, valrec);
1132 	if(mesh_detect_cycle_found(qstate, *sub)) {
1133 		verbose(VERB_ALGO, "attach failed, cycle detected");
1134 		return 0;
1135 	}
1136 	if(!*sub) {
1137 #ifdef UNBOUND_DEBUG
1138 		struct rbnode_type* n;
1139 #endif
1140 		/* create a new one */
1141 		*sub = mesh_state_create(qstate->env, qinfo, NULL, qflags, prime,
1142 			valrec);
1143 		if(!*sub) {
1144 			log_err("mesh_attach_sub: out of memory");
1145 			return 0;
1146 		}
1147 #ifdef UNBOUND_DEBUG
1148 		n =
1149 #else
1150 		(void)
1151 #endif
1152 		rbtree_insert(&mesh->all, &(*sub)->node);
1153 		log_assert(n != NULL);
1154 		/* set detached (it is now) */
1155 		mesh->num_detached_states++;
1156 		/* set new query state to run */
1157 #ifdef UNBOUND_DEBUG
1158 		n =
1159 #else
1160 		(void)
1161 #endif
1162 		rbtree_insert(&mesh->run, &(*sub)->run_node);
1163 		log_assert(n != NULL);
1164 		*newq = &(*sub)->s;
1165 	} else
1166 		*newq = NULL;
1167 	return 1;
1168 }
1169 
1170 int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
1171         uint16_t qflags, int prime, int valrec, struct module_qstate** newq)
1172 {
1173 	struct mesh_area* mesh = qstate->env->mesh;
1174 	struct mesh_state* sub = NULL;
1175 	int was_detached;
1176 	if(!mesh_add_sub(qstate, qinfo, qflags, prime, valrec, newq, &sub))
1177 		return 0;
1178 	was_detached = (sub->super_set.count == 0);
1179 	if(!mesh_state_attachment(qstate->mesh_info, sub))
1180 		return 0;
1181 	/* if it was a duplicate  attachment, the count was not zero before */
1182 	if(!sub->reply_list && !sub->cb_list && was_detached &&
1183 		sub->super_set.count == 1) {
1184 		/* it used to be detached, before this one got added */
1185 		log_assert(mesh->num_detached_states > 0);
1186 		mesh->num_detached_states--;
1187 	}
1188 	/* *newq will be run when inited after the current module stops */
1189 	return 1;
1190 }
1191 
1192 int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub)
1193 {
1194 #ifdef UNBOUND_DEBUG
1195 	struct rbnode_type* n;
1196 #endif
1197 	struct mesh_state_ref* subref; /* points to sub, inserted in super */
1198 	struct mesh_state_ref* superref; /* points to super, inserted in sub */
1199 	if( !(subref = regional_alloc(super->s.region,
1200 		sizeof(struct mesh_state_ref))) ||
1201 		!(superref = regional_alloc(sub->s.region,
1202 		sizeof(struct mesh_state_ref))) ) {
1203 		log_err("mesh_state_attachment: out of memory");
1204 		return 0;
1205 	}
1206 	superref->node.key = superref;
1207 	superref->s = super;
1208 	subref->node.key = subref;
1209 	subref->s = sub;
1210 	if(!rbtree_insert(&sub->super_set, &superref->node)) {
1211 		/* this should not happen, iterator and validator do not
1212 		 * attach subqueries that are identical. */
1213 		/* already attached, we are done, nothing todo.
1214 		 * since superref and subref already allocated in region,
1215 		 * we cannot free them */
1216 		return 1;
1217 	}
1218 #ifdef UNBOUND_DEBUG
1219 	n =
1220 #else
1221 	(void)
1222 #endif
1223 	rbtree_insert(&super->sub_set, &subref->node);
1224 	log_assert(n != NULL); /* we checked above if statement, the reverse
1225 	  administration should not fail now, unless they are out of sync */
1226 	return 1;
1227 }
1228 
1229 /**
1230  * callback results to mesh cb entry
1231  * @param m: mesh state to send it for.
1232  * @param rcode: if not 0, error code.
1233  * @param rep: reply to send (or NULL if rcode is set).
1234  * @param r: callback entry
1235  * @param start_time: the time to pass to callback functions, it is 0 or
1236  * 	a value from one of the packets if the mesh state had packets.
1237  */
1238 static void
1239 mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
1240 	struct mesh_cb* r, struct timeval* start_time)
1241 {
1242 	int secure;
1243 	char* reason = NULL;
1244 	int was_ratelimited = m->s.was_ratelimited;
1245 	/* bogus messages are not made into servfail, sec_status passed
1246 	 * to the callback function */
1247 	if(rep && rep->security == sec_status_secure)
1248 		secure = 1;
1249 	else	secure = 0;
1250 	if(!rep && rcode == LDNS_RCODE_NOERROR)
1251 		rcode = LDNS_RCODE_SERVFAIL;
1252 	if(!rcode && (rep->security == sec_status_bogus ||
1253 		rep->security == sec_status_secure_sentinel_fail)) {
1254 		if(!(reason = errinf_to_str_bogus(&m->s)))
1255 			rcode = LDNS_RCODE_SERVFAIL;
1256 	}
1257 	/* send the reply */
1258 	if(rcode) {
1259 		if(rcode == LDNS_RCODE_SERVFAIL) {
1260 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
1261 				rep, rcode, &r->edns, NULL, m->s.region, start_time))
1262 					r->edns.opt_list_inplace_cb_out = NULL;
1263 		} else {
1264 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
1265 				&r->edns, NULL, m->s.region, start_time))
1266 					r->edns.opt_list_inplace_cb_out = NULL;
1267 		}
1268 		fptr_ok(fptr_whitelist_mesh_cb(r->cb));
1269 		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked, NULL,
1270 			was_ratelimited);
1271 	} else {
1272 		size_t udp_size = r->edns.udp_size;
1273 		sldns_buffer_clear(r->buf);
1274 		r->edns.edns_version = EDNS_ADVERTISED_VERSION;
1275 		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
1276 		r->edns.ext_rcode = 0;
1277 		r->edns.bits &= EDNS_DO;
1278 
1279 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
1280 			LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||
1281 			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
1282 			r->qflags, r->buf, 0, 1,
1283 			m->s.env->scratch, udp_size, &r->edns,
1284 			(int)(r->edns.bits & EDNS_DO), secure))
1285 		{
1286 			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
1287 			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
1288 				sec_status_unchecked, NULL, 0);
1289 		} else {
1290 			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
1291 			(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
1292 				rep->security, reason, was_ratelimited);
1293 		}
1294 	}
1295 	free(reason);
1296 	log_assert(m->s.env->mesh->num_reply_addrs > 0);
1297 	m->s.env->mesh->num_reply_addrs--;
1298 }
1299 
1300 static inline int
1301 mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m)
1302 {
1303 	struct respip_action_info const* respip_info = m->s.respip_action_info;
1304 	return respip_info == NULL
1305 			? 0
1306 			: (respip_info->rpz_used
1307 			&& !respip_info->rpz_disabled
1308 			&& respip_info->action == respip_truncate);
1309 }
1310 
1311 static inline int
1312 mesh_is_udp(struct mesh_reply const* r) {
1313 	return r->query_reply.c->type == comm_udp;
1314 }
1315 
1316 /**
1317  * Send reply to mesh reply entry
1318  * @param m: mesh state to send it for.
1319  * @param rcode: if not 0, error code.
1320  * @param rep: reply to send (or NULL if rcode is set).
1321  * @param r: reply entry
1322  * @param r_buffer: buffer to use for reply entry.
1323  * @param prev: previous reply, already has its answer encoded in buffer.
1324  * @param prev_buffer: buffer for previous reply.
1325  */
1326 static void
1327 mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
1328 	struct mesh_reply* r, struct sldns_buffer* r_buffer,
1329 	struct mesh_reply* prev, struct sldns_buffer* prev_buffer)
1330 {
1331 	struct timeval end_time;
1332 	struct timeval duration;
1333 	int secure;
1334 	/* briefly set the replylist to null in case the
1335 	 * meshsendreply calls tcpreqinfo sendreply that
1336 	 * comm_point_drops because of size, and then the
1337 	 * null stops the mesh state remove and thus
1338 	 * reply_list modification and accounting */
1339 	struct mesh_reply* rlist = m->reply_list;
1340 
1341 	/* rpz: apply actions */
1342 	rcode = mesh_is_udp(r) && mesh_is_rpz_respip_tcponly_action(m)
1343 			? (rcode|BIT_TC) : rcode;
1344 
1345 	/* examine security status */
1346 	if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
1347 		m->s.env->cfg->ignore_cd) && rep &&
1348 		(rep->security <= sec_status_bogus ||
1349 		rep->security == sec_status_secure_sentinel_fail)) {
1350 		rcode = LDNS_RCODE_SERVFAIL;
1351 		if(m->s.env->cfg->stat_extended)
1352 			m->s.env->mesh->ans_bogus++;
1353 	}
1354 	if(rep && rep->security == sec_status_secure)
1355 		secure = 1;
1356 	else	secure = 0;
1357 	if(!rep && rcode == LDNS_RCODE_NOERROR)
1358 		rcode = LDNS_RCODE_SERVFAIL;
1359 	if(r->query_reply.c->use_h2) {
1360 		r->query_reply.c->h2_stream = r->h2_stream;
1361 		/* Mesh reply won't exist for long anymore. Make it impossible
1362 		 * for HTTP/2 stream to refer to mesh state, in case
1363 		 * connection gets cleanup before HTTP/2 stream close. */
1364 		r->h2_stream->mesh_state = NULL;
1365 	}
1366 	/* send the reply */
1367 	/* We don't reuse the encoded answer if:
1368 	 * - either the previous or current response has a local alias.  We could
1369 	 *   compare the alias records and still reuse the previous answer if they
1370 	 *   are the same, but that would be complicated and error prone for the
1371 	 *   relatively minor case. So we err on the side of safety.
1372 	 * - there are registered callback functions for the given rcode, as these
1373 	 *   need to be called for each reply. */
1374 	if(((rcode != LDNS_RCODE_SERVFAIL &&
1375 			!m->s.env->inplace_cb_lists[inplace_cb_reply]) ||
1376 		(rcode == LDNS_RCODE_SERVFAIL &&
1377 			!m->s.env->inplace_cb_lists[inplace_cb_reply_servfail])) &&
1378 		prev && prev_buffer && prev->qflags == r->qflags &&
1379 		!prev->local_alias && !r->local_alias &&
1380 		prev->edns.edns_present == r->edns.edns_present &&
1381 		prev->edns.bits == r->edns.bits &&
1382 		prev->edns.udp_size == r->edns.udp_size &&
1383 		edns_opt_list_compare(prev->edns.opt_list_out, r->edns.opt_list_out) == 0 &&
1384 		edns_opt_list_compare(prev->edns.opt_list_inplace_cb_out, r->edns.opt_list_inplace_cb_out) == 0
1385 		) {
1386 		/* if the previous reply is identical to this one, fix ID */
1387 		if(prev_buffer != r_buffer)
1388 			sldns_buffer_copy(r_buffer, prev_buffer);
1389 		sldns_buffer_write_at(r_buffer, 0, &r->qid, sizeof(uint16_t));
1390 		sldns_buffer_write_at(r_buffer, 12, r->qname,
1391 			m->s.qinfo.qname_len);
1392 		m->reply_list = NULL;
1393 		comm_point_send_reply(&r->query_reply);
1394 		m->reply_list = rlist;
1395 	} else if(rcode) {
1396 		m->s.qinfo.qname = r->qname;
1397 		m->s.qinfo.local_alias = r->local_alias;
1398 		if(rcode == LDNS_RCODE_SERVFAIL) {
1399 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
1400 				rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))
1401 					r->edns.opt_list_inplace_cb_out = NULL;
1402 		} else {
1403 			if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,
1404 				&r->edns, &r->query_reply, m->s.region, &r->start_time))
1405 					r->edns.opt_list_inplace_cb_out = NULL;
1406 		}
1407 		/* Send along EDE BOGUS EDNS0 option when answer is bogus */
1408 		if(m->s.env->cfg->ede && rcode == LDNS_RCODE_SERVFAIL &&
1409 			m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||
1410 			m->s.env->cfg->ignore_cd) && rep &&
1411 			(rep->security <= sec_status_bogus ||
1412 			rep->security == sec_status_secure_sentinel_fail)) {
1413 			char *reason = m->s.env->cfg->val_log_level >= 2
1414 				? errinf_to_str_bogus(&m->s) : NULL;
1415 
1416 			/* During validation the EDE code can be received via two
1417 			 * code paths. One code path fills the reply_info EDE, and
1418 			 * the other fills it in the errinf_strlist. These paths
1419 			 * intersect at some points, but where is opaque due to
1420 			 * the complexity of the validator. At the time of writing
1421 			 * we make the choice to prefer the EDE from errinf_strlist
1422 			 * but a compelling reason to do otherwise is just as valid
1423 			 */
1424 			sldns_ede_code reason_bogus = errinf_to_reason_bogus(&m->s);
1425 			if ((reason_bogus == LDNS_EDE_DNSSEC_BOGUS &&
1426 				rep->reason_bogus != LDNS_EDE_NONE) ||
1427 				reason_bogus == LDNS_EDE_NONE) {
1428 					reason_bogus = rep->reason_bogus;
1429 			}
1430 
1431 			if(reason_bogus != LDNS_EDE_NONE) {
1432 				edns_opt_list_append_ede(&r->edns.opt_list_out,
1433 					m->s.region, reason_bogus, reason);
1434 			}
1435 			free(reason);
1436 		}
1437 		error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,
1438 			r->qflags, &r->edns);
1439 		m->reply_list = NULL;
1440 		comm_point_send_reply(&r->query_reply);
1441 		m->reply_list = rlist;
1442 	} else {
1443 		size_t udp_size = r->edns.udp_size;
1444 		r->edns.edns_version = EDNS_ADVERTISED_VERSION;
1445 		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
1446 		r->edns.ext_rcode = 0;
1447 		r->edns.bits &= EDNS_DO;
1448 		m->s.qinfo.qname = r->qname;
1449 		m->s.qinfo.local_alias = r->local_alias;
1450 		if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,
1451 			LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||
1452 			!reply_info_answer_encode(&m->s.qinfo, rep, r->qid,
1453 			r->qflags, r_buffer, 0, 1, m->s.env->scratch,
1454 			udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),
1455 			secure))
1456 		{
1457 			if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,
1458 			rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))
1459 				r->edns.opt_list_inplace_cb_out = NULL;
1460 			/* internal server error (probably malloc failure) so no
1461 			 * EDE (RFC8914) needed */
1462 			error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
1463 				&m->s.qinfo, r->qid, r->qflags, &r->edns);
1464 		}
1465 		m->reply_list = NULL;
1466 		comm_point_send_reply(&r->query_reply);
1467 		m->reply_list = rlist;
1468 	}
1469 	/* account */
1470 	log_assert(m->s.env->mesh->num_reply_addrs > 0);
1471 	m->s.env->mesh->num_reply_addrs--;
1472 	end_time = *m->s.env->now_tv;
1473 	timeval_subtract(&duration, &end_time, &r->start_time);
1474 	verbose(VERB_ALGO, "query took " ARG_LL "d.%6.6d sec",
1475 		(long long)duration.tv_sec, (int)duration.tv_usec);
1476 	m->s.env->mesh->replies_sent++;
1477 	timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
1478 	timehist_insert(m->s.env->mesh->histogram, &duration);
1479 	if(m->s.env->cfg->stat_extended) {
1480 		uint16_t rc = FLAGS_GET_RCODE(sldns_buffer_read_u16_at(
1481 			r_buffer, 2));
1482 		if(secure) m->s.env->mesh->ans_secure++;
1483 		m->s.env->mesh->ans_rcode[ rc ] ++;
1484 		if(rc == 0 && LDNS_ANCOUNT(sldns_buffer_begin(r_buffer)) == 0)
1485 			m->s.env->mesh->ans_nodata++;
1486 	}
1487 	/* Log reply sent */
1488 	if(m->s.env->cfg->log_replies) {
1489 		log_reply_info(NO_VERBOSE, &m->s.qinfo, &r->query_reply.addr,
1490 			r->query_reply.addrlen, duration, 0, r_buffer);
1491 	}
1492 }
1493 
1494 void mesh_query_done(struct mesh_state* mstate)
1495 {
1496 	struct mesh_reply* r;
1497 	struct mesh_reply* prev = NULL;
1498 	struct sldns_buffer* prev_buffer = NULL;
1499 	struct mesh_cb* c;
1500 	struct reply_info* rep = (mstate->s.return_msg?
1501 		mstate->s.return_msg->rep:NULL);
1502 	struct timeval tv = {0, 0};
1503 	/* No need for the serve expired timer anymore; we are going to reply. */
1504 	if(mstate->s.serve_expired_data) {
1505 		comm_timer_delete(mstate->s.serve_expired_data->timer);
1506 		mstate->s.serve_expired_data->timer = NULL;
1507 	}
1508 	if(mstate->s.return_rcode == LDNS_RCODE_SERVFAIL ||
1509 		(rep && FLAGS_GET_RCODE(rep->flags) == LDNS_RCODE_SERVFAIL)) {
1510 		/* we are SERVFAILing; check for expired answer here */
1511 		mesh_serve_expired_callback(mstate);
1512 		if((mstate->reply_list || mstate->cb_list)
1513 		&& mstate->s.env->cfg->log_servfail
1514 		&& !mstate->s.env->cfg->val_log_squelch) {
1515 			char* err = errinf_to_str_servfail(&mstate->s);
1516 			if(err)
1517 				log_err("%s", err);
1518 			free(err);
1519 		}
1520 	}
1521 	for(r = mstate->reply_list; r; r = r->next) {
1522 		tv = r->start_time;
1523 
1524 		/* if a response-ip address block has been stored the
1525 		 *  information should be logged for each client. */
1526 		if(mstate->s.respip_action_info &&
1527 			mstate->s.respip_action_info->addrinfo) {
1528 			respip_inform_print(mstate->s.respip_action_info,
1529 				r->qname, mstate->s.qinfo.qtype,
1530 				mstate->s.qinfo.qclass, r->local_alias,
1531 				&r->query_reply);
1532 			if(mstate->s.env->cfg->stat_extended &&
1533 				mstate->s.respip_action_info->rpz_used) {
1534 				if(mstate->s.respip_action_info->rpz_disabled)
1535 					mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
1536 				if(mstate->s.respip_action_info->rpz_cname_override)
1537 					mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
1538 				else
1539 					mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action(
1540 						mstate->s.respip_action_info->action)]++;
1541 			}
1542 		}
1543 
1544 		/* if this query is determined to be dropped during the
1545 		 * mesh processing, this is the point to take that action. */
1546 		if(mstate->s.is_drop) {
1547 			/* briefly set the reply_list to NULL, so that the
1548 			 * tcp req info cleanup routine that calls the mesh
1549 			 * to deregister the meshstate for it is not done
1550 			 * because the list is NULL and also accounting is not
1551 			 * done there, but instead we do that here. */
1552 			struct mesh_reply* reply_list = mstate->reply_list;
1553 			mstate->reply_list = NULL;
1554 			comm_point_drop_reply(&r->query_reply);
1555 			mstate->reply_list = reply_list;
1556 		} else {
1557 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
1558 			if(r->query_reply.c->tcp_req_info) {
1559 				r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
1560 				prev_buffer = NULL;
1561 			}
1562 			mesh_send_reply(mstate, mstate->s.return_rcode, rep,
1563 				r, r_buffer, prev, prev_buffer);
1564 			if(r->query_reply.c->tcp_req_info) {
1565 				tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
1566 				r_buffer = NULL;
1567 			}
1568 			prev = r;
1569 			prev_buffer = r_buffer;
1570 		}
1571 	}
1572 	if(mstate->reply_list) {
1573 		mstate->reply_list = NULL;
1574 		if(!mstate->reply_list && !mstate->cb_list) {
1575 			/* was a reply state, not anymore */
1576 			log_assert(mstate->s.env->mesh->num_reply_states > 0);
1577 			mstate->s.env->mesh->num_reply_states--;
1578 		}
1579 		if(!mstate->reply_list && !mstate->cb_list &&
1580 			mstate->super_set.count == 0)
1581 			mstate->s.env->mesh->num_detached_states++;
1582 	}
1583 	mstate->replies_sent = 1;
1584 	while((c = mstate->cb_list) != NULL) {
1585 		/* take this cb off the list; so that the list can be
1586 		 * changed, eg. by adds from the callback routine */
1587 		if(!mstate->reply_list && mstate->cb_list && !c->next) {
1588 			/* was a reply state, not anymore */
1589 			log_assert(mstate->s.env->mesh->num_reply_states > 0);
1590 			mstate->s.env->mesh->num_reply_states--;
1591 		}
1592 		mstate->cb_list = c->next;
1593 		if(!mstate->reply_list && !mstate->cb_list &&
1594 			mstate->super_set.count == 0)
1595 			mstate->s.env->mesh->num_detached_states++;
1596 		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c, &tv);
1597 	}
1598 }
1599 
1600 void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
1601 {
1602 	struct mesh_state_ref* ref;
1603 	RBTREE_FOR(ref, struct mesh_state_ref*, &mstate->super_set)
1604 	{
1605 		/* make super runnable */
1606 		(void)rbtree_insert(&mesh->run, &ref->s->run_node);
1607 		/* callback the function to inform super of result */
1608 		fptr_ok(fptr_whitelist_mod_inform_super(
1609 			mesh->mods.mod[ref->s->s.curmod]->inform_super));
1610 		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s,
1611 			ref->s->s.curmod, &ref->s->s);
1612 		/* copy state that is always relevant to super */
1613 		copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s);
1614 	}
1615 }
1616 
1617 struct mesh_state* mesh_area_find(struct mesh_area* mesh,
1618 	struct respip_client_info* cinfo, struct query_info* qinfo,
1619 	uint16_t qflags, int prime, int valrec)
1620 {
1621 	struct mesh_state key;
1622 	struct mesh_state* result;
1623 
1624 	key.node.key = &key;
1625 	key.s.is_priming = prime;
1626 	key.s.is_valrec = valrec;
1627 	key.s.qinfo = *qinfo;
1628 	key.s.query_flags = qflags;
1629 	/* We are searching for a similar mesh state when we DO want to
1630 	 * aggregate the state. Thus unique is set to NULL. (default when we
1631 	 * desire aggregation).*/
1632 	key.unique = NULL;
1633 	key.s.client_info = cinfo;
1634 
1635 	result = (struct mesh_state*)rbtree_search(&mesh->all, &key);
1636 	return result;
1637 }
1638 
1639 int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
1640         sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,
1641 	uint16_t qid, uint16_t qflags)
1642 {
1643 	struct mesh_cb* r = regional_alloc(s->s.region,
1644 		sizeof(struct mesh_cb));
1645 	if(!r)
1646 		return 0;
1647 	r->buf = buf;
1648 	log_assert(fptr_whitelist_mesh_cb(cb)); /* early failure ifmissing*/
1649 	r->cb = cb;
1650 	r->cb_arg = cb_arg;
1651 	r->edns = *edns;
1652 	if(edns->opt_list_in && !(r->edns.opt_list_in =
1653 			edns_opt_copy_region(edns->opt_list_in, s->s.region)))
1654 		return 0;
1655 	if(edns->opt_list_out && !(r->edns.opt_list_out =
1656 			edns_opt_copy_region(edns->opt_list_out, s->s.region)))
1657 		return 0;
1658 	if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out =
1659 			edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region)))
1660 		return 0;
1661 	r->qid = qid;
1662 	r->qflags = qflags;
1663 	r->next = s->cb_list;
1664 	s->cb_list = r;
1665 	return 1;
1666 
1667 }
1668 
1669 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
1670         struct comm_reply* rep, uint16_t qid, uint16_t qflags,
1671         const struct query_info* qinfo)
1672 {
1673 	struct mesh_reply* r = regional_alloc(s->s.region,
1674 		sizeof(struct mesh_reply));
1675 	if(!r)
1676 		return 0;
1677 	r->query_reply = *rep;
1678 	r->edns = *edns;
1679 	if(edns->opt_list_in && !(r->edns.opt_list_in =
1680 			edns_opt_copy_region(edns->opt_list_in, s->s.region)))
1681 		return 0;
1682 	if(edns->opt_list_out && !(r->edns.opt_list_out =
1683 			edns_opt_copy_region(edns->opt_list_out, s->s.region)))
1684 		return 0;
1685 	if(edns->opt_list_inplace_cb_out && !(r->edns.opt_list_inplace_cb_out =
1686 			edns_opt_copy_region(edns->opt_list_inplace_cb_out, s->s.region)))
1687 		return 0;
1688 	r->qid = qid;
1689 	r->qflags = qflags;
1690 	r->start_time = *s->s.env->now_tv;
1691 	r->next = s->reply_list;
1692 	r->qname = regional_alloc_init(s->s.region, qinfo->qname,
1693 		s->s.qinfo.qname_len);
1694 	if(!r->qname)
1695 		return 0;
1696 	if(rep->c->use_h2)
1697 		r->h2_stream = rep->c->h2_stream;
1698 
1699 	/* Data related to local alias stored in 'qinfo' (if any) is ephemeral
1700 	 * and can be different for different original queries (even if the
1701 	 * replaced query name is the same).  So we need to make a deep copy
1702 	 * and store the copy for each reply info. */
1703 	if(qinfo->local_alias) {
1704 		struct packed_rrset_data* d;
1705 		struct packed_rrset_data* dsrc;
1706 		r->local_alias = regional_alloc_zero(s->s.region,
1707 			sizeof(*qinfo->local_alias));
1708 		if(!r->local_alias)
1709 			return 0;
1710 		r->local_alias->rrset = regional_alloc_init(s->s.region,
1711 			qinfo->local_alias->rrset,
1712 			sizeof(*qinfo->local_alias->rrset));
1713 		if(!r->local_alias->rrset)
1714 			return 0;
1715 		dsrc = qinfo->local_alias->rrset->entry.data;
1716 
1717 		/* In the current implementation, a local alias must be
1718 		 * a single CNAME RR (see worker_handle_request()). */
1719 		log_assert(!qinfo->local_alias->next && dsrc->count == 1 &&
1720 			qinfo->local_alias->rrset->rk.type ==
1721 			htons(LDNS_RR_TYPE_CNAME));
1722 		/* we should make a local copy for the owner name of
1723 		 * the RRset */
1724 		r->local_alias->rrset->rk.dname_len =
1725 			qinfo->local_alias->rrset->rk.dname_len;
1726 		r->local_alias->rrset->rk.dname = regional_alloc_init(
1727 			s->s.region, qinfo->local_alias->rrset->rk.dname,
1728 			qinfo->local_alias->rrset->rk.dname_len);
1729 		if(!r->local_alias->rrset->rk.dname)
1730 			return 0;
1731 
1732 		/* the rrset is not packed, like in the cache, but it is
1733 		 * individually allocated with an allocator from localzone. */
1734 		d = regional_alloc_zero(s->s.region, sizeof(*d));
1735 		if(!d)
1736 			return 0;
1737 		r->local_alias->rrset->entry.data = d;
1738 		if(!rrset_insert_rr(s->s.region, d, dsrc->rr_data[0],
1739 			dsrc->rr_len[0], dsrc->rr_ttl[0], "CNAME local alias"))
1740 			return 0;
1741 	} else
1742 		r->local_alias = NULL;
1743 
1744 	s->reply_list = r;
1745 	return 1;
1746 }
1747 
1748 /* Extract the query info and flags from 'mstate' into '*qinfop' and '*qflags'.
1749  * Since this is only used for internal refetch of otherwise-expired answer,
1750  * we simply ignore the rare failure mode when memory allocation fails. */
1751 static void
1752 mesh_copy_qinfo(struct mesh_state* mstate, struct query_info** qinfop,
1753 	uint16_t* qflags)
1754 {
1755 	struct regional* region = mstate->s.env->scratch;
1756 	struct query_info* qinfo;
1757 
1758 	qinfo = regional_alloc_init(region, &mstate->s.qinfo, sizeof(*qinfo));
1759 	if(!qinfo)
1760 		return;
1761 	qinfo->qname = regional_alloc_init(region, qinfo->qname,
1762 		qinfo->qname_len);
1763 	if(!qinfo->qname)
1764 		return;
1765 	*qinfop = qinfo;
1766 	*qflags = mstate->s.query_flags;
1767 }
1768 
1769 /**
1770  * Continue processing the mesh state at another module.
1771  * Handles module to modules transfer of control.
1772  * Handles module finished.
1773  * @param mesh: the mesh area.
1774  * @param mstate: currently active mesh state.
1775  * 	Deleted if finished, calls _done and _supers to
1776  * 	send replies to clients and inform other mesh states.
1777  * 	This in turn may create additional runnable mesh states.
1778  * @param s: state at which the current module exited.
1779  * @param ev: the event sent to the module.
1780  * 	returned is the event to send to the next module.
1781  * @return true if continue processing at the new module.
1782  * 	false if not continued processing is needed.
1783  */
1784 static int
1785 mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
1786 	enum module_ext_state s, enum module_ev* ev)
1787 {
1788 	mstate->num_activated++;
1789 	if(mstate->num_activated > MESH_MAX_ACTIVATION) {
1790 		/* module is looping. Stop it. */
1791 		log_err("internal error: looping module (%s) stopped",
1792 			mesh->mods.mod[mstate->s.curmod]->name);
1793 		log_query_info(NO_VERBOSE, "pass error for qstate",
1794 			&mstate->s.qinfo);
1795 		s = module_error;
1796 	}
1797 	if(s == module_wait_module || s == module_restart_next) {
1798 		/* start next module */
1799 		mstate->s.curmod++;
1800 		if(mesh->mods.num == mstate->s.curmod) {
1801 			log_err("Cannot pass to next module; at last module");
1802 			log_query_info(VERB_QUERY, "pass error for qstate",
1803 				&mstate->s.qinfo);
1804 			mstate->s.curmod--;
1805 			return mesh_continue(mesh, mstate, module_error, ev);
1806 		}
1807 		if(s == module_restart_next) {
1808 			int curmod = mstate->s.curmod;
1809 			for(; mstate->s.curmod < mesh->mods.num;
1810 				mstate->s.curmod++) {
1811 				fptr_ok(fptr_whitelist_mod_clear(
1812 					mesh->mods.mod[mstate->s.curmod]->clear));
1813 				(*mesh->mods.mod[mstate->s.curmod]->clear)
1814 					(&mstate->s, mstate->s.curmod);
1815 				mstate->s.minfo[mstate->s.curmod] = NULL;
1816 			}
1817 			mstate->s.curmod = curmod;
1818 		}
1819 		*ev = module_event_pass;
1820 		return 1;
1821 	}
1822 	if(s == module_wait_subquery && mstate->sub_set.count == 0) {
1823 		log_err("module cannot wait for subquery, subquery list empty");
1824 		log_query_info(VERB_QUERY, "pass error for qstate",
1825 			&mstate->s.qinfo);
1826 		s = module_error;
1827 	}
1828 	if(s == module_error && mstate->s.return_rcode == LDNS_RCODE_NOERROR) {
1829 		/* error is bad, handle pass back up below */
1830 		mstate->s.return_rcode = LDNS_RCODE_SERVFAIL;
1831 	}
1832 	if(s == module_error) {
1833 		mesh_query_done(mstate);
1834 		mesh_walk_supers(mesh, mstate);
1835 		mesh_state_delete(&mstate->s);
1836 		return 0;
1837 	}
1838 	if(s == module_finished) {
1839 		if(mstate->s.curmod == 0) {
1840 			struct query_info* qinfo = NULL;
1841 			uint16_t qflags;
1842 			int rpz_p = 0;
1843 
1844 			mesh_query_done(mstate);
1845 			mesh_walk_supers(mesh, mstate);
1846 
1847 			/* If the answer to the query needs to be refetched
1848 			 * from an external DNS server, we'll need to schedule
1849 			 * a prefetch after removing the current state, so
1850 			 * we need to make a copy of the query info here. */
1851 			if(mstate->s.need_refetch) {
1852 				mesh_copy_qinfo(mstate, &qinfo, &qflags);
1853 				rpz_p = mstate->s.rpz_passthru;
1854 			}
1855 
1856 			mesh_state_delete(&mstate->s);
1857 			if(qinfo) {
1858 				mesh_schedule_prefetch(mesh, qinfo, qflags,
1859 					0, 1, rpz_p);
1860 			}
1861 			return 0;
1862 		}
1863 		/* pass along the locus of control */
1864 		mstate->s.curmod --;
1865 		*ev = module_event_moddone;
1866 		return 1;
1867 	}
1868 	return 0;
1869 }
1870 
1871 void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
1872 	enum module_ev ev, struct outbound_entry* e)
1873 {
1874 	enum module_ext_state s;
1875 	verbose(VERB_ALGO, "mesh_run: start");
1876 	while(mstate) {
1877 		/* run the module */
1878 		fptr_ok(fptr_whitelist_mod_operate(
1879 			mesh->mods.mod[mstate->s.curmod]->operate));
1880 		(*mesh->mods.mod[mstate->s.curmod]->operate)
1881 			(&mstate->s, ev, mstate->s.curmod, e);
1882 
1883 		/* examine results */
1884 		mstate->s.reply = NULL;
1885 		regional_free_all(mstate->s.env->scratch);
1886 		s = mstate->s.ext_state[mstate->s.curmod];
1887 		verbose(VERB_ALGO, "mesh_run: %s module exit state is %s",
1888 			mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));
1889 		e = NULL;
1890 		if(mesh_continue(mesh, mstate, s, &ev))
1891 			continue;
1892 
1893 		/* run more modules */
1894 		ev = module_event_pass;
1895 		if(mesh->run.count > 0) {
1896 			/* pop random element off the runnable tree */
1897 			mstate = (struct mesh_state*)mesh->run.root->key;
1898 			(void)rbtree_delete(&mesh->run, mstate);
1899 		} else mstate = NULL;
1900 	}
1901 	if(verbosity >= VERB_ALGO) {
1902 		mesh_stats(mesh, "mesh_run: end");
1903 		mesh_log_list(mesh);
1904 	}
1905 }
1906 
1907 void
1908 mesh_log_list(struct mesh_area* mesh)
1909 {
1910 	char buf[30];
1911 	struct mesh_state* m;
1912 	int num = 0;
1913 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
1914 		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s",
1915 			num++, (m->s.is_priming)?"p":"",  /* prime */
1916 			(m->s.is_valrec)?"v":"",  /* prime */
1917 			(m->s.query_flags&BIT_RD)?"RD":"",
1918 			(m->s.query_flags&BIT_CD)?"CD":"",
1919 			(m->super_set.count==0)?"d":"", /* detached */
1920 			(m->sub_set.count!=0)?"c":"",  /* children */
1921 			m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/
1922 			(m->cb_list)?"cb":"" /* callbacks */
1923 			);
1924 		log_query_info(VERB_ALGO, buf, &m->s.qinfo);
1925 	}
1926 }
1927 
1928 void
1929 mesh_stats(struct mesh_area* mesh, const char* str)
1930 {
1931 	verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
1932 		"%u detached), %u waiting replies, %u recursion replies "
1933 		"sent, %d replies dropped, %d states jostled out",
1934 		str, (unsigned)mesh->all.count,
1935 		(unsigned)mesh->num_reply_states,
1936 		(unsigned)mesh->num_detached_states,
1937 		(unsigned)mesh->num_reply_addrs,
1938 		(unsigned)mesh->replies_sent,
1939 		(unsigned)mesh->stats_dropped,
1940 		(unsigned)mesh->stats_jostled);
1941 	if(mesh->replies_sent > 0) {
1942 		struct timeval avg;
1943 		timeval_divide(&avg, &mesh->replies_sum_wait,
1944 			mesh->replies_sent);
1945 		log_info("average recursion processing time "
1946 			ARG_LL "d.%6.6d sec",
1947 			(long long)avg.tv_sec, (int)avg.tv_usec);
1948 		log_info("histogram of recursion processing times");
1949 		timehist_log(mesh->histogram, "recursions");
1950 	}
1951 }
1952 
1953 void
1954 mesh_stats_clear(struct mesh_area* mesh)
1955 {
1956 	if(!mesh)
1957 		return;
1958 	mesh->replies_sent = 0;
1959 	mesh->replies_sum_wait.tv_sec = 0;
1960 	mesh->replies_sum_wait.tv_usec = 0;
1961 	mesh->stats_jostled = 0;
1962 	mesh->stats_dropped = 0;
1963 	timehist_clear(mesh->histogram);
1964 	mesh->ans_secure = 0;
1965 	mesh->ans_bogus = 0;
1966 	mesh->ans_expired = 0;
1967 	memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM);
1968 	memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);
1969 	mesh->ans_nodata = 0;
1970 }
1971 
1972 size_t
1973 mesh_get_mem(struct mesh_area* mesh)
1974 {
1975 	struct mesh_state* m;
1976 	size_t s = sizeof(*mesh) + sizeof(struct timehist) +
1977 		sizeof(struct th_buck)*mesh->histogram->num +
1978 		sizeof(sldns_buffer) + sldns_buffer_capacity(mesh->qbuf_bak);
1979 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
1980 		/* all, including m itself allocated in qstate region */
1981 		s += regional_get_mem(m->s.region);
1982 	}
1983 	return s;
1984 }
1985 
1986 int
1987 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
1988 	uint16_t flags, int prime, int valrec)
1989 {
1990 	struct mesh_area* mesh = qstate->env->mesh;
1991 	struct mesh_state* dep_m = NULL;
1992 	dep_m = mesh_area_find(mesh, NULL, qinfo, flags, prime, valrec);
1993 	return mesh_detect_cycle_found(qstate, dep_m);
1994 }
1995 
1996 void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,
1997         struct mesh_state** lp)
1998 {
1999 	/* insert as last element */
2000 	m->prev = *lp;
2001 	m->next = NULL;
2002 	if(*lp)
2003 		(*lp)->next = m;
2004 	else	*fp = m;
2005 	*lp = m;
2006 }
2007 
2008 void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
2009         struct mesh_state** lp)
2010 {
2011 	if(m->next)
2012 		m->next->prev = m->prev;
2013 	else	*lp = m->prev;
2014 	if(m->prev)
2015 		m->prev->next = m->next;
2016 	else	*fp = m->next;
2017 }
2018 
2019 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
2020 	struct comm_point* cp)
2021 {
2022 	struct mesh_reply* n, *prev = NULL;
2023 	n = m->reply_list;
2024 	/* when in mesh_cleanup, it sets the reply_list to NULL, so that
2025 	 * there is no accounting twice */
2026 	if(!n) return; /* nothing to remove, also no accounting needed */
2027 	while(n) {
2028 		if(n->query_reply.c == cp) {
2029 			/* unlink it */
2030 			if(prev) prev->next = n->next;
2031 			else m->reply_list = n->next;
2032 			/* delete it, but allocated in m region */
2033 			log_assert(mesh->num_reply_addrs > 0);
2034 			mesh->num_reply_addrs--;
2035 
2036 			/* prev = prev; */
2037 			n = n->next;
2038 			continue;
2039 		}
2040 		prev = n;
2041 		n = n->next;
2042 	}
2043 	/* it was not detached (because it had a reply list), could be now */
2044 	if(!m->reply_list && !m->cb_list
2045 		&& m->super_set.count == 0) {
2046 		mesh->num_detached_states++;
2047 	}
2048 	/* if not replies any more in mstate, it is no longer a reply_state */
2049 	if(!m->reply_list && !m->cb_list) {
2050 		log_assert(mesh->num_reply_states > 0);
2051 		mesh->num_reply_states--;
2052 	}
2053 }
2054 
2055 
2056 static int
2057 apply_respip_action(struct module_qstate* qstate,
2058 	const struct query_info* qinfo, struct respip_client_info* cinfo,
2059 	struct respip_action_info* actinfo, struct reply_info* rep,
2060 	struct ub_packed_rrset_key** alias_rrset,
2061 	struct reply_info** encode_repp, struct auth_zones* az)
2062 {
2063 	if(qinfo->qtype != LDNS_RR_TYPE_A &&
2064 		qinfo->qtype != LDNS_RR_TYPE_AAAA &&
2065 		qinfo->qtype != LDNS_RR_TYPE_ANY)
2066 		return 1;
2067 
2068 	if(!respip_rewrite_reply(qinfo, cinfo, rep, encode_repp, actinfo,
2069 		alias_rrset, 0, qstate->region, az, NULL))
2070 		return 0;
2071 
2072 	/* xxx_deny actions mean dropping the reply, unless the original reply
2073 	 * was redirected to response-ip data. */
2074 	if((actinfo->action == respip_deny ||
2075 		actinfo->action == respip_inform_deny) &&
2076 		*encode_repp == rep)
2077 		*encode_repp = NULL;
2078 
2079 	return 1;
2080 }
2081 
2082 void
2083 mesh_serve_expired_callback(void* arg)
2084 {
2085 	struct mesh_state* mstate = (struct mesh_state*) arg;
2086 	struct module_qstate* qstate = &mstate->s;
2087 	struct mesh_reply* r;
2088 	struct mesh_area* mesh = qstate->env->mesh;
2089 	struct dns_msg* msg;
2090 	struct mesh_cb* c;
2091 	struct mesh_reply* prev = NULL;
2092 	struct sldns_buffer* prev_buffer = NULL;
2093 	struct sldns_buffer* r_buffer = NULL;
2094 	struct reply_info* partial_rep = NULL;
2095 	struct ub_packed_rrset_key* alias_rrset = NULL;
2096 	struct reply_info* encode_rep = NULL;
2097 	struct respip_action_info actinfo;
2098 	struct query_info* lookup_qinfo = &qstate->qinfo;
2099 	struct query_info qinfo_tmp;
2100 	struct timeval tv = {0, 0};
2101 	int must_validate = (!(qstate->query_flags&BIT_CD)
2102 		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
2103 	if(!qstate->serve_expired_data) return;
2104 	verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");
2105 	comm_timer_delete(qstate->serve_expired_data->timer);
2106 	qstate->serve_expired_data->timer = NULL;
2107 	/* If is_drop or no_cache_lookup (modules that handle their own cache e.g.,
2108 	 * subnetmod) ignore stale data from the main cache. */
2109 	if(qstate->no_cache_lookup || qstate->is_drop) {
2110 		verbose(VERB_ALGO,
2111 			"Serve expired: Not allowed to look into cache for stale");
2112 		return;
2113 	}
2114 	/* The following while is used instead of the `goto lookup_cache`
2115 	 * like in the worker. */
2116 	while(1) {
2117 		fptr_ok(fptr_whitelist_serve_expired_lookup(
2118 			qstate->serve_expired_data->get_cached_answer));
2119 		msg = (*qstate->serve_expired_data->get_cached_answer)(qstate,
2120 			lookup_qinfo);
2121 		if(!msg)
2122 			return;
2123 		/* Reset these in case we pass a second time from here. */
2124 		encode_rep = msg->rep;
2125 		memset(&actinfo, 0, sizeof(actinfo));
2126 		actinfo.action = respip_none;
2127 		alias_rrset = NULL;
2128 		if((mesh->use_response_ip || mesh->use_rpz) &&
2129 			!partial_rep && !apply_respip_action(qstate, &qstate->qinfo,
2130 			qstate->client_info, &actinfo, msg->rep, &alias_rrset, &encode_rep,
2131 			qstate->env->auth_zones)) {
2132 			return;
2133 		} else if(partial_rep &&
2134 			!respip_merge_cname(partial_rep, &qstate->qinfo, msg->rep,
2135 			qstate->client_info, must_validate, &encode_rep, qstate->region,
2136 			qstate->env->auth_zones)) {
2137 			return;
2138 		}
2139 		if(!encode_rep || alias_rrset) {
2140 			if(!encode_rep) {
2141 				/* Needs drop */
2142 				return;
2143 			} else {
2144 				/* A partial CNAME chain is found. */
2145 				partial_rep = encode_rep;
2146 			}
2147 		}
2148 		/* We've found a partial reply ending with an
2149 		* alias.  Replace the lookup qinfo for the
2150 		* alias target and lookup the cache again to
2151 		* (possibly) complete the reply.  As we're
2152 		* passing the "base" reply, there will be no
2153 		* more alias chasing. */
2154 		if(partial_rep) {
2155 			memset(&qinfo_tmp, 0, sizeof(qinfo_tmp));
2156 			get_cname_target(alias_rrset, &qinfo_tmp.qname,
2157 				&qinfo_tmp.qname_len);
2158 			if(!qinfo_tmp.qname) {
2159 				log_err("Serve expired: unexpected: invalid answer alias");
2160 				return;
2161 			}
2162 			qinfo_tmp.qtype = qstate->qinfo.qtype;
2163 			qinfo_tmp.qclass = qstate->qinfo.qclass;
2164 			lookup_qinfo = &qinfo_tmp;
2165 			continue;
2166 		}
2167 		break;
2168 	}
2169 
2170 	if(verbosity >= VERB_ALGO)
2171 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
2172 
2173 	for(r = mstate->reply_list; r; r = r->next) {
2174 		tv = r->start_time;
2175 
2176 		/* If address info is returned, it means the action should be an
2177 		* 'inform' variant and the information should be logged. */
2178 		if(actinfo.addrinfo) {
2179 			respip_inform_print(&actinfo, r->qname,
2180 				qstate->qinfo.qtype, qstate->qinfo.qclass,
2181 				r->local_alias, &r->query_reply);
2182 
2183 			if(qstate->env->cfg->stat_extended && actinfo.rpz_used) {
2184 				if(actinfo.rpz_disabled)
2185 					qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
2186 				if(actinfo.rpz_cname_override)
2187 					qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
2188 				else
2189 					qstate->env->mesh->rpz_action[
2190 						respip_action_to_rpz_action(actinfo.action)]++;
2191 			}
2192 		}
2193 
2194 		/* Add EDE Stale Answer (RCF8914). Ignore global ede as this is
2195 		 * warning instead of an error */
2196 		if (r->edns.edns_present && qstate->env->cfg->ede_serve_expired &&
2197 			qstate->env->cfg->ede) {
2198 			edns_opt_list_append_ede(&r->edns.opt_list_out,
2199 				mstate->s.region, LDNS_EDE_STALE_ANSWER, NULL);
2200 		}
2201 
2202 		r_buffer = r->query_reply.c->buffer;
2203 		if(r->query_reply.c->tcp_req_info)
2204 			r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
2205 		mesh_send_reply(mstate, LDNS_RCODE_NOERROR, msg->rep,
2206 			r, r_buffer, prev, prev_buffer);
2207 		if(r->query_reply.c->tcp_req_info)
2208 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
2209 		prev = r;
2210 		prev_buffer = r_buffer;
2211 
2212 		/* Account for each reply sent. */
2213 		mesh->ans_expired++;
2214 
2215 	}
2216 	if(mstate->reply_list) {
2217 		mstate->reply_list = NULL;
2218 		if(!mstate->reply_list && !mstate->cb_list) {
2219 			log_assert(mesh->num_reply_states > 0);
2220 			mesh->num_reply_states--;
2221 			if(mstate->super_set.count == 0) {
2222 				mesh->num_detached_states++;
2223 			}
2224 		}
2225 	}
2226 	while((c = mstate->cb_list) != NULL) {
2227 		/* take this cb off the list; so that the list can be
2228 		 * changed, eg. by adds from the callback routine */
2229 		if(!mstate->reply_list && mstate->cb_list && !c->next) {
2230 			/* was a reply state, not anymore */
2231 			log_assert(qstate->env->mesh->num_reply_states > 0);
2232 			qstate->env->mesh->num_reply_states--;
2233 		}
2234 		mstate->cb_list = c->next;
2235 		if(!mstate->reply_list && !mstate->cb_list &&
2236 			mstate->super_set.count == 0)
2237 			qstate->env->mesh->num_detached_states++;
2238 		mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c, &tv);
2239 	}
2240 }
2241