auth: add configurable timeout for inbound AXFR

diff --git a/docs/settings.rst b/docs/settings.rst
index e68dfc33a566ac643fe9272ae8c1502ba62d26b9..54b5137c010dee80d61581bbd0dc55019d920860 100644 (file)
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -160,6 +160,18 @@ Static pre-shared authentication key for access to the REST API.
 
 Disallow data modification through the REST API when set.
 
+.. _setting-axfr-fetch-timeout:
+
+``axfr-fetch-timeout``
+----------------------
+
+- Integer
+- Default: 10
+
+.. versionadded:: 4.3.0
+
+Maximum time in seconds for inbound AXFR to start or be idle after starting.
+
 .. _setting-axfr-lower-serial:
 
 ``axfr-lower-serial``

diff --git a/pdns/common_startup.cc b/pdns/common_startup.cc
index fa56dd687070de9adf5968d30b96acc371628e6c..62e72b04d6c56f7404515e5ce8bd3f13785569bb 100644 (file)
--- a/pdns/common_startup.cc
+++ b/pdns/common_startup.cc
@@ -222,6 +222,7 @@ void declareArguments()
 
   ::arg().set("lua-axfr-script", "Script to be used to edit incoming AXFRs")="";
   ::arg().set("xfr-max-received-mbytes", "Maximum number of megabytes received from an incoming XFR")="100";
+  ::arg().set("axfr-fetch-timeout", "Maximum time in seconds for inbound AXFR to start or be idle after starting")="10";
 
   ::arg().set("tcp-fast-open", "Enable TCP Fast Open support on the listening sockets, using the supplied numerical value as the queue size")="0";
 

diff --git a/pdns/slavecommunicator.cc b/pdns/slavecommunicator.cc
index 46e4c8f15de94f77651e114f3cf0b60604d04315..af88fa9585e7f5c5554cf8e54e16067375fda57a 100644 (file)
--- a/pdns/slavecommunicator.cc
+++ b/pdns/slavecommunicator.cc
@@ -241,13 +241,14 @@ static bool processRecordForZS(const DNSName& domain, bool& firstNSEC3, DNSResou
 
 static vector<DNSResourceRecord> doAxfr(const ComboAddress& raddr, const DNSName& domain, const TSIGTriplet& tt, const ComboAddress& laddr,  scoped_ptr<AuthLua4>& pdl, ZoneStatus& zs)
 {
+  uint16_t axfr_timeout=::arg().asNum("axfr-fetch-timeout");
   vector<DNSResourceRecord> rrs;
-  AXFRRetriever retriever(raddr, domain, tt, (laddr.sin4.sin_family == 0) ? NULL : &laddr, ((size_t) ::arg().asNum("xfr-max-received-mbytes")) * 1024 * 1024);
+  AXFRRetriever retriever(raddr, domain, tt, (laddr.sin4.sin_family == 0) ? NULL : &laddr, ((size_t) ::arg().asNum("xfr-max-received-mbytes")) * 1024 * 1024, axfr_timeout);
   Resolver::res_t recs;
   bool first=true;
   bool firstNSEC3{true};
   bool soa_received {false};
-  while(retriever.getChunk(recs)) {
+  while(retriever.getChunk(recs, nullptr, axfr_timeout)) {
     if(first) {
       g_log<<Logger::Error<<"AXFR started for '"<<domain<<"'"<<endl;
       first=false;