Released today so I haven't been able to give it much testing yet...

Index: doc/Changelog
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/Changelog,v
retrieving revision 1.45
diff -u -p -r1.45 Changelog
--- doc/Changelog       29 Aug 2022 16:05:00 -0000      1.45
+++ doc/Changelog       21 Sep 2022 12:41:57 -0000
@@ -1,5 +1,5 @@
-7 February 2022: Wouter
-       - Fix that TCP interface does not use TLS when TLS is also configured.
+21 September 2022: Wouter
+       - Patch for CVE-2022-3204 Non-Responsive Delegation Attack.
 
 1 August 2022: Wouter
        - Fix the novel ghost domain issues CVE-2022-30698 and CVE-2022-30699.
Index: config.guess
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/config.guess,v
retrieving revision 1.12
diff -u -p -r1.12 config.guess
--- config.guess        7 Jun 2022 15:42:53 -0000       1.12
+++ config.guess        21 Sep 2022 12:41:57 -0000
@@ -4,7 +4,7 @@
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2022-05-25'
+timestamp='2022-08-01'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -1036,7 +1036,7 @@ EOF
     k1om:Linux:*:*)
        GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
        ;;
-    loongarch32:Linux:*:* | loongarch64:Linux:*:* | loongarchx32:Linux:*:*)
+    loongarch32:Linux:*:* | loongarch64:Linux:*:*)
        GUESS=$UNAME_MACHINE-unknown-linux-$LIBC
        ;;
     m32r*:Linux:*:*)
Index: config.sub
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/config.sub,v
retrieving revision 1.11
diff -u -p -r1.11 config.sub
--- config.sub  23 Feb 2022 12:04:05 -0000      1.11
+++ config.sub  21 Sep 2022 12:41:57 -0000
@@ -4,7 +4,7 @@
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2022-01-03'
+timestamp='2022-08-01'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -1207,7 +1207,7 @@ case $cpu-$vendor in
                        | k1om \
                        | le32 | le64 \
                        | lm32 \
-                       | loongarch32 | loongarch64 | loongarchx32 \
+                       | loongarch32 | loongarch64 \
                        | m32c | m32r | m32rle \
                        | m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | 
m68k \
                        | m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
Index: configure
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/configure,v
retrieving revision 1.47
diff -u -p -r1.47 configure
--- configure   29 Aug 2022 16:04:59 -0000      1.47
+++ configure   21 Sep 2022 12:41:57 -0000
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.16.2.
+# Generated by GNU Autoconf 2.71 for unbound 1.16.3.
 #
 # Report bugs to <unbound-b...@nlnetlabs.nl or 
https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.16.2'
-PACKAGE_STRING='unbound 1.16.2'
+PACKAGE_VERSION='1.16.3'
+PACKAGE_STRING='unbound 1.16.3'
 PACKAGE_BUGREPORT='unbound-b...@nlnetlabs.nl or 
https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1503,7 +1503,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.16.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.16.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1569,7 +1569,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.16.2:";;
+     short | recursive ) echo "Configuration of unbound 1.16.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1812,7 +1812,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.16.2
+unbound configure 1.16.3
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2469,7 +2469,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.16.2, which was
+It was created by unbound $as_me 1.16.3, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3233,11 +3233,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=16
 
-UNBOUND_VERSION_MICRO=2
+UNBOUND_VERSION_MICRO=3
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=18
+LIBUNBOUND_REVISION=19
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3323,6 +3323,7 @@ LIBUNBOUND_AGE=1
 # 1.16.0 had 9:16:1
 # 1.16.1 had 9:17:1
 # 1.16.2 had 9:18:1
+# 1.16.3 had 9:19:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -23778,7 +23779,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 1
 
 
 
-version=1.16.2
+version=1.16.3
 
 date=`date +'%b %e, %Y'`
 
@@ -24290,7 +24291,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.16.2, which was
+This file was extended by unbound $as_me 1.16.3, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -24358,7 +24359,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.16.2
+unbound config.status 1.16.3
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
Index: configure.ac
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/configure.ac,v
retrieving revision 1.47
diff -u -p -r1.47 configure.ac
--- configure.ac        29 Aug 2022 16:04:59 -0000      1.47
+++ configure.ac        21 Sep 2022 12:41:57 -0000
@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[16])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MICRO],[3])
 
AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-b...@nlnetlabs.nl
 or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=18
+LIBUNBOUND_REVISION=19
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -104,6 +104,7 @@ LIBUNBOUND_AGE=1
 # 1.16.0 had 9:16:1
 # 1.16.1 had 9:17:1
 # 1.16.2 had 9:18:1
+# 1.16.3 had 9:19:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
Index: doc/README
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/README,v
retrieving revision 1.32
diff -u -p -r1.32 README
--- doc/README  29 Aug 2022 16:05:00 -0000      1.32
+++ doc/README  21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-README for Unbound 1.16.2
+README for Unbound 1.16.3
 Copyright 2007 NLnet Labs
 http://unbound.net
 
Index: doc/example.conf.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/example.conf.in,v
retrieving revision 1.37
diff -u -p -r1.37 example.conf.in
--- doc/example.conf.in 29 Aug 2022 16:05:00 -0000      1.37
+++ doc/example.conf.in 21 Sep 2022 12:41:57 -0000
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page, version 1.16.2.
+# See unbound.conf(5) man page, version 1.16.3.
 #
 # this is a comment.
 
Index: doc/libunbound.3.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/libunbound.3.in,v
retrieving revision 1.35
diff -u -p -r1.35 libunbound.3.in
--- doc/libunbound.3.in 29 Aug 2022 16:05:00 -0000      1.35
+++ doc/libunbound.3.in 21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "libunbound" "3" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "libunbound" "3" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" libunbound.3 -- unbound library functions manual
 .\"
@@ -44,7 +44,7 @@
 .B ub_ctx_zone_remove,
 .B ub_ctx_data_add,
 .B ub_ctx_data_remove
-\- Unbound DNS validating resolver 1.16.2 functions.
+\- Unbound DNS validating resolver 1.16.3 functions.
 .SH "SYNOPSIS"
 .B #include <unbound.h>
 .LP
Index: doc/unbound-anchor.8.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound-anchor.8.in,v
retrieving revision 1.34
diff -u -p -r1.34 unbound-anchor.8.in
--- doc/unbound-anchor.8.in     29 Aug 2022 16:05:00 -0000      1.34
+++ doc/unbound-anchor.8.in     21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound-anchor" "8" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound-anchor" "8" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound-anchor.8 -- unbound anchor maintenance utility manual
 .\"
Index: doc/unbound-checkconf.8.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound-checkconf.8.in,v
retrieving revision 1.34
diff -u -p -r1.34 unbound-checkconf.8.in
--- doc/unbound-checkconf.8.in  29 Aug 2022 16:05:00 -0000      1.34
+++ doc/unbound-checkconf.8.in  21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound-checkconf" "8" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound-checkconf" "8" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
Index: doc/unbound-control.8.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound-control.8.in,v
retrieving revision 1.36
diff -u -p -r1.36 unbound-control.8.in
--- doc/unbound-control.8.in    29 Aug 2022 16:05:00 -0000      1.36
+++ doc/unbound-control.8.in    21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound-control" "8" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound-control" "8" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound-control.8 -- unbound remote control manual
 .\"
Index: doc/unbound-host.1.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound-host.1.in,v
retrieving revision 1.36
diff -u -p -r1.36 unbound-host.1.in
--- doc/unbound-host.1.in       29 Aug 2022 16:05:00 -0000      1.36
+++ doc/unbound-host.1.in       21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound\-host" "1" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound\-host" "1" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound-host.1 -- unbound DNS lookup utility
 .\"
Index: doc/unbound.8.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound.8.in,v
retrieving revision 1.37
diff -u -p -r1.37 unbound.8.in
--- doc/unbound.8.in    29 Aug 2022 16:05:00 -0000      1.37
+++ doc/unbound.8.in    21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound" "8" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound" "8" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -9,7 +9,7 @@
 .\"
 .SH "NAME"
 .B unbound
-\- Unbound DNS validating resolver 1.16.2.
+\- Unbound DNS validating resolver 1.16.3.
 .SH "SYNOPSIS"
 .B unbound
 .RB [ \-h ]
Index: doc/unbound.conf.5.in
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/doc/unbound.conf.5.in,v
retrieving revision 1.41
diff -u -p -r1.41 unbound.conf.5.in
--- doc/unbound.conf.5.in       29 Aug 2022 16:05:00 -0000      1.41
+++ doc/unbound.conf.5.in       21 Sep 2022 12:41:57 -0000
@@ -1,4 +1,4 @@
-.TH "unbound.conf" "5" "Aug  1, 2022" "NLnet Labs" "unbound 1.16.2"
+.TH "unbound.conf" "5" "Sep 21, 2022" "NLnet Labs" "unbound 1.16.3"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
Index: iterator/iter_delegpt.c
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/iterator/iter_delegpt.c,v
retrieving revision 1.6
diff -u -p -r1.6 iter_delegpt.c
--- iterator/iter_delegpt.c     29 Aug 2022 16:05:00 -0000      1.6
+++ iterator/iter_delegpt.c     21 Sep 2022 12:41:57 -0000
@@ -78,6 +78,7 @@ struct delegpt* delegpt_copy(struct dele
                if(!delegpt_add_ns(copy, region, ns->name, ns->lame,
                        ns->tls_auth_name, ns->port))
                        return NULL;
+               copy->nslist->cache_lookup_count = ns->cache_lookup_count;
                copy->nslist->resolved = ns->resolved;
                copy->nslist->got4 = ns->got4;
                copy->nslist->got6 = ns->got6;
@@ -121,6 +122,7 @@ delegpt_add_ns(struct delegpt* dp, struc
        ns->namelen = len;
        dp->nslist = ns;
        ns->name = regional_alloc_init(region, name, ns->namelen);
+       ns->cache_lookup_count = 0;
        ns->resolved = 0;
        ns->got4 = 0;
        ns->got6 = 0;
@@ -620,6 +622,7 @@ int delegpt_add_ns_mlc(struct delegpt* d
        }
        ns->next = dp->nslist;
        dp->nslist = ns;
+       ns->cache_lookup_count = 0;
        ns->resolved = 0;
        ns->got4 = 0;
        ns->got6 = 0;
Index: iterator/iter_delegpt.h
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/iterator/iter_delegpt.h,v
retrieving revision 1.9
diff -u -p -r1.9 iter_delegpt.h
--- iterator/iter_delegpt.h     29 Aug 2022 16:05:00 -0000      1.9
+++ iterator/iter_delegpt.h     21 Sep 2022 12:41:57 -0000
@@ -101,6 +101,8 @@ struct delegpt_ns {
        uint8_t* name;
        /** length of name */
        size_t namelen;
+       /** number of cache lookups for the name */
+       int cache_lookup_count;
        /** 
         * If the name has been resolved. false if not queried for yet.
         * true if the A, AAAA queries have been generated.
Index: iterator/iter_utils.c
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/iterator/iter_utils.c,v
retrieving revision 1.19
diff -u -p -r1.19 iter_utils.c
--- iterator/iter_utils.c       29 Aug 2022 16:05:00 -0000      1.19
+++ iterator/iter_utils.c       21 Sep 2022 12:41:57 -0000
@@ -1209,6 +1209,9 @@ int iter_lookup_parent_glue_from_cache(s
        struct delegpt_ns* ns;
        size_t num = delegpt_count_targets(dp);
        for(ns = dp->nslist; ns; ns = ns->next) {
+               if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX_PSIDE)
+                       continue;
+               ns->cache_lookup_count++;
                /* get cached parentside A */
                akey = rrset_cache_lookup(env->rrset_cache, ns->name,
                        ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass,
Index: iterator/iter_utils.h
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/iterator/iter_utils.h,v
retrieving revision 1.13
diff -u -p -r1.13 iter_utils.h
--- iterator/iter_utils.h       29 Aug 2022 16:05:00 -0000      1.13
+++ iterator/iter_utils.h       21 Sep 2022 12:41:57 -0000
@@ -62,6 +62,15 @@ struct ub_packed_rrset_key;
 struct module_stack;
 struct outside_network;
 
+/* max number of lookups in the cache for target nameserver names.
+ * This stops, for large delegations, N*N lookups in the cache. */
+#define ITERATOR_NAME_CACHELOOKUP_MAX  3
+/* max number of lookups in the cache for parentside glue for nameserver names
+ * This stops, for larger delegations, N*N lookups in the cache.
+ * It is a little larger than the nonpside max, so it allows a couple extra
+ * lookups of parent side glue. */
+#define ITERATOR_NAME_CACHELOOKUP_MAX_PSIDE    5
+
 /**
  * Process config options and set iterator module state.
  * Sets default values if no config is found.
Index: iterator/iterator.c
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/iterator/iterator.c,v
retrieving revision 1.31
diff -u -p -r1.31 iterator.c
--- iterator/iterator.c 29 Aug 2022 16:05:00 -0000      1.31
+++ iterator/iterator.c 21 Sep 2022 12:41:57 -0000
@@ -1218,6 +1218,15 @@ generate_dnskey_prefetch(struct module_q
                (qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
                return;
        }
+       /* we do not generate this prefetch when the query list is full,
+        * the query is fetched, if needed, when the validator wants it.
+        * At that time the validator waits for it, after spawning it.
+        * This means there is one state that uses cpu and a socket, the
+        * spawned while this one waits, and not several at the same time,
+        * if we had created the lookup here. And this helps to keep
+        * the total load down, but the query still succeeds to resolve. */
+       if(mesh_jostle_exceeded(qstate->env->mesh))
+               return;
 
        /* if the DNSKEY is in the cache this lookup will stop quickly */
        log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 
@@ -1911,6 +1920,14 @@ query_for_targets(struct module_qstate* 
                                return 0;
                        }
                        query_count++;
+                       /* If the mesh query list is full, exit the loop here.
+                        * This makes the routine spawn one query at a time,
+                        * and this means there is no query state load
+                        * increase, because the spawned state uses cpu and a
+                        * socket while this state waits for that spawned
+                        * state. Next time we can look up further targets */
+                       if(mesh_jostle_exceeded(qstate->env->mesh))
+                               break;
                }
                /* Send the A request. */
                if(ie->supports_ipv4 &&
@@ -1925,6 +1942,9 @@ query_for_targets(struct module_qstate* 
                                return 0;
                        }
                        query_count++;
+                       /* If the mesh query list is full, exit the loop. */
+                       if(mesh_jostle_exceeded(qstate->env->mesh))
+                               break;
                }
 
                /* mark this target as in progress. */
@@ -2085,6 +2105,15 @@ processLastResort(struct module_qstate* 
                        }
                        ns->done_pside6 = 1;
                        query_count++;
+                       if(mesh_jostle_exceeded(qstate->env->mesh)) {
+                               /* Wait for the lookup; do not spawn multiple
+                                * lookups at a time. */
+                               verbose(VERB_ALGO, "try parent-side glue 
lookup");
+                               iq->num_target_queries += query_count;
+                               target_count_increase(iq, query_count);
+                               qstate->ext_state[id] = module_wait_subquery;
+                               return 0;
+                       }
                }
                if(ie->supports_ipv4 && !ns->done_pside4) {
                        /* Send the A request. */
@@ -2560,7 +2589,12 @@ processQueryTargets(struct module_qstate
        if(iq->depth < ie->max_dependency_depth
                && iq->num_target_queries == 0
                && (!iq->target_count || iq->target_count[TARGET_COUNT_NX]==0)
-               && iq->sent_count < TARGET_FETCH_STOP) {
+               && iq->sent_count < TARGET_FETCH_STOP
+               /* if the mesh query list is full, then do not waste cpu
+                * and sockets to fetch promiscuous targets. They can be
+                * looked up when needed. */
+               && !mesh_jostle_exceeded(qstate->env->mesh)
+               ) {
                tf_policy = ie->target_fetch_policy[iq->depth];
        }
 
Index: services/mesh.c
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/services/mesh.c,v
retrieving revision 1.23
diff -u -p -r1.23 mesh.c
--- services/mesh.c     29 Aug 2022 16:05:00 -0000      1.23
+++ services/mesh.c     21 Sep 2022 12:41:57 -0000
@@ -2240,3 +2240,10 @@ mesh_serve_expired_callback(void* arg)
                mesh_do_callback(mstate, LDNS_RCODE_NOERROR, msg->rep, c, &tv);
        }
 }
+
+int mesh_jostle_exceeded(struct mesh_area* mesh)
+{
+       if(mesh->all.count < mesh->max_reply_states)
+               return 0;
+       return 1;
+}
Index: services/mesh.h
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/services/mesh.h,v
retrieving revision 1.9
diff -u -p -r1.9 mesh.h
--- services/mesh.h     7 Jun 2022 15:42:53 -0000       1.9
+++ services/mesh.h     21 Sep 2022 12:41:57 -0000
@@ -685,4 +685,15 @@ struct dns_msg*
 mesh_serve_expired_lookup(struct module_qstate* qstate,
        struct query_info* lookup_qinfo);
 
+/**
+ * See if the mesh has space for more queries. You can allocate queries
+ * anyway, but this checks for the allocated space.
+ * @param mesh: mesh area.
+ * @return true if the query list is full.
+ *     It checks the number of all queries, not just number of reply states,
+ *     that have a client address. So that spawned queries count too,
+ *     that were created by the iterator, or other modules.
+ */
+int mesh_jostle_exceeded(struct mesh_area* mesh);
+
 #endif /* SERVICES_MESH_H */
Index: services/cache/dns.c
===================================================================
RCS file: /cvs/src/usr.sbin/unbound/services/cache/dns.c,v
retrieving revision 1.19
diff -u -p -r1.19 dns.c
--- services/cache/dns.c        29 Aug 2022 16:05:00 -0000      1.19
+++ services/cache/dns.c        21 Sep 2022 12:41:57 -0000
@@ -404,6 +404,9 @@ cache_fill_missing(struct module_env* en
        struct ub_packed_rrset_key* akey;
        time_t now = *env->now;
        for(ns = dp->nslist; ns; ns = ns->next) {
+               if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX)
+                       continue;
+               ns->cache_lookup_count++;
                akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
                        ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
                if(akey) {

Reply via email to