c-ares: add option for udp_max_queries

api/envoy/config/core/v3/resolver.proto

@@ -4,6 +4,8 @@ package envoy.config.core.v3;
 
 import "envoy/config/core/v3/address.proto";
 
+import "google/protobuf/wrappers.proto";
+
 import "udpa/annotations/status.proto";
 import "validate/validate.proto";
 
@@ -22,6 +24,10 @@ message DnsResolverOptions {
 
   // Do not use the default search domains; only query hostnames as-is or as aliases.
   bool no_default_search_domain = 2;
+
+  // This option allows for number of UDP based DNS queries to be capped. Note, this
+  // is only applicable to c-ares DNS resolver currently.
+  google.protobuf.UInt32Value udp_max_queries = 3;
 }
 
 // DNS resolution configuration which includes the underlying dns resolver addresses and options.

bazel/repository_locations.bzl

@@ -218,12 +218,12 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         project_name = "c-ares",
         project_desc = "C library for asynchronous DNS requests",
         project_url = "https://c-ares.haxx.se/",
-        version = "1.19.1",
-        sha256 = "321700399b72ed0e037d0074c629e7741f6b2ec2dda92956abe3e9671d3e268e",
+        version = "1.20.0",
+        sha256 = "cde8433e9bf6c6a0d9e7e69947745ee649256d76009d6c23b9555f84c5c13988",
         strip_prefix = "c-ares-{version}",
         urls = ["https://github.com/c-ares/c-ares/releases/download/cares-{underscore_version}/c-ares-{version}.tar.gz"],
         use_category = ["dataplane_core", "controlplane"],
-        release_date = "2023-05-22",
+        release_date = "2023-10-07",
         cpe = "cpe:2.3:a:c-ares_project:c-ares:*",
         license = "c-ares",
         license_url = "https://github.com/c-ares/c-ares/blob/cares-{underscore_version}/LICENSE.md",

changelogs/current.yaml

@@ -512,6 +512,10 @@ new_features:
 - area: rbac
   change: |
     Added additional statistics for rules and shadow rules to the RBAC HTTP filter.
+- area: cares
+  change: |
+    Added :ref:`udp_max_queries<envoy_v3_api_field_config.core.v3.DnsResolverOptions.udp_max_queries>`
+    option to limit the number of UDP queries.
 
 deprecated:
 - area: listener

source/extensions/network/dns_resolver/cares/dns_impl.cc

@@ -1,5 +1,7 @@
 #include "source/extensions/network/dns_resolver/cares/dns_impl.h"
 
+#include <ares.h>
+
 #include <chrono>
 #include <cstdint>
 #include <list>
@@ -92,6 +94,12 @@ DnsResolverImpl::AresOptions DnsResolverImpl::defaultAresOptions() {
     options.options_.flags |= ARES_FLAG_NOSEARCH;
   }
 
+  if (dns_resolver_options_.has_udp_max_queries()) {
+    options.optmask_ |= ARES_OPT_FLAGS;
+    options.options_.flags |= ARES_OPT_UDP_MAX_QUERIES;
+    options.options_.udp_max_queries = dns_resolver_options_.udp_max_queries().value();
+  }
+
   return options;
 }
 
@@ -194,7 +202,7 @@ void DnsResolverImpl::AddrInfoPendingResolution::onAresGetAddrInfoCallback(
     //
     // The channel cannot be destroyed and reinitialized here because that leads to a c-ares
     // segfault.
-    if (status == ARES_ECONNREFUSED) {
+    if (status == ARES_ECONNREFUSED || status == ARES_EREFUSED) {
       parent_.dirty_channel_ = true;
     }
   }

test/extensions/network/dns_resolver/cares/dns_impl_test.cc

@@ -2089,5 +2089,35 @@ TEST_P(DnsImplCustomResolverTest, CustomResolverValidAfterChannelDestruction) {
   EXPECT_FALSE(peer_->isChannelDirty());
 }
 
+class DnsImplAresFlagsForMaxUdpQueriesinTest : public DnsImplTest {
+protected:
+  bool tcpOnly() const override { return false; }
+  void updateDnsResolverOptions() override {
+    auto udp_max_queries = std::make_unique<ProtobufWkt::UInt32Value>();
+    udp_max_queries->set_value(100);
+    dns_resolver_options_.set_allocated_udp_max_queries(
+        dynamic_cast<ProtobufWkt::UInt32Value*>(udp_max_queries.get()));
+  }
+};
+
+// Parameterize the DNS test server socket address.
+INSTANTIATE_TEST_SUITE_P(IpVersions, DnsImplAresFlagsForMaxUdpQueriesinTest,
+                         testing::ValuesIn(TestEnvironment::getIpVersionsForTest()),
+                         TestUtility::ipTestParamsToString);
+
+// Validate that c_ares flag `ARES_OPT_UDP_MAX_QUERIES` is set when UInt32 property
+// `udp_max_queries` is set.
+TEST_P(DnsImplAresFlagsForMaxUdpQueriesinTest, UdpMaxQueriesIsSet) {
+  server_->addCName("root.cname.domain", "result.cname.domain");
+  server_->addHosts("result.cname.domain", {"201.134.56.7"}, RecordType::A);
+  ares_options opts{};
+  int optmask = 0;
+  EXPECT_EQ(ARES_SUCCESS, ares_save_options(peer_->channel(), &opts, &optmask));
+  EXPECT_TRUE((opts.flags & ARES_OPT_UDP_MAX_QUERIES) == ARES_OPT_UDP_MAX_QUERIES);
+  EXPECT_NE(nullptr,
+            resolveWithUnreferencedParameters("root.cname.domain", DnsLookupFamily::Auto, true));
+  ares_destroy_options(&opts);
+}
+
 } // namespace Network
 } // namespace Envoy