blob: a60795945bf0abcb49da16164507612d77785a9d [file] [log] [blame]
Simon Kelleyc47e3ba2014-01-08 17:07:54 +00001/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
Simon Kelley824af852008-02-12 20:43:05 +00005 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
Simon Kelley9e4abcb2004-01-22 19:47:41 +00008 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
Simon Kelley824af852008-02-12 20:43:05 +000012
Simon Kelley73a08a22009-02-05 20:28:08 +000013 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000015*/
16
Simon Kelley9e4abcb2004-01-22 19:47:41 +000017#include "dnsmasq.h"
18
Simon Kelley8a9be9e2014-01-25 23:17:21 +000019static struct frec *lookup_frec(unsigned short id, void *hash);
Simon Kelley9e4abcb2004-01-22 19:47:41 +000020static struct frec *lookup_frec_by_sender(unsigned short id,
Simon Kelleyfd9fa482004-10-21 20:24:00 +010021 union mysockaddr *addr,
Simon Kelley8a9be9e2014-01-25 23:17:21 +000022 void *hash);
23static unsigned short get_id(void);
Simon Kelley1a6bca82008-07-11 11:11:42 +010024static void free_frec(struct frec *f);
25static struct randfd *allocate_rfd(int family);
Simon Kelley9e4abcb2004-01-22 19:47:41 +000026
Simon Kelley00a5b5d2014-02-28 18:10:55 +000027#ifdef HAVE_DNSSEC
28static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
29 int class, char *name, char *keyname, struct server *server, int *keycount);
30static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
31static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
32#endif
33
34
Simon Kelley824af852008-02-12 20:43:05 +000035/* Send a UDP packet with its source address set as "source"
Simon Kelley44a2a312004-03-10 20:04:35 +000036 unless nowild is true, when we just send it with the kernel default */
Simon Kelley29689cf2012-03-22 14:01:00 +000037int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
Simon Kelley50303b12012-04-04 22:13:17 +010039 unsigned int iface)
Simon Kelley9e4abcb2004-01-22 19:47:41 +000040{
Simon Kelley44a2a312004-03-10 20:04:35 +000041 struct msghdr msg;
42 struct iovec iov[1];
Simon Kelley44a2a312004-03-10 20:04:35 +000043 union {
44 struct cmsghdr align; /* this ensures alignment */
Simon Kelley5e9e0ef2006-04-17 14:24:29 +010045#if defined(HAVE_LINUX_NETWORK)
Simon Kelley44a2a312004-03-10 20:04:35 +000046 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47#elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49#endif
50#ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52#endif
53 } control_u;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010054
Simon Kelley44a2a312004-03-10 20:04:35 +000055 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
Simon Kelleyfeba5c12004-07-27 20:28:58 +010058 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
Simon Kelley44a2a312004-03-10 20:04:35 +000060 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010065
Simon Kelley26128d22004-11-14 16:43:54 +000066 if (!nowild)
Simon Kelleyfeba5c12004-07-27 20:28:58 +010067 {
Simon Kelley26128d22004-11-14 16:43:54 +000068 struct cmsghdr *cmptr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010069 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
Simon Kelley26128d22004-11-14 16:43:54 +000071 cmptr = CMSG_FIRSTHDR(&msg);
Simon Kelley44a2a312004-03-10 20:04:35 +000072
Simon Kelley26128d22004-11-14 16:43:54 +000073 if (to->sa.sa_family == AF_INET)
74 {
Simon Kelley5e9e0ef2006-04-17 14:24:29 +010075#if defined(HAVE_LINUX_NETWORK)
Simon Kelley8ef5ada2010-06-03 19:42:45 +010076 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
Simon Kelley26128d22004-11-14 16:43:54 +000080 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
Simon Kelleyc72daea2012-01-05 21:33:27 +000081 cmptr->cmsg_level = IPPROTO_IP;
Simon Kelley26128d22004-11-14 16:43:54 +000082 cmptr->cmsg_type = IP_PKTINFO;
83#elif defined(IP_SENDSRCADDR)
Simon Kelley8ef5ada2010-06-03 19:42:45 +010084 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
Simon Kelley26128d22004-11-14 16:43:54 +000085 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
Simon Kelley44a2a312004-03-10 20:04:35 +000088#endif
Simon Kelley26128d22004-11-14 16:43:54 +000089 }
Simon Kelley26128d22004-11-14 16:43:54 +000090 else
Simon Kelleyb8187c82005-11-26 21:46:27 +000091#ifdef HAVE_IPV6
Simon Kelley26128d22004-11-14 16:43:54 +000092 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +010093 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
Simon Kelley26128d22004-11-14 16:43:54 +000097 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
Simon Kelley316e2732010-01-22 20:16:09 +000098 cmptr->cmsg_type = daemon->v6pktinfo;
Simon Kelleyc72daea2012-01-05 21:33:27 +000099 cmptr->cmsg_level = IPPROTO_IPV6;
Simon Kelley26128d22004-11-14 16:43:54 +0000100 }
Simon Kelley3d8df262005-08-29 12:19:27 +0100101#else
Simon Kelleyc72daea2012-01-05 21:33:27 +0000102 (void)iface; /* eliminate warning */
Simon Kelley26128d22004-11-14 16:43:54 +0000103#endif
104 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100105
Simon Kelley29d28dd2012-12-03 14:05:59 +0000106 while (sendmsg(fd, &msg, 0) == -1)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100107 {
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100108 if (retry_send())
Simon Kelley29d28dd2012-12-03 14:05:59 +0000109 continue;
110
111 /* If interface is still in DAD, EINVAL results - ignore that. */
112 if (errno == EINVAL)
113 break;
Simon Kelley22d904d2012-02-26 20:13:45 +0000114
Simon Kelley50303b12012-04-04 22:13:17 +0100115 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
Simon Kelley29689cf2012-03-22 14:01:00 +0000116 return 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100117 }
Simon Kelley29d28dd2012-12-03 14:05:59 +0000118
Simon Kelley29689cf2012-03-22 14:01:00 +0000119 return 1;
Simon Kelley44a2a312004-03-10 20:04:35 +0000120}
121
Simon Kelley28866e92011-02-14 20:19:14 +0000122static unsigned int search_servers(time_t now, struct all_addr **addrpp,
123 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100124
125{
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
129
130 unsigned int namelen = strlen(qdomain);
131 unsigned int matchlen = 0;
132 struct server *serv;
Simon Kelley28866e92011-02-14 20:19:14 +0000133 unsigned int flags = 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100134
Simon Kelley3be34542004-09-11 19:12:13 +0100135 for (serv = daemon->servers; serv; serv=serv->next)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100136 /* domain matches take priority over NODOTS matches */
Simon Kelley3d8df262005-08-29 12:19:27 +0100137 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100138 {
Simon Kelley28866e92011-02-14 20:19:14 +0000139 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100140 *type = SERV_FOR_NODOTS;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100141 if (serv->flags & SERV_NO_ADDR)
Simon Kelley36717ee2004-09-20 19:20:58 +0100142 flags = F_NXDOMAIN;
143 else if (serv->flags & SERV_LITERAL_ADDRESS)
144 {
145 if (sflag & qtype)
146 {
147 flags = sflag;
148 if (serv->addr.sa.sa_family == AF_INET)
149 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100150#ifdef HAVE_IPV6
Simon Kelley36717ee2004-09-20 19:20:58 +0100151 else
152 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100153#endif
Simon Kelley36717ee2004-09-20 19:20:58 +0100154 }
Simon Kelley824af852008-02-12 20:43:05 +0000155 else if (!flags || (flags & F_NXDOMAIN))
Simon Kelley36717ee2004-09-20 19:20:58 +0100156 flags = F_NOERR;
157 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100158 }
159 else if (serv->flags & SERV_HAS_DOMAIN)
160 {
161 unsigned int domainlen = strlen(serv->domain);
Simon Kelleyb8187c82005-11-26 21:46:27 +0000162 char *matchstart = qdomain + namelen - domainlen;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100163 if (namelen >= domainlen &&
Simon Kelleyb8187c82005-11-26 21:46:27 +0000164 hostname_isequal(matchstart, serv->domain) &&
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100165 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100166 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100167 if (serv->flags & SERV_NO_REBIND)
168 *norebind = 1;
Simon Kelley28866e92011-02-14 20:19:14 +0000169 else
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100170 {
Simon Kelley28866e92011-02-14 20:19:14 +0000171 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen != 0 && domainlen == matchlen)
Simon Kelley36717ee2004-09-20 19:20:58 +0100176 {
Simon Kelley28866e92011-02-14 20:19:14 +0000177 if ((serv->flags & SERV_LITERAL_ADDRESS))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100178 {
Simon Kelley28866e92011-02-14 20:19:14 +0000179 if (!(sflag & qtype) && flags == 0)
180 continue;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100181 }
Simon Kelley28866e92011-02-14 20:19:14 +0000182 else
183 {
184 if (flags & (F_IPV4 | F_IPV6))
185 continue;
186 }
Simon Kelley36717ee2004-09-20 19:20:58 +0100187 }
Simon Kelley28866e92011-02-14 20:19:14 +0000188
189 if (domainlen >= matchlen)
190 {
191 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
192 *domain = serv->domain;
193 matchlen = domainlen;
194 if (serv->flags & SERV_NO_ADDR)
195 flags = F_NXDOMAIN;
196 else if (serv->flags & SERV_LITERAL_ADDRESS)
197 {
198 if (sflag & qtype)
199 {
200 flags = sflag;
201 if (serv->addr.sa.sa_family == AF_INET)
202 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
203#ifdef HAVE_IPV6
204 else
205 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
206#endif
207 }
208 else if (!flags || (flags & F_NXDOMAIN))
209 flags = F_NOERR;
210 }
211 else
212 flags = 0;
213 }
214 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100215 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100216 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100217
Simon Kelley7de060b2011-08-26 17:24:52 +0100218 if (flags == 0 && !(qtype & F_QUERY) &&
Simon Kelley28866e92011-02-14 20:19:14 +0000219 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
Simon Kelley7de060b2011-08-26 17:24:52 +0100220 /* don't forward A or AAAA queries for simple names, except the empty name */
221 flags = F_NOERR;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100222
Simon Kelley5aabfc72007-08-29 11:24:47 +0100223 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
Simon Kelleyc1bb8502004-08-11 18:40:17 +0100224 flags = F_NOERR;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100225
Simon Kelley824af852008-02-12 20:43:05 +0000226 if (flags)
227 {
228 int logflags = 0;
229
230 if (flags == F_NXDOMAIN || flags == F_NOERR)
231 logflags = F_NEG | qtype;
232
Simon Kelley1a6bca82008-07-11 11:11:42 +0100233 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
Simon Kelley824af852008-02-12 20:43:05 +0000234 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100235 else if ((*type) & SERV_USE_RESOLV)
236 {
237 *type = 0; /* use normal servers for this domain */
238 *domain = NULL;
239 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100240 return flags;
241}
Simon Kelley44a2a312004-03-10 20:04:35 +0000242
Simon Kelley824af852008-02-12 20:43:05 +0000243static int forward_query(int udpfd, union mysockaddr *udpaddr,
244 struct all_addr *dst_addr, unsigned int dst_iface,
Simon Kelley83349b82014-02-10 21:02:01 +0000245 struct dns_header *header, size_t plen, time_t now,
Simon Kelley613ad152014-02-25 23:02:28 +0000246 struct frec *forward, int ad_reqd, int do_bit)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000247{
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000248 char *domain = NULL;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100249 int type = 0, norebind = 0;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000250 struct all_addr *addrp = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +0000251 unsigned int flags = 0;
Simon Kelleyde379512004-06-22 20:23:33 +0100252 struct server *start = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000253#ifdef HAVE_DNSSEC
254 void *hash = hash_questions(header, plen, daemon->namebuff);
255#else
256 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
257 void *hash = &crc;
258#endif
259 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
260
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000261 (void)do_bit;
262
Simon Kelley3d8df262005-08-29 12:19:27 +0100263 /* may be no servers available. */
264 if (!daemon->servers)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000265 forward = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000266 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000267 {
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000268#ifdef HAVE_DNSSEC
Simon Kelleydac74312014-02-13 16:43:49 +0000269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000270 there's no point retrying the query, retry the key query instead...... */
271 if (forward->blocking_query)
272 {
273 int fd;
274
275 while (forward->blocking_query)
276 forward = forward->blocking_query;
277
278 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
279 plen = forward->stash_len;
280
Simon Kelley2b291912014-03-21 11:13:55 +0000281 if (forward->sentto->addr.sa.sa_family == AF_INET)
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000282 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
283#ifdef HAVE_IPV6
284 else
285 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
286#endif
287
288 if (forward->sentto->sfd)
289 fd = forward->sentto->sfd->fd;
290 else
291 {
292#ifdef HAVE_IPV6
293 if (forward->sentto->addr.sa.sa_family == AF_INET6)
294 fd = forward->rfd6->fd;
295 else
296#endif
297 fd = forward->rfd4->fd;
298 }
299
300 while (sendto(fd, (char *)header, plen, 0,
301 &forward->sentto->addr.sa,
Simon Kelley2b291912014-03-21 11:13:55 +0000302 sa_len(&forward->sentto->addr)) == -1 && retry_send());
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000303
304 return 1;
305 }
306#endif
307
Simon Kelleyde379512004-06-22 20:23:33 +0100308 /* retry on existing query, send to all available servers */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000309 domain = forward->sentto->domain;
Simon Kelley824af852008-02-12 20:43:05 +0000310 forward->sentto->failed_queries++;
Simon Kelley28866e92011-02-14 20:19:14 +0000311 if (!option_bool(OPT_ORDER))
Simon Kelleyde379512004-06-22 20:23:33 +0100312 {
Simon Kelley0a852542005-03-23 20:28:59 +0000313 forward->forwardall = 1;
Simon Kelley3be34542004-09-11 19:12:13 +0100314 daemon->last_server = NULL;
Simon Kelleyde379512004-06-22 20:23:33 +0100315 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000316 type = forward->sentto->flags & SERV_TYPE;
Simon Kelleyde379512004-06-22 20:23:33 +0100317 if (!(start = forward->sentto->next))
Simon Kelley3be34542004-09-11 19:12:13 +0100318 start = daemon->servers; /* at end of list, recycle */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000319 header->id = htons(forward->new_id);
320 }
321 else
322 {
323 if (gotname)
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100324 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000325
Simon Kelley3a237152013-12-12 12:15:50 +0000326 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100327 /* table full - server failure. */
328 flags = F_NEG;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000329
330 if (forward)
331 {
Simon Kelley0a852542005-03-23 20:28:59 +0000332 forward->source = *udpaddr;
333 forward->dest = *dst_addr;
334 forward->iface = dst_iface;
Simon Kelley0a852542005-03-23 20:28:59 +0000335 forward->orig_id = ntohs(header->id);
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000336 forward->new_id = get_id();
Simon Kelley832af0b2007-01-21 20:01:28 +0000337 forward->fd = udpfd;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000338 memcpy(forward->hash, hash, HASH_SIZE);
Simon Kelley0a852542005-03-23 20:28:59 +0000339 forward->forwardall = 0;
Simon Kelleyed4c0762013-10-08 20:46:34 +0100340 forward->flags = 0;
Simon Kelley28866e92011-02-14 20:19:14 +0000341 if (norebind)
342 forward->flags |= FREC_NOREBIND;
Simon Kelley572b41e2011-02-18 18:11:18 +0000343 if (header->hb4 & HB4_CD)
Simon Kelley28866e92011-02-14 20:19:14 +0000344 forward->flags |= FREC_CHECKING_DISABLED;
Simon Kelley83349b82014-02-10 21:02:01 +0000345 if (ad_reqd)
346 forward->flags |= FREC_AD_QUESTION;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000347#ifdef HAVE_DNSSEC
348 forward->work_counter = DNSSEC_WORK;
Simon Kelley613ad152014-02-25 23:02:28 +0000349 if (do_bit)
350 forward->flags |= FREC_DO_QUESTION;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000351#endif
Simon Kelley613ad152014-02-25 23:02:28 +0000352
Simon Kelley28866e92011-02-14 20:19:14 +0000353 header->id = htons(forward->new_id);
354
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000358 otherwise, use the one last known to work. */
359
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100360 if (type == 0)
361 {
Simon Kelley28866e92011-02-14 20:19:14 +0000362 if (option_bool(OPT_ORDER))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100363 start = daemon->servers;
364 else if (!(start = daemon->last_server) ||
365 daemon->forwardcount++ > FORWARD_TEST ||
366 difftime(now, daemon->forwardtime) > FORWARD_TIME)
367 {
368 start = daemon->servers;
369 forward->forwardall = 1;
370 daemon->forwardcount = 0;
371 daemon->forwardtime = now;
372 }
373 }
374 else
Simon Kelleyde379512004-06-22 20:23:33 +0100375 {
Simon Kelley3be34542004-09-11 19:12:13 +0100376 start = daemon->servers;
Simon Kelley28866e92011-02-14 20:19:14 +0000377 if (!option_bool(OPT_ORDER))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100378 forward->forwardall = 1;
Simon Kelleyde379512004-06-22 20:23:33 +0100379 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000380 }
381 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100382
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
386
387 if (!flags && forward)
388 {
Simon Kelleyde379512004-06-22 20:23:33 +0100389 struct server *firstsentto = start;
390 int forwarded = 0;
Simon Kelley28866e92011-02-14 20:19:14 +0000391
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100392 if (option_bool(OPT_ADD_MAC))
Simon Kelley60b68062014-01-08 12:10:28 +0000393 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
Simon Kelley28866e92011-02-14 20:19:14 +0000394
Simon Kelleyed4c0762013-10-08 20:46:34 +0100395 if (option_bool(OPT_CLIENT_SUBNET))
396 {
Simon Kelley60b68062014-01-08 12:10:28 +0000397 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
Simon Kelleyed4c0762013-10-08 20:46:34 +0100398 if (new != plen)
399 {
400 plen = new;
401 forward->flags |= FREC_HAS_SUBNET;
402 }
403 }
404
Simon Kelley3a237152013-12-12 12:15:50 +0000405#ifdef HAVE_DNSSEC
406 if (option_bool(OPT_DNSSEC_VALID))
Simon Kelley0fc2f312014-01-08 10:26:58 +0000407 {
Simon Kelley613ad152014-02-25 23:02:28 +0000408 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
409
Simon Kelley5b3bf922014-01-25 17:03:07 +0000410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG))
413 header->hb4 |= HB4_CD;
Simon Kelley613ad152014-02-25 23:02:28 +0000414
415 if (new_plen != plen)
416 forward->flags |= FREC_ADDED_PHEADER;
417
418 plen = new_plen;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000419 }
Simon Kelley3a237152013-12-12 12:15:50 +0000420#endif
421
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000422 while (1)
423 {
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
427
Simon Kelleyde379512004-06-22 20:23:33 +0100428 if (type == (start->flags & SERV_TYPE) &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100429 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
430 !(start->flags & SERV_LITERAL_ADDRESS))
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000431 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100432 int fd;
433
434 /* find server socket to use, may need to get random one. */
435 if (start->sfd)
436 fd = start->sfd->fd;
437 else
438 {
439#ifdef HAVE_IPV6
440 if (start->addr.sa.sa_family == AF_INET6)
441 {
442 if (!forward->rfd6 &&
443 !(forward->rfd6 = allocate_rfd(AF_INET6)))
444 break;
Simon Kelley3927da42008-07-20 15:10:39 +0100445 daemon->rfd_save = forward->rfd6;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100446 fd = forward->rfd6->fd;
447 }
448 else
449#endif
450 {
451 if (!forward->rfd4 &&
452 !(forward->rfd4 = allocate_rfd(AF_INET)))
453 break;
Simon Kelley3927da42008-07-20 15:10:39 +0100454 daemon->rfd_save = forward->rfd4;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100455 fd = forward->rfd4->fd;
456 }
Simon Kelley7de060b2011-08-26 17:24:52 +0100457
458#ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK))
461 {
462 unsigned int mark;
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100463 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
Simon Kelley7de060b2011-08-26 17:24:52 +0100464 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
465 }
466#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +0100467 }
468
469 if (sendto(fd, (char *)header, plen, 0,
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100470 &start->addr.sa,
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100471 sa_len(&start->addr)) == -1)
472 {
473 if (retry_send())
474 continue;
475 }
476 else
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000477 {
Simon Kelleycdeda282006-03-16 20:16:06 +0000478 /* Keep info in case we want to re-send this packet */
479 daemon->srv_save = start;
480 daemon->packet_len = plen;
481
Simon Kelleyde379512004-06-22 20:23:33 +0100482 if (!gotname)
Simon Kelley3be34542004-09-11 19:12:13 +0100483 strcpy(daemon->namebuff, "query");
Simon Kelleyde379512004-06-22 20:23:33 +0100484 if (start->addr.sa.sa_family == AF_INET)
Simon Kelley3be34542004-09-11 19:12:13 +0100485 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +0100486 (struct all_addr *)&start->addr.in.sin_addr, NULL);
Simon Kelleyde379512004-06-22 20:23:33 +0100487#ifdef HAVE_IPV6
488 else
Simon Kelley3be34542004-09-11 19:12:13 +0100489 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +0100490 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
Simon Kelleyde379512004-06-22 20:23:33 +0100491#endif
Simon Kelley824af852008-02-12 20:43:05 +0000492 start->queries++;
Simon Kelleyde379512004-06-22 20:23:33 +0100493 forwarded = 1;
494 forward->sentto = start;
Simon Kelley0a852542005-03-23 20:28:59 +0000495 if (!forward->forwardall)
Simon Kelleyde379512004-06-22 20:23:33 +0100496 break;
Simon Kelley0a852542005-03-23 20:28:59 +0000497 forward->forwardall++;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000498 }
499 }
500
Simon Kelleyde379512004-06-22 20:23:33 +0100501 if (!(start = start->next))
Simon Kelley3be34542004-09-11 19:12:13 +0100502 start = daemon->servers;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000503
Simon Kelleyde379512004-06-22 20:23:33 +0100504 if (start == firstsentto)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000505 break;
506 }
507
Simon Kelleyde379512004-06-22 20:23:33 +0100508 if (forwarded)
Simon Kelley824af852008-02-12 20:43:05 +0000509 return 1;
Simon Kelleyde379512004-06-22 20:23:33 +0100510
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000511 /* could not send on, prepare to return */
512 header->id = htons(forward->orig_id);
Simon Kelley1a6bca82008-07-11 11:11:42 +0100513 free_frec(forward); /* cancel */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000514 }
515
516 /* could not send on, return empty answer or address if known for whole domain */
Simon Kelleyb8187c82005-11-26 21:46:27 +0000517 if (udpfd != -1)
518 {
Simon Kelleycdeda282006-03-16 20:16:06 +0000519 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
Simon Kelley54dd3932012-06-20 11:23:38 +0100520 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
Simon Kelleyb8187c82005-11-26 21:46:27 +0000521 }
522
Simon Kelley824af852008-02-12 20:43:05 +0000523 return 0;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000524}
525
Simon Kelleyed4c0762013-10-08 20:46:34 +0100526static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
Simon Kelley613ad152014-02-25 23:02:28 +0000527 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100528{
Simon Kelley36717ee2004-09-20 19:20:58 +0100529 unsigned char *pheader, *sizep;
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000530 char **sets = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +0000531 int munged = 0, is_sign;
Simon Kelleycdeda282006-03-16 20:16:06 +0000532 size_t plen;
533
Simon Kelley83349b82014-02-10 21:02:01 +0000534 (void)ad_reqd;
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000535 (void) do_bit;
Simon Kelley83349b82014-02-10 21:02:01 +0000536
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000537#ifdef HAVE_IPSET
538 /* Similar algorithm to search_servers. */
539 struct ipsets *ipset_pos;
540 unsigned int namelen = strlen(daemon->namebuff);
541 unsigned int matchlen = 0;
542 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
543 {
544 unsigned int domainlen = strlen(ipset_pos->domain);
545 char *matchstart = daemon->namebuff + namelen - domainlen;
546 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
547 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
Simon Kelley6c0cb852014-01-17 14:40:46 +0000548 domainlen >= matchlen)
549 {
550 matchlen = domainlen;
551 sets = ipset_pos->sets;
552 }
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000553 }
554#endif
555
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100556 /* If upstream is advertising a larger UDP packet size
Simon Kelley9009d742008-11-14 20:04:27 +0000557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100559
Simon Kelleyed4c0762013-10-08 20:46:34 +0100560 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100561 {
Simon Kelley83349b82014-02-10 21:02:01 +0000562 unsigned short udpsz;
563 unsigned char *psave = sizep;
564
565 GETSHORT(udpsz, sizep);
566
567 if (!is_sign && udpsz > daemon->edns_pktsz)
568 PUTSHORT(daemon->edns_pktsz, psave);
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100569
Simon Kelleyed4c0762013-10-08 20:46:34 +0100570 if (check_subnet && !check_source(header, plen, pheader, query_source))
571 {
572 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
573 return 0;
574 }
Simon Kelley613ad152014-02-25 23:02:28 +0000575
576 if (added_pheader)
577 {
578 pheader = 0;
579 header->arcount = htons(0);
580 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100581 }
Simon Kelley83349b82014-02-10 21:02:01 +0000582
Simon Kelley28866e92011-02-14 20:19:14 +0000583 /* RFC 4035 sect 4.6 para 3 */
Giovanni Bajo237724c2012-04-05 02:46:52 +0200584 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
Simon Kelley795501b2014-01-08 18:11:55 +0000585 header->hb4 &= ~HB4_AD;
Simon Kelley3a237152013-12-12 12:15:50 +0000586
Simon Kelley572b41e2011-02-18 18:11:18 +0000587 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
Simon Kelley36717ee2004-09-20 19:20:58 +0100588 return n;
589
Simon Kelley0a852542005-03-23 20:28:59 +0000590 /* Complain loudly if the upstream server is non-recursive. */
Simon Kelley572b41e2011-02-18 18:11:18 +0000591 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
Simon Kelley0a852542005-03-23 20:28:59 +0000592 server && !(server->flags & SERV_WARNED_RECURSIVE))
593 {
Simon Kelley3d8df262005-08-29 12:19:27 +0100594 prettyprint_addr(&server->addr, daemon->namebuff);
Simon Kelleyf2621c72007-04-29 19:47:21 +0100595 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
Simon Kelley28866e92011-02-14 20:19:14 +0000596 if (!option_bool(OPT_LOG))
Simon Kelley0a852542005-03-23 20:28:59 +0000597 server->flags |= SERV_WARNED_RECURSIVE;
598 }
Giovanni Bajoe292e932012-04-22 14:32:02 +0200599
Simon Kelley572b41e2011-02-18 18:11:18 +0000600 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100601 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100602 {
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100603 munged = 1;
Simon Kelley572b41e2011-02-18 18:11:18 +0000604 SET_RCODE(header, NXDOMAIN);
605 header->hb3 &= ~HB3_AA;
Simon Kelley6938f342014-01-26 22:47:39 +0000606 cache_secure = 0;
Simon Kelley36717ee2004-09-20 19:20:58 +0100607 }
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100608 else
Simon Kelley36717ee2004-09-20 19:20:58 +0100609 {
Simon Kelley6938f342014-01-26 22:47:39 +0000610 int doctored = 0;
611
Simon Kelley572b41e2011-02-18 18:11:18 +0000612 if (RCODE(header) == NXDOMAIN &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100613 extract_request(header, n, daemon->namebuff, NULL) &&
Simon Kelley5aabfc72007-08-29 11:24:47 +0100614 check_for_local_domain(daemon->namebuff, now))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100615 {
Simon Kelley36717ee2004-09-20 19:20:58 +0100616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100619 munged = 1;
Simon Kelley572b41e2011-02-18 18:11:18 +0000620 header->hb3 |= HB3_AA;
621 SET_RCODE(header, NOERROR);
Simon Kelley6938f342014-01-26 22:47:39 +0000622 cache_secure = 0;
Simon Kelley36717ee2004-09-20 19:20:58 +0100623 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000624
Simon Kelley6938f342014-01-26 22:47:39 +0000625 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
Simon Kelley824af852008-02-12 20:43:05 +0000626 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100627 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
Simon Kelley824af852008-02-12 20:43:05 +0000628 munged = 1;
Simon Kelley6938f342014-01-26 22:47:39 +0000629 cache_secure = 0;
Simon Kelley824af852008-02-12 20:43:05 +0000630 }
Simon Kelley6938f342014-01-26 22:47:39 +0000631
632 if (doctored)
633 cache_secure = 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100634 }
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100635
Simon Kelleya25720a2014-01-14 23:13:55 +0000636#ifdef HAVE_DNSSEC
637 if (no_cache && !(header->hb4 & HB4_CD))
638 {
Simon Kelley7d23a662014-01-26 09:33:21 +0000639 if (!option_bool(OPT_DNSSEC_DEBUG))
Simon Kelleya25720a2014-01-14 23:13:55 +0000640 {
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header, SERVFAIL);
643 munged = 1;
644 }
645 }
Simon Kelley6938f342014-01-26 22:47:39 +0000646
647 if (option_bool(OPT_DNSSEC_VALID))
648 header->hb4 &= ~HB4_AD;
649
Simon Kelley83349b82014-02-10 21:02:01 +0000650 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
Simon Kelley6938f342014-01-26 22:47:39 +0000651 header->hb4 |= HB4_AD;
Simon Kelley613ad152014-02-25 23:02:28 +0000652
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
654 if (!do_bit)
655 n = filter_rrsigs(header, n);
Simon Kelleya25720a2014-01-14 23:13:55 +0000656#endif
657
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100658 /* do this after extract_addresses. Ensure NODATA reply and remove
659 nameserver info. */
660
661 if (munged)
662 {
663 header->ancount = htons(0);
664 header->nscount = htons(0);
665 header->arcount = htons(0);
666 }
667
Simon Kelley36717ee2004-09-20 19:20:58 +0100668 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
669 sections of the packet. Find the new length here and put back pseudoheader
670 if it was removed. */
671 return resize_packet(header, n, pheader, plen);
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100672}
673
Simon Kelley3be34542004-09-11 19:12:13 +0100674/* sets new last_server */
Simon Kelley1a6bca82008-07-11 11:11:42 +0100675void reply_query(int fd, int family, time_t now)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000676{
677 /* packet from peer server, extract data for cache, and send to
678 original requester */
Simon Kelley572b41e2011-02-18 18:11:18 +0000679 struct dns_header *header;
Simon Kelleyde379512004-06-22 20:23:33 +0100680 union mysockaddr serveraddr;
Simon Kelley832af0b2007-01-21 20:01:28 +0000681 struct frec *forward;
Simon Kelleyde379512004-06-22 20:23:33 +0100682 socklen_t addrlen = sizeof(serveraddr);
Simon Kelley60b68062014-01-08 12:10:28 +0000683 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
Simon Kelleycdeda282006-03-16 20:16:06 +0000684 size_t nn;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100685 struct server *server;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000686 void *hash;
687#ifndef HAVE_DNSSEC
688 unsigned int crc;
689#endif
690
Simon Kelleycdeda282006-03-16 20:16:06 +0000691 /* packet buffer overwritten */
692 daemon->srv_save = NULL;
Simon Kelley832af0b2007-01-21 20:01:28 +0000693
Simon Kelleyde379512004-06-22 20:23:33 +0100694 /* Determine the address of the server replying so that we can mark that as good */
Simon Kelley1a6bca82008-07-11 11:11:42 +0100695 serveraddr.sa.sa_family = family;
Simon Kelleyde379512004-06-22 20:23:33 +0100696#ifdef HAVE_IPV6
697 if (serveraddr.sa.sa_family == AF_INET6)
Simon Kelley5e9e0ef2006-04-17 14:24:29 +0100698 serveraddr.in6.sin6_flowinfo = 0;
Simon Kelleyde379512004-06-22 20:23:33 +0100699#endif
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000700
Simon Kelley490f9072014-03-24 22:04:42 +0000701 header = (struct dns_header *)daemon->packet;
702
703 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
704 return;
705
Simon Kelley1a6bca82008-07-11 11:11:42 +0100706 /* spoof check: answer must come from known server, */
707 for (server = daemon->servers; server; server = server->next)
708 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
709 sockaddr_isequal(&server->addr, &serveraddr))
710 break;
Simon Kelley490f9072014-03-24 22:04:42 +0000711
712 if (!server)
713 return;
714
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000715#ifdef HAVE_DNSSEC
716 hash = hash_questions(header, n, daemon->namebuff);
717#else
718 hash = &crc;
719 crc = questions_crc(header, n, daemon->namebuff);
720#endif
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100721
Simon Kelley490f9072014-03-24 22:04:42 +0000722 if (!(forward = lookup_frec(ntohs(header->id), hash)))
Simon Kelley1a6bca82008-07-11 11:11:42 +0100723 return;
Simon Kelley490f9072014-03-24 22:04:42 +0000724
Simon Kelley572b41e2011-02-18 18:11:18 +0000725 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
Simon Kelley28866e92011-02-14 20:19:14 +0000726 !option_bool(OPT_ORDER) &&
Simon Kelley1a6bca82008-07-11 11:11:42 +0100727 forward->forwardall == 0)
728 /* for broken servers, attempt to send to another one. */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000729 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100730 unsigned char *pheader;
731 size_t plen;
732 int is_sign;
Simon Kelley832af0b2007-01-21 20:01:28 +0000733
Simon Kelley1a6bca82008-07-11 11:11:42 +0100734 /* recreate query from reply */
735 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
736 if (!is_sign)
Simon Kelley832af0b2007-01-21 20:01:28 +0000737 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100738 header->ancount = htons(0);
739 header->nscount = htons(0);
740 header->arcount = htons(0);
741 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
742 {
Simon Kelley572b41e2011-02-18 18:11:18 +0000743 header->hb3 &= ~(HB3_QR | HB3_TC);
Simon Kelley613ad152014-02-25 23:02:28 +0000744 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
Simon Kelley1a6bca82008-07-11 11:11:42 +0100745 return;
746 }
747 }
748 }
Simon Kelley3a237152013-12-12 12:15:50 +0000749
750 server = forward->sentto;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100751
752 if ((forward->sentto->flags & SERV_TYPE) == 0)
753 {
Simon Kelley572b41e2011-02-18 18:11:18 +0000754 if (RCODE(header) == SERVFAIL || RCODE(header) == REFUSED)
Simon Kelley1a6bca82008-07-11 11:11:42 +0100755 server = NULL;
756 else
757 {
758 struct server *last_server;
Simon Kelley832af0b2007-01-21 20:01:28 +0000759
Simon Kelley1a6bca82008-07-11 11:11:42 +0100760 /* find good server by address if possible, otherwise assume the last one we sent to */
761 for (last_server = daemon->servers; last_server; last_server = last_server->next)
762 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
763 sockaddr_isequal(&last_server->addr, &serveraddr))
764 {
765 server = last_server;
766 break;
767 }
768 }
Simon Kelley28866e92011-02-14 20:19:14 +0000769 if (!option_bool(OPT_ALL_SERVERS))
Simon Kelley1a6bca82008-07-11 11:11:42 +0100770 daemon->last_server = server;
771 }
Simon Kelley3a237152013-12-12 12:15:50 +0000772
Simon Kelley1a6bca82008-07-11 11:11:42 +0100773 /* If the answer is an error, keep the forward record in place in case
774 we get a good reply from another server. Kill it when we've
775 had replies from all to avoid filling the forwarding table when
776 everything is broken */
777 if (forward->forwardall == 0 || --forward->forwardall == 1 ||
Simon Kelley572b41e2011-02-18 18:11:18 +0000778 (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL))
Simon Kelley1a6bca82008-07-11 11:11:42 +0100779 {
Simon Kelley3a237152013-12-12 12:15:50 +0000780 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100781
Simon Kelley3a237152013-12-12 12:15:50 +0000782 if (option_bool(OPT_NO_REBIND))
783 check_rebind = !(forward->flags & FREC_NOREBIND);
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100784
Simon Kelley3a237152013-12-12 12:15:50 +0000785 /* Don't cache replies where DNSSEC validation was turned off, either
786 the upstream server told us so, or the original query specified it. */
787 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
788 no_cache_dnssec = 1;
789
790#ifdef HAVE_DNSSEC
791 if (option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
792 {
Simon Kelley9d633042013-12-13 15:36:55 +0000793 int status;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000794
795 /* We've had a reply already, which we're validating. Ignore this duplicate */
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000796 if (forward->blocking_query)
Simon Kelley0fc2f312014-01-08 10:26:58 +0000797 return;
Simon Kelley9d633042013-12-13 15:36:55 +0000798
Simon Kelley871417d2014-01-08 11:22:32 +0000799 if (header->hb3 & HB3_TC)
800 {
801 /* Truncated answer can't be validated.
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000802 If this is an answer to a DNSSEC-generated query, we still
803 need to get the client to retry over TCP, so return
804 an answer with the TC bit set, even if the actual answer fits.
805 */
806 status = STAT_TRUNCATED;
Simon Kelley871417d2014-01-08 11:22:32 +0000807 }
808 else if (forward->flags & FREC_DNSKEY_QUERY)
Simon Kelley8d718cb2014-02-03 16:27:37 +0000809 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelleyc3e0b9b2013-12-31 13:50:39 +0000810 else if (forward->flags & FREC_DS_QUERY)
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000811 {
812 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
813 if (status == STAT_NO_DS)
814 status = STAT_INSECURE;
815 }
816 else if (forward->flags & FREC_CHECK_NOSIGN)
817 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelley9d633042013-12-13 15:36:55 +0000818 else
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000819 {
820 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
821 if (status == STAT_NO_SIG)
822 {
823 if (option_bool(OPT_DNSSEC_NO_SIGN))
824 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
825 else
826 status = STAT_INSECURE;
827 }
828 }
Simon Kelley3a237152013-12-12 12:15:50 +0000829 /* Can't validate, as we're missing key data. Put this
830 answer aside, whilst we get that. */
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000831 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
Simon Kelley3a237152013-12-12 12:15:50 +0000832 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000833 struct frec *new, *orig;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000834
Simon Kelley7fa836e2014-02-10 20:11:24 +0000835 /* Free any saved query */
836 if (forward->stash)
837 blockdata_free(forward->stash);
838
839 /* Now save reply pending receipt of key data */
840 if (!(forward->stash = blockdata_alloc((char *)header, n)))
841 return;
842 forward->stash_len = n;
843
844 anotherkey:
845 /* Find the original query that started it all.... */
846 for (orig = forward; orig->dependent; orig = orig->dependent);
847
848 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
849 status = STAT_INSECURE;
850 else
Simon Kelley3a237152013-12-12 12:15:50 +0000851 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000852 int fd;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000853 struct frec *next = new->next;
854 *new = *forward; /* copy everything, then overwrite */
855 new->next = next;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000856 new->blocking_query = NULL;
Simon Kelleyf1668d22014-01-08 16:53:27 +0000857 new->rfd4 = NULL;
858#ifdef HAVE_IPV6
859 new->rfd6 = NULL;
860#endif
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000861 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
Simon Kelley9d633042013-12-13 15:36:55 +0000862
Simon Kelley7fa836e2014-02-10 20:11:24 +0000863 new->dependent = forward; /* to find query awaiting new one. */
864 forward->blocking_query = new; /* for garbage cleaning */
865 /* validate routines leave name of required record in daemon->keyname */
866 if (status == STAT_NEED_KEY)
867 {
868 new->flags |= FREC_DNSKEY_QUERY;
869 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
870 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
871 }
872 else
873 {
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000874 if (status == STAT_NEED_DS_NEG)
875 new->flags |= FREC_CHECK_NOSIGN;
876 else
877 new->flags |= FREC_DS_QUERY;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000878 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
879 daemon->keyname, forward->class, T_DS, &server->addr);
880 }
881 if ((hash = hash_questions(header, nn, daemon->namebuff)))
882 memcpy(new->hash, hash, HASH_SIZE);
883 new->new_id = get_id();
884 header->id = htons(new->new_id);
885 /* Save query for retransmission */
886 new->stash = blockdata_alloc((char *)header, nn);
887 new->stash_len = nn;
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000888
Simon Kelley7fa836e2014-02-10 20:11:24 +0000889 /* Don't resend this. */
890 daemon->srv_save = NULL;
891
892 if (server->sfd)
893 fd = server->sfd->fd;
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000894 else
Simon Kelley3a237152013-12-12 12:15:50 +0000895 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000896 fd = -1;
Simon Kelley3a237152013-12-12 12:15:50 +0000897#ifdef HAVE_IPV6
Simon Kelley7fa836e2014-02-10 20:11:24 +0000898 if (server->addr.sa.sa_family == AF_INET6)
Simon Kelleyf1668d22014-01-08 16:53:27 +0000899 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000900 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
901 fd = new->rfd6->fd;
902 }
903 else
904#endif
905 {
906 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
907 fd = new->rfd4->fd;
Simon Kelleyf1668d22014-01-08 16:53:27 +0000908 }
Simon Kelley3a237152013-12-12 12:15:50 +0000909 }
Simon Kelley7fa836e2014-02-10 20:11:24 +0000910
911 if (fd != -1)
912 {
913 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
914 server->queries++;
915 }
916
917 return;
Simon Kelley3a237152013-12-12 12:15:50 +0000918 }
Simon Kelley3a237152013-12-12 12:15:50 +0000919 }
920
921 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
922 Now wind back down, pulling back answers which wouldn't previously validate
Simon Kelley7fa836e2014-02-10 20:11:24 +0000923 and validate them with the new data. Note that if an answer needs multiple
924 keys to validate, we may find another key is needed, in which case we set off
925 down another branch of the tree. Once we get to the original answer
926 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
Simon Kelley0744ca62014-01-25 16:40:15 +0000927 while (forward->dependent)
Simon Kelley3a237152013-12-12 12:15:50 +0000928 {
Simon Kelley0744ca62014-01-25 16:40:15 +0000929 struct frec *prev = forward->dependent;
930 free_frec(forward);
931 forward = prev;
932 forward->blocking_query = NULL; /* already gone */
933 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
934 n = forward->stash_len;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000935
Simon Kelley0fc2f312014-01-08 10:26:58 +0000936 if (status == STAT_SECURE)
Simon Kelley0fc2f312014-01-08 10:26:58 +0000937 {
Simon Kelley0744ca62014-01-25 16:40:15 +0000938 if (forward->flags & FREC_DNSKEY_QUERY)
939 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
940 else if (forward->flags & FREC_DS_QUERY)
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000941 {
942 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
943 if (status == STAT_NO_DS)
944 status = STAT_INSECURE;
945 }
946 else if (forward->flags & FREC_CHECK_NOSIGN)
947 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelley0744ca62014-01-25 16:40:15 +0000948 else
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000949 {
950 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
951 if (status == STAT_NO_SIG)
952 {
953 if (option_bool(OPT_DNSSEC_NO_SIGN))
954 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
955 else
956 status = STAT_INSECURE;
957 }
958 }
959
960 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
Simon Kelley7fa836e2014-02-10 20:11:24 +0000961 goto anotherkey;
Simon Kelley3a237152013-12-12 12:15:50 +0000962 }
963 }
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000964
965 if (status == STAT_TRUNCATED)
Simon Kelley0744ca62014-01-25 16:40:15 +0000966 header->hb3 |= HB3_TC;
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000967 else
Simon Kelley7fa836e2014-02-10 20:11:24 +0000968 {
969 char *result;
970
971 if (forward->work_counter == 0)
972 result = "ABANDONED";
973 else
974 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
975
976 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
977 }
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000978
Simon Kelley0fc2f312014-01-08 10:26:58 +0000979 no_cache_dnssec = 0;
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000980
Simon Kelley3a237152013-12-12 12:15:50 +0000981 if (status == STAT_SECURE)
982 cache_secure = 1;
Simon Kelley3a237152013-12-12 12:15:50 +0000983 else if (status == STAT_BOGUS)
984 no_cache_dnssec = 1;
985 }
Simon Kelley83349b82014-02-10 21:02:01 +0000986#endif
987
988 /* restore CD bit to the value in the query */
989 if (forward->flags & FREC_CHECKING_DISABLED)
990 header->hb4 |= HB4_CD;
991 else
992 header->hb4 &= ~HB4_CD;
Simon Kelley3a237152013-12-12 12:15:50 +0000993
994 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
Simon Kelley613ad152014-02-25 23:02:28 +0000995 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
996 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
Simon Kelley832af0b2007-01-21 20:01:28 +0000997 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100998 header->id = htons(forward->orig_id);
Simon Kelley572b41e2011-02-18 18:11:18 +0000999 header->hb4 |= HB4_RA; /* recursion if available */
Simon Kelley54dd3932012-06-20 11:23:38 +01001000 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
Simon Kelley50303b12012-04-04 22:13:17 +01001001 &forward->source, &forward->dest, forward->iface);
Simon Kelley832af0b2007-01-21 20:01:28 +00001002 }
Simon Kelley1a6bca82008-07-11 11:11:42 +01001003 free_frec(forward); /* cancel */
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001004 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001005}
Simon Kelley44a2a312004-03-10 20:04:35 +00001006
Simon Kelley1a6bca82008-07-11 11:11:42 +01001007
Simon Kelley5aabfc72007-08-29 11:24:47 +01001008void receive_query(struct listener *listen, time_t now)
Simon Kelley44a2a312004-03-10 20:04:35 +00001009{
Simon Kelley572b41e2011-02-18 18:11:18 +00001010 struct dns_header *header = (struct dns_header *)daemon->packet;
Simon Kelley44a2a312004-03-10 20:04:35 +00001011 union mysockaddr source_addr;
Simon Kelleyc1bb8502004-08-11 18:40:17 +01001012 unsigned short type;
Simon Kelley44a2a312004-03-10 20:04:35 +00001013 struct all_addr dst_addr;
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001014 struct in_addr netmask, dst_addr_4;
Simon Kelleycdeda282006-03-16 20:16:06 +00001015 size_t m;
1016 ssize_t n;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001017 int if_index = 0, auth_dns = 0;
1018#ifdef HAVE_AUTH
1019 int local_auth = 0;
1020#endif
Simon Kelley44a2a312004-03-10 20:04:35 +00001021 struct iovec iov[1];
1022 struct msghdr msg;
1023 struct cmsghdr *cmptr;
Simon Kelley44a2a312004-03-10 20:04:35 +00001024 union {
1025 struct cmsghdr align; /* this ensures alignment */
1026#ifdef HAVE_IPV6
1027 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1028#endif
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001029#if defined(HAVE_LINUX_NETWORK)
Simon Kelley44a2a312004-03-10 20:04:35 +00001030 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
Simon Kelley824af852008-02-12 20:43:05 +00001031#elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1032 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1033 CMSG_SPACE(sizeof(unsigned int))];
Simon Kelley44a2a312004-03-10 20:04:35 +00001034#elif defined(IP_RECVDSTADDR)
1035 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1036 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1037#endif
1038 } control_u;
Simon Kelley2329bef2013-12-03 13:41:16 +00001039#ifdef HAVE_IPV6
1040 /* Can always get recvd interface for IPv6 */
1041 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1042#else
1043 int check_dst = !option_bool(OPT_NOWILD);
1044#endif
1045
Simon Kelleycdeda282006-03-16 20:16:06 +00001046 /* packet buffer overwritten */
1047 daemon->srv_save = NULL;
1048
Simon Kelley4f7b3042012-11-28 21:27:02 +00001049 dst_addr_4.s_addr = 0;
1050 netmask.s_addr = 0;
1051
Simon Kelley7e5664b2013-04-05 16:57:41 +01001052 if (option_bool(OPT_NOWILD) && listen->iface)
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001053 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001054 auth_dns = listen->iface->dns_auth;
1055
1056 if (listen->family == AF_INET)
1057 {
1058 dst_addr_4 = listen->iface->addr.in.sin_addr;
1059 netmask = listen->iface->netmask;
1060 }
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001061 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001062
Simon Kelley3be34542004-09-11 19:12:13 +01001063 iov[0].iov_base = daemon->packet;
1064 iov[0].iov_len = daemon->edns_pktsz;
Simon Kelley44a2a312004-03-10 20:04:35 +00001065
1066 msg.msg_control = control_u.control;
1067 msg.msg_controllen = sizeof(control_u);
1068 msg.msg_flags = 0;
1069 msg.msg_name = &source_addr;
1070 msg.msg_namelen = sizeof(source_addr);
1071 msg.msg_iov = iov;
1072 msg.msg_iovlen = 1;
1073
Simon Kelleyde379512004-06-22 20:23:33 +01001074 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
Simon Kelley3be34542004-09-11 19:12:13 +01001075 return;
Simon Kelley44a2a312004-03-10 20:04:35 +00001076
Simon Kelley572b41e2011-02-18 18:11:18 +00001077 if (n < (int)sizeof(struct dns_header) ||
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001078 (msg.msg_flags & MSG_TRUNC) ||
Simon Kelley572b41e2011-02-18 18:11:18 +00001079 (header->hb3 & HB3_QR))
Simon Kelley3be34542004-09-11 19:12:13 +01001080 return;
Simon Kelley44a2a312004-03-10 20:04:35 +00001081
Simon Kelley26128d22004-11-14 16:43:54 +00001082 source_addr.sa.sa_family = listen->family;
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001083
1084 if (listen->family == AF_INET)
1085 {
1086 /* Source-port == 0 is an error, we can't send back to that.
1087 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1088 if (source_addr.in.sin_port == 0)
1089 return;
1090 }
Simon Kelley26128d22004-11-14 16:43:54 +00001091#ifdef HAVE_IPV6
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001092 else
1093 {
1094 /* Source-port == 0 is an error, we can't send back to that. */
1095 if (source_addr.in6.sin6_port == 0)
1096 return;
1097 source_addr.in6.sin6_flowinfo = 0;
1098 }
Simon Kelley26128d22004-11-14 16:43:54 +00001099#endif
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001100
Simon Kelleyc8a80482014-03-05 14:29:54 +00001101 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1102 if (option_bool(OPT_LOCAL_SERVICE))
1103 {
1104 struct addrlist *addr;
1105#ifdef HAVE_IPV6
1106 if (listen->family == AF_INET6)
1107 {
1108 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1109 if ((addr->flags & ADDRLIST_IPV6) &&
1110 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1111 break;
1112 }
1113 else
1114#endif
1115 {
1116 struct in_addr netmask;
1117 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1118 {
1119 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1120 if (!(addr->flags & ADDRLIST_IPV6) &&
1121 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1122 break;
1123 }
1124 }
1125 if (!addr)
1126 {
Simon Kelley0c8584e2014-03-12 20:12:56 +00001127 static int warned = 0;
1128 if (!warned)
1129 {
1130 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1131 warned = 1;
1132 }
Simon Kelleyc8a80482014-03-05 14:29:54 +00001133 return;
1134 }
1135 }
1136
Simon Kelley2329bef2013-12-03 13:41:16 +00001137 if (check_dst)
Simon Kelley44a2a312004-03-10 20:04:35 +00001138 {
Simon Kelley8a911cc2004-03-16 18:35:52 +00001139 struct ifreq ifr;
1140
Simon Kelley26128d22004-11-14 16:43:54 +00001141 if (msg.msg_controllen < sizeof(struct cmsghdr))
1142 return;
1143
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001144#if defined(HAVE_LINUX_NETWORK)
Simon Kelley26128d22004-11-14 16:43:54 +00001145 if (listen->family == AF_INET)
1146 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +00001147 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
Simon Kelley26128d22004-11-14 16:43:54 +00001148 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001149 union {
1150 unsigned char *c;
1151 struct in_pktinfo *p;
1152 } p;
1153 p.c = CMSG_DATA(cmptr);
1154 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1155 if_index = p.p->ipi_ifindex;
Simon Kelley26128d22004-11-14 16:43:54 +00001156 }
1157#elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1158 if (listen->family == AF_INET)
1159 {
1160 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001161 {
1162 union {
1163 unsigned char *c;
1164 unsigned int *i;
1165 struct in_addr *a;
1166#ifndef HAVE_SOLARIS_NETWORK
1167 struct sockaddr_dl *s;
Simon Kelley824af852008-02-12 20:43:05 +00001168#endif
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001169 } p;
1170 p.c = CMSG_DATA(cmptr);
1171 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1172 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1173 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1174#ifdef HAVE_SOLARIS_NETWORK
1175 if_index = *(p.i);
1176#else
1177 if_index = p.s->sdl_index;
1178#endif
1179 }
Simon Kelley26128d22004-11-14 16:43:54 +00001180 }
1181#endif
1182
1183#ifdef HAVE_IPV6
1184 if (listen->family == AF_INET6)
1185 {
1186 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +00001187 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
Simon Kelley26128d22004-11-14 16:43:54 +00001188 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001189 union {
1190 unsigned char *c;
1191 struct in6_pktinfo *p;
1192 } p;
1193 p.c = CMSG_DATA(cmptr);
1194
1195 dst_addr.addr.addr6 = p.p->ipi6_addr;
1196 if_index = p.p->ipi6_ifindex;
Simon Kelley26128d22004-11-14 16:43:54 +00001197 }
1198 }
1199#endif
1200
1201 /* enforce available interface configuration */
1202
Simon Kelleye25db1f2013-01-29 22:10:26 +00001203 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
Simon Kelley832af0b2007-01-21 20:01:28 +00001204 return;
1205
Simon Kelleye25db1f2013-01-29 22:10:26 +00001206 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1207 {
1208 if (!option_bool(OPT_CLEVERBIND))
Simon Kelley115ac3e2013-05-20 11:28:32 +01001209 enumerate_interfaces(0);
Simon Kelley3f2873d2013-05-14 11:28:47 +01001210 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1211 !label_exception(if_index, listen->family, &dst_addr))
Simon Kelleye25db1f2013-01-29 22:10:26 +00001212 return;
1213 }
1214
Simon Kelley552af8b2012-02-29 20:10:31 +00001215 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1216 {
1217 struct irec *iface;
1218
1219 /* get the netmask of the interface whch has the address we were sent to.
1220 This is no neccessarily the interface we arrived on. */
1221
1222 for (iface = daemon->interfaces; iface; iface = iface->next)
1223 if (iface->addr.sa.sa_family == AF_INET &&
1224 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1225 break;
1226
1227 /* interface may be new */
Simon Kelleye25db1f2013-01-29 22:10:26 +00001228 if (!iface && !option_bool(OPT_CLEVERBIND))
Simon Kelley115ac3e2013-05-20 11:28:32 +01001229 enumerate_interfaces(0);
Simon Kelley552af8b2012-02-29 20:10:31 +00001230
1231 for (iface = daemon->interfaces; iface; iface = iface->next)
1232 if (iface->addr.sa.sa_family == AF_INET &&
1233 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1234 break;
1235
1236 /* If we failed, abandon localisation */
1237 if (iface)
1238 netmask = iface->netmask;
1239 else
1240 dst_addr_4.s_addr = 0;
1241 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001242 }
1243
Simon Kelleycdeda282006-03-16 20:16:06 +00001244 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
Simon Kelley44a2a312004-03-10 20:04:35 +00001245 {
Simon Kelleyb485ed92013-10-18 22:00:39 +01001246#ifdef HAVE_AUTH
1247 struct auth_zone *zone;
1248#endif
Simon Kelley610e7822014-02-06 14:45:17 +00001249 char *types = querystr(auth_dns ? "auth" : "query", type);
1250
Simon Kelley44a2a312004-03-10 20:04:35 +00001251 if (listen->family == AF_INET)
Simon Kelley3be34542004-09-11 19:12:13 +01001252 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +01001253 (struct all_addr *)&source_addr.in.sin_addr, types);
Simon Kelley44a2a312004-03-10 20:04:35 +00001254#ifdef HAVE_IPV6
1255 else
Simon Kelley3be34542004-09-11 19:12:13 +01001256 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +01001257 (struct all_addr *)&source_addr.in6.sin6_addr, types);
Simon Kelley44a2a312004-03-10 20:04:35 +00001258#endif
Simon Kelley44a2a312004-03-10 20:04:35 +00001259
Simon Kelley4820dce2012-12-18 18:30:30 +00001260#ifdef HAVE_AUTH
Simon Kelleyb485ed92013-10-18 22:00:39 +01001261 /* find queries for zones we're authoritative for, and answer them directly */
Simon Kelley6008bdb2013-10-21 21:47:03 +01001262 if (!auth_dns)
1263 for (zone = daemon->auth_zones; zone; zone = zone->next)
1264 if (in_zone(zone, daemon->namebuff, NULL))
1265 {
1266 auth_dns = 1;
1267 local_auth = 1;
1268 break;
1269 }
Simon Kelleyb485ed92013-10-18 22:00:39 +01001270#endif
1271 }
1272
1273#ifdef HAVE_AUTH
Simon Kelley4f7b3042012-11-28 21:27:02 +00001274 if (auth_dns)
Simon Kelley824af852008-02-12 20:43:05 +00001275 {
Simon Kelley60b68062014-01-08 12:10:28 +00001276 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001277 if (m >= 1)
Simon Kelleyb485ed92013-10-18 22:00:39 +01001278 {
1279 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1280 (char *)header, m, &source_addr, &dst_addr, if_index);
1281 daemon->auth_answer++;
1282 }
Simon Kelley824af852008-02-12 20:43:05 +00001283 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001284 else
Simon Kelley4820dce2012-12-18 18:30:30 +00001285#endif
Simon Kelley4f7b3042012-11-28 21:27:02 +00001286 {
Simon Kelley613ad152014-02-25 23:02:28 +00001287 int ad_reqd, do_bit;
Simon Kelley60b68062014-01-08 12:10:28 +00001288 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
Simon Kelley613ad152014-02-25 23:02:28 +00001289 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001290
1291 if (m >= 1)
1292 {
1293 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1294 (char *)header, m, &source_addr, &dst_addr, if_index);
1295 daemon->local_answer++;
1296 }
1297 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
Simon Kelley613ad152014-02-25 23:02:28 +00001298 header, (size_t)n, now, NULL, ad_reqd, do_bit))
Simon Kelley4f7b3042012-11-28 21:27:02 +00001299 daemon->queries_forwarded++;
1300 else
1301 daemon->local_answer++;
1302 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001303}
1304
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001305#ifdef HAVE_DNSSEC
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001306
1307/* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1308 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1309 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1310static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
1311{
1312 struct crec *crecp;
1313 char *name_start = name;
1314 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1315
1316 if (status != STAT_INSECURE)
1317 return status;
1318
1319 while (1)
1320 {
1321 crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1322
1323 if (crecp && (crecp->flags & F_DNSSECOK))
1324 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1325
1326 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1327 {
1328 name_start++; /* chop a label off and try again */
1329 continue;
1330 }
1331
1332 strcpy(keyname, name_start);
1333 return STAT_NEED_DS_NEG;
1334 }
1335}
1336
1337/* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1338static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
1339
1340{
1341 char *name_start;
1342 unsigned char *p;
1343 int status = dnssec_validate_ds(now, header, plen, name, keyname, class);
1344
1345 if (status != STAT_INSECURE)
1346 {
1347 if (status == STAT_NO_DS)
1348 status = STAT_INSECURE;
1349 return status;
1350 }
1351
1352 p = (unsigned char *)(header+1);
1353
1354 if (extract_name(header, plen, &p, name, 1, 4) &&
1355 (name_start = strchr(name, '.')))
1356 {
1357 name_start++; /* chop a label off and try again */
1358 strcpy(keyname, name_start);
1359 return STAT_NEED_DS_NEG;
1360 }
1361
1362 return STAT_BOGUS;
1363}
1364
1365/* Move toward the root, until we find a signed non-existance of a DS, in which case
1366 an unsigned answer is OK, or we find a signed DS, in which case there should be
1367 a signature, and the answer is BOGUS */
1368static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1369 char *keyname, struct server *server, int *keycount)
1370{
1371 size_t m;
1372 unsigned char *packet, *payload;
1373 u16 *length;
1374 unsigned char *p = (unsigned char *)(header+1);
1375 int status;
1376 char *name_start = name;
1377
1378 /* Get first insecure entry in CNAME chain */
1379 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1380 if (status == STAT_BOGUS)
1381 return STAT_BOGUS;
1382
1383 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1384 return STAT_BOGUS;
1385
1386 payload = &packet[2];
1387 header = (struct dns_header *)payload;
1388 length = (u16 *)packet;
1389
1390 while (1)
1391 {
1392 unsigned char *newhash, hash[HASH_SIZE];
1393 unsigned char c1, c2;
1394 struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1395
1396 if (--(*keycount) == 0)
1397 return STAT_BOGUS;
1398
1399 if (crecp && (crecp->flags & F_DNSSECOK))
1400 {
1401 free(packet);
1402 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1403 }
1404
1405 /* If we have cached insecurely that a DS doesn't exist,
1406 ise that is a hit for where to start looking for the secure one */
1407 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1408 {
1409 name_start++; /* chop a label off and try again */
1410 continue;
1411 }
1412
1413 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1414
1415 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1416 if ((newhash = hash_questions(header, (unsigned int)m, name)))
1417 memcpy(hash, newhash, HASH_SIZE);
1418
1419 *length = htons(m);
1420
1421 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1422 read_write(server->tcpfd, &c1, 1, 1) &&
1423 read_write(server->tcpfd, &c2, 1, 1) &&
1424 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1425 {
1426 m = (c1 << 8) | c2;
1427
1428 newhash = hash_questions(header, (unsigned int)m, name);
1429 if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
1430 {
1431 /* Note this trashes all three name workspaces */
1432 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1433
1434 /* We've found a DS which proves the bit of the DNS where the
1435 original query is, is unsigned, so the answer is OK,
1436 if unvalidated. */
1437 if (status == STAT_NO_DS)
1438 {
1439 free(packet);
1440 return STAT_INSECURE;
1441 }
1442
1443 /* No DS, not got to DNSSEC-land yet, go up. */
1444 if (status == STAT_INSECURE)
1445 {
1446 p = (unsigned char *)(header+1);
1447
1448 if (extract_name(header, plen, &p, name, 1, 4) &&
1449 (name_start = strchr(name, '.')))
1450 {
1451 name_start++; /* chop a label off and try again */
1452 continue;
1453 }
1454 }
1455 }
1456 }
1457
1458 free(packet);
1459
1460 return STAT_BOGUS;
1461 }
1462}
1463
Simon Kelley7fa836e2014-02-10 20:11:24 +00001464static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1465 int class, char *name, char *keyname, struct server *server, int *keycount)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001466{
1467 /* Recurse up the key heirarchy */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001468 int new_status;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001469
Simon Kelley7fa836e2014-02-10 20:11:24 +00001470 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1471 if (--(*keycount) == 0)
1472 return STAT_INSECURE;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001473
Simon Kelley7fa836e2014-02-10 20:11:24 +00001474 if (status == STAT_NEED_KEY)
1475 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001476 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1477 {
1478 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1479 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1480 new_status = STAT_INSECURE;
1481 }
1482 else if (status == STAT_CHASE_CNAME)
1483 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1484 else
1485 {
1486 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1487
1488 if (new_status == STAT_NO_SIG)
1489 {
1490 if (option_bool(OPT_DNSSEC_NO_SIGN))
1491 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1492 else
1493 new_status = STAT_INSECURE;
1494 }
1495 }
1496
Simon Kelley7fa836e2014-02-10 20:11:24 +00001497 /* Can't validate because we need a key/DS whose name now in keyname.
1498 Make query for same, and recurse to validate */
1499 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001500 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001501 size_t m;
1502 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1503 unsigned char *payload = &packet[2];
1504 struct dns_header *new_header = (struct dns_header *)payload;
1505 u16 *length = (u16 *)packet;
1506 unsigned char c1, c2;
1507
1508 if (!packet)
1509 return STAT_INSECURE;
1510
1511 another_tcp_key:
1512 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1513 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001514
Simon Kelley7fa836e2014-02-10 20:11:24 +00001515 *length = htons(m);
1516
1517 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1518 !read_write(server->tcpfd, &c1, 1, 1) ||
1519 !read_write(server->tcpfd, &c2, 1, 1) ||
1520 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1521 new_status = STAT_INSECURE;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001522 else
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001523 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001524 m = (c1 << 8) | c2;
1525
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001526 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1527
1528 if (new_status == STAT_SECURE)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001529 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001530 /* Reached a validated record, now try again at this level.
1531 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1532 If so, go round again. */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001533
Simon Kelley7fa836e2014-02-10 20:11:24 +00001534 if (status == STAT_NEED_KEY)
1535 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001536 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1537 {
1538 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1539 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1540 new_status = STAT_INSECURE; /* Validated no DS */
1541 }
1542 else if (status == STAT_CHASE_CNAME)
1543 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1544 else
1545 {
1546 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1547
1548 if (new_status == STAT_NO_SIG)
1549 {
1550 if (option_bool(OPT_DNSSEC_NO_SIGN))
1551 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1552 else
1553 new_status = STAT_INSECURE;
1554 }
1555 }
1556
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001557 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
Simon Kelley7fa836e2014-02-10 20:11:24 +00001558 goto another_tcp_key;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001559 }
1560 }
Simon Kelley7fa836e2014-02-10 20:11:24 +00001561
1562 free(packet);
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001563 }
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001564 return new_status;
1565}
1566#endif
1567
1568
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001569/* The daemon forks before calling this: it should deal with one connection,
1570 blocking as neccessary, and then return. Note, need to be a bit careful
1571 about resources for debug mode, when the fork is suppressed: that's
1572 done by the caller. */
Simon Kelley5aabfc72007-08-29 11:24:47 +01001573unsigned char *tcp_request(int confd, time_t now,
Simon Kelley4f7b3042012-11-28 21:27:02 +00001574 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001575{
Simon Kelley28866e92011-02-14 20:19:14 +00001576 size_t size = 0;
1577 int norebind = 0;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001578#ifdef HAVE_AUTH
Simon Kelley19b16892013-10-20 10:19:39 +01001579 int local_auth = 0;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001580#endif
Simon Kelley613ad152014-02-25 23:02:28 +00001581 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1582 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
Simon Kelleycdeda282006-03-16 20:16:06 +00001583 size_t m;
Simon Kelleyee86ce62012-12-07 11:54:46 +00001584 unsigned short qtype;
1585 unsigned int gotname;
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001586 unsigned char c1, c2;
Simon Kelley4b5ea122013-04-22 10:18:26 +01001587 /* Max TCP packet + slop + size */
1588 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1589 unsigned char *payload = &packet[2];
1590 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1591 struct dns_header *header = (struct dns_header *)payload;
1592 u16 *length = (u16 *)packet;
Simon Kelley3be34542004-09-11 19:12:13 +01001593 struct server *last_server;
Simon Kelley7de060b2011-08-26 17:24:52 +01001594 struct in_addr dst_addr_4;
1595 union mysockaddr peer_addr;
1596 socklen_t peer_len = sizeof(union mysockaddr);
Simon Kelley3be34542004-09-11 19:12:13 +01001597
Simon Kelley7de060b2011-08-26 17:24:52 +01001598 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1599 return packet;
Simon Kelleyc8a80482014-03-05 14:29:54 +00001600
1601 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1602 if (option_bool(OPT_LOCAL_SERVICE))
1603 {
1604 struct addrlist *addr;
1605#ifdef HAVE_IPV6
1606 if (peer_addr.sa.sa_family == AF_INET6)
1607 {
1608 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1609 if ((addr->flags & ADDRLIST_IPV6) &&
1610 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1611 break;
1612 }
1613 else
1614#endif
1615 {
1616 struct in_addr netmask;
1617 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1618 {
1619 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1620 if (!(addr->flags & ADDRLIST_IPV6) &&
1621 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1622 break;
1623 }
1624 }
1625 if (!addr)
1626 {
1627 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1628 return packet;
1629 }
1630 }
Simon Kelley7de060b2011-08-26 17:24:52 +01001631
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001632 while (1)
1633 {
1634 if (!packet ||
1635 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1636 !(size = c1 << 8 | c2) ||
Simon Kelley4b5ea122013-04-22 10:18:26 +01001637 !read_write(confd, payload, size, 1))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001638 return packet;
1639
Simon Kelley572b41e2011-02-18 18:11:18 +00001640 if (size < (int)sizeof(struct dns_header))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001641 continue;
1642
Simon Kelleyed4c0762013-10-08 20:46:34 +01001643 check_subnet = 0;
1644
Simon Kelley28866e92011-02-14 20:19:14 +00001645 /* save state of "cd" flag in query */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001646 if ((checking_disabled = header->hb4 & HB4_CD))
1647 no_cache_dnssec = 1;
Simon Kelley28866e92011-02-14 20:19:14 +00001648
Simon Kelley3be34542004-09-11 19:12:13 +01001649 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001650 {
Simon Kelleyb485ed92013-10-18 22:00:39 +01001651#ifdef HAVE_AUTH
1652 struct auth_zone *zone;
1653#endif
Simon Kelley610e7822014-02-06 14:45:17 +00001654 char *types = querystr(auth_dns ? "auth" : "query", qtype);
Simon Kelley7de060b2011-08-26 17:24:52 +01001655
1656 if (peer_addr.sa.sa_family == AF_INET)
1657 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1658 (struct all_addr *)&peer_addr.in.sin_addr, types);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001659#ifdef HAVE_IPV6
Simon Kelley7de060b2011-08-26 17:24:52 +01001660 else
1661 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1662 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001663#endif
Simon Kelleyb485ed92013-10-18 22:00:39 +01001664
1665#ifdef HAVE_AUTH
1666 /* find queries for zones we're authoritative for, and answer them directly */
Simon Kelley6008bdb2013-10-21 21:47:03 +01001667 if (!auth_dns)
1668 for (zone = daemon->auth_zones; zone; zone = zone->next)
1669 if (in_zone(zone, daemon->namebuff, NULL))
1670 {
1671 auth_dns = 1;
1672 local_auth = 1;
1673 break;
1674 }
Simon Kelleyb485ed92013-10-18 22:00:39 +01001675#endif
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001676 }
1677
Simon Kelley7de060b2011-08-26 17:24:52 +01001678 if (local_addr->sa.sa_family == AF_INET)
1679 dst_addr_4 = local_addr->in.sin_addr;
1680 else
1681 dst_addr_4.s_addr = 0;
1682
Simon Kelley4820dce2012-12-18 18:30:30 +00001683#ifdef HAVE_AUTH
Simon Kelley4f7b3042012-11-28 21:27:02 +00001684 if (auth_dns)
Simon Kelley19b16892013-10-20 10:19:39 +01001685 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001686 else
Simon Kelley4820dce2012-12-18 18:30:30 +00001687#endif
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001688 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001689 /* m > 0 if answered from cache */
1690 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
Simon Kelley613ad152014-02-25 23:02:28 +00001691 dst_addr_4, netmask, now, &ad_question, &do_bit);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001692
Simon Kelley4f7b3042012-11-28 21:27:02 +00001693 /* Do this by steam now we're not in the select() loop */
1694 check_log_writer(NULL);
1695
1696 if (m == 0)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001697 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001698 unsigned int flags = 0;
1699 struct all_addr *addrp = NULL;
1700 int type = 0;
1701 char *domain = NULL;
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001702
Simon Kelley4f7b3042012-11-28 21:27:02 +00001703 if (option_bool(OPT_ADD_MAC))
1704 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
Simon Kelleyed4c0762013-10-08 20:46:34 +01001705
1706 if (option_bool(OPT_CLIENT_SUBNET))
1707 {
1708 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1709 if (size != new)
1710 {
1711 size = new;
1712 check_subnet = 1;
1713 }
1714 }
1715
Simon Kelley4f7b3042012-11-28 21:27:02 +00001716 if (gotname)
1717 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1718
1719 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1720 last_server = daemon->servers;
1721 else
1722 last_server = daemon->last_server;
1723
1724 if (!flags && last_server)
1725 {
1726 struct server *firstsendto = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001727#ifdef HAVE_DNSSEC
Simon Kelley703c7ff2014-01-25 23:46:23 +00001728 unsigned char *newhash, hash[HASH_SIZE];
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001729 if ((newhash = hash_questions(header, (unsigned int)size, daemon->keyname)))
1730 memcpy(hash, newhash, HASH_SIZE);
1731#else
Simon Kelley4f7b3042012-11-28 21:27:02 +00001732 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001733#endif
Simon Kelley4f7b3042012-11-28 21:27:02 +00001734 /* Loop round available servers until we succeed in connecting to one.
1735 Note that this code subtley ensures that consecutive queries on this connection
1736 which can go to the same server, do so. */
1737 while (1)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001738 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001739 if (!firstsendto)
1740 firstsendto = last_server;
1741 else
1742 {
1743 if (!(last_server = last_server->next))
1744 last_server = daemon->servers;
1745
1746 if (last_server == firstsendto)
1747 break;
1748 }
1749
1750 /* server for wrong domain */
1751 if (type != (last_server->flags & SERV_TYPE) ||
1752 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)))
Simon Kelley7de060b2011-08-26 17:24:52 +01001753 continue;
1754
Simon Kelley4f7b3042012-11-28 21:27:02 +00001755 if (last_server->tcpfd == -1)
1756 {
1757 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1758 continue;
1759
1760 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1761 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1762 {
1763 close(last_server->tcpfd);
1764 last_server->tcpfd = -1;
1765 continue;
1766 }
1767
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001768#ifdef HAVE_DNSSEC
1769 if (option_bool(OPT_DNSSEC_VALID))
1770 {
Simon Kelley613ad152014-02-25 23:02:28 +00001771 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1772
Simon Kelley2ecd9bd2014-02-13 16:42:02 +00001773 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1774 this allows it to select auth servers when one is returning bad data. */
1775 if (option_bool(OPT_DNSSEC_DEBUG))
1776 header->hb4 |= HB4_CD;
Simon Kelley613ad152014-02-25 23:02:28 +00001777
1778 if (size != new_size)
1779 added_pheader = 1;
1780
1781 size = new_size;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001782 }
1783#endif
1784
Simon Kelley4f7b3042012-11-28 21:27:02 +00001785#ifdef HAVE_CONNTRACK
1786 /* Copy connection mark of incoming query to outgoing connection. */
1787 if (option_bool(OPT_CONNTRACK))
1788 {
1789 unsigned int mark;
1790 struct all_addr local;
1791#ifdef HAVE_IPV6
1792 if (local_addr->sa.sa_family == AF_INET6)
1793 local.addr.addr6 = local_addr->in6.sin6_addr;
1794 else
1795#endif
1796 local.addr.addr4 = local_addr->in.sin_addr;
1797
1798 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1799 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1800 }
1801#endif
1802 }
1803
Simon Kelley4b5ea122013-04-22 10:18:26 +01001804 *length = htons(size);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001805
Simon Kelley4b5ea122013-04-22 10:18:26 +01001806 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
Simon Kelley4f7b3042012-11-28 21:27:02 +00001807 !read_write(last_server->tcpfd, &c1, 1, 1) ||
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001808 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1809 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
Simon Kelley7de060b2011-08-26 17:24:52 +01001810 {
1811 close(last_server->tcpfd);
1812 last_server->tcpfd = -1;
1813 continue;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001814 }
1815
1816 m = (c1 << 8) | c2;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001817
1818 if (!gotname)
1819 strcpy(daemon->namebuff, "query");
1820 if (last_server->addr.sa.sa_family == AF_INET)
1821 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1822 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001823#ifdef HAVE_IPV6
Simon Kelley4f7b3042012-11-28 21:27:02 +00001824 else
1825 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1826 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001827#endif
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001828
1829#ifdef HAVE_DNSSEC
1830 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1831 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001832 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1833 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1834 char *result;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001835
Simon Kelley7fa836e2014-02-10 20:11:24 +00001836 if (keycount == 0)
1837 result = "ABANDONED";
1838 else
1839 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1840
1841 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1842
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001843 if (status == STAT_BOGUS)
1844 no_cache_dnssec = 1;
Simon Kelley7fa836e2014-02-10 20:11:24 +00001845
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001846 if (status == STAT_SECURE)
1847 cache_secure = 1;
1848 }
1849#endif
1850
1851 /* restore CD bit to the value in the query */
1852 if (checking_disabled)
1853 header->hb4 |= HB4_CD;
1854 else
1855 header->hb4 &= ~HB4_CD;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001856
1857 /* There's no point in updating the cache, since this process will exit and
1858 lose the information after a few queries. We make this call for the alias and
1859 bogus-nxdomain side-effects. */
1860 /* If the crc of the question section doesn't match the crc we sent, then
1861 someone might be attempting to insert bogus values into the cache by
1862 sending replies containing questions and bogus answers. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001863#ifdef HAVE_DNSSEC
1864 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1865 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
Simon Kelley703c7ff2014-01-25 23:46:23 +00001866 {
1867 m = 0;
1868 break;
1869 }
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001870#else
1871 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
Simon Kelley703c7ff2014-01-25 23:46:23 +00001872 {
1873 m = 0;
1874 break;
1875 }
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001876#endif
1877
1878 m = process_reply(header, now, last_server, (unsigned int)m,
1879 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
Simon Kelley613ad152014-02-25 23:02:28 +00001880 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001881
1882 break;
1883 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001884 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001885
1886 /* In case of local answer or no connections made. */
1887 if (m == 0)
1888 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001889 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001890 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001891
Simon Kelley5aabfc72007-08-29 11:24:47 +01001892 check_log_writer(NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001893
Simon Kelley4b5ea122013-04-22 10:18:26 +01001894 *length = htons(m);
1895
1896 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001897 return packet;
1898 }
1899}
1900
Simon Kelley16972692006-10-16 20:04:18 +01001901static struct frec *allocate_frec(time_t now)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001902{
Simon Kelley16972692006-10-16 20:04:18 +01001903 struct frec *f;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001904
Simon Kelley5aabfc72007-08-29 11:24:47 +01001905 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001906 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01001907 f->next = daemon->frec_list;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001908 f->time = now;
Simon Kelley832af0b2007-01-21 20:01:28 +00001909 f->sentto = NULL;
Simon Kelley1a6bca82008-07-11 11:11:42 +01001910 f->rfd4 = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +00001911 f->flags = 0;
Simon Kelley1a6bca82008-07-11 11:11:42 +01001912#ifdef HAVE_IPV6
1913 f->rfd6 = NULL;
1914#endif
Simon Kelley3a237152013-12-12 12:15:50 +00001915#ifdef HAVE_DNSSEC
Simon Kelley97bc7982014-01-31 10:19:52 +00001916 f->dependent = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00001917 f->blocking_query = NULL;
Simon Kelley4619d942014-01-16 19:53:06 +00001918 f->stash = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00001919#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +01001920 daemon->frec_list = f;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001921 }
Simon Kelley16972692006-10-16 20:04:18 +01001922
1923 return f;
1924}
1925
Simon Kelley1a6bca82008-07-11 11:11:42 +01001926static struct randfd *allocate_rfd(int family)
1927{
1928 static int finger = 0;
1929 int i;
1930
1931 /* limit the number of sockets we have open to avoid starvation of
1932 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1933
1934 for (i = 0; i < RANDOM_SOCKS; i++)
Simon Kelley9009d742008-11-14 20:04:27 +00001935 if (daemon->randomsocks[i].refcount == 0)
Simon Kelley1a6bca82008-07-11 11:11:42 +01001936 {
Simon Kelley9009d742008-11-14 20:04:27 +00001937 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
1938 break;
1939
Simon Kelley1a6bca82008-07-11 11:11:42 +01001940 daemon->randomsocks[i].refcount = 1;
1941 daemon->randomsocks[i].family = family;
1942 return &daemon->randomsocks[i];
1943 }
1944
Simon Kelley9009d742008-11-14 20:04:27 +00001945 /* No free ones or cannot get new socket, grab an existing one */
Simon Kelley1a6bca82008-07-11 11:11:42 +01001946 for (i = 0; i < RANDOM_SOCKS; i++)
1947 {
1948 int j = (i+finger) % RANDOM_SOCKS;
Simon Kelley9009d742008-11-14 20:04:27 +00001949 if (daemon->randomsocks[j].refcount != 0 &&
1950 daemon->randomsocks[j].family == family &&
1951 daemon->randomsocks[j].refcount != 0xffff)
Simon Kelley1a6bca82008-07-11 11:11:42 +01001952 {
1953 finger = j;
1954 daemon->randomsocks[j].refcount++;
1955 return &daemon->randomsocks[j];
1956 }
1957 }
1958
1959 return NULL; /* doom */
1960}
Simon Kelley1a6bca82008-07-11 11:11:42 +01001961static void free_frec(struct frec *f)
1962{
1963 if (f->rfd4 && --(f->rfd4->refcount) == 0)
1964 close(f->rfd4->fd);
1965
1966 f->rfd4 = NULL;
1967 f->sentto = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +00001968 f->flags = 0;
Simon Kelley1a6bca82008-07-11 11:11:42 +01001969
1970#ifdef HAVE_IPV6
1971 if (f->rfd6 && --(f->rfd6->refcount) == 0)
1972 close(f->rfd6->fd);
1973
1974 f->rfd6 = NULL;
1975#endif
Simon Kelley3a237152013-12-12 12:15:50 +00001976
1977#ifdef HAVE_DNSSEC
1978 if (f->stash)
Simon Kelley0fc2f312014-01-08 10:26:58 +00001979 {
1980 blockdata_free(f->stash);
1981 f->stash = NULL;
1982 }
Simon Kelley3a237152013-12-12 12:15:50 +00001983
1984 /* Anything we're waiting on is pointless now, too */
1985 if (f->blocking_query)
1986 free_frec(f->blocking_query);
1987 f->blocking_query = NULL;
Simon Kelley39048ad2014-01-21 17:33:58 +00001988 f->dependent = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00001989#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +01001990}
1991
Simon Kelley16972692006-10-16 20:04:18 +01001992/* if wait==NULL return a free or older than TIMEOUT record.
1993 else return *wait zero if one available, or *wait is delay to
Simon Kelley1a6bca82008-07-11 11:11:42 +01001994 when the oldest in-use record will expire. Impose an absolute
Simon Kelley3a237152013-12-12 12:15:50 +00001995 limit of 4*TIMEOUT before we wipe things (for random sockets).
1996 If force is set, always return a result, even if we have
1997 to allocate above the limit. */
1998struct frec *get_new_frec(time_t now, int *wait, int force)
Simon Kelley16972692006-10-16 20:04:18 +01001999{
Simon Kelley1a6bca82008-07-11 11:11:42 +01002000 struct frec *f, *oldest, *target;
Simon Kelley16972692006-10-16 20:04:18 +01002001 int count;
2002
2003 if (wait)
2004 *wait = 0;
2005
Simon Kelley1a6bca82008-07-11 11:11:42 +01002006 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
Simon Kelley832af0b2007-01-21 20:01:28 +00002007 if (!f->sentto)
Simon Kelley1a6bca82008-07-11 11:11:42 +01002008 target = f;
2009 else
Simon Kelley16972692006-10-16 20:04:18 +01002010 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01002011 if (difftime(now, f->time) >= 4*TIMEOUT)
2012 {
2013 free_frec(f);
2014 target = f;
2015 }
2016
2017 if (!oldest || difftime(f->time, oldest->time) <= 0)
2018 oldest = f;
Simon Kelley16972692006-10-16 20:04:18 +01002019 }
Simon Kelley1a6bca82008-07-11 11:11:42 +01002020
2021 if (target)
2022 {
2023 target->time = now;
2024 return target;
2025 }
Simon Kelley16972692006-10-16 20:04:18 +01002026
2027 /* can't find empty one, use oldest if there is one
2028 and it's older than timeout */
2029 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2030 {
2031 /* keep stuff for twice timeout if we can by allocating a new
2032 record instead */
2033 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2034 count <= daemon->ftabsize &&
2035 (f = allocate_frec(now)))
2036 return f;
2037
2038 if (!wait)
2039 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01002040 free_frec(oldest);
Simon Kelley16972692006-10-16 20:04:18 +01002041 oldest->time = now;
2042 }
2043 return oldest;
2044 }
2045
2046 /* none available, calculate time 'till oldest record expires */
Simon Kelley3a237152013-12-12 12:15:50 +00002047 if (!force && count > daemon->ftabsize)
Simon Kelley16972692006-10-16 20:04:18 +01002048 {
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +01002049 static time_t last_log = 0;
2050
Simon Kelley16972692006-10-16 20:04:18 +01002051 if (oldest && wait)
2052 *wait = oldest->time + (time_t)TIMEOUT - now;
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +01002053
2054 if ((int)difftime(now, last_log) > 5)
2055 {
2056 last_log = now;
2057 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2058 }
2059
Simon Kelley16972692006-10-16 20:04:18 +01002060 return NULL;
2061 }
2062
2063 if (!(f = allocate_frec(now)) && wait)
2064 /* wait one second on malloc failure */
2065 *wait = 1;
2066
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002067 return f; /* OK if malloc fails and this is NULL */
2068}
2069
Simon Kelley832af0b2007-01-21 20:01:28 +00002070/* crc is all-ones if not known. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002071static struct frec *lookup_frec(unsigned short id, void *hash)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002072{
2073 struct frec *f;
2074
Simon Kelley1a6bca82008-07-11 11:11:42 +01002075 for(f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002076 if (f->sentto && f->new_id == id &&
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002077 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002078 return f;
2079
2080 return NULL;
2081}
2082
2083static struct frec *lookup_frec_by_sender(unsigned short id,
Simon Kelleyfd9fa482004-10-21 20:24:00 +01002084 union mysockaddr *addr,
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002085 void *hash)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002086{
Simon Kelleyfeba5c12004-07-27 20:28:58 +01002087 struct frec *f;
2088
Simon Kelley1a6bca82008-07-11 11:11:42 +01002089 for(f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002090 if (f->sentto &&
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002091 f->orig_id == id &&
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002092 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002093 sockaddr_isequal(&f->source, addr))
2094 return f;
2095
2096 return NULL;
2097}
2098
Simon Kelley849a8352006-06-09 21:02:31 +01002099/* A server record is going away, remove references to it */
Simon Kelley5aabfc72007-08-29 11:24:47 +01002100void server_gone(struct server *server)
Simon Kelley849a8352006-06-09 21:02:31 +01002101{
2102 struct frec *f;
2103
Simon Kelley1a6bca82008-07-11 11:11:42 +01002104 for (f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002105 if (f->sentto && f->sentto == server)
Simon Kelley1a6bca82008-07-11 11:11:42 +01002106 free_frec(f);
Simon Kelley849a8352006-06-09 21:02:31 +01002107
2108 if (daemon->last_server == server)
2109 daemon->last_server = NULL;
2110
2111 if (daemon->srv_save == server)
2112 daemon->srv_save = NULL;
2113}
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002114
Simon Kelley316e2732010-01-22 20:16:09 +00002115/* return unique random ids. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002116static unsigned short get_id(void)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002117{
2118 unsigned short ret = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +00002119
Simon Kelley316e2732010-01-22 20:16:09 +00002120 do
Simon Kelley832af0b2007-01-21 20:01:28 +00002121 ret = rand16();
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002122 while (lookup_frec(ret, NULL));
Simon Kelley832af0b2007-01-21 20:01:28 +00002123
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002124 return ret;
2125}
2126
2127
2128
2129
2130