Simon Kelley | c47e3ba | 2014-01-08 17:07:54 +0000 | [diff] [blame] | 1 | /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2 | |
| 3 | This program is free software; you can redistribute it and/or modify |
| 4 | it under the terms of the GNU General Public License as published by |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 5 | the Free Software Foundation; version 2 dated June, 1991, or |
| 6 | (at your option) version 3 dated 29 June, 2007. |
| 7 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 8 | This program is distributed in the hope that it will be useful, |
| 9 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 10 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 11 | GNU General Public License for more details. |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 12 | |
Simon Kelley | 73a08a2 | 2009-02-05 20:28:08 +0000 | [diff] [blame] | 13 | You should have received a copy of the GNU General Public License |
| 14 | along with this program. If not, see <http://www.gnu.org/licenses/>. |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 15 | */ |
| 16 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 17 | #include "dnsmasq.h" |
| 18 | |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 19 | static struct frec *lookup_frec(unsigned short id, void *hash); |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 20 | static struct frec *lookup_frec_by_sender(unsigned short id, |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 21 | union mysockaddr *addr, |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 22 | void *hash); |
| 23 | static unsigned short get_id(void); |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 24 | static void free_frec(struct frec *f); |
| 25 | static struct randfd *allocate_rfd(int family); |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 26 | |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 27 | #ifdef HAVE_DNSSEC |
| 28 | static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n, |
| 29 | int class, char *name, char *keyname, struct server *server, int *keycount); |
| 30 | static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class); |
| 31 | static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname); |
| 32 | #endif |
| 33 | |
| 34 | |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 35 | /* Send a UDP packet with its source address set as "source" |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 36 | unless nowild is true, when we just send it with the kernel default */ |
Simon Kelley | 29689cf | 2012-03-22 14:01:00 +0000 | [diff] [blame] | 37 | int send_from(int fd, int nowild, char *packet, size_t len, |
| 38 | union mysockaddr *to, struct all_addr *source, |
Simon Kelley | 50303b1 | 2012-04-04 22:13:17 +0100 | [diff] [blame] | 39 | unsigned int iface) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 40 | { |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 41 | struct msghdr msg; |
| 42 | struct iovec iov[1]; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 43 | union { |
| 44 | struct cmsghdr align; /* this ensures alignment */ |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 45 | #if defined(HAVE_LINUX_NETWORK) |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 46 | char control[CMSG_SPACE(sizeof(struct in_pktinfo))]; |
| 47 | #elif defined(IP_SENDSRCADDR) |
| 48 | char control[CMSG_SPACE(sizeof(struct in_addr))]; |
| 49 | #endif |
| 50 | #ifdef HAVE_IPV6 |
| 51 | char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))]; |
| 52 | #endif |
| 53 | } control_u; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 54 | |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 55 | iov[0].iov_base = packet; |
| 56 | iov[0].iov_len = len; |
| 57 | |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 58 | msg.msg_control = NULL; |
| 59 | msg.msg_controllen = 0; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 60 | msg.msg_flags = 0; |
| 61 | msg.msg_name = to; |
| 62 | msg.msg_namelen = sa_len(to); |
| 63 | msg.msg_iov = iov; |
| 64 | msg.msg_iovlen = 1; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 65 | |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 66 | if (!nowild) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 67 | { |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 68 | struct cmsghdr *cmptr; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 69 | msg.msg_control = &control_u; |
| 70 | msg.msg_controllen = sizeof(control_u); |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 71 | cmptr = CMSG_FIRSTHDR(&msg); |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 72 | |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 73 | if (to->sa.sa_family == AF_INET) |
| 74 | { |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 75 | #if defined(HAVE_LINUX_NETWORK) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 76 | struct in_pktinfo p; |
| 77 | p.ipi_ifindex = 0; |
| 78 | p.ipi_spec_dst = source->addr.addr4; |
| 79 | memcpy(CMSG_DATA(cmptr), &p, sizeof(p)); |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 80 | msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); |
Simon Kelley | c72daea | 2012-01-05 21:33:27 +0000 | [diff] [blame] | 81 | cmptr->cmsg_level = IPPROTO_IP; |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 82 | cmptr->cmsg_type = IP_PKTINFO; |
| 83 | #elif defined(IP_SENDSRCADDR) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 84 | memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4)); |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 85 | msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); |
| 86 | cmptr->cmsg_level = IPPROTO_IP; |
| 87 | cmptr->cmsg_type = IP_SENDSRCADDR; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 88 | #endif |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 89 | } |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 90 | else |
Simon Kelley | b8187c8 | 2005-11-26 21:46:27 +0000 | [diff] [blame] | 91 | #ifdef HAVE_IPV6 |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 92 | { |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 93 | struct in6_pktinfo p; |
| 94 | p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */ |
| 95 | p.ipi6_addr = source->addr.addr6; |
| 96 | memcpy(CMSG_DATA(cmptr), &p, sizeof(p)); |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 97 | msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); |
Simon Kelley | 316e273 | 2010-01-22 20:16:09 +0000 | [diff] [blame] | 98 | cmptr->cmsg_type = daemon->v6pktinfo; |
Simon Kelley | c72daea | 2012-01-05 21:33:27 +0000 | [diff] [blame] | 99 | cmptr->cmsg_level = IPPROTO_IPV6; |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 100 | } |
Simon Kelley | 3d8df26 | 2005-08-29 12:19:27 +0100 | [diff] [blame] | 101 | #else |
Simon Kelley | c72daea | 2012-01-05 21:33:27 +0000 | [diff] [blame] | 102 | (void)iface; /* eliminate warning */ |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 103 | #endif |
| 104 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 105 | |
Simon Kelley | 29d28dd | 2012-12-03 14:05:59 +0000 | [diff] [blame] | 106 | while (sendmsg(fd, &msg, 0) == -1) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 107 | { |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 108 | if (retry_send()) |
Simon Kelley | 29d28dd | 2012-12-03 14:05:59 +0000 | [diff] [blame] | 109 | continue; |
| 110 | |
| 111 | /* If interface is still in DAD, EINVAL results - ignore that. */ |
| 112 | if (errno == EINVAL) |
| 113 | break; |
Simon Kelley | 22d904d | 2012-02-26 20:13:45 +0000 | [diff] [blame] | 114 | |
Simon Kelley | 50303b1 | 2012-04-04 22:13:17 +0100 | [diff] [blame] | 115 | my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno)); |
Simon Kelley | 29689cf | 2012-03-22 14:01:00 +0000 | [diff] [blame] | 116 | return 0; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 117 | } |
Simon Kelley | 29d28dd | 2012-12-03 14:05:59 +0000 | [diff] [blame] | 118 | |
Simon Kelley | 29689cf | 2012-03-22 14:01:00 +0000 | [diff] [blame] | 119 | return 1; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 120 | } |
| 121 | |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 122 | static unsigned int search_servers(time_t now, struct all_addr **addrpp, |
| 123 | unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 124 | |
| 125 | { |
| 126 | /* If the query ends in the domain in one of our servers, set |
| 127 | domain to point to that name. We find the largest match to allow both |
| 128 | domain.org and sub.domain.org to exist. */ |
| 129 | |
| 130 | unsigned int namelen = strlen(qdomain); |
| 131 | unsigned int matchlen = 0; |
| 132 | struct server *serv; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 133 | unsigned int flags = 0; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 134 | |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 135 | for (serv = daemon->servers; serv; serv=serv->next) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 136 | /* domain matches take priority over NODOTS matches */ |
Simon Kelley | 3d8df26 | 2005-08-29 12:19:27 +0100 | [diff] [blame] | 137 | if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 138 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 139 | unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 140 | *type = SERV_FOR_NODOTS; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 141 | if (serv->flags & SERV_NO_ADDR) |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 142 | flags = F_NXDOMAIN; |
| 143 | else if (serv->flags & SERV_LITERAL_ADDRESS) |
| 144 | { |
| 145 | if (sflag & qtype) |
| 146 | { |
| 147 | flags = sflag; |
| 148 | if (serv->addr.sa.sa_family == AF_INET) |
| 149 | *addrpp = (struct all_addr *)&serv->addr.in.sin_addr; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 150 | #ifdef HAVE_IPV6 |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 151 | else |
| 152 | *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 153 | #endif |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 154 | } |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 155 | else if (!flags || (flags & F_NXDOMAIN)) |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 156 | flags = F_NOERR; |
| 157 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 158 | } |
| 159 | else if (serv->flags & SERV_HAS_DOMAIN) |
| 160 | { |
| 161 | unsigned int domainlen = strlen(serv->domain); |
Simon Kelley | b8187c8 | 2005-11-26 21:46:27 +0000 | [diff] [blame] | 162 | char *matchstart = qdomain + namelen - domainlen; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 163 | if (namelen >= domainlen && |
Simon Kelley | b8187c8 | 2005-11-26 21:46:27 +0000 | [diff] [blame] | 164 | hostname_isequal(matchstart, serv->domain) && |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 165 | (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' )) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 166 | { |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 167 | if (serv->flags & SERV_NO_REBIND) |
| 168 | *norebind = 1; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 169 | else |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 170 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 171 | unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6; |
| 172 | /* implement priority rules for --address and --server for same domain. |
| 173 | --address wins if the address is for the correct AF |
| 174 | --server wins otherwise. */ |
| 175 | if (domainlen != 0 && domainlen == matchlen) |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 176 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 177 | if ((serv->flags & SERV_LITERAL_ADDRESS)) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 178 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 179 | if (!(sflag & qtype) && flags == 0) |
| 180 | continue; |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 181 | } |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 182 | else |
| 183 | { |
| 184 | if (flags & (F_IPV4 | F_IPV6)) |
| 185 | continue; |
| 186 | } |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 187 | } |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 188 | |
| 189 | if (domainlen >= matchlen) |
| 190 | { |
| 191 | *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND); |
| 192 | *domain = serv->domain; |
| 193 | matchlen = domainlen; |
| 194 | if (serv->flags & SERV_NO_ADDR) |
| 195 | flags = F_NXDOMAIN; |
| 196 | else if (serv->flags & SERV_LITERAL_ADDRESS) |
| 197 | { |
| 198 | if (sflag & qtype) |
| 199 | { |
| 200 | flags = sflag; |
| 201 | if (serv->addr.sa.sa_family == AF_INET) |
| 202 | *addrpp = (struct all_addr *)&serv->addr.in.sin_addr; |
| 203 | #ifdef HAVE_IPV6 |
| 204 | else |
| 205 | *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr; |
| 206 | #endif |
| 207 | } |
| 208 | else if (!flags || (flags & F_NXDOMAIN)) |
| 209 | flags = F_NOERR; |
| 210 | } |
| 211 | else |
| 212 | flags = 0; |
| 213 | } |
| 214 | } |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 215 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 216 | } |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 217 | |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 218 | if (flags == 0 && !(qtype & F_QUERY) && |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 219 | option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0) |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 220 | /* don't forward A or AAAA queries for simple names, except the empty name */ |
| 221 | flags = F_NOERR; |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 222 | |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 223 | if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now)) |
Simon Kelley | c1bb850 | 2004-08-11 18:40:17 +0100 | [diff] [blame] | 224 | flags = F_NOERR; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 225 | |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 226 | if (flags) |
| 227 | { |
| 228 | int logflags = 0; |
| 229 | |
| 230 | if (flags == F_NXDOMAIN || flags == F_NOERR) |
| 231 | logflags = F_NEG | qtype; |
| 232 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 233 | log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL); |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 234 | } |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 235 | else if ((*type) & SERV_USE_RESOLV) |
| 236 | { |
| 237 | *type = 0; /* use normal servers for this domain */ |
| 238 | *domain = NULL; |
| 239 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 240 | return flags; |
| 241 | } |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 242 | |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 243 | static int forward_query(int udpfd, union mysockaddr *udpaddr, |
| 244 | struct all_addr *dst_addr, unsigned int dst_iface, |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 245 | struct dns_header *header, size_t plen, time_t now, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 246 | struct frec *forward, int ad_reqd, int do_bit) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 247 | { |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 248 | char *domain = NULL; |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 249 | int type = 0, norebind = 0; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 250 | struct all_addr *addrp = NULL; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 251 | unsigned int flags = 0; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 252 | struct server *start = NULL; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 253 | #ifdef HAVE_DNSSEC |
| 254 | void *hash = hash_questions(header, plen, daemon->namebuff); |
| 255 | #else |
| 256 | unsigned int crc = questions_crc(header, plen, daemon->namebuff); |
| 257 | void *hash = &crc; |
| 258 | #endif |
| 259 | unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL); |
| 260 | |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 261 | (void)do_bit; |
| 262 | |
Simon Kelley | 3d8df26 | 2005-08-29 12:19:27 +0100 | [diff] [blame] | 263 | /* may be no servers available. */ |
| 264 | if (!daemon->servers) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 265 | forward = NULL; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 266 | else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash)))) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 267 | { |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 268 | #ifdef HAVE_DNSSEC |
Simon Kelley | dac7431 | 2014-02-13 16:43:49 +0000 | [diff] [blame] | 269 | /* If we've already got an answer to this query, but we're awaiting keys for validation, |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 270 | there's no point retrying the query, retry the key query instead...... */ |
| 271 | if (forward->blocking_query) |
| 272 | { |
| 273 | int fd; |
| 274 | |
| 275 | while (forward->blocking_query) |
| 276 | forward = forward->blocking_query; |
| 277 | |
| 278 | blockdata_retrieve(forward->stash, forward->stash_len, (void *)header); |
| 279 | plen = forward->stash_len; |
| 280 | |
Simon Kelley | 2b29191 | 2014-03-21 11:13:55 +0000 | [diff] [blame] | 281 | if (forward->sentto->addr.sa.sa_family == AF_INET) |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 282 | log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec"); |
| 283 | #ifdef HAVE_IPV6 |
| 284 | else |
| 285 | log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec"); |
| 286 | #endif |
| 287 | |
| 288 | if (forward->sentto->sfd) |
| 289 | fd = forward->sentto->sfd->fd; |
| 290 | else |
| 291 | { |
| 292 | #ifdef HAVE_IPV6 |
| 293 | if (forward->sentto->addr.sa.sa_family == AF_INET6) |
| 294 | fd = forward->rfd6->fd; |
| 295 | else |
| 296 | #endif |
| 297 | fd = forward->rfd4->fd; |
| 298 | } |
| 299 | |
| 300 | while (sendto(fd, (char *)header, plen, 0, |
| 301 | &forward->sentto->addr.sa, |
Simon Kelley | 2b29191 | 2014-03-21 11:13:55 +0000 | [diff] [blame] | 302 | sa_len(&forward->sentto->addr)) == -1 && retry_send()); |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 303 | |
| 304 | return 1; |
| 305 | } |
| 306 | #endif |
| 307 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 308 | /* retry on existing query, send to all available servers */ |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 309 | domain = forward->sentto->domain; |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 310 | forward->sentto->failed_queries++; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 311 | if (!option_bool(OPT_ORDER)) |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 312 | { |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 313 | forward->forwardall = 1; |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 314 | daemon->last_server = NULL; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 315 | } |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 316 | type = forward->sentto->flags & SERV_TYPE; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 317 | if (!(start = forward->sentto->next)) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 318 | start = daemon->servers; /* at end of list, recycle */ |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 319 | header->id = htons(forward->new_id); |
| 320 | } |
| 321 | else |
| 322 | { |
| 323 | if (gotname) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 324 | flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind); |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 325 | |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 326 | if (!flags && !(forward = get_new_frec(now, NULL, 0))) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 327 | /* table full - server failure. */ |
| 328 | flags = F_NEG; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 329 | |
| 330 | if (forward) |
| 331 | { |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 332 | forward->source = *udpaddr; |
| 333 | forward->dest = *dst_addr; |
| 334 | forward->iface = dst_iface; |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 335 | forward->orig_id = ntohs(header->id); |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 336 | forward->new_id = get_id(); |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 337 | forward->fd = udpfd; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 338 | memcpy(forward->hash, hash, HASH_SIZE); |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 339 | forward->forwardall = 0; |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 340 | forward->flags = 0; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 341 | if (norebind) |
| 342 | forward->flags |= FREC_NOREBIND; |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 343 | if (header->hb4 & HB4_CD) |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 344 | forward->flags |= FREC_CHECKING_DISABLED; |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 345 | if (ad_reqd) |
| 346 | forward->flags |= FREC_AD_QUESTION; |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 347 | #ifdef HAVE_DNSSEC |
| 348 | forward->work_counter = DNSSEC_WORK; |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 349 | if (do_bit) |
| 350 | forward->flags |= FREC_DO_QUESTION; |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 351 | #endif |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 352 | |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 353 | header->id = htons(forward->new_id); |
| 354 | |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 355 | /* In strict_order mode, always try servers in the order |
| 356 | specified in resolv.conf, if a domain is given |
| 357 | always try all the available servers, |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 358 | otherwise, use the one last known to work. */ |
| 359 | |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 360 | if (type == 0) |
| 361 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 362 | if (option_bool(OPT_ORDER)) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 363 | start = daemon->servers; |
| 364 | else if (!(start = daemon->last_server) || |
| 365 | daemon->forwardcount++ > FORWARD_TEST || |
| 366 | difftime(now, daemon->forwardtime) > FORWARD_TIME) |
| 367 | { |
| 368 | start = daemon->servers; |
| 369 | forward->forwardall = 1; |
| 370 | daemon->forwardcount = 0; |
| 371 | daemon->forwardtime = now; |
| 372 | } |
| 373 | } |
| 374 | else |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 375 | { |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 376 | start = daemon->servers; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 377 | if (!option_bool(OPT_ORDER)) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 378 | forward->forwardall = 1; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 379 | } |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 380 | } |
| 381 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 382 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 383 | /* check for send errors here (no route to host) |
| 384 | if we fail to send to all nameservers, send back an error |
| 385 | packet straight away (helps modem users when offline) */ |
| 386 | |
| 387 | if (!flags && forward) |
| 388 | { |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 389 | struct server *firstsentto = start; |
| 390 | int forwarded = 0; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 391 | |
Giacomo Tazzari | 797a7af | 2013-04-22 13:16:37 +0100 | [diff] [blame] | 392 | if (option_bool(OPT_ADD_MAC)) |
Simon Kelley | 60b6806 | 2014-01-08 12:10:28 +0000 | [diff] [blame] | 393 | plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source); |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 394 | |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 395 | if (option_bool(OPT_CLIENT_SUBNET)) |
| 396 | { |
Simon Kelley | 60b6806 | 2014-01-08 12:10:28 +0000 | [diff] [blame] | 397 | size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source); |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 398 | if (new != plen) |
| 399 | { |
| 400 | plen = new; |
| 401 | forward->flags |= FREC_HAS_SUBNET; |
| 402 | } |
| 403 | } |
| 404 | |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 405 | #ifdef HAVE_DNSSEC |
| 406 | if (option_bool(OPT_DNSSEC_VALID)) |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 407 | { |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 408 | size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz); |
| 409 | |
Simon Kelley | 5b3bf92 | 2014-01-25 17:03:07 +0000 | [diff] [blame] | 410 | /* For debugging, set Checking Disabled, otherwise, have the upstream check too, |
| 411 | this allows it to select auth servers when one is returning bad data. */ |
| 412 | if (option_bool(OPT_DNSSEC_DEBUG)) |
| 413 | header->hb4 |= HB4_CD; |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 414 | |
| 415 | if (new_plen != plen) |
| 416 | forward->flags |= FREC_ADDED_PHEADER; |
| 417 | |
| 418 | plen = new_plen; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 419 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 420 | #endif |
| 421 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 422 | while (1) |
| 423 | { |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 424 | /* only send to servers dealing with our domain. |
| 425 | domain may be NULL, in which case server->domain |
| 426 | must be NULL also. */ |
| 427 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 428 | if (type == (start->flags & SERV_TYPE) && |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 429 | (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) && |
| 430 | !(start->flags & SERV_LITERAL_ADDRESS)) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 431 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 432 | int fd; |
| 433 | |
| 434 | /* find server socket to use, may need to get random one. */ |
| 435 | if (start->sfd) |
| 436 | fd = start->sfd->fd; |
| 437 | else |
| 438 | { |
| 439 | #ifdef HAVE_IPV6 |
| 440 | if (start->addr.sa.sa_family == AF_INET6) |
| 441 | { |
| 442 | if (!forward->rfd6 && |
| 443 | !(forward->rfd6 = allocate_rfd(AF_INET6))) |
| 444 | break; |
Simon Kelley | 3927da4 | 2008-07-20 15:10:39 +0100 | [diff] [blame] | 445 | daemon->rfd_save = forward->rfd6; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 446 | fd = forward->rfd6->fd; |
| 447 | } |
| 448 | else |
| 449 | #endif |
| 450 | { |
| 451 | if (!forward->rfd4 && |
| 452 | !(forward->rfd4 = allocate_rfd(AF_INET))) |
| 453 | break; |
Simon Kelley | 3927da4 | 2008-07-20 15:10:39 +0100 | [diff] [blame] | 454 | daemon->rfd_save = forward->rfd4; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 455 | fd = forward->rfd4->fd; |
| 456 | } |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 457 | |
| 458 | #ifdef HAVE_CONNTRACK |
| 459 | /* Copy connection mark of incoming query to outgoing connection. */ |
| 460 | if (option_bool(OPT_CONNTRACK)) |
| 461 | { |
| 462 | unsigned int mark; |
Giacomo Tazzari | 797a7af | 2013-04-22 13:16:37 +0100 | [diff] [blame] | 463 | if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark)) |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 464 | setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); |
| 465 | } |
| 466 | #endif |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 467 | } |
| 468 | |
| 469 | if (sendto(fd, (char *)header, plen, 0, |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 470 | &start->addr.sa, |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 471 | sa_len(&start->addr)) == -1) |
| 472 | { |
| 473 | if (retry_send()) |
| 474 | continue; |
| 475 | } |
| 476 | else |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 477 | { |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 478 | /* Keep info in case we want to re-send this packet */ |
| 479 | daemon->srv_save = start; |
| 480 | daemon->packet_len = plen; |
| 481 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 482 | if (!gotname) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 483 | strcpy(daemon->namebuff, "query"); |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 484 | if (start->addr.sa.sa_family == AF_INET) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 485 | log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff, |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 486 | (struct all_addr *)&start->addr.in.sin_addr, NULL); |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 487 | #ifdef HAVE_IPV6 |
| 488 | else |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 489 | log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff, |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 490 | (struct all_addr *)&start->addr.in6.sin6_addr, NULL); |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 491 | #endif |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 492 | start->queries++; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 493 | forwarded = 1; |
| 494 | forward->sentto = start; |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 495 | if (!forward->forwardall) |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 496 | break; |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 497 | forward->forwardall++; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 498 | } |
| 499 | } |
| 500 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 501 | if (!(start = start->next)) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 502 | start = daemon->servers; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 503 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 504 | if (start == firstsentto) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 505 | break; |
| 506 | } |
| 507 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 508 | if (forwarded) |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 509 | return 1; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 510 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 511 | /* could not send on, prepare to return */ |
| 512 | header->id = htons(forward->orig_id); |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 513 | free_frec(forward); /* cancel */ |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 514 | } |
| 515 | |
| 516 | /* could not send on, return empty answer or address if known for whole domain */ |
Simon Kelley | b8187c8 | 2005-11-26 21:46:27 +0000 | [diff] [blame] | 517 | if (udpfd != -1) |
| 518 | { |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 519 | plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl); |
Simon Kelley | 54dd393 | 2012-06-20 11:23:38 +0100 | [diff] [blame] | 520 | send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface); |
Simon Kelley | b8187c8 | 2005-11-26 21:46:27 +0000 | [diff] [blame] | 521 | } |
| 522 | |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 523 | return 0; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 524 | } |
| 525 | |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 526 | static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 527 | int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 528 | { |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 529 | unsigned char *pheader, *sizep; |
Jason A. Donenfeld | 13d86c7 | 2013-02-22 18:20:53 +0000 | [diff] [blame] | 530 | char **sets = 0; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 531 | int munged = 0, is_sign; |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 532 | size_t plen; |
| 533 | |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 534 | (void)ad_reqd; |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 535 | (void) do_bit; |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 536 | |
Jason A. Donenfeld | 13d86c7 | 2013-02-22 18:20:53 +0000 | [diff] [blame] | 537 | #ifdef HAVE_IPSET |
| 538 | /* Similar algorithm to search_servers. */ |
| 539 | struct ipsets *ipset_pos; |
| 540 | unsigned int namelen = strlen(daemon->namebuff); |
| 541 | unsigned int matchlen = 0; |
| 542 | for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next) |
| 543 | { |
| 544 | unsigned int domainlen = strlen(ipset_pos->domain); |
| 545 | char *matchstart = daemon->namebuff + namelen - domainlen; |
| 546 | if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) && |
| 547 | (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) && |
Simon Kelley | 6c0cb85 | 2014-01-17 14:40:46 +0000 | [diff] [blame] | 548 | domainlen >= matchlen) |
| 549 | { |
| 550 | matchlen = domainlen; |
| 551 | sets = ipset_pos->sets; |
| 552 | } |
Jason A. Donenfeld | 13d86c7 | 2013-02-22 18:20:53 +0000 | [diff] [blame] | 553 | } |
| 554 | #endif |
| 555 | |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 556 | /* If upstream is advertising a larger UDP packet size |
Simon Kelley | 9009d74 | 2008-11-14 20:04:27 +0000 | [diff] [blame] | 557 | than we allow, trim it so that we don't get overlarge |
| 558 | requests for the client. We can't do this for signed packets. */ |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 559 | |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 560 | if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign))) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 561 | { |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 562 | unsigned short udpsz; |
| 563 | unsigned char *psave = sizep; |
| 564 | |
| 565 | GETSHORT(udpsz, sizep); |
| 566 | |
| 567 | if (!is_sign && udpsz > daemon->edns_pktsz) |
| 568 | PUTSHORT(daemon->edns_pktsz, psave); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 569 | |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 570 | if (check_subnet && !check_source(header, plen, pheader, query_source)) |
| 571 | { |
| 572 | my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch")); |
| 573 | return 0; |
| 574 | } |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 575 | |
| 576 | if (added_pheader) |
| 577 | { |
| 578 | pheader = 0; |
| 579 | header->arcount = htons(0); |
| 580 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 581 | } |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 582 | |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 583 | /* RFC 4035 sect 4.6 para 3 */ |
Giovanni Bajo | 237724c | 2012-04-05 02:46:52 +0200 | [diff] [blame] | 584 | if (!is_sign && !option_bool(OPT_DNSSEC_PROXY)) |
Simon Kelley | 795501b | 2014-01-08 18:11:55 +0000 | [diff] [blame] | 585 | header->hb4 &= ~HB4_AD; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 586 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 587 | if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN)) |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 588 | return n; |
| 589 | |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 590 | /* Complain loudly if the upstream server is non-recursive. */ |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 591 | if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 && |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 592 | server && !(server->flags & SERV_WARNED_RECURSIVE)) |
| 593 | { |
Simon Kelley | 3d8df26 | 2005-08-29 12:19:27 +0100 | [diff] [blame] | 594 | prettyprint_addr(&server->addr, daemon->namebuff); |
Simon Kelley | f2621c7 | 2007-04-29 19:47:21 +0100 | [diff] [blame] | 595 | my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff); |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 596 | if (!option_bool(OPT_LOG)) |
Simon Kelley | 0a85254 | 2005-03-23 20:28:59 +0000 | [diff] [blame] | 597 | server->flags |= SERV_WARNED_RECURSIVE; |
| 598 | } |
Giovanni Bajo | e292e93 | 2012-04-22 14:32:02 +0200 | [diff] [blame] | 599 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 600 | if (daemon->bogus_addr && RCODE(header) != NXDOMAIN && |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 601 | check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now)) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 602 | { |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 603 | munged = 1; |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 604 | SET_RCODE(header, NXDOMAIN); |
| 605 | header->hb3 &= ~HB3_AA; |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 606 | cache_secure = 0; |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 607 | } |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 608 | else |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 609 | { |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 610 | int doctored = 0; |
| 611 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 612 | if (RCODE(header) == NXDOMAIN && |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 613 | extract_request(header, n, daemon->namebuff, NULL) && |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 614 | check_for_local_domain(daemon->namebuff, now)) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 615 | { |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 616 | /* if we forwarded a query for a locally known name (because it was for |
| 617 | an unknown type) and the answer is NXDOMAIN, convert that to NODATA, |
| 618 | since we know that the domain exists, even if upstream doesn't */ |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 619 | munged = 1; |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 620 | header->hb3 |= HB3_AA; |
| 621 | SET_RCODE(header, NOERROR); |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 622 | cache_secure = 0; |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 623 | } |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 624 | |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 625 | if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored)) |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 626 | { |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 627 | my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff); |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 628 | munged = 1; |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 629 | cache_secure = 0; |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 630 | } |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 631 | |
| 632 | if (doctored) |
| 633 | cache_secure = 0; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 634 | } |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 635 | |
Simon Kelley | a25720a | 2014-01-14 23:13:55 +0000 | [diff] [blame] | 636 | #ifdef HAVE_DNSSEC |
| 637 | if (no_cache && !(header->hb4 & HB4_CD)) |
| 638 | { |
Simon Kelley | 7d23a66 | 2014-01-26 09:33:21 +0000 | [diff] [blame] | 639 | if (!option_bool(OPT_DNSSEC_DEBUG)) |
Simon Kelley | a25720a | 2014-01-14 23:13:55 +0000 | [diff] [blame] | 640 | { |
| 641 | /* Bogus reply, turn into SERVFAIL */ |
| 642 | SET_RCODE(header, SERVFAIL); |
| 643 | munged = 1; |
| 644 | } |
| 645 | } |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 646 | |
| 647 | if (option_bool(OPT_DNSSEC_VALID)) |
| 648 | header->hb4 &= ~HB4_AD; |
| 649 | |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 650 | if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure) |
Simon Kelley | 6938f34 | 2014-01-26 22:47:39 +0000 | [diff] [blame] | 651 | header->hb4 |= HB4_AD; |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 652 | |
| 653 | /* If the requestor didn't set the DO bit, don't return DNSSEC info. */ |
| 654 | if (!do_bit) |
| 655 | n = filter_rrsigs(header, n); |
Simon Kelley | a25720a | 2014-01-14 23:13:55 +0000 | [diff] [blame] | 656 | #endif |
| 657 | |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 658 | /* do this after extract_addresses. Ensure NODATA reply and remove |
| 659 | nameserver info. */ |
| 660 | |
| 661 | if (munged) |
| 662 | { |
| 663 | header->ancount = htons(0); |
| 664 | header->nscount = htons(0); |
| 665 | header->arcount = htons(0); |
| 666 | } |
| 667 | |
Simon Kelley | 36717ee | 2004-09-20 19:20:58 +0100 | [diff] [blame] | 668 | /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide |
| 669 | sections of the packet. Find the new length here and put back pseudoheader |
| 670 | if it was removed. */ |
| 671 | return resize_packet(header, n, pheader, plen); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 672 | } |
| 673 | |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 674 | /* sets new last_server */ |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 675 | void reply_query(int fd, int family, time_t now) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 676 | { |
| 677 | /* packet from peer server, extract data for cache, and send to |
| 678 | original requester */ |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 679 | struct dns_header *header; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 680 | union mysockaddr serveraddr; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 681 | struct frec *forward; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 682 | socklen_t addrlen = sizeof(serveraddr); |
Simon Kelley | 60b6806 | 2014-01-08 12:10:28 +0000 | [diff] [blame] | 683 | ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen); |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 684 | size_t nn; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 685 | struct server *server; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 686 | void *hash; |
| 687 | #ifndef HAVE_DNSSEC |
| 688 | unsigned int crc; |
| 689 | #endif |
| 690 | |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 691 | /* packet buffer overwritten */ |
| 692 | daemon->srv_save = NULL; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 693 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 694 | /* Determine the address of the server replying so that we can mark that as good */ |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 695 | serveraddr.sa.sa_family = family; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 696 | #ifdef HAVE_IPV6 |
| 697 | if (serveraddr.sa.sa_family == AF_INET6) |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 698 | serveraddr.in6.sin6_flowinfo = 0; |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 699 | #endif |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 700 | |
Simon Kelley | 490f907 | 2014-03-24 22:04:42 +0000 | [diff] [blame^] | 701 | header = (struct dns_header *)daemon->packet; |
| 702 | |
| 703 | if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR)) |
| 704 | return; |
| 705 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 706 | /* spoof check: answer must come from known server, */ |
| 707 | for (server = daemon->servers; server; server = server->next) |
| 708 | if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) && |
| 709 | sockaddr_isequal(&server->addr, &serveraddr)) |
| 710 | break; |
Simon Kelley | 490f907 | 2014-03-24 22:04:42 +0000 | [diff] [blame^] | 711 | |
| 712 | if (!server) |
| 713 | return; |
| 714 | |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 715 | #ifdef HAVE_DNSSEC |
| 716 | hash = hash_questions(header, n, daemon->namebuff); |
| 717 | #else |
| 718 | hash = &crc; |
| 719 | crc = questions_crc(header, n, daemon->namebuff); |
| 720 | #endif |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 721 | |
Simon Kelley | 490f907 | 2014-03-24 22:04:42 +0000 | [diff] [blame^] | 722 | if (!(forward = lookup_frec(ntohs(header->id), hash))) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 723 | return; |
Simon Kelley | 490f907 | 2014-03-24 22:04:42 +0000 | [diff] [blame^] | 724 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 725 | if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) && |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 726 | !option_bool(OPT_ORDER) && |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 727 | forward->forwardall == 0) |
| 728 | /* for broken servers, attempt to send to another one. */ |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 729 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 730 | unsigned char *pheader; |
| 731 | size_t plen; |
| 732 | int is_sign; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 733 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 734 | /* recreate query from reply */ |
| 735 | pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign); |
| 736 | if (!is_sign) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 737 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 738 | header->ancount = htons(0); |
| 739 | header->nscount = htons(0); |
| 740 | header->arcount = htons(0); |
| 741 | if ((nn = resize_packet(header, (size_t)n, pheader, plen))) |
| 742 | { |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 743 | header->hb3 &= ~(HB3_QR | HB3_TC); |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 744 | forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0); |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 745 | return; |
| 746 | } |
| 747 | } |
| 748 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 749 | |
| 750 | server = forward->sentto; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 751 | |
| 752 | if ((forward->sentto->flags & SERV_TYPE) == 0) |
| 753 | { |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 754 | if (RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 755 | server = NULL; |
| 756 | else |
| 757 | { |
| 758 | struct server *last_server; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 759 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 760 | /* find good server by address if possible, otherwise assume the last one we sent to */ |
| 761 | for (last_server = daemon->servers; last_server; last_server = last_server->next) |
| 762 | if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) && |
| 763 | sockaddr_isequal(&last_server->addr, &serveraddr)) |
| 764 | { |
| 765 | server = last_server; |
| 766 | break; |
| 767 | } |
| 768 | } |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 769 | if (!option_bool(OPT_ALL_SERVERS)) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 770 | daemon->last_server = server; |
| 771 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 772 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 773 | /* If the answer is an error, keep the forward record in place in case |
| 774 | we get a good reply from another server. Kill it when we've |
| 775 | had replies from all to avoid filling the forwarding table when |
| 776 | everything is broken */ |
| 777 | if (forward->forwardall == 0 || --forward->forwardall == 1 || |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 778 | (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL)) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 779 | { |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 780 | int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0; |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 781 | |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 782 | if (option_bool(OPT_NO_REBIND)) |
| 783 | check_rebind = !(forward->flags & FREC_NOREBIND); |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 784 | |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 785 | /* Don't cache replies where DNSSEC validation was turned off, either |
| 786 | the upstream server told us so, or the original query specified it. */ |
| 787 | if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED)) |
| 788 | no_cache_dnssec = 1; |
| 789 | |
| 790 | #ifdef HAVE_DNSSEC |
| 791 | if (option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED)) |
| 792 | { |
Simon Kelley | 9d63304 | 2013-12-13 15:36:55 +0000 | [diff] [blame] | 793 | int status; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 794 | |
| 795 | /* We've had a reply already, which we're validating. Ignore this duplicate */ |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 796 | if (forward->blocking_query) |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 797 | return; |
Simon Kelley | 9d63304 | 2013-12-13 15:36:55 +0000 | [diff] [blame] | 798 | |
Simon Kelley | 871417d | 2014-01-08 11:22:32 +0000 | [diff] [blame] | 799 | if (header->hb3 & HB3_TC) |
| 800 | { |
| 801 | /* Truncated answer can't be validated. |
Simon Kelley | 5d3b87a | 2014-01-20 11:57:23 +0000 | [diff] [blame] | 802 | If this is an answer to a DNSSEC-generated query, we still |
| 803 | need to get the client to retry over TCP, so return |
| 804 | an answer with the TC bit set, even if the actual answer fits. |
| 805 | */ |
| 806 | status = STAT_TRUNCATED; |
Simon Kelley | 871417d | 2014-01-08 11:22:32 +0000 | [diff] [blame] | 807 | } |
| 808 | else if (forward->flags & FREC_DNSKEY_QUERY) |
Simon Kelley | 8d718cb | 2014-02-03 16:27:37 +0000 | [diff] [blame] | 809 | status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
Simon Kelley | c3e0b9b | 2013-12-31 13:50:39 +0000 | [diff] [blame] | 810 | else if (forward->flags & FREC_DS_QUERY) |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 811 | { |
| 812 | status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
| 813 | if (status == STAT_NO_DS) |
| 814 | status = STAT_INSECURE; |
| 815 | } |
| 816 | else if (forward->flags & FREC_CHECK_NOSIGN) |
| 817 | status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
Simon Kelley | 9d63304 | 2013-12-13 15:36:55 +0000 | [diff] [blame] | 818 | else |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 819 | { |
| 820 | status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL); |
| 821 | if (status == STAT_NO_SIG) |
| 822 | { |
| 823 | if (option_bool(OPT_DNSSEC_NO_SIGN)) |
| 824 | status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname); |
| 825 | else |
| 826 | status = STAT_INSECURE; |
| 827 | } |
| 828 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 829 | /* Can't validate, as we're missing key data. Put this |
| 830 | answer aside, whilst we get that. */ |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 831 | if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY) |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 832 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 833 | struct frec *new, *orig; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 834 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 835 | /* Free any saved query */ |
| 836 | if (forward->stash) |
| 837 | blockdata_free(forward->stash); |
| 838 | |
| 839 | /* Now save reply pending receipt of key data */ |
| 840 | if (!(forward->stash = blockdata_alloc((char *)header, n))) |
| 841 | return; |
| 842 | forward->stash_len = n; |
| 843 | |
| 844 | anotherkey: |
| 845 | /* Find the original query that started it all.... */ |
| 846 | for (orig = forward; orig->dependent; orig = orig->dependent); |
| 847 | |
| 848 | if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1))) |
| 849 | status = STAT_INSECURE; |
| 850 | else |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 851 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 852 | int fd; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 853 | struct frec *next = new->next; |
| 854 | *new = *forward; /* copy everything, then overwrite */ |
| 855 | new->next = next; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 856 | new->blocking_query = NULL; |
Simon Kelley | f1668d2 | 2014-01-08 16:53:27 +0000 | [diff] [blame] | 857 | new->rfd4 = NULL; |
| 858 | #ifdef HAVE_IPV6 |
| 859 | new->rfd6 = NULL; |
| 860 | #endif |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 861 | new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN); |
Simon Kelley | 9d63304 | 2013-12-13 15:36:55 +0000 | [diff] [blame] | 862 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 863 | new->dependent = forward; /* to find query awaiting new one. */ |
| 864 | forward->blocking_query = new; /* for garbage cleaning */ |
| 865 | /* validate routines leave name of required record in daemon->keyname */ |
| 866 | if (status == STAT_NEED_KEY) |
| 867 | { |
| 868 | new->flags |= FREC_DNSKEY_QUERY; |
| 869 | nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz, |
| 870 | daemon->keyname, forward->class, T_DNSKEY, &server->addr); |
| 871 | } |
| 872 | else |
| 873 | { |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 874 | if (status == STAT_NEED_DS_NEG) |
| 875 | new->flags |= FREC_CHECK_NOSIGN; |
| 876 | else |
| 877 | new->flags |= FREC_DS_QUERY; |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 878 | nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz, |
| 879 | daemon->keyname, forward->class, T_DS, &server->addr); |
| 880 | } |
| 881 | if ((hash = hash_questions(header, nn, daemon->namebuff))) |
| 882 | memcpy(new->hash, hash, HASH_SIZE); |
| 883 | new->new_id = get_id(); |
| 884 | header->id = htons(new->new_id); |
| 885 | /* Save query for retransmission */ |
| 886 | new->stash = blockdata_alloc((char *)header, nn); |
| 887 | new->stash_len = nn; |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 888 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 889 | /* Don't resend this. */ |
| 890 | daemon->srv_save = NULL; |
| 891 | |
| 892 | if (server->sfd) |
| 893 | fd = server->sfd->fd; |
Simon Kelley | e0c0ad3 | 2014-01-16 22:42:07 +0000 | [diff] [blame] | 894 | else |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 895 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 896 | fd = -1; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 897 | #ifdef HAVE_IPV6 |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 898 | if (server->addr.sa.sa_family == AF_INET6) |
Simon Kelley | f1668d2 | 2014-01-08 16:53:27 +0000 | [diff] [blame] | 899 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 900 | if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6))) |
| 901 | fd = new->rfd6->fd; |
| 902 | } |
| 903 | else |
| 904 | #endif |
| 905 | { |
| 906 | if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET))) |
| 907 | fd = new->rfd4->fd; |
Simon Kelley | f1668d2 | 2014-01-08 16:53:27 +0000 | [diff] [blame] | 908 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 909 | } |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 910 | |
| 911 | if (fd != -1) |
| 912 | { |
| 913 | while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send()); |
| 914 | server->queries++; |
| 915 | } |
| 916 | |
| 917 | return; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 918 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 919 | } |
| 920 | |
| 921 | /* Ok, we reached far enough up the chain-of-trust that we can validate something. |
| 922 | Now wind back down, pulling back answers which wouldn't previously validate |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 923 | and validate them with the new data. Note that if an answer needs multiple |
| 924 | keys to validate, we may find another key is needed, in which case we set off |
| 925 | down another branch of the tree. Once we get to the original answer |
| 926 | (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */ |
Simon Kelley | 0744ca6 | 2014-01-25 16:40:15 +0000 | [diff] [blame] | 927 | while (forward->dependent) |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 928 | { |
Simon Kelley | 0744ca6 | 2014-01-25 16:40:15 +0000 | [diff] [blame] | 929 | struct frec *prev = forward->dependent; |
| 930 | free_frec(forward); |
| 931 | forward = prev; |
| 932 | forward->blocking_query = NULL; /* already gone */ |
| 933 | blockdata_retrieve(forward->stash, forward->stash_len, (void *)header); |
| 934 | n = forward->stash_len; |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 935 | |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 936 | if (status == STAT_SECURE) |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 937 | { |
Simon Kelley | 0744ca6 | 2014-01-25 16:40:15 +0000 | [diff] [blame] | 938 | if (forward->flags & FREC_DNSKEY_QUERY) |
| 939 | status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
| 940 | else if (forward->flags & FREC_DS_QUERY) |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 941 | { |
| 942 | status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
| 943 | if (status == STAT_NO_DS) |
| 944 | status = STAT_INSECURE; |
| 945 | } |
| 946 | else if (forward->flags & FREC_CHECK_NOSIGN) |
| 947 | status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class); |
Simon Kelley | 0744ca6 | 2014-01-25 16:40:15 +0000 | [diff] [blame] | 948 | else |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 949 | { |
| 950 | status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL); |
| 951 | if (status == STAT_NO_SIG) |
| 952 | { |
| 953 | if (option_bool(OPT_DNSSEC_NO_SIGN)) |
| 954 | status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname); |
| 955 | else |
| 956 | status = STAT_INSECURE; |
| 957 | } |
| 958 | } |
| 959 | |
| 960 | if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY) |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 961 | goto anotherkey; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 962 | } |
| 963 | } |
Simon Kelley | 5d3b87a | 2014-01-20 11:57:23 +0000 | [diff] [blame] | 964 | |
| 965 | if (status == STAT_TRUNCATED) |
Simon Kelley | 0744ca6 | 2014-01-25 16:40:15 +0000 | [diff] [blame] | 966 | header->hb3 |= HB3_TC; |
Simon Kelley | 5d3b87a | 2014-01-20 11:57:23 +0000 | [diff] [blame] | 967 | else |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 968 | { |
| 969 | char *result; |
| 970 | |
| 971 | if (forward->work_counter == 0) |
| 972 | result = "ABANDONED"; |
| 973 | else |
| 974 | result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS")); |
| 975 | |
| 976 | log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result); |
| 977 | } |
Simon Kelley | 5d3b87a | 2014-01-20 11:57:23 +0000 | [diff] [blame] | 978 | |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 979 | no_cache_dnssec = 0; |
Simon Kelley | 5d3b87a | 2014-01-20 11:57:23 +0000 | [diff] [blame] | 980 | |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 981 | if (status == STAT_SECURE) |
| 982 | cache_secure = 1; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 983 | else if (status == STAT_BOGUS) |
| 984 | no_cache_dnssec = 1; |
| 985 | } |
Simon Kelley | 83349b8 | 2014-02-10 21:02:01 +0000 | [diff] [blame] | 986 | #endif |
| 987 | |
| 988 | /* restore CD bit to the value in the query */ |
| 989 | if (forward->flags & FREC_CHECKING_DISABLED) |
| 990 | header->hb4 |= HB4_CD; |
| 991 | else |
| 992 | header->hb4 &= ~HB4_CD; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 993 | |
| 994 | if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 995 | forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION, |
| 996 | forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source))) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 997 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 998 | header->id = htons(forward->orig_id); |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 999 | header->hb4 |= HB4_RA; /* recursion if available */ |
Simon Kelley | 54dd393 | 2012-06-20 11:23:38 +0100 | [diff] [blame] | 1000 | send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, |
Simon Kelley | 50303b1 | 2012-04-04 22:13:17 +0100 | [diff] [blame] | 1001 | &forward->source, &forward->dest, forward->iface); |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 1002 | } |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1003 | free_frec(forward); /* cancel */ |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1004 | } |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1005 | } |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1006 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1007 | |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 1008 | void receive_query(struct listener *listen, time_t now) |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1009 | { |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 1010 | struct dns_header *header = (struct dns_header *)daemon->packet; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1011 | union mysockaddr source_addr; |
Simon Kelley | c1bb850 | 2004-08-11 18:40:17 +0100 | [diff] [blame] | 1012 | unsigned short type; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1013 | struct all_addr dst_addr; |
Simon Kelley | f6b7dc4 | 2005-01-23 12:06:08 +0000 | [diff] [blame] | 1014 | struct in_addr netmask, dst_addr_4; |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 1015 | size_t m; |
| 1016 | ssize_t n; |
Vladislav Grishenko | 3b19596 | 2013-11-26 11:08:21 +0000 | [diff] [blame] | 1017 | int if_index = 0, auth_dns = 0; |
| 1018 | #ifdef HAVE_AUTH |
| 1019 | int local_auth = 0; |
| 1020 | #endif |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1021 | struct iovec iov[1]; |
| 1022 | struct msghdr msg; |
| 1023 | struct cmsghdr *cmptr; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1024 | union { |
| 1025 | struct cmsghdr align; /* this ensures alignment */ |
| 1026 | #ifdef HAVE_IPV6 |
| 1027 | char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))]; |
| 1028 | #endif |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 1029 | #if defined(HAVE_LINUX_NETWORK) |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1030 | char control[CMSG_SPACE(sizeof(struct in_pktinfo))]; |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 1031 | #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK) |
| 1032 | char control[CMSG_SPACE(sizeof(struct in_addr)) + |
| 1033 | CMSG_SPACE(sizeof(unsigned int))]; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1034 | #elif defined(IP_RECVDSTADDR) |
| 1035 | char control[CMSG_SPACE(sizeof(struct in_addr)) + |
| 1036 | CMSG_SPACE(sizeof(struct sockaddr_dl))]; |
| 1037 | #endif |
| 1038 | } control_u; |
Simon Kelley | 2329bef | 2013-12-03 13:41:16 +0000 | [diff] [blame] | 1039 | #ifdef HAVE_IPV6 |
| 1040 | /* Can always get recvd interface for IPv6 */ |
| 1041 | int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6; |
| 1042 | #else |
| 1043 | int check_dst = !option_bool(OPT_NOWILD); |
| 1044 | #endif |
| 1045 | |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 1046 | /* packet buffer overwritten */ |
| 1047 | daemon->srv_save = NULL; |
| 1048 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1049 | dst_addr_4.s_addr = 0; |
| 1050 | netmask.s_addr = 0; |
| 1051 | |
Simon Kelley | 7e5664b | 2013-04-05 16:57:41 +0100 | [diff] [blame] | 1052 | if (option_bool(OPT_NOWILD) && listen->iface) |
Simon Kelley | f6b7dc4 | 2005-01-23 12:06:08 +0000 | [diff] [blame] | 1053 | { |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1054 | auth_dns = listen->iface->dns_auth; |
| 1055 | |
| 1056 | if (listen->family == AF_INET) |
| 1057 | { |
| 1058 | dst_addr_4 = listen->iface->addr.in.sin_addr; |
| 1059 | netmask = listen->iface->netmask; |
| 1060 | } |
Simon Kelley | f6b7dc4 | 2005-01-23 12:06:08 +0000 | [diff] [blame] | 1061 | } |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1062 | |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1063 | iov[0].iov_base = daemon->packet; |
| 1064 | iov[0].iov_len = daemon->edns_pktsz; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1065 | |
| 1066 | msg.msg_control = control_u.control; |
| 1067 | msg.msg_controllen = sizeof(control_u); |
| 1068 | msg.msg_flags = 0; |
| 1069 | msg.msg_name = &source_addr; |
| 1070 | msg.msg_namelen = sizeof(source_addr); |
| 1071 | msg.msg_iov = iov; |
| 1072 | msg.msg_iovlen = 1; |
| 1073 | |
Simon Kelley | de37951 | 2004-06-22 20:23:33 +0100 | [diff] [blame] | 1074 | if ((n = recvmsg(listen->fd, &msg, 0)) == -1) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1075 | return; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1076 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 1077 | if (n < (int)sizeof(struct dns_header) || |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 1078 | (msg.msg_flags & MSG_TRUNC) || |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 1079 | (header->hb3 & HB3_QR)) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1080 | return; |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1081 | |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1082 | source_addr.sa.sa_family = listen->family; |
Simon Kelley | 2a7a2b8 | 2014-03-22 19:18:06 +0000 | [diff] [blame] | 1083 | |
| 1084 | if (listen->family == AF_INET) |
| 1085 | { |
| 1086 | /* Source-port == 0 is an error, we can't send back to that. |
| 1087 | http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */ |
| 1088 | if (source_addr.in.sin_port == 0) |
| 1089 | return; |
| 1090 | } |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1091 | #ifdef HAVE_IPV6 |
Simon Kelley | 2a7a2b8 | 2014-03-22 19:18:06 +0000 | [diff] [blame] | 1092 | else |
| 1093 | { |
| 1094 | /* Source-port == 0 is an error, we can't send back to that. */ |
| 1095 | if (source_addr.in6.sin6_port == 0) |
| 1096 | return; |
| 1097 | source_addr.in6.sin6_flowinfo = 0; |
| 1098 | } |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1099 | #endif |
Simon Kelley | 2a7a2b8 | 2014-03-22 19:18:06 +0000 | [diff] [blame] | 1100 | |
Simon Kelley | c8a8048 | 2014-03-05 14:29:54 +0000 | [diff] [blame] | 1101 | /* We can be configured to only accept queries from at-most-one-hop-away addresses. */ |
| 1102 | if (option_bool(OPT_LOCAL_SERVICE)) |
| 1103 | { |
| 1104 | struct addrlist *addr; |
| 1105 | #ifdef HAVE_IPV6 |
| 1106 | if (listen->family == AF_INET6) |
| 1107 | { |
| 1108 | for (addr = daemon->interface_addrs; addr; addr = addr->next) |
| 1109 | if ((addr->flags & ADDRLIST_IPV6) && |
| 1110 | is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen)) |
| 1111 | break; |
| 1112 | } |
| 1113 | else |
| 1114 | #endif |
| 1115 | { |
| 1116 | struct in_addr netmask; |
| 1117 | for (addr = daemon->interface_addrs; addr; addr = addr->next) |
| 1118 | { |
| 1119 | netmask.s_addr = 0xffffffff << (32 - addr->prefixlen); |
| 1120 | if (!(addr->flags & ADDRLIST_IPV6) && |
| 1121 | is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask)) |
| 1122 | break; |
| 1123 | } |
| 1124 | } |
| 1125 | if (!addr) |
| 1126 | { |
Simon Kelley | 0c8584e | 2014-03-12 20:12:56 +0000 | [diff] [blame] | 1127 | static int warned = 0; |
| 1128 | if (!warned) |
| 1129 | { |
| 1130 | my_syslog(LOG_WARNING, _("Ignoring query from non-local network")); |
| 1131 | warned = 1; |
| 1132 | } |
Simon Kelley | c8a8048 | 2014-03-05 14:29:54 +0000 | [diff] [blame] | 1133 | return; |
| 1134 | } |
| 1135 | } |
| 1136 | |
Simon Kelley | 2329bef | 2013-12-03 13:41:16 +0000 | [diff] [blame] | 1137 | if (check_dst) |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1138 | { |
Simon Kelley | 8a911cc | 2004-03-16 18:35:52 +0000 | [diff] [blame] | 1139 | struct ifreq ifr; |
| 1140 | |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1141 | if (msg.msg_controllen < sizeof(struct cmsghdr)) |
| 1142 | return; |
| 1143 | |
Simon Kelley | 5e9e0ef | 2006-04-17 14:24:29 +0100 | [diff] [blame] | 1144 | #if defined(HAVE_LINUX_NETWORK) |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1145 | if (listen->family == AF_INET) |
| 1146 | for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) |
Simon Kelley | c72daea | 2012-01-05 21:33:27 +0000 | [diff] [blame] | 1147 | if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO) |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1148 | { |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 1149 | union { |
| 1150 | unsigned char *c; |
| 1151 | struct in_pktinfo *p; |
| 1152 | } p; |
| 1153 | p.c = CMSG_DATA(cmptr); |
| 1154 | dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst; |
| 1155 | if_index = p.p->ipi_ifindex; |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1156 | } |
| 1157 | #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF) |
| 1158 | if (listen->family == AF_INET) |
| 1159 | { |
| 1160 | for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 1161 | { |
| 1162 | union { |
| 1163 | unsigned char *c; |
| 1164 | unsigned int *i; |
| 1165 | struct in_addr *a; |
| 1166 | #ifndef HAVE_SOLARIS_NETWORK |
| 1167 | struct sockaddr_dl *s; |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 1168 | #endif |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 1169 | } p; |
| 1170 | p.c = CMSG_DATA(cmptr); |
| 1171 | if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR) |
| 1172 | dst_addr_4 = dst_addr.addr.addr4 = *(p.a); |
| 1173 | else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF) |
| 1174 | #ifdef HAVE_SOLARIS_NETWORK |
| 1175 | if_index = *(p.i); |
| 1176 | #else |
| 1177 | if_index = p.s->sdl_index; |
| 1178 | #endif |
| 1179 | } |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1180 | } |
| 1181 | #endif |
| 1182 | |
| 1183 | #ifdef HAVE_IPV6 |
| 1184 | if (listen->family == AF_INET6) |
| 1185 | { |
| 1186 | for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) |
Simon Kelley | c72daea | 2012-01-05 21:33:27 +0000 | [diff] [blame] | 1187 | if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo) |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1188 | { |
Simon Kelley | 8ef5ada | 2010-06-03 19:42:45 +0100 | [diff] [blame] | 1189 | union { |
| 1190 | unsigned char *c; |
| 1191 | struct in6_pktinfo *p; |
| 1192 | } p; |
| 1193 | p.c = CMSG_DATA(cmptr); |
| 1194 | |
| 1195 | dst_addr.addr.addr6 = p.p->ipi6_addr; |
| 1196 | if_index = p.p->ipi6_ifindex; |
Simon Kelley | 26128d2 | 2004-11-14 16:43:54 +0000 | [diff] [blame] | 1197 | } |
| 1198 | } |
| 1199 | #endif |
| 1200 | |
| 1201 | /* enforce available interface configuration */ |
| 1202 | |
Simon Kelley | e25db1f | 2013-01-29 22:10:26 +0000 | [diff] [blame] | 1203 | if (!indextoname(listen->fd, if_index, ifr.ifr_name)) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 1204 | return; |
| 1205 | |
Simon Kelley | e25db1f | 2013-01-29 22:10:26 +0000 | [diff] [blame] | 1206 | if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns)) |
| 1207 | { |
| 1208 | if (!option_bool(OPT_CLEVERBIND)) |
Simon Kelley | 115ac3e | 2013-05-20 11:28:32 +0100 | [diff] [blame] | 1209 | enumerate_interfaces(0); |
Simon Kelley | 3f2873d | 2013-05-14 11:28:47 +0100 | [diff] [blame] | 1210 | if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) && |
| 1211 | !label_exception(if_index, listen->family, &dst_addr)) |
Simon Kelley | e25db1f | 2013-01-29 22:10:26 +0000 | [diff] [blame] | 1212 | return; |
| 1213 | } |
| 1214 | |
Simon Kelley | 552af8b | 2012-02-29 20:10:31 +0000 | [diff] [blame] | 1215 | if (listen->family == AF_INET && option_bool(OPT_LOCALISE)) |
| 1216 | { |
| 1217 | struct irec *iface; |
| 1218 | |
| 1219 | /* get the netmask of the interface whch has the address we were sent to. |
| 1220 | This is no neccessarily the interface we arrived on. */ |
| 1221 | |
| 1222 | for (iface = daemon->interfaces; iface; iface = iface->next) |
| 1223 | if (iface->addr.sa.sa_family == AF_INET && |
| 1224 | iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr) |
| 1225 | break; |
| 1226 | |
| 1227 | /* interface may be new */ |
Simon Kelley | e25db1f | 2013-01-29 22:10:26 +0000 | [diff] [blame] | 1228 | if (!iface && !option_bool(OPT_CLEVERBIND)) |
Simon Kelley | 115ac3e | 2013-05-20 11:28:32 +0100 | [diff] [blame] | 1229 | enumerate_interfaces(0); |
Simon Kelley | 552af8b | 2012-02-29 20:10:31 +0000 | [diff] [blame] | 1230 | |
| 1231 | for (iface = daemon->interfaces; iface; iface = iface->next) |
| 1232 | if (iface->addr.sa.sa_family == AF_INET && |
| 1233 | iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr) |
| 1234 | break; |
| 1235 | |
| 1236 | /* If we failed, abandon localisation */ |
| 1237 | if (iface) |
| 1238 | netmask = iface->netmask; |
| 1239 | else |
| 1240 | dst_addr_4.s_addr = 0; |
| 1241 | } |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1242 | } |
| 1243 | |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 1244 | if (extract_request(header, (size_t)n, daemon->namebuff, &type)) |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1245 | { |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1246 | #ifdef HAVE_AUTH |
| 1247 | struct auth_zone *zone; |
| 1248 | #endif |
Simon Kelley | 610e782 | 2014-02-06 14:45:17 +0000 | [diff] [blame] | 1249 | char *types = querystr(auth_dns ? "auth" : "query", type); |
| 1250 | |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1251 | if (listen->family == AF_INET) |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1252 | log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff, |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1253 | (struct all_addr *)&source_addr.in.sin_addr, types); |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1254 | #ifdef HAVE_IPV6 |
| 1255 | else |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1256 | log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff, |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1257 | (struct all_addr *)&source_addr.in6.sin6_addr, types); |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1258 | #endif |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1259 | |
Simon Kelley | 4820dce | 2012-12-18 18:30:30 +0000 | [diff] [blame] | 1260 | #ifdef HAVE_AUTH |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1261 | /* find queries for zones we're authoritative for, and answer them directly */ |
Simon Kelley | 6008bdb | 2013-10-21 21:47:03 +0100 | [diff] [blame] | 1262 | if (!auth_dns) |
| 1263 | for (zone = daemon->auth_zones; zone; zone = zone->next) |
| 1264 | if (in_zone(zone, daemon->namebuff, NULL)) |
| 1265 | { |
| 1266 | auth_dns = 1; |
| 1267 | local_auth = 1; |
| 1268 | break; |
| 1269 | } |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1270 | #endif |
| 1271 | } |
| 1272 | |
| 1273 | #ifdef HAVE_AUTH |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1274 | if (auth_dns) |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 1275 | { |
Simon Kelley | 60b6806 | 2014-01-08 12:10:28 +0000 | [diff] [blame] | 1276 | m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth); |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1277 | if (m >= 1) |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1278 | { |
| 1279 | send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), |
| 1280 | (char *)header, m, &source_addr, &dst_addr, if_index); |
| 1281 | daemon->auth_answer++; |
| 1282 | } |
Simon Kelley | 824af85 | 2008-02-12 20:43:05 +0000 | [diff] [blame] | 1283 | } |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1284 | else |
Simon Kelley | 4820dce | 2012-12-18 18:30:30 +0000 | [diff] [blame] | 1285 | #endif |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1286 | { |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1287 | int ad_reqd, do_bit; |
Simon Kelley | 60b6806 | 2014-01-08 12:10:28 +0000 | [diff] [blame] | 1288 | m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1289 | dst_addr_4, netmask, now, &ad_reqd, &do_bit); |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1290 | |
| 1291 | if (m >= 1) |
| 1292 | { |
| 1293 | send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), |
| 1294 | (char *)header, m, &source_addr, &dst_addr, if_index); |
| 1295 | daemon->local_answer++; |
| 1296 | } |
| 1297 | else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1298 | header, (size_t)n, now, NULL, ad_reqd, do_bit)) |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1299 | daemon->queries_forwarded++; |
| 1300 | else |
| 1301 | daemon->local_answer++; |
| 1302 | } |
Simon Kelley | 44a2a31 | 2004-03-10 20:04:35 +0000 | [diff] [blame] | 1303 | } |
| 1304 | |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1305 | #ifdef HAVE_DNSSEC |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 1306 | |
| 1307 | /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS |
| 1308 | and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or |
| 1309 | STAT_NEED_DS_NEG and keyname if we need to do the query. */ |
| 1310 | static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname) |
| 1311 | { |
| 1312 | struct crec *crecp; |
| 1313 | char *name_start = name; |
| 1314 | int status = dnssec_chase_cname(now, header, plen, name, keyname); |
| 1315 | |
| 1316 | if (status != STAT_INSECURE) |
| 1317 | return status; |
| 1318 | |
| 1319 | while (1) |
| 1320 | { |
| 1321 | crecp = cache_find_by_name(NULL, name_start, now, F_DS); |
| 1322 | |
| 1323 | if (crecp && (crecp->flags & F_DNSSECOK)) |
| 1324 | return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS; |
| 1325 | |
| 1326 | if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.'))) |
| 1327 | { |
| 1328 | name_start++; /* chop a label off and try again */ |
| 1329 | continue; |
| 1330 | } |
| 1331 | |
| 1332 | strcpy(keyname, name_start); |
| 1333 | return STAT_NEED_DS_NEG; |
| 1334 | } |
| 1335 | } |
| 1336 | |
| 1337 | /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */ |
| 1338 | static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class) |
| 1339 | |
| 1340 | { |
| 1341 | char *name_start; |
| 1342 | unsigned char *p; |
| 1343 | int status = dnssec_validate_ds(now, header, plen, name, keyname, class); |
| 1344 | |
| 1345 | if (status != STAT_INSECURE) |
| 1346 | { |
| 1347 | if (status == STAT_NO_DS) |
| 1348 | status = STAT_INSECURE; |
| 1349 | return status; |
| 1350 | } |
| 1351 | |
| 1352 | p = (unsigned char *)(header+1); |
| 1353 | |
| 1354 | if (extract_name(header, plen, &p, name, 1, 4) && |
| 1355 | (name_start = strchr(name, '.'))) |
| 1356 | { |
| 1357 | name_start++; /* chop a label off and try again */ |
| 1358 | strcpy(keyname, name_start); |
| 1359 | return STAT_NEED_DS_NEG; |
| 1360 | } |
| 1361 | |
| 1362 | return STAT_BOGUS; |
| 1363 | } |
| 1364 | |
| 1365 | /* Move toward the root, until we find a signed non-existance of a DS, in which case |
| 1366 | an unsigned answer is OK, or we find a signed DS, in which case there should be |
| 1367 | a signature, and the answer is BOGUS */ |
| 1368 | static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name, |
| 1369 | char *keyname, struct server *server, int *keycount) |
| 1370 | { |
| 1371 | size_t m; |
| 1372 | unsigned char *packet, *payload; |
| 1373 | u16 *length; |
| 1374 | unsigned char *p = (unsigned char *)(header+1); |
| 1375 | int status; |
| 1376 | char *name_start = name; |
| 1377 | |
| 1378 | /* Get first insecure entry in CNAME chain */ |
| 1379 | status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount); |
| 1380 | if (status == STAT_BOGUS) |
| 1381 | return STAT_BOGUS; |
| 1382 | |
| 1383 | if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16)))) |
| 1384 | return STAT_BOGUS; |
| 1385 | |
| 1386 | payload = &packet[2]; |
| 1387 | header = (struct dns_header *)payload; |
| 1388 | length = (u16 *)packet; |
| 1389 | |
| 1390 | while (1) |
| 1391 | { |
| 1392 | unsigned char *newhash, hash[HASH_SIZE]; |
| 1393 | unsigned char c1, c2; |
| 1394 | struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS); |
| 1395 | |
| 1396 | if (--(*keycount) == 0) |
| 1397 | return STAT_BOGUS; |
| 1398 | |
| 1399 | if (crecp && (crecp->flags & F_DNSSECOK)) |
| 1400 | { |
| 1401 | free(packet); |
| 1402 | return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS; |
| 1403 | } |
| 1404 | |
| 1405 | /* If we have cached insecurely that a DS doesn't exist, |
| 1406 | ise that is a hit for where to start looking for the secure one */ |
| 1407 | if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.'))) |
| 1408 | { |
| 1409 | name_start++; /* chop a label off and try again */ |
| 1410 | continue; |
| 1411 | } |
| 1412 | |
| 1413 | m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr); |
| 1414 | |
| 1415 | /* We rely on the question section coming back unchanged, ensure it is with the hash. */ |
| 1416 | if ((newhash = hash_questions(header, (unsigned int)m, name))) |
| 1417 | memcpy(hash, newhash, HASH_SIZE); |
| 1418 | |
| 1419 | *length = htons(m); |
| 1420 | |
| 1421 | if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) && |
| 1422 | read_write(server->tcpfd, &c1, 1, 1) && |
| 1423 | read_write(server->tcpfd, &c2, 1, 1) && |
| 1424 | read_write(server->tcpfd, payload, (c1 << 8) | c2, 1)) |
| 1425 | { |
| 1426 | m = (c1 << 8) | c2; |
| 1427 | |
| 1428 | newhash = hash_questions(header, (unsigned int)m, name); |
| 1429 | if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0) |
| 1430 | { |
| 1431 | /* Note this trashes all three name workspaces */ |
| 1432 | status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount); |
| 1433 | |
| 1434 | /* We've found a DS which proves the bit of the DNS where the |
| 1435 | original query is, is unsigned, so the answer is OK, |
| 1436 | if unvalidated. */ |
| 1437 | if (status == STAT_NO_DS) |
| 1438 | { |
| 1439 | free(packet); |
| 1440 | return STAT_INSECURE; |
| 1441 | } |
| 1442 | |
| 1443 | /* No DS, not got to DNSSEC-land yet, go up. */ |
| 1444 | if (status == STAT_INSECURE) |
| 1445 | { |
| 1446 | p = (unsigned char *)(header+1); |
| 1447 | |
| 1448 | if (extract_name(header, plen, &p, name, 1, 4) && |
| 1449 | (name_start = strchr(name, '.'))) |
| 1450 | { |
| 1451 | name_start++; /* chop a label off and try again */ |
| 1452 | continue; |
| 1453 | } |
| 1454 | } |
| 1455 | } |
| 1456 | } |
| 1457 | |
| 1458 | free(packet); |
| 1459 | |
| 1460 | return STAT_BOGUS; |
| 1461 | } |
| 1462 | } |
| 1463 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1464 | static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n, |
| 1465 | int class, char *name, char *keyname, struct server *server, int *keycount) |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1466 | { |
| 1467 | /* Recurse up the key heirarchy */ |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1468 | int new_status; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1469 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1470 | /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */ |
| 1471 | if (--(*keycount) == 0) |
| 1472 | return STAT_INSECURE; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1473 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1474 | if (status == STAT_NEED_KEY) |
| 1475 | new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class); |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 1476 | else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG) |
| 1477 | { |
| 1478 | new_status = dnssec_validate_ds(now, header, n, name, keyname, class); |
| 1479 | if (status == STAT_NEED_DS && new_status == STAT_NO_DS) |
| 1480 | new_status = STAT_INSECURE; |
| 1481 | } |
| 1482 | else if (status == STAT_CHASE_CNAME) |
| 1483 | new_status = dnssec_chase_cname(now, header, n, name, keyname); |
| 1484 | else |
| 1485 | { |
| 1486 | new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL); |
| 1487 | |
| 1488 | if (new_status == STAT_NO_SIG) |
| 1489 | { |
| 1490 | if (option_bool(OPT_DNSSEC_NO_SIGN)) |
| 1491 | new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount); |
| 1492 | else |
| 1493 | new_status = STAT_INSECURE; |
| 1494 | } |
| 1495 | } |
| 1496 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1497 | /* Can't validate because we need a key/DS whose name now in keyname. |
| 1498 | Make query for same, and recurse to validate */ |
| 1499 | if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY) |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1500 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1501 | size_t m; |
| 1502 | unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16)); |
| 1503 | unsigned char *payload = &packet[2]; |
| 1504 | struct dns_header *new_header = (struct dns_header *)payload; |
| 1505 | u16 *length = (u16 *)packet; |
| 1506 | unsigned char c1, c2; |
| 1507 | |
| 1508 | if (!packet) |
| 1509 | return STAT_INSECURE; |
| 1510 | |
| 1511 | another_tcp_key: |
| 1512 | m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class, |
| 1513 | new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr); |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1514 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1515 | *length = htons(m); |
| 1516 | |
| 1517 | if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) || |
| 1518 | !read_write(server->tcpfd, &c1, 1, 1) || |
| 1519 | !read_write(server->tcpfd, &c2, 1, 1) || |
| 1520 | !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1)) |
| 1521 | new_status = STAT_INSECURE; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1522 | else |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1523 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1524 | m = (c1 << 8) | c2; |
| 1525 | |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 1526 | new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount); |
| 1527 | |
| 1528 | if (new_status == STAT_SECURE) |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1529 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1530 | /* Reached a validated record, now try again at this level. |
| 1531 | Note that we may get ANOTHER NEED_* if an answer needs more than one key. |
| 1532 | If so, go round again. */ |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1533 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1534 | if (status == STAT_NEED_KEY) |
| 1535 | new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class); |
Simon Kelley | 00a5b5d | 2014-02-28 18:10:55 +0000 | [diff] [blame] | 1536 | else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG) |
| 1537 | { |
| 1538 | new_status = dnssec_validate_ds(now, header, n, name, keyname, class); |
| 1539 | if (status == STAT_NEED_DS && new_status == STAT_NO_DS) |
| 1540 | new_status = STAT_INSECURE; /* Validated no DS */ |
| 1541 | } |
| 1542 | else if (status == STAT_CHASE_CNAME) |
| 1543 | new_status = dnssec_chase_cname(now, header, n, name, keyname); |
| 1544 | else |
| 1545 | { |
| 1546 | new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL); |
| 1547 | |
| 1548 | if (new_status == STAT_NO_SIG) |
| 1549 | { |
| 1550 | if (option_bool(OPT_DNSSEC_NO_SIGN)) |
| 1551 | new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount); |
| 1552 | else |
| 1553 | new_status = STAT_INSECURE; |
| 1554 | } |
| 1555 | } |
| 1556 | |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1557 | if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY) |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1558 | goto another_tcp_key; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1559 | } |
| 1560 | } |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1561 | |
| 1562 | free(packet); |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1563 | } |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1564 | return new_status; |
| 1565 | } |
| 1566 | #endif |
| 1567 | |
| 1568 | |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1569 | /* The daemon forks before calling this: it should deal with one connection, |
| 1570 | blocking as neccessary, and then return. Note, need to be a bit careful |
| 1571 | about resources for debug mode, when the fork is suppressed: that's |
| 1572 | done by the caller. */ |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 1573 | unsigned char *tcp_request(int confd, time_t now, |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1574 | union mysockaddr *local_addr, struct in_addr netmask, int auth_dns) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1575 | { |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 1576 | size_t size = 0; |
| 1577 | int norebind = 0; |
Vladislav Grishenko | 3b19596 | 2013-11-26 11:08:21 +0000 | [diff] [blame] | 1578 | #ifdef HAVE_AUTH |
Simon Kelley | 19b1689 | 2013-10-20 10:19:39 +0100 | [diff] [blame] | 1579 | int local_auth = 0; |
Vladislav Grishenko | 3b19596 | 2013-11-26 11:08:21 +0000 | [diff] [blame] | 1580 | #endif |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1581 | int checking_disabled, ad_question, do_bit, added_pheader = 0; |
| 1582 | int check_subnet, no_cache_dnssec = 0, cache_secure = 0; |
Simon Kelley | cdeda28 | 2006-03-16 20:16:06 +0000 | [diff] [blame] | 1583 | size_t m; |
Simon Kelley | ee86ce6 | 2012-12-07 11:54:46 +0000 | [diff] [blame] | 1584 | unsigned short qtype; |
| 1585 | unsigned int gotname; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1586 | unsigned char c1, c2; |
Simon Kelley | 4b5ea12 | 2013-04-22 10:18:26 +0100 | [diff] [blame] | 1587 | /* Max TCP packet + slop + size */ |
| 1588 | unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16)); |
| 1589 | unsigned char *payload = &packet[2]; |
| 1590 | /* largest field in header is 16-bits, so this is still sufficiently aligned */ |
| 1591 | struct dns_header *header = (struct dns_header *)payload; |
| 1592 | u16 *length = (u16 *)packet; |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1593 | struct server *last_server; |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1594 | struct in_addr dst_addr_4; |
| 1595 | union mysockaddr peer_addr; |
| 1596 | socklen_t peer_len = sizeof(union mysockaddr); |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1597 | |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1598 | if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) |
| 1599 | return packet; |
Simon Kelley | c8a8048 | 2014-03-05 14:29:54 +0000 | [diff] [blame] | 1600 | |
| 1601 | /* We can be configured to only accept queries from at-most-one-hop-away addresses. */ |
| 1602 | if (option_bool(OPT_LOCAL_SERVICE)) |
| 1603 | { |
| 1604 | struct addrlist *addr; |
| 1605 | #ifdef HAVE_IPV6 |
| 1606 | if (peer_addr.sa.sa_family == AF_INET6) |
| 1607 | { |
| 1608 | for (addr = daemon->interface_addrs; addr; addr = addr->next) |
| 1609 | if ((addr->flags & ADDRLIST_IPV6) && |
| 1610 | is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen)) |
| 1611 | break; |
| 1612 | } |
| 1613 | else |
| 1614 | #endif |
| 1615 | { |
| 1616 | struct in_addr netmask; |
| 1617 | for (addr = daemon->interface_addrs; addr; addr = addr->next) |
| 1618 | { |
| 1619 | netmask.s_addr = 0xffffffff << (32 - addr->prefixlen); |
| 1620 | if (!(addr->flags & ADDRLIST_IPV6) && |
| 1621 | is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask)) |
| 1622 | break; |
| 1623 | } |
| 1624 | } |
| 1625 | if (!addr) |
| 1626 | { |
| 1627 | my_syslog(LOG_WARNING, _("Ignoring query from non-local network")); |
| 1628 | return packet; |
| 1629 | } |
| 1630 | } |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1631 | |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1632 | while (1) |
| 1633 | { |
| 1634 | if (!packet || |
| 1635 | !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) || |
| 1636 | !(size = c1 << 8 | c2) || |
Simon Kelley | 4b5ea12 | 2013-04-22 10:18:26 +0100 | [diff] [blame] | 1637 | !read_write(confd, payload, size, 1)) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1638 | return packet; |
| 1639 | |
Simon Kelley | 572b41e | 2011-02-18 18:11:18 +0000 | [diff] [blame] | 1640 | if (size < (int)sizeof(struct dns_header)) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1641 | continue; |
| 1642 | |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 1643 | check_subnet = 0; |
| 1644 | |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 1645 | /* save state of "cd" flag in query */ |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1646 | if ((checking_disabled = header->hb4 & HB4_CD)) |
| 1647 | no_cache_dnssec = 1; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 1648 | |
Simon Kelley | 3be3454 | 2004-09-11 19:12:13 +0100 | [diff] [blame] | 1649 | if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype))) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1650 | { |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1651 | #ifdef HAVE_AUTH |
| 1652 | struct auth_zone *zone; |
| 1653 | #endif |
Simon Kelley | 610e782 | 2014-02-06 14:45:17 +0000 | [diff] [blame] | 1654 | char *types = querystr(auth_dns ? "auth" : "query", qtype); |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1655 | |
| 1656 | if (peer_addr.sa.sa_family == AF_INET) |
| 1657 | log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff, |
| 1658 | (struct all_addr *)&peer_addr.in.sin_addr, types); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1659 | #ifdef HAVE_IPV6 |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1660 | else |
| 1661 | log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff, |
| 1662 | (struct all_addr *)&peer_addr.in6.sin6_addr, types); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1663 | #endif |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1664 | |
| 1665 | #ifdef HAVE_AUTH |
| 1666 | /* find queries for zones we're authoritative for, and answer them directly */ |
Simon Kelley | 6008bdb | 2013-10-21 21:47:03 +0100 | [diff] [blame] | 1667 | if (!auth_dns) |
| 1668 | for (zone = daemon->auth_zones; zone; zone = zone->next) |
| 1669 | if (in_zone(zone, daemon->namebuff, NULL)) |
| 1670 | { |
| 1671 | auth_dns = 1; |
| 1672 | local_auth = 1; |
| 1673 | break; |
| 1674 | } |
Simon Kelley | b485ed9 | 2013-10-18 22:00:39 +0100 | [diff] [blame] | 1675 | #endif |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1676 | } |
| 1677 | |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1678 | if (local_addr->sa.sa_family == AF_INET) |
| 1679 | dst_addr_4 = local_addr->in.sin_addr; |
| 1680 | else |
| 1681 | dst_addr_4.s_addr = 0; |
| 1682 | |
Simon Kelley | 4820dce | 2012-12-18 18:30:30 +0000 | [diff] [blame] | 1683 | #ifdef HAVE_AUTH |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1684 | if (auth_dns) |
Simon Kelley | 19b1689 | 2013-10-20 10:19:39 +0100 | [diff] [blame] | 1685 | m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth); |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1686 | else |
Simon Kelley | 4820dce | 2012-12-18 18:30:30 +0000 | [diff] [blame] | 1687 | #endif |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1688 | { |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1689 | /* m > 0 if answered from cache */ |
| 1690 | m = answer_request(header, ((char *) header) + 65536, (size_t)size, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1691 | dst_addr_4, netmask, now, &ad_question, &do_bit); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1692 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1693 | /* Do this by steam now we're not in the select() loop */ |
| 1694 | check_log_writer(NULL); |
| 1695 | |
| 1696 | if (m == 0) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1697 | { |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1698 | unsigned int flags = 0; |
| 1699 | struct all_addr *addrp = NULL; |
| 1700 | int type = 0; |
| 1701 | char *domain = NULL; |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1702 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1703 | if (option_bool(OPT_ADD_MAC)) |
| 1704 | size = add_mac(header, size, ((char *) header) + 65536, &peer_addr); |
Simon Kelley | ed4c076 | 2013-10-08 20:46:34 +0100 | [diff] [blame] | 1705 | |
| 1706 | if (option_bool(OPT_CLIENT_SUBNET)) |
| 1707 | { |
| 1708 | size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr); |
| 1709 | if (size != new) |
| 1710 | { |
| 1711 | size = new; |
| 1712 | check_subnet = 1; |
| 1713 | } |
| 1714 | } |
| 1715 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1716 | if (gotname) |
| 1717 | flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind); |
| 1718 | |
| 1719 | if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server) |
| 1720 | last_server = daemon->servers; |
| 1721 | else |
| 1722 | last_server = daemon->last_server; |
| 1723 | |
| 1724 | if (!flags && last_server) |
| 1725 | { |
| 1726 | struct server *firstsendto = NULL; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1727 | #ifdef HAVE_DNSSEC |
Simon Kelley | 703c7ff | 2014-01-25 23:46:23 +0000 | [diff] [blame] | 1728 | unsigned char *newhash, hash[HASH_SIZE]; |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1729 | if ((newhash = hash_questions(header, (unsigned int)size, daemon->keyname))) |
| 1730 | memcpy(hash, newhash, HASH_SIZE); |
| 1731 | #else |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1732 | unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff); |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1733 | #endif |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1734 | /* Loop round available servers until we succeed in connecting to one. |
| 1735 | Note that this code subtley ensures that consecutive queries on this connection |
| 1736 | which can go to the same server, do so. */ |
| 1737 | while (1) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1738 | { |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1739 | if (!firstsendto) |
| 1740 | firstsendto = last_server; |
| 1741 | else |
| 1742 | { |
| 1743 | if (!(last_server = last_server->next)) |
| 1744 | last_server = daemon->servers; |
| 1745 | |
| 1746 | if (last_server == firstsendto) |
| 1747 | break; |
| 1748 | } |
| 1749 | |
| 1750 | /* server for wrong domain */ |
| 1751 | if (type != (last_server->flags & SERV_TYPE) || |
| 1752 | (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain))) |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1753 | continue; |
| 1754 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1755 | if (last_server->tcpfd == -1) |
| 1756 | { |
| 1757 | if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1) |
| 1758 | continue; |
| 1759 | |
| 1760 | if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) || |
| 1761 | connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1)) |
| 1762 | { |
| 1763 | close(last_server->tcpfd); |
| 1764 | last_server->tcpfd = -1; |
| 1765 | continue; |
| 1766 | } |
| 1767 | |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1768 | #ifdef HAVE_DNSSEC |
| 1769 | if (option_bool(OPT_DNSSEC_VALID)) |
| 1770 | { |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1771 | size_t new_size = add_do_bit(header, size, ((char *) header) + 65536); |
| 1772 | |
Simon Kelley | 2ecd9bd | 2014-02-13 16:42:02 +0000 | [diff] [blame] | 1773 | /* For debugging, set Checking Disabled, otherwise, have the upstream check too, |
| 1774 | this allows it to select auth servers when one is returning bad data. */ |
| 1775 | if (option_bool(OPT_DNSSEC_DEBUG)) |
| 1776 | header->hb4 |= HB4_CD; |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1777 | |
| 1778 | if (size != new_size) |
| 1779 | added_pheader = 1; |
| 1780 | |
| 1781 | size = new_size; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1782 | } |
| 1783 | #endif |
| 1784 | |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1785 | #ifdef HAVE_CONNTRACK |
| 1786 | /* Copy connection mark of incoming query to outgoing connection. */ |
| 1787 | if (option_bool(OPT_CONNTRACK)) |
| 1788 | { |
| 1789 | unsigned int mark; |
| 1790 | struct all_addr local; |
| 1791 | #ifdef HAVE_IPV6 |
| 1792 | if (local_addr->sa.sa_family == AF_INET6) |
| 1793 | local.addr.addr6 = local_addr->in6.sin6_addr; |
| 1794 | else |
| 1795 | #endif |
| 1796 | local.addr.addr4 = local_addr->in.sin_addr; |
| 1797 | |
| 1798 | if (get_incoming_mark(&peer_addr, &local, 1, &mark)) |
| 1799 | setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); |
| 1800 | } |
| 1801 | #endif |
| 1802 | } |
| 1803 | |
Simon Kelley | 4b5ea12 | 2013-04-22 10:18:26 +0100 | [diff] [blame] | 1804 | *length = htons(size); |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1805 | |
Simon Kelley | 4b5ea12 | 2013-04-22 10:18:26 +0100 | [diff] [blame] | 1806 | if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) || |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1807 | !read_write(last_server->tcpfd, &c1, 1, 1) || |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1808 | !read_write(last_server->tcpfd, &c2, 1, 1) || |
| 1809 | !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1)) |
Simon Kelley | 7de060b | 2011-08-26 17:24:52 +0100 | [diff] [blame] | 1810 | { |
| 1811 | close(last_server->tcpfd); |
| 1812 | last_server->tcpfd = -1; |
| 1813 | continue; |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1814 | } |
| 1815 | |
| 1816 | m = (c1 << 8) | c2; |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1817 | |
| 1818 | if (!gotname) |
| 1819 | strcpy(daemon->namebuff, "query"); |
| 1820 | if (last_server->addr.sa.sa_family == AF_INET) |
| 1821 | log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff, |
| 1822 | (struct all_addr *)&last_server->addr.in.sin_addr, NULL); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1823 | #ifdef HAVE_IPV6 |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1824 | else |
| 1825 | log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff, |
| 1826 | (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1827 | #endif |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1828 | |
| 1829 | #ifdef HAVE_DNSSEC |
| 1830 | if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled) |
| 1831 | { |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1832 | int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */ |
| 1833 | int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount); |
| 1834 | char *result; |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1835 | |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1836 | if (keycount == 0) |
| 1837 | result = "ABANDONED"; |
| 1838 | else |
| 1839 | result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS")); |
| 1840 | |
| 1841 | log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result); |
| 1842 | |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1843 | if (status == STAT_BOGUS) |
| 1844 | no_cache_dnssec = 1; |
Simon Kelley | 7fa836e | 2014-02-10 20:11:24 +0000 | [diff] [blame] | 1845 | |
Simon Kelley | 7d7b7b3 | 2014-01-08 15:53:35 +0000 | [diff] [blame] | 1846 | if (status == STAT_SECURE) |
| 1847 | cache_secure = 1; |
| 1848 | } |
| 1849 | #endif |
| 1850 | |
| 1851 | /* restore CD bit to the value in the query */ |
| 1852 | if (checking_disabled) |
| 1853 | header->hb4 |= HB4_CD; |
| 1854 | else |
| 1855 | header->hb4 &= ~HB4_CD; |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1856 | |
| 1857 | /* There's no point in updating the cache, since this process will exit and |
| 1858 | lose the information after a few queries. We make this call for the alias and |
| 1859 | bogus-nxdomain side-effects. */ |
| 1860 | /* If the crc of the question section doesn't match the crc we sent, then |
| 1861 | someone might be attempting to insert bogus values into the cache by |
| 1862 | sending replies containing questions and bogus answers. */ |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1863 | #ifdef HAVE_DNSSEC |
| 1864 | newhash = hash_questions(header, (unsigned int)m, daemon->namebuff); |
| 1865 | if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0) |
Simon Kelley | 703c7ff | 2014-01-25 23:46:23 +0000 | [diff] [blame] | 1866 | { |
| 1867 | m = 0; |
| 1868 | break; |
| 1869 | } |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1870 | #else |
| 1871 | if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff)) |
Simon Kelley | 703c7ff | 2014-01-25 23:46:23 +0000 | [diff] [blame] | 1872 | { |
| 1873 | m = 0; |
| 1874 | break; |
| 1875 | } |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 1876 | #endif |
| 1877 | |
| 1878 | m = process_reply(header, now, last_server, (unsigned int)m, |
| 1879 | option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec, |
Simon Kelley | 613ad15 | 2014-02-25 23:02:28 +0000 | [diff] [blame] | 1880 | cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr); |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1881 | |
| 1882 | break; |
| 1883 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1884 | } |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1885 | |
| 1886 | /* In case of local answer or no connections made. */ |
| 1887 | if (m == 0) |
| 1888 | m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1889 | } |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1890 | } |
Simon Kelley | 4f7b304 | 2012-11-28 21:27:02 +0000 | [diff] [blame] | 1891 | |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 1892 | check_log_writer(NULL); |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1893 | |
Simon Kelley | 4b5ea12 | 2013-04-22 10:18:26 +0100 | [diff] [blame] | 1894 | *length = htons(m); |
| 1895 | |
| 1896 | if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0)) |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 1897 | return packet; |
| 1898 | } |
| 1899 | } |
| 1900 | |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 1901 | static struct frec *allocate_frec(time_t now) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1902 | { |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 1903 | struct frec *f; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1904 | |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 1905 | if ((f = (struct frec *)whine_malloc(sizeof(struct frec)))) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1906 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1907 | f->next = daemon->frec_list; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1908 | f->time = now; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 1909 | f->sentto = NULL; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1910 | f->rfd4 = NULL; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 1911 | f->flags = 0; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1912 | #ifdef HAVE_IPV6 |
| 1913 | f->rfd6 = NULL; |
| 1914 | #endif |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1915 | #ifdef HAVE_DNSSEC |
Simon Kelley | 97bc798 | 2014-01-31 10:19:52 +0000 | [diff] [blame] | 1916 | f->dependent = NULL; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1917 | f->blocking_query = NULL; |
Simon Kelley | 4619d94 | 2014-01-16 19:53:06 +0000 | [diff] [blame] | 1918 | f->stash = NULL; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1919 | #endif |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1920 | daemon->frec_list = f; |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 1921 | } |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 1922 | |
| 1923 | return f; |
| 1924 | } |
| 1925 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1926 | static struct randfd *allocate_rfd(int family) |
| 1927 | { |
| 1928 | static int finger = 0; |
| 1929 | int i; |
| 1930 | |
| 1931 | /* limit the number of sockets we have open to avoid starvation of |
| 1932 | (eg) TFTP. Once we have a reasonable number, randomness should be OK */ |
| 1933 | |
| 1934 | for (i = 0; i < RANDOM_SOCKS; i++) |
Simon Kelley | 9009d74 | 2008-11-14 20:04:27 +0000 | [diff] [blame] | 1935 | if (daemon->randomsocks[i].refcount == 0) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1936 | { |
Simon Kelley | 9009d74 | 2008-11-14 20:04:27 +0000 | [diff] [blame] | 1937 | if ((daemon->randomsocks[i].fd = random_sock(family)) == -1) |
| 1938 | break; |
| 1939 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1940 | daemon->randomsocks[i].refcount = 1; |
| 1941 | daemon->randomsocks[i].family = family; |
| 1942 | return &daemon->randomsocks[i]; |
| 1943 | } |
| 1944 | |
Simon Kelley | 9009d74 | 2008-11-14 20:04:27 +0000 | [diff] [blame] | 1945 | /* No free ones or cannot get new socket, grab an existing one */ |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1946 | for (i = 0; i < RANDOM_SOCKS; i++) |
| 1947 | { |
| 1948 | int j = (i+finger) % RANDOM_SOCKS; |
Simon Kelley | 9009d74 | 2008-11-14 20:04:27 +0000 | [diff] [blame] | 1949 | if (daemon->randomsocks[j].refcount != 0 && |
| 1950 | daemon->randomsocks[j].family == family && |
| 1951 | daemon->randomsocks[j].refcount != 0xffff) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1952 | { |
| 1953 | finger = j; |
| 1954 | daemon->randomsocks[j].refcount++; |
| 1955 | return &daemon->randomsocks[j]; |
| 1956 | } |
| 1957 | } |
| 1958 | |
| 1959 | return NULL; /* doom */ |
| 1960 | } |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1961 | static void free_frec(struct frec *f) |
| 1962 | { |
| 1963 | if (f->rfd4 && --(f->rfd4->refcount) == 0) |
| 1964 | close(f->rfd4->fd); |
| 1965 | |
| 1966 | f->rfd4 = NULL; |
| 1967 | f->sentto = NULL; |
Simon Kelley | 28866e9 | 2011-02-14 20:19:14 +0000 | [diff] [blame] | 1968 | f->flags = 0; |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1969 | |
| 1970 | #ifdef HAVE_IPV6 |
| 1971 | if (f->rfd6 && --(f->rfd6->refcount) == 0) |
| 1972 | close(f->rfd6->fd); |
| 1973 | |
| 1974 | f->rfd6 = NULL; |
| 1975 | #endif |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1976 | |
| 1977 | #ifdef HAVE_DNSSEC |
| 1978 | if (f->stash) |
Simon Kelley | 0fc2f31 | 2014-01-08 10:26:58 +0000 | [diff] [blame] | 1979 | { |
| 1980 | blockdata_free(f->stash); |
| 1981 | f->stash = NULL; |
| 1982 | } |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1983 | |
| 1984 | /* Anything we're waiting on is pointless now, too */ |
| 1985 | if (f->blocking_query) |
| 1986 | free_frec(f->blocking_query); |
| 1987 | f->blocking_query = NULL; |
Simon Kelley | 39048ad | 2014-01-21 17:33:58 +0000 | [diff] [blame] | 1988 | f->dependent = NULL; |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1989 | #endif |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1990 | } |
| 1991 | |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 1992 | /* if wait==NULL return a free or older than TIMEOUT record. |
| 1993 | else return *wait zero if one available, or *wait is delay to |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 1994 | when the oldest in-use record will expire. Impose an absolute |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 1995 | limit of 4*TIMEOUT before we wipe things (for random sockets). |
| 1996 | If force is set, always return a result, even if we have |
| 1997 | to allocate above the limit. */ |
| 1998 | struct frec *get_new_frec(time_t now, int *wait, int force) |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 1999 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2000 | struct frec *f, *oldest, *target; |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2001 | int count; |
| 2002 | |
| 2003 | if (wait) |
| 2004 | *wait = 0; |
| 2005 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2006 | for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2007 | if (!f->sentto) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2008 | target = f; |
| 2009 | else |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2010 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2011 | if (difftime(now, f->time) >= 4*TIMEOUT) |
| 2012 | { |
| 2013 | free_frec(f); |
| 2014 | target = f; |
| 2015 | } |
| 2016 | |
| 2017 | if (!oldest || difftime(f->time, oldest->time) <= 0) |
| 2018 | oldest = f; |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2019 | } |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2020 | |
| 2021 | if (target) |
| 2022 | { |
| 2023 | target->time = now; |
| 2024 | return target; |
| 2025 | } |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2026 | |
| 2027 | /* can't find empty one, use oldest if there is one |
| 2028 | and it's older than timeout */ |
| 2029 | if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT) |
| 2030 | { |
| 2031 | /* keep stuff for twice timeout if we can by allocating a new |
| 2032 | record instead */ |
| 2033 | if (difftime(now, oldest->time) < 2*TIMEOUT && |
| 2034 | count <= daemon->ftabsize && |
| 2035 | (f = allocate_frec(now))) |
| 2036 | return f; |
| 2037 | |
| 2038 | if (!wait) |
| 2039 | { |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2040 | free_frec(oldest); |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2041 | oldest->time = now; |
| 2042 | } |
| 2043 | return oldest; |
| 2044 | } |
| 2045 | |
| 2046 | /* none available, calculate time 'till oldest record expires */ |
Simon Kelley | 3a23715 | 2013-12-12 12:15:50 +0000 | [diff] [blame] | 2047 | if (!force && count > daemon->ftabsize) |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2048 | { |
Marcelo Salhab Brogliato | 0da5e89 | 2013-05-31 11:49:06 +0100 | [diff] [blame] | 2049 | static time_t last_log = 0; |
| 2050 | |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2051 | if (oldest && wait) |
| 2052 | *wait = oldest->time + (time_t)TIMEOUT - now; |
Marcelo Salhab Brogliato | 0da5e89 | 2013-05-31 11:49:06 +0100 | [diff] [blame] | 2053 | |
| 2054 | if ((int)difftime(now, last_log) > 5) |
| 2055 | { |
| 2056 | last_log = now; |
| 2057 | my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize); |
| 2058 | } |
| 2059 | |
Simon Kelley | 1697269 | 2006-10-16 20:04:18 +0100 | [diff] [blame] | 2060 | return NULL; |
| 2061 | } |
| 2062 | |
| 2063 | if (!(f = allocate_frec(now)) && wait) |
| 2064 | /* wait one second on malloc failure */ |
| 2065 | *wait = 1; |
| 2066 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2067 | return f; /* OK if malloc fails and this is NULL */ |
| 2068 | } |
| 2069 | |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2070 | /* crc is all-ones if not known. */ |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2071 | static struct frec *lookup_frec(unsigned short id, void *hash) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2072 | { |
| 2073 | struct frec *f; |
| 2074 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2075 | for(f = daemon->frec_list; f; f = f->next) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2076 | if (f->sentto && f->new_id == id && |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2077 | (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0)) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2078 | return f; |
| 2079 | |
| 2080 | return NULL; |
| 2081 | } |
| 2082 | |
| 2083 | static struct frec *lookup_frec_by_sender(unsigned short id, |
Simon Kelley | fd9fa48 | 2004-10-21 20:24:00 +0100 | [diff] [blame] | 2084 | union mysockaddr *addr, |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2085 | void *hash) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2086 | { |
Simon Kelley | feba5c1 | 2004-07-27 20:28:58 +0100 | [diff] [blame] | 2087 | struct frec *f; |
| 2088 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2089 | for(f = daemon->frec_list; f; f = f->next) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2090 | if (f->sentto && |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2091 | f->orig_id == id && |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2092 | memcmp(hash, f->hash, HASH_SIZE) == 0 && |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2093 | sockaddr_isequal(&f->source, addr)) |
| 2094 | return f; |
| 2095 | |
| 2096 | return NULL; |
| 2097 | } |
| 2098 | |
Simon Kelley | 849a835 | 2006-06-09 21:02:31 +0100 | [diff] [blame] | 2099 | /* A server record is going away, remove references to it */ |
Simon Kelley | 5aabfc7 | 2007-08-29 11:24:47 +0100 | [diff] [blame] | 2100 | void server_gone(struct server *server) |
Simon Kelley | 849a835 | 2006-06-09 21:02:31 +0100 | [diff] [blame] | 2101 | { |
| 2102 | struct frec *f; |
| 2103 | |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2104 | for (f = daemon->frec_list; f; f = f->next) |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2105 | if (f->sentto && f->sentto == server) |
Simon Kelley | 1a6bca8 | 2008-07-11 11:11:42 +0100 | [diff] [blame] | 2106 | free_frec(f); |
Simon Kelley | 849a835 | 2006-06-09 21:02:31 +0100 | [diff] [blame] | 2107 | |
| 2108 | if (daemon->last_server == server) |
| 2109 | daemon->last_server = NULL; |
| 2110 | |
| 2111 | if (daemon->srv_save == server) |
| 2112 | daemon->srv_save = NULL; |
| 2113 | } |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2114 | |
Simon Kelley | 316e273 | 2010-01-22 20:16:09 +0000 | [diff] [blame] | 2115 | /* return unique random ids. */ |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2116 | static unsigned short get_id(void) |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2117 | { |
| 2118 | unsigned short ret = 0; |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2119 | |
Simon Kelley | 316e273 | 2010-01-22 20:16:09 +0000 | [diff] [blame] | 2120 | do |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2121 | ret = rand16(); |
Simon Kelley | 8a9be9e | 2014-01-25 23:17:21 +0000 | [diff] [blame] | 2122 | while (lookup_frec(ret, NULL)); |
Simon Kelley | 832af0b | 2007-01-21 20:01:28 +0000 | [diff] [blame] | 2123 | |
Simon Kelley | 9e4abcb | 2004-01-22 19:47:41 +0000 | [diff] [blame] | 2124 | return ret; |
| 2125 | } |
| 2126 | |
| 2127 | |
| 2128 | |
| 2129 | |
| 2130 | |