blob: 81ae3ee19114d19168bb05bf1d99571f8069f64b [file] [log] [blame]
Simon Kelleyc47e3ba2014-01-08 17:07:54 +00001/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
Simon Kelley824af852008-02-12 20:43:05 +00005 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
Simon Kelley9e4abcb2004-01-22 19:47:41 +00008 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
Simon Kelley824af852008-02-12 20:43:05 +000012
Simon Kelley73a08a22009-02-05 20:28:08 +000013 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
Simon Kelley9e4abcb2004-01-22 19:47:41 +000015*/
16
Simon Kelley9e4abcb2004-01-22 19:47:41 +000017#include "dnsmasq.h"
18
Simon Kelley8a9be9e2014-01-25 23:17:21 +000019static struct frec *lookup_frec(unsigned short id, void *hash);
Simon Kelley9e4abcb2004-01-22 19:47:41 +000020static struct frec *lookup_frec_by_sender(unsigned short id,
Simon Kelleyfd9fa482004-10-21 20:24:00 +010021 union mysockaddr *addr,
Simon Kelley8a9be9e2014-01-25 23:17:21 +000022 void *hash);
23static unsigned short get_id(void);
Simon Kelley1a6bca82008-07-11 11:11:42 +010024static void free_frec(struct frec *f);
25static struct randfd *allocate_rfd(int family);
Simon Kelley9e4abcb2004-01-22 19:47:41 +000026
Simon Kelley00a5b5d2014-02-28 18:10:55 +000027#ifdef HAVE_DNSSEC
28static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
29 int class, char *name, char *keyname, struct server *server, int *keycount);
30static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
31static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
32#endif
33
34
Simon Kelley824af852008-02-12 20:43:05 +000035/* Send a UDP packet with its source address set as "source"
Simon Kelley44a2a312004-03-10 20:04:35 +000036 unless nowild is true, when we just send it with the kernel default */
Simon Kelley29689cf2012-03-22 14:01:00 +000037int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
Simon Kelley50303b12012-04-04 22:13:17 +010039 unsigned int iface)
Simon Kelley9e4abcb2004-01-22 19:47:41 +000040{
Simon Kelley44a2a312004-03-10 20:04:35 +000041 struct msghdr msg;
42 struct iovec iov[1];
Simon Kelley44a2a312004-03-10 20:04:35 +000043 union {
44 struct cmsghdr align; /* this ensures alignment */
Simon Kelley5e9e0ef2006-04-17 14:24:29 +010045#if defined(HAVE_LINUX_NETWORK)
Simon Kelley44a2a312004-03-10 20:04:35 +000046 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47#elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49#endif
50#ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52#endif
53 } control_u;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010054
Simon Kelley44a2a312004-03-10 20:04:35 +000055 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
Simon Kelleyfeba5c12004-07-27 20:28:58 +010058 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
Simon Kelley44a2a312004-03-10 20:04:35 +000060 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010065
Simon Kelley26128d22004-11-14 16:43:54 +000066 if (!nowild)
Simon Kelleyfeba5c12004-07-27 20:28:58 +010067 {
Simon Kelley26128d22004-11-14 16:43:54 +000068 struct cmsghdr *cmptr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +010069 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
Simon Kelley26128d22004-11-14 16:43:54 +000071 cmptr = CMSG_FIRSTHDR(&msg);
Simon Kelley44a2a312004-03-10 20:04:35 +000072
Simon Kelley26128d22004-11-14 16:43:54 +000073 if (to->sa.sa_family == AF_INET)
74 {
Simon Kelley5e9e0ef2006-04-17 14:24:29 +010075#if defined(HAVE_LINUX_NETWORK)
Simon Kelley8ef5ada2010-06-03 19:42:45 +010076 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
Simon Kelley26128d22004-11-14 16:43:54 +000080 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
Simon Kelleyc72daea2012-01-05 21:33:27 +000081 cmptr->cmsg_level = IPPROTO_IP;
Simon Kelley26128d22004-11-14 16:43:54 +000082 cmptr->cmsg_type = IP_PKTINFO;
83#elif defined(IP_SENDSRCADDR)
Simon Kelley8ef5ada2010-06-03 19:42:45 +010084 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
Simon Kelley26128d22004-11-14 16:43:54 +000085 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
Simon Kelley44a2a312004-03-10 20:04:35 +000088#endif
Simon Kelley26128d22004-11-14 16:43:54 +000089 }
Simon Kelley26128d22004-11-14 16:43:54 +000090 else
Simon Kelleyb8187c82005-11-26 21:46:27 +000091#ifdef HAVE_IPV6
Simon Kelley26128d22004-11-14 16:43:54 +000092 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +010093 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
Simon Kelley26128d22004-11-14 16:43:54 +000097 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
Simon Kelley316e2732010-01-22 20:16:09 +000098 cmptr->cmsg_type = daemon->v6pktinfo;
Simon Kelleyc72daea2012-01-05 21:33:27 +000099 cmptr->cmsg_level = IPPROTO_IPV6;
Simon Kelley26128d22004-11-14 16:43:54 +0000100 }
Simon Kelley3d8df262005-08-29 12:19:27 +0100101#else
Simon Kelleyc72daea2012-01-05 21:33:27 +0000102 (void)iface; /* eliminate warning */
Simon Kelley26128d22004-11-14 16:43:54 +0000103#endif
104 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100105
Simon Kelley29d28dd2012-12-03 14:05:59 +0000106 while (sendmsg(fd, &msg, 0) == -1)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100107 {
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100108 if (retry_send())
Simon Kelley29d28dd2012-12-03 14:05:59 +0000109 continue;
110
111 /* If interface is still in DAD, EINVAL results - ignore that. */
112 if (errno == EINVAL)
113 break;
Simon Kelley22d904d2012-02-26 20:13:45 +0000114
Simon Kelley50303b12012-04-04 22:13:17 +0100115 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
Simon Kelley29689cf2012-03-22 14:01:00 +0000116 return 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100117 }
Simon Kelley29d28dd2012-12-03 14:05:59 +0000118
Simon Kelley29689cf2012-03-22 14:01:00 +0000119 return 1;
Simon Kelley44a2a312004-03-10 20:04:35 +0000120}
121
Simon Kelley28866e92011-02-14 20:19:14 +0000122static unsigned int search_servers(time_t now, struct all_addr **addrpp,
123 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100124
125{
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
129
130 unsigned int namelen = strlen(qdomain);
131 unsigned int matchlen = 0;
132 struct server *serv;
Simon Kelley28866e92011-02-14 20:19:14 +0000133 unsigned int flags = 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100134
Simon Kelley3be34542004-09-11 19:12:13 +0100135 for (serv = daemon->servers; serv; serv=serv->next)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100136 /* domain matches take priority over NODOTS matches */
Simon Kelley3d8df262005-08-29 12:19:27 +0100137 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100138 {
Simon Kelley28866e92011-02-14 20:19:14 +0000139 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100140 *type = SERV_FOR_NODOTS;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100141 if (serv->flags & SERV_NO_ADDR)
Simon Kelley36717ee2004-09-20 19:20:58 +0100142 flags = F_NXDOMAIN;
143 else if (serv->flags & SERV_LITERAL_ADDRESS)
144 {
145 if (sflag & qtype)
146 {
147 flags = sflag;
148 if (serv->addr.sa.sa_family == AF_INET)
149 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100150#ifdef HAVE_IPV6
Simon Kelley36717ee2004-09-20 19:20:58 +0100151 else
152 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100153#endif
Simon Kelley36717ee2004-09-20 19:20:58 +0100154 }
Simon Kelley824af852008-02-12 20:43:05 +0000155 else if (!flags || (flags & F_NXDOMAIN))
Simon Kelley36717ee2004-09-20 19:20:58 +0100156 flags = F_NOERR;
157 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100158 }
159 else if (serv->flags & SERV_HAS_DOMAIN)
160 {
161 unsigned int domainlen = strlen(serv->domain);
Simon Kelleyb8187c82005-11-26 21:46:27 +0000162 char *matchstart = qdomain + namelen - domainlen;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100163 if (namelen >= domainlen &&
Simon Kelleyb8187c82005-11-26 21:46:27 +0000164 hostname_isequal(matchstart, serv->domain) &&
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100165 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100166 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100167 if (serv->flags & SERV_NO_REBIND)
168 *norebind = 1;
Simon Kelley28866e92011-02-14 20:19:14 +0000169 else
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100170 {
Simon Kelley28866e92011-02-14 20:19:14 +0000171 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen != 0 && domainlen == matchlen)
Simon Kelley36717ee2004-09-20 19:20:58 +0100176 {
Simon Kelley28866e92011-02-14 20:19:14 +0000177 if ((serv->flags & SERV_LITERAL_ADDRESS))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100178 {
Simon Kelley28866e92011-02-14 20:19:14 +0000179 if (!(sflag & qtype) && flags == 0)
180 continue;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100181 }
Simon Kelley28866e92011-02-14 20:19:14 +0000182 else
183 {
184 if (flags & (F_IPV4 | F_IPV6))
185 continue;
186 }
Simon Kelley36717ee2004-09-20 19:20:58 +0100187 }
Simon Kelley28866e92011-02-14 20:19:14 +0000188
189 if (domainlen >= matchlen)
190 {
191 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
192 *domain = serv->domain;
193 matchlen = domainlen;
194 if (serv->flags & SERV_NO_ADDR)
195 flags = F_NXDOMAIN;
196 else if (serv->flags & SERV_LITERAL_ADDRESS)
197 {
198 if (sflag & qtype)
199 {
200 flags = sflag;
201 if (serv->addr.sa.sa_family == AF_INET)
202 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
203#ifdef HAVE_IPV6
204 else
205 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
206#endif
207 }
208 else if (!flags || (flags & F_NXDOMAIN))
209 flags = F_NOERR;
210 }
211 else
212 flags = 0;
213 }
214 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100215 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100216 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100217
Simon Kelley7de060b2011-08-26 17:24:52 +0100218 if (flags == 0 && !(qtype & F_QUERY) &&
Simon Kelley28866e92011-02-14 20:19:14 +0000219 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
Simon Kelley7de060b2011-08-26 17:24:52 +0100220 /* don't forward A or AAAA queries for simple names, except the empty name */
221 flags = F_NOERR;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100222
Simon Kelley5aabfc72007-08-29 11:24:47 +0100223 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
Simon Kelleyc1bb8502004-08-11 18:40:17 +0100224 flags = F_NOERR;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100225
Simon Kelley824af852008-02-12 20:43:05 +0000226 if (flags)
227 {
228 int logflags = 0;
229
230 if (flags == F_NXDOMAIN || flags == F_NOERR)
231 logflags = F_NEG | qtype;
232
Simon Kelley1a6bca82008-07-11 11:11:42 +0100233 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
Simon Kelley824af852008-02-12 20:43:05 +0000234 }
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100235 else if ((*type) & SERV_USE_RESOLV)
236 {
237 *type = 0; /* use normal servers for this domain */
238 *domain = NULL;
239 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100240 return flags;
241}
Simon Kelley44a2a312004-03-10 20:04:35 +0000242
Simon Kelley824af852008-02-12 20:43:05 +0000243static int forward_query(int udpfd, union mysockaddr *udpaddr,
244 struct all_addr *dst_addr, unsigned int dst_iface,
Simon Kelley83349b82014-02-10 21:02:01 +0000245 struct dns_header *header, size_t plen, time_t now,
Simon Kelley613ad152014-02-25 23:02:28 +0000246 struct frec *forward, int ad_reqd, int do_bit)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000247{
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000248 char *domain = NULL;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100249 int type = 0, norebind = 0;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000250 struct all_addr *addrp = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +0000251 unsigned int flags = 0;
Simon Kelleyde379512004-06-22 20:23:33 +0100252 struct server *start = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000253#ifdef HAVE_DNSSEC
254 void *hash = hash_questions(header, plen, daemon->namebuff);
255#else
256 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
257 void *hash = &crc;
258#endif
259 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
260
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000261 (void)do_bit;
262
Simon Kelley3d8df262005-08-29 12:19:27 +0100263 /* may be no servers available. */
264 if (!daemon->servers)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000265 forward = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000266 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000267 {
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000268#ifdef HAVE_DNSSEC
Simon Kelleydac74312014-02-13 16:43:49 +0000269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000270 there's no point retrying the query, retry the key query instead...... */
271 if (forward->blocking_query)
272 {
273 int fd;
274
275 while (forward->blocking_query)
276 forward = forward->blocking_query;
277
278 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
279 plen = forward->stash_len;
280
Simon Kelley2b291912014-03-21 11:13:55 +0000281 if (forward->sentto->addr.sa.sa_family == AF_INET)
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000282 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
283#ifdef HAVE_IPV6
284 else
285 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
286#endif
287
288 if (forward->sentto->sfd)
289 fd = forward->sentto->sfd->fd;
290 else
291 {
292#ifdef HAVE_IPV6
293 if (forward->sentto->addr.sa.sa_family == AF_INET6)
294 fd = forward->rfd6->fd;
295 else
296#endif
297 fd = forward->rfd4->fd;
298 }
299
300 while (sendto(fd, (char *)header, plen, 0,
301 &forward->sentto->addr.sa,
Simon Kelley2b291912014-03-21 11:13:55 +0000302 sa_len(&forward->sentto->addr)) == -1 && retry_send());
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000303
304 return 1;
305 }
306#endif
307
Simon Kelleyde379512004-06-22 20:23:33 +0100308 /* retry on existing query, send to all available servers */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000309 domain = forward->sentto->domain;
Simon Kelley824af852008-02-12 20:43:05 +0000310 forward->sentto->failed_queries++;
Simon Kelley28866e92011-02-14 20:19:14 +0000311 if (!option_bool(OPT_ORDER))
Simon Kelleyde379512004-06-22 20:23:33 +0100312 {
Simon Kelley0a852542005-03-23 20:28:59 +0000313 forward->forwardall = 1;
Simon Kelley3be34542004-09-11 19:12:13 +0100314 daemon->last_server = NULL;
Simon Kelleyde379512004-06-22 20:23:33 +0100315 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000316 type = forward->sentto->flags & SERV_TYPE;
Simon Kelleyde379512004-06-22 20:23:33 +0100317 if (!(start = forward->sentto->next))
Simon Kelley3be34542004-09-11 19:12:13 +0100318 start = daemon->servers; /* at end of list, recycle */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000319 header->id = htons(forward->new_id);
320 }
321 else
322 {
323 if (gotname)
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100324 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000325
Simon Kelley3a237152013-12-12 12:15:50 +0000326 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100327 /* table full - server failure. */
328 flags = F_NEG;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000329
330 if (forward)
331 {
Simon Kelley0a852542005-03-23 20:28:59 +0000332 forward->source = *udpaddr;
333 forward->dest = *dst_addr;
334 forward->iface = dst_iface;
Simon Kelley0a852542005-03-23 20:28:59 +0000335 forward->orig_id = ntohs(header->id);
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000336 forward->new_id = get_id();
Simon Kelley832af0b2007-01-21 20:01:28 +0000337 forward->fd = udpfd;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000338 memcpy(forward->hash, hash, HASH_SIZE);
Simon Kelley0a852542005-03-23 20:28:59 +0000339 forward->forwardall = 0;
Simon Kelleyed4c0762013-10-08 20:46:34 +0100340 forward->flags = 0;
Simon Kelley28866e92011-02-14 20:19:14 +0000341 if (norebind)
342 forward->flags |= FREC_NOREBIND;
Simon Kelley572b41e2011-02-18 18:11:18 +0000343 if (header->hb4 & HB4_CD)
Simon Kelley28866e92011-02-14 20:19:14 +0000344 forward->flags |= FREC_CHECKING_DISABLED;
Simon Kelley83349b82014-02-10 21:02:01 +0000345 if (ad_reqd)
346 forward->flags |= FREC_AD_QUESTION;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000347#ifdef HAVE_DNSSEC
348 forward->work_counter = DNSSEC_WORK;
Simon Kelley613ad152014-02-25 23:02:28 +0000349 if (do_bit)
350 forward->flags |= FREC_DO_QUESTION;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000351#endif
Simon Kelley613ad152014-02-25 23:02:28 +0000352
Simon Kelley28866e92011-02-14 20:19:14 +0000353 header->id = htons(forward->new_id);
354
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000358 otherwise, use the one last known to work. */
359
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100360 if (type == 0)
361 {
Simon Kelley28866e92011-02-14 20:19:14 +0000362 if (option_bool(OPT_ORDER))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100363 start = daemon->servers;
364 else if (!(start = daemon->last_server) ||
365 daemon->forwardcount++ > FORWARD_TEST ||
366 difftime(now, daemon->forwardtime) > FORWARD_TIME)
367 {
368 start = daemon->servers;
369 forward->forwardall = 1;
370 daemon->forwardcount = 0;
371 daemon->forwardtime = now;
372 }
373 }
374 else
Simon Kelleyde379512004-06-22 20:23:33 +0100375 {
Simon Kelley3be34542004-09-11 19:12:13 +0100376 start = daemon->servers;
Simon Kelley28866e92011-02-14 20:19:14 +0000377 if (!option_bool(OPT_ORDER))
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100378 forward->forwardall = 1;
Simon Kelleyde379512004-06-22 20:23:33 +0100379 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000380 }
381 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100382
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
386
387 if (!flags && forward)
388 {
Simon Kelleyde379512004-06-22 20:23:33 +0100389 struct server *firstsentto = start;
390 int forwarded = 0;
Simon Kelley28866e92011-02-14 20:19:14 +0000391
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100392 if (option_bool(OPT_ADD_MAC))
Simon Kelley60b68062014-01-08 12:10:28 +0000393 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
Simon Kelley28866e92011-02-14 20:19:14 +0000394
Simon Kelleyed4c0762013-10-08 20:46:34 +0100395 if (option_bool(OPT_CLIENT_SUBNET))
396 {
Simon Kelley60b68062014-01-08 12:10:28 +0000397 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
Simon Kelleyed4c0762013-10-08 20:46:34 +0100398 if (new != plen)
399 {
400 plen = new;
401 forward->flags |= FREC_HAS_SUBNET;
402 }
403 }
404
Simon Kelley3a237152013-12-12 12:15:50 +0000405#ifdef HAVE_DNSSEC
406 if (option_bool(OPT_DNSSEC_VALID))
Simon Kelley0fc2f312014-01-08 10:26:58 +0000407 {
Simon Kelley613ad152014-02-25 23:02:28 +0000408 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
409
Simon Kelley5b3bf922014-01-25 17:03:07 +0000410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG))
413 header->hb4 |= HB4_CD;
Simon Kelley613ad152014-02-25 23:02:28 +0000414
415 if (new_plen != plen)
416 forward->flags |= FREC_ADDED_PHEADER;
417
418 plen = new_plen;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000419 }
Simon Kelley3a237152013-12-12 12:15:50 +0000420#endif
421
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000422 while (1)
423 {
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
427
Simon Kelleyde379512004-06-22 20:23:33 +0100428 if (type == (start->flags & SERV_TYPE) &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100429 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
430 !(start->flags & SERV_LITERAL_ADDRESS))
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000431 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100432 int fd;
433
434 /* find server socket to use, may need to get random one. */
435 if (start->sfd)
436 fd = start->sfd->fd;
437 else
438 {
439#ifdef HAVE_IPV6
440 if (start->addr.sa.sa_family == AF_INET6)
441 {
442 if (!forward->rfd6 &&
443 !(forward->rfd6 = allocate_rfd(AF_INET6)))
444 break;
Simon Kelley3927da42008-07-20 15:10:39 +0100445 daemon->rfd_save = forward->rfd6;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100446 fd = forward->rfd6->fd;
447 }
448 else
449#endif
450 {
451 if (!forward->rfd4 &&
452 !(forward->rfd4 = allocate_rfd(AF_INET)))
453 break;
Simon Kelley3927da42008-07-20 15:10:39 +0100454 daemon->rfd_save = forward->rfd4;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100455 fd = forward->rfd4->fd;
456 }
Simon Kelley7de060b2011-08-26 17:24:52 +0100457
458#ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK))
461 {
462 unsigned int mark;
Giacomo Tazzari797a7af2013-04-22 13:16:37 +0100463 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
Simon Kelley7de060b2011-08-26 17:24:52 +0100464 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
465 }
466#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +0100467 }
468
469 if (sendto(fd, (char *)header, plen, 0,
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100470 &start->addr.sa,
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100471 sa_len(&start->addr)) == -1)
472 {
473 if (retry_send())
474 continue;
475 }
476 else
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000477 {
Simon Kelleycdeda282006-03-16 20:16:06 +0000478 /* Keep info in case we want to re-send this packet */
479 daemon->srv_save = start;
480 daemon->packet_len = plen;
481
Simon Kelleyde379512004-06-22 20:23:33 +0100482 if (!gotname)
Simon Kelley3be34542004-09-11 19:12:13 +0100483 strcpy(daemon->namebuff, "query");
Simon Kelleyde379512004-06-22 20:23:33 +0100484 if (start->addr.sa.sa_family == AF_INET)
Simon Kelley3be34542004-09-11 19:12:13 +0100485 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +0100486 (struct all_addr *)&start->addr.in.sin_addr, NULL);
Simon Kelleyde379512004-06-22 20:23:33 +0100487#ifdef HAVE_IPV6
488 else
Simon Kelley3be34542004-09-11 19:12:13 +0100489 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +0100490 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
Simon Kelleyde379512004-06-22 20:23:33 +0100491#endif
Simon Kelley824af852008-02-12 20:43:05 +0000492 start->queries++;
Simon Kelleyde379512004-06-22 20:23:33 +0100493 forwarded = 1;
494 forward->sentto = start;
Simon Kelley0a852542005-03-23 20:28:59 +0000495 if (!forward->forwardall)
Simon Kelleyde379512004-06-22 20:23:33 +0100496 break;
Simon Kelley0a852542005-03-23 20:28:59 +0000497 forward->forwardall++;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000498 }
499 }
500
Simon Kelleyde379512004-06-22 20:23:33 +0100501 if (!(start = start->next))
Simon Kelley3be34542004-09-11 19:12:13 +0100502 start = daemon->servers;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000503
Simon Kelleyde379512004-06-22 20:23:33 +0100504 if (start == firstsentto)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000505 break;
506 }
507
Simon Kelleyde379512004-06-22 20:23:33 +0100508 if (forwarded)
Simon Kelley824af852008-02-12 20:43:05 +0000509 return 1;
Simon Kelleyde379512004-06-22 20:23:33 +0100510
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000511 /* could not send on, prepare to return */
512 header->id = htons(forward->orig_id);
Simon Kelley1a6bca82008-07-11 11:11:42 +0100513 free_frec(forward); /* cancel */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000514 }
515
516 /* could not send on, return empty answer or address if known for whole domain */
Simon Kelleyb8187c82005-11-26 21:46:27 +0000517 if (udpfd != -1)
518 {
Simon Kelleycdeda282006-03-16 20:16:06 +0000519 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
Simon Kelley54dd3932012-06-20 11:23:38 +0100520 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
Simon Kelleyb8187c82005-11-26 21:46:27 +0000521 }
522
Simon Kelley824af852008-02-12 20:43:05 +0000523 return 0;
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000524}
525
Simon Kelleyed4c0762013-10-08 20:46:34 +0100526static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
Simon Kelley613ad152014-02-25 23:02:28 +0000527 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100528{
Simon Kelley36717ee2004-09-20 19:20:58 +0100529 unsigned char *pheader, *sizep;
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000530 char **sets = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +0000531 int munged = 0, is_sign;
Simon Kelleycdeda282006-03-16 20:16:06 +0000532 size_t plen;
533
Simon Kelley83349b82014-02-10 21:02:01 +0000534 (void)ad_reqd;
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000535 (void) do_bit;
Simon Kelley83349b82014-02-10 21:02:01 +0000536
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000537#ifdef HAVE_IPSET
Simon Kelley82a14af2014-04-13 20:48:57 +0100538 if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL))
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000539 {
Simon Kelley82a14af2014-04-13 20:48:57 +0100540 /* Similar algorithm to search_servers. */
541 struct ipsets *ipset_pos;
542 unsigned int namelen = strlen(daemon->namebuff);
543 unsigned int matchlen = 0;
544 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
Simon Kelley6c0cb852014-01-17 14:40:46 +0000545 {
Simon Kelley82a14af2014-04-13 20:48:57 +0100546 unsigned int domainlen = strlen(ipset_pos->domain);
547 char *matchstart = daemon->namebuff + namelen - domainlen;
548 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
549 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
550 domainlen >= matchlen)
551 {
552 matchlen = domainlen;
553 sets = ipset_pos->sets;
554 }
Simon Kelley6c0cb852014-01-17 14:40:46 +0000555 }
Jason A. Donenfeld13d86c72013-02-22 18:20:53 +0000556 }
557#endif
558
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100559 /* If upstream is advertising a larger UDP packet size
Simon Kelley9009d742008-11-14 20:04:27 +0000560 than we allow, trim it so that we don't get overlarge
561 requests for the client. We can't do this for signed packets. */
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100562
Simon Kelleyed4c0762013-10-08 20:46:34 +0100563 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100564 {
Simon Kelley83349b82014-02-10 21:02:01 +0000565 unsigned short udpsz;
566 unsigned char *psave = sizep;
567
568 GETSHORT(udpsz, sizep);
569
570 if (!is_sign && udpsz > daemon->edns_pktsz)
571 PUTSHORT(daemon->edns_pktsz, psave);
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100572
Simon Kelleyed4c0762013-10-08 20:46:34 +0100573 if (check_subnet && !check_source(header, plen, pheader, query_source))
574 {
575 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
576 return 0;
577 }
Simon Kelley613ad152014-02-25 23:02:28 +0000578
579 if (added_pheader)
580 {
581 pheader = 0;
582 header->arcount = htons(0);
583 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100584 }
Simon Kelley83349b82014-02-10 21:02:01 +0000585
Simon Kelley28866e92011-02-14 20:19:14 +0000586 /* RFC 4035 sect 4.6 para 3 */
Giovanni Bajo237724c2012-04-05 02:46:52 +0200587 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
Simon Kelley795501b2014-01-08 18:11:55 +0000588 header->hb4 &= ~HB4_AD;
Simon Kelley3a237152013-12-12 12:15:50 +0000589
Simon Kelley572b41e2011-02-18 18:11:18 +0000590 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
Simon Kelley36717ee2004-09-20 19:20:58 +0100591 return n;
592
Simon Kelley0a852542005-03-23 20:28:59 +0000593 /* Complain loudly if the upstream server is non-recursive. */
Simon Kelley572b41e2011-02-18 18:11:18 +0000594 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
Simon Kelley0a852542005-03-23 20:28:59 +0000595 server && !(server->flags & SERV_WARNED_RECURSIVE))
596 {
Simon Kelley3d8df262005-08-29 12:19:27 +0100597 prettyprint_addr(&server->addr, daemon->namebuff);
Simon Kelleyf2621c72007-04-29 19:47:21 +0100598 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
Simon Kelley28866e92011-02-14 20:19:14 +0000599 if (!option_bool(OPT_LOG))
Simon Kelley0a852542005-03-23 20:28:59 +0000600 server->flags |= SERV_WARNED_RECURSIVE;
601 }
Giovanni Bajoe292e932012-04-22 14:32:02 +0200602
Simon Kelley572b41e2011-02-18 18:11:18 +0000603 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100604 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100605 {
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100606 munged = 1;
Simon Kelley572b41e2011-02-18 18:11:18 +0000607 SET_RCODE(header, NXDOMAIN);
608 header->hb3 &= ~HB3_AA;
Simon Kelley6938f342014-01-26 22:47:39 +0000609 cache_secure = 0;
Simon Kelley36717ee2004-09-20 19:20:58 +0100610 }
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100611 else
Simon Kelley36717ee2004-09-20 19:20:58 +0100612 {
Simon Kelley6938f342014-01-26 22:47:39 +0000613 int doctored = 0;
614
Simon Kelley572b41e2011-02-18 18:11:18 +0000615 if (RCODE(header) == NXDOMAIN &&
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100616 extract_request(header, n, daemon->namebuff, NULL) &&
Simon Kelley5aabfc72007-08-29 11:24:47 +0100617 check_for_local_domain(daemon->namebuff, now))
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100618 {
Simon Kelley36717ee2004-09-20 19:20:58 +0100619 /* if we forwarded a query for a locally known name (because it was for
620 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
621 since we know that the domain exists, even if upstream doesn't */
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100622 munged = 1;
Simon Kelley572b41e2011-02-18 18:11:18 +0000623 header->hb3 |= HB3_AA;
624 SET_RCODE(header, NOERROR);
Simon Kelley6938f342014-01-26 22:47:39 +0000625 cache_secure = 0;
Simon Kelley36717ee2004-09-20 19:20:58 +0100626 }
Simon Kelley832af0b2007-01-21 20:01:28 +0000627
Simon Kelley6938f342014-01-26 22:47:39 +0000628 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
Simon Kelley824af852008-02-12 20:43:05 +0000629 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100630 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
Simon Kelley824af852008-02-12 20:43:05 +0000631 munged = 1;
Simon Kelley6938f342014-01-26 22:47:39 +0000632 cache_secure = 0;
Simon Kelley824af852008-02-12 20:43:05 +0000633 }
Simon Kelley6938f342014-01-26 22:47:39 +0000634
635 if (doctored)
636 cache_secure = 0;
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100637 }
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100638
Simon Kelleya25720a2014-01-14 23:13:55 +0000639#ifdef HAVE_DNSSEC
640 if (no_cache && !(header->hb4 & HB4_CD))
641 {
Simon Kelley7d23a662014-01-26 09:33:21 +0000642 if (!option_bool(OPT_DNSSEC_DEBUG))
Simon Kelleya25720a2014-01-14 23:13:55 +0000643 {
644 /* Bogus reply, turn into SERVFAIL */
645 SET_RCODE(header, SERVFAIL);
646 munged = 1;
647 }
648 }
Simon Kelley6938f342014-01-26 22:47:39 +0000649
650 if (option_bool(OPT_DNSSEC_VALID))
651 header->hb4 &= ~HB4_AD;
652
Simon Kelley83349b82014-02-10 21:02:01 +0000653 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
Simon Kelley6938f342014-01-26 22:47:39 +0000654 header->hb4 |= HB4_AD;
Simon Kelley613ad152014-02-25 23:02:28 +0000655
656 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
657 if (!do_bit)
658 n = filter_rrsigs(header, n);
Simon Kelleya25720a2014-01-14 23:13:55 +0000659#endif
660
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100661 /* do this after extract_addresses. Ensure NODATA reply and remove
662 nameserver info. */
663
664 if (munged)
665 {
666 header->ancount = htons(0);
667 header->nscount = htons(0);
668 header->arcount = htons(0);
669 }
670
Simon Kelley36717ee2004-09-20 19:20:58 +0100671 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
672 sections of the packet. Find the new length here and put back pseudoheader
673 if it was removed. */
674 return resize_packet(header, n, pheader, plen);
Simon Kelleyfeba5c12004-07-27 20:28:58 +0100675}
676
Simon Kelley3be34542004-09-11 19:12:13 +0100677/* sets new last_server */
Simon Kelley1a6bca82008-07-11 11:11:42 +0100678void reply_query(int fd, int family, time_t now)
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000679{
680 /* packet from peer server, extract data for cache, and send to
681 original requester */
Simon Kelley572b41e2011-02-18 18:11:18 +0000682 struct dns_header *header;
Simon Kelleyde379512004-06-22 20:23:33 +0100683 union mysockaddr serveraddr;
Simon Kelley832af0b2007-01-21 20:01:28 +0000684 struct frec *forward;
Simon Kelleyde379512004-06-22 20:23:33 +0100685 socklen_t addrlen = sizeof(serveraddr);
Simon Kelley60b68062014-01-08 12:10:28 +0000686 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
Simon Kelleycdeda282006-03-16 20:16:06 +0000687 size_t nn;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100688 struct server *server;
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000689 void *hash;
690#ifndef HAVE_DNSSEC
691 unsigned int crc;
692#endif
693
Simon Kelleycdeda282006-03-16 20:16:06 +0000694 /* packet buffer overwritten */
695 daemon->srv_save = NULL;
Simon Kelley832af0b2007-01-21 20:01:28 +0000696
Simon Kelleyde379512004-06-22 20:23:33 +0100697 /* Determine the address of the server replying so that we can mark that as good */
Simon Kelley1a6bca82008-07-11 11:11:42 +0100698 serveraddr.sa.sa_family = family;
Simon Kelleyde379512004-06-22 20:23:33 +0100699#ifdef HAVE_IPV6
700 if (serveraddr.sa.sa_family == AF_INET6)
Simon Kelley5e9e0ef2006-04-17 14:24:29 +0100701 serveraddr.in6.sin6_flowinfo = 0;
Simon Kelleyde379512004-06-22 20:23:33 +0100702#endif
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000703
Simon Kelley490f9072014-03-24 22:04:42 +0000704 header = (struct dns_header *)daemon->packet;
705
706 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
707 return;
708
Simon Kelley1a6bca82008-07-11 11:11:42 +0100709 /* spoof check: answer must come from known server, */
710 for (server = daemon->servers; server; server = server->next)
711 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
712 sockaddr_isequal(&server->addr, &serveraddr))
713 break;
Simon Kelley490f9072014-03-24 22:04:42 +0000714
715 if (!server)
716 return;
717
Simon Kelley8a9be9e2014-01-25 23:17:21 +0000718#ifdef HAVE_DNSSEC
719 hash = hash_questions(header, n, daemon->namebuff);
720#else
721 hash = &crc;
722 crc = questions_crc(header, n, daemon->namebuff);
723#endif
Simon Kelleyfd9fa482004-10-21 20:24:00 +0100724
Simon Kelley490f9072014-03-24 22:04:42 +0000725 if (!(forward = lookup_frec(ntohs(header->id), hash)))
Simon Kelley1a6bca82008-07-11 11:11:42 +0100726 return;
Simon Kelley490f9072014-03-24 22:04:42 +0000727
Simon Kelley572b41e2011-02-18 18:11:18 +0000728 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
Simon Kelley28866e92011-02-14 20:19:14 +0000729 !option_bool(OPT_ORDER) &&
Simon Kelley1a6bca82008-07-11 11:11:42 +0100730 forward->forwardall == 0)
731 /* for broken servers, attempt to send to another one. */
Simon Kelley9e4abcb2004-01-22 19:47:41 +0000732 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100733 unsigned char *pheader;
734 size_t plen;
735 int is_sign;
Simon Kelley832af0b2007-01-21 20:01:28 +0000736
Simon Kelley1a6bca82008-07-11 11:11:42 +0100737 /* recreate query from reply */
738 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
739 if (!is_sign)
Simon Kelley832af0b2007-01-21 20:01:28 +0000740 {
Simon Kelley1a6bca82008-07-11 11:11:42 +0100741 header->ancount = htons(0);
742 header->nscount = htons(0);
743 header->arcount = htons(0);
744 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
745 {
Simon Kelley572b41e2011-02-18 18:11:18 +0000746 header->hb3 &= ~(HB3_QR | HB3_TC);
Simon Kelley613ad152014-02-25 23:02:28 +0000747 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
Simon Kelley1a6bca82008-07-11 11:11:42 +0100748 return;
749 }
750 }
751 }
Simon Kelley3a237152013-12-12 12:15:50 +0000752
753 server = forward->sentto;
Simon Kelley1a6bca82008-07-11 11:11:42 +0100754
755 if ((forward->sentto->flags & SERV_TYPE) == 0)
756 {
Simon Kelley51967f92014-03-25 21:07:00 +0000757 if (RCODE(header) == REFUSED)
Simon Kelley1a6bca82008-07-11 11:11:42 +0100758 server = NULL;
759 else
760 {
761 struct server *last_server;
Simon Kelley832af0b2007-01-21 20:01:28 +0000762
Simon Kelley1a6bca82008-07-11 11:11:42 +0100763 /* find good server by address if possible, otherwise assume the last one we sent to */
764 for (last_server = daemon->servers; last_server; last_server = last_server->next)
765 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
766 sockaddr_isequal(&last_server->addr, &serveraddr))
767 {
768 server = last_server;
769 break;
770 }
771 }
Simon Kelley28866e92011-02-14 20:19:14 +0000772 if (!option_bool(OPT_ALL_SERVERS))
Simon Kelley1a6bca82008-07-11 11:11:42 +0100773 daemon->last_server = server;
774 }
Simon Kelley3a237152013-12-12 12:15:50 +0000775
Simon Kelley1a6bca82008-07-11 11:11:42 +0100776 /* If the answer is an error, keep the forward record in place in case
777 we get a good reply from another server. Kill it when we've
778 had replies from all to avoid filling the forwarding table when
779 everything is broken */
Simon Kelley51967f92014-03-25 21:07:00 +0000780 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
Simon Kelley1a6bca82008-07-11 11:11:42 +0100781 {
Simon Kelley3a237152013-12-12 12:15:50 +0000782 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100783
Simon Kelley3a237152013-12-12 12:15:50 +0000784 if (option_bool(OPT_NO_REBIND))
785 check_rebind = !(forward->flags & FREC_NOREBIND);
Simon Kelley8ef5ada2010-06-03 19:42:45 +0100786
Simon Kelley3a237152013-12-12 12:15:50 +0000787 /* Don't cache replies where DNSSEC validation was turned off, either
788 the upstream server told us so, or the original query specified it. */
789 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
790 no_cache_dnssec = 1;
791
792#ifdef HAVE_DNSSEC
Simon Kelley51967f92014-03-25 21:07:00 +0000793 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
Simon Kelley3a237152013-12-12 12:15:50 +0000794 {
Simon Kelley9d633042013-12-13 15:36:55 +0000795 int status;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000796
797 /* We've had a reply already, which we're validating. Ignore this duplicate */
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000798 if (forward->blocking_query)
Simon Kelley0fc2f312014-01-08 10:26:58 +0000799 return;
Simon Kelley9d633042013-12-13 15:36:55 +0000800
Simon Kelley871417d2014-01-08 11:22:32 +0000801 if (header->hb3 & HB3_TC)
802 {
803 /* Truncated answer can't be validated.
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000804 If this is an answer to a DNSSEC-generated query, we still
805 need to get the client to retry over TCP, so return
806 an answer with the TC bit set, even if the actual answer fits.
807 */
808 status = STAT_TRUNCATED;
Simon Kelley871417d2014-01-08 11:22:32 +0000809 }
810 else if (forward->flags & FREC_DNSKEY_QUERY)
Simon Kelley8d718cb2014-02-03 16:27:37 +0000811 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelleyc3e0b9b2013-12-31 13:50:39 +0000812 else if (forward->flags & FREC_DS_QUERY)
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000813 {
814 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
815 if (status == STAT_NO_DS)
816 status = STAT_INSECURE;
817 }
818 else if (forward->flags & FREC_CHECK_NOSIGN)
819 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelley9d633042013-12-13 15:36:55 +0000820 else
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000821 {
822 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
823 if (status == STAT_NO_SIG)
824 {
825 if (option_bool(OPT_DNSSEC_NO_SIGN))
826 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
827 else
828 status = STAT_INSECURE;
829 }
830 }
Simon Kelley3a237152013-12-12 12:15:50 +0000831 /* Can't validate, as we're missing key data. Put this
832 answer aside, whilst we get that. */
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000833 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
Simon Kelley3a237152013-12-12 12:15:50 +0000834 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000835 struct frec *new, *orig;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000836
Simon Kelley7fa836e2014-02-10 20:11:24 +0000837 /* Free any saved query */
838 if (forward->stash)
839 blockdata_free(forward->stash);
840
841 /* Now save reply pending receipt of key data */
842 if (!(forward->stash = blockdata_alloc((char *)header, n)))
843 return;
844 forward->stash_len = n;
845
846 anotherkey:
847 /* Find the original query that started it all.... */
848 for (orig = forward; orig->dependent; orig = orig->dependent);
849
850 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
851 status = STAT_INSECURE;
852 else
Simon Kelley3a237152013-12-12 12:15:50 +0000853 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000854 int fd;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000855 struct frec *next = new->next;
856 *new = *forward; /* copy everything, then overwrite */
857 new->next = next;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000858 new->blocking_query = NULL;
Simon Kelley8a8bbad2014-03-27 22:02:17 +0000859 new->sentto = server;
Simon Kelleyf1668d22014-01-08 16:53:27 +0000860 new->rfd4 = NULL;
861#ifdef HAVE_IPV6
862 new->rfd6 = NULL;
863#endif
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000864 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
Simon Kelley9d633042013-12-13 15:36:55 +0000865
Simon Kelley7fa836e2014-02-10 20:11:24 +0000866 new->dependent = forward; /* to find query awaiting new one. */
867 forward->blocking_query = new; /* for garbage cleaning */
868 /* validate routines leave name of required record in daemon->keyname */
869 if (status == STAT_NEED_KEY)
870 {
871 new->flags |= FREC_DNSKEY_QUERY;
872 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
873 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
874 }
875 else
876 {
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000877 if (status == STAT_NEED_DS_NEG)
878 new->flags |= FREC_CHECK_NOSIGN;
879 else
880 new->flags |= FREC_DS_QUERY;
Simon Kelley7fa836e2014-02-10 20:11:24 +0000881 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
882 daemon->keyname, forward->class, T_DS, &server->addr);
883 }
884 if ((hash = hash_questions(header, nn, daemon->namebuff)))
885 memcpy(new->hash, hash, HASH_SIZE);
886 new->new_id = get_id();
887 header->id = htons(new->new_id);
888 /* Save query for retransmission */
889 new->stash = blockdata_alloc((char *)header, nn);
890 new->stash_len = nn;
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000891
Simon Kelley7fa836e2014-02-10 20:11:24 +0000892 /* Don't resend this. */
893 daemon->srv_save = NULL;
894
895 if (server->sfd)
896 fd = server->sfd->fd;
Simon Kelleye0c0ad32014-01-16 22:42:07 +0000897 else
Simon Kelley3a237152013-12-12 12:15:50 +0000898 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000899 fd = -1;
Simon Kelley3a237152013-12-12 12:15:50 +0000900#ifdef HAVE_IPV6
Simon Kelley7fa836e2014-02-10 20:11:24 +0000901 if (server->addr.sa.sa_family == AF_INET6)
Simon Kelleyf1668d22014-01-08 16:53:27 +0000902 {
Simon Kelley7fa836e2014-02-10 20:11:24 +0000903 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
904 fd = new->rfd6->fd;
905 }
906 else
907#endif
908 {
909 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
910 fd = new->rfd4->fd;
Simon Kelleyf1668d22014-01-08 16:53:27 +0000911 }
Simon Kelley3a237152013-12-12 12:15:50 +0000912 }
Simon Kelley7fa836e2014-02-10 20:11:24 +0000913
914 if (fd != -1)
915 {
916 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
917 server->queries++;
918 }
919
920 return;
Simon Kelley3a237152013-12-12 12:15:50 +0000921 }
Simon Kelley3a237152013-12-12 12:15:50 +0000922 }
923
924 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
925 Now wind back down, pulling back answers which wouldn't previously validate
Simon Kelley7fa836e2014-02-10 20:11:24 +0000926 and validate them with the new data. Note that if an answer needs multiple
927 keys to validate, we may find another key is needed, in which case we set off
928 down another branch of the tree. Once we get to the original answer
929 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
Simon Kelley0744ca62014-01-25 16:40:15 +0000930 while (forward->dependent)
Simon Kelley3a237152013-12-12 12:15:50 +0000931 {
Simon Kelley0744ca62014-01-25 16:40:15 +0000932 struct frec *prev = forward->dependent;
933 free_frec(forward);
934 forward = prev;
935 forward->blocking_query = NULL; /* already gone */
936 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
937 n = forward->stash_len;
Simon Kelley0fc2f312014-01-08 10:26:58 +0000938
Simon Kelley0fc2f312014-01-08 10:26:58 +0000939 if (status == STAT_SECURE)
Simon Kelley0fc2f312014-01-08 10:26:58 +0000940 {
Simon Kelley0744ca62014-01-25 16:40:15 +0000941 if (forward->flags & FREC_DNSKEY_QUERY)
942 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
943 else if (forward->flags & FREC_DS_QUERY)
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000944 {
945 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
946 if (status == STAT_NO_DS)
947 status = STAT_INSECURE;
948 }
949 else if (forward->flags & FREC_CHECK_NOSIGN)
950 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
Simon Kelley0744ca62014-01-25 16:40:15 +0000951 else
Simon Kelley00a5b5d2014-02-28 18:10:55 +0000952 {
953 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
954 if (status == STAT_NO_SIG)
955 {
956 if (option_bool(OPT_DNSSEC_NO_SIGN))
957 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
958 else
959 status = STAT_INSECURE;
960 }
961 }
962
963 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
Simon Kelley7fa836e2014-02-10 20:11:24 +0000964 goto anotherkey;
Simon Kelley3a237152013-12-12 12:15:50 +0000965 }
966 }
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000967
968 if (status == STAT_TRUNCATED)
Simon Kelley0744ca62014-01-25 16:40:15 +0000969 header->hb3 |= HB3_TC;
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000970 else
Simon Kelley7fa836e2014-02-10 20:11:24 +0000971 {
972 char *result;
973
974 if (forward->work_counter == 0)
975 result = "ABANDONED";
976 else
977 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
978
979 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
980 }
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000981
Simon Kelley0fc2f312014-01-08 10:26:58 +0000982 no_cache_dnssec = 0;
Simon Kelley5d3b87a2014-01-20 11:57:23 +0000983
Simon Kelley3a237152013-12-12 12:15:50 +0000984 if (status == STAT_SECURE)
985 cache_secure = 1;
Simon Kelley3a237152013-12-12 12:15:50 +0000986 else if (status == STAT_BOGUS)
987 no_cache_dnssec = 1;
988 }
Simon Kelley83349b82014-02-10 21:02:01 +0000989#endif
990
991 /* restore CD bit to the value in the query */
992 if (forward->flags & FREC_CHECKING_DISABLED)
993 header->hb4 |= HB4_CD;
994 else
995 header->hb4 &= ~HB4_CD;
Simon Kelley3a237152013-12-12 12:15:50 +0000996
997 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
Simon Kelley613ad152014-02-25 23:02:28 +0000998 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
999 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
Simon Kelley832af0b2007-01-21 20:01:28 +00001000 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01001001 header->id = htons(forward->orig_id);
Simon Kelley572b41e2011-02-18 18:11:18 +00001002 header->hb4 |= HB4_RA; /* recursion if available */
Simon Kelley54dd3932012-06-20 11:23:38 +01001003 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
Simon Kelley50303b12012-04-04 22:13:17 +01001004 &forward->source, &forward->dest, forward->iface);
Simon Kelley832af0b2007-01-21 20:01:28 +00001005 }
Simon Kelley1a6bca82008-07-11 11:11:42 +01001006 free_frec(forward); /* cancel */
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001007 }
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001008}
Simon Kelley44a2a312004-03-10 20:04:35 +00001009
Simon Kelley1a6bca82008-07-11 11:11:42 +01001010
Simon Kelley5aabfc72007-08-29 11:24:47 +01001011void receive_query(struct listener *listen, time_t now)
Simon Kelley44a2a312004-03-10 20:04:35 +00001012{
Simon Kelley572b41e2011-02-18 18:11:18 +00001013 struct dns_header *header = (struct dns_header *)daemon->packet;
Simon Kelley44a2a312004-03-10 20:04:35 +00001014 union mysockaddr source_addr;
Simon Kelleyc1bb8502004-08-11 18:40:17 +01001015 unsigned short type;
Simon Kelley44a2a312004-03-10 20:04:35 +00001016 struct all_addr dst_addr;
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001017 struct in_addr netmask, dst_addr_4;
Simon Kelleycdeda282006-03-16 20:16:06 +00001018 size_t m;
1019 ssize_t n;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001020 int if_index = 0, auth_dns = 0;
1021#ifdef HAVE_AUTH
1022 int local_auth = 0;
1023#endif
Simon Kelley44a2a312004-03-10 20:04:35 +00001024 struct iovec iov[1];
1025 struct msghdr msg;
1026 struct cmsghdr *cmptr;
Simon Kelley44a2a312004-03-10 20:04:35 +00001027 union {
1028 struct cmsghdr align; /* this ensures alignment */
1029#ifdef HAVE_IPV6
1030 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1031#endif
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001032#if defined(HAVE_LINUX_NETWORK)
Simon Kelley44a2a312004-03-10 20:04:35 +00001033 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
Simon Kelley824af852008-02-12 20:43:05 +00001034#elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1035 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1036 CMSG_SPACE(sizeof(unsigned int))];
Simon Kelley44a2a312004-03-10 20:04:35 +00001037#elif defined(IP_RECVDSTADDR)
1038 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1039 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1040#endif
1041 } control_u;
Simon Kelley2329bef2013-12-03 13:41:16 +00001042#ifdef HAVE_IPV6
1043 /* Can always get recvd interface for IPv6 */
1044 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1045#else
1046 int check_dst = !option_bool(OPT_NOWILD);
1047#endif
1048
Simon Kelleycdeda282006-03-16 20:16:06 +00001049 /* packet buffer overwritten */
1050 daemon->srv_save = NULL;
1051
Simon Kelley4f7b3042012-11-28 21:27:02 +00001052 dst_addr_4.s_addr = 0;
1053 netmask.s_addr = 0;
1054
Simon Kelley7e5664b2013-04-05 16:57:41 +01001055 if (option_bool(OPT_NOWILD) && listen->iface)
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001056 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001057 auth_dns = listen->iface->dns_auth;
1058
1059 if (listen->family == AF_INET)
1060 {
1061 dst_addr_4 = listen->iface->addr.in.sin_addr;
1062 netmask = listen->iface->netmask;
1063 }
Simon Kelleyf6b7dc42005-01-23 12:06:08 +00001064 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001065
Simon Kelley3be34542004-09-11 19:12:13 +01001066 iov[0].iov_base = daemon->packet;
1067 iov[0].iov_len = daemon->edns_pktsz;
Simon Kelley44a2a312004-03-10 20:04:35 +00001068
1069 msg.msg_control = control_u.control;
1070 msg.msg_controllen = sizeof(control_u);
1071 msg.msg_flags = 0;
1072 msg.msg_name = &source_addr;
1073 msg.msg_namelen = sizeof(source_addr);
1074 msg.msg_iov = iov;
1075 msg.msg_iovlen = 1;
1076
Simon Kelleyde379512004-06-22 20:23:33 +01001077 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
Simon Kelley3be34542004-09-11 19:12:13 +01001078 return;
Simon Kelley44a2a312004-03-10 20:04:35 +00001079
Simon Kelley572b41e2011-02-18 18:11:18 +00001080 if (n < (int)sizeof(struct dns_header) ||
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001081 (msg.msg_flags & MSG_TRUNC) ||
Simon Kelley572b41e2011-02-18 18:11:18 +00001082 (header->hb3 & HB3_QR))
Simon Kelley3be34542004-09-11 19:12:13 +01001083 return;
Simon Kelley44a2a312004-03-10 20:04:35 +00001084
Simon Kelley26128d22004-11-14 16:43:54 +00001085 source_addr.sa.sa_family = listen->family;
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001086
1087 if (listen->family == AF_INET)
1088 {
1089 /* Source-port == 0 is an error, we can't send back to that.
1090 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1091 if (source_addr.in.sin_port == 0)
1092 return;
1093 }
Simon Kelley26128d22004-11-14 16:43:54 +00001094#ifdef HAVE_IPV6
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001095 else
1096 {
1097 /* Source-port == 0 is an error, we can't send back to that. */
1098 if (source_addr.in6.sin6_port == 0)
1099 return;
1100 source_addr.in6.sin6_flowinfo = 0;
1101 }
Simon Kelley26128d22004-11-14 16:43:54 +00001102#endif
Simon Kelley2a7a2b82014-03-22 19:18:06 +00001103
Simon Kelleyc8a80482014-03-05 14:29:54 +00001104 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1105 if (option_bool(OPT_LOCAL_SERVICE))
1106 {
1107 struct addrlist *addr;
1108#ifdef HAVE_IPV6
1109 if (listen->family == AF_INET6)
1110 {
1111 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1112 if ((addr->flags & ADDRLIST_IPV6) &&
1113 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1114 break;
1115 }
1116 else
1117#endif
1118 {
1119 struct in_addr netmask;
1120 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1121 {
1122 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1123 if (!(addr->flags & ADDRLIST_IPV6) &&
1124 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1125 break;
1126 }
1127 }
1128 if (!addr)
1129 {
Simon Kelley0c8584e2014-03-12 20:12:56 +00001130 static int warned = 0;
1131 if (!warned)
1132 {
1133 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1134 warned = 1;
1135 }
Simon Kelleyc8a80482014-03-05 14:29:54 +00001136 return;
1137 }
1138 }
1139
Simon Kelley2329bef2013-12-03 13:41:16 +00001140 if (check_dst)
Simon Kelley44a2a312004-03-10 20:04:35 +00001141 {
Simon Kelley8a911cc2004-03-16 18:35:52 +00001142 struct ifreq ifr;
1143
Simon Kelley26128d22004-11-14 16:43:54 +00001144 if (msg.msg_controllen < sizeof(struct cmsghdr))
1145 return;
1146
Simon Kelley5e9e0ef2006-04-17 14:24:29 +01001147#if defined(HAVE_LINUX_NETWORK)
Simon Kelley26128d22004-11-14 16:43:54 +00001148 if (listen->family == AF_INET)
1149 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +00001150 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
Simon Kelley26128d22004-11-14 16:43:54 +00001151 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001152 union {
1153 unsigned char *c;
1154 struct in_pktinfo *p;
1155 } p;
1156 p.c = CMSG_DATA(cmptr);
1157 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1158 if_index = p.p->ipi_ifindex;
Simon Kelley26128d22004-11-14 16:43:54 +00001159 }
1160#elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1161 if (listen->family == AF_INET)
1162 {
1163 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001164 {
1165 union {
1166 unsigned char *c;
1167 unsigned int *i;
1168 struct in_addr *a;
1169#ifndef HAVE_SOLARIS_NETWORK
1170 struct sockaddr_dl *s;
Simon Kelley824af852008-02-12 20:43:05 +00001171#endif
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001172 } p;
1173 p.c = CMSG_DATA(cmptr);
1174 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1175 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1176 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1177#ifdef HAVE_SOLARIS_NETWORK
1178 if_index = *(p.i);
1179#else
1180 if_index = p.s->sdl_index;
1181#endif
1182 }
Simon Kelley26128d22004-11-14 16:43:54 +00001183 }
1184#endif
1185
1186#ifdef HAVE_IPV6
1187 if (listen->family == AF_INET6)
1188 {
1189 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
Simon Kelleyc72daea2012-01-05 21:33:27 +00001190 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
Simon Kelley26128d22004-11-14 16:43:54 +00001191 {
Simon Kelley8ef5ada2010-06-03 19:42:45 +01001192 union {
1193 unsigned char *c;
1194 struct in6_pktinfo *p;
1195 } p;
1196 p.c = CMSG_DATA(cmptr);
1197
1198 dst_addr.addr.addr6 = p.p->ipi6_addr;
1199 if_index = p.p->ipi6_ifindex;
Simon Kelley26128d22004-11-14 16:43:54 +00001200 }
1201 }
1202#endif
1203
1204 /* enforce available interface configuration */
1205
Simon Kelleye25db1f2013-01-29 22:10:26 +00001206 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
Simon Kelley832af0b2007-01-21 20:01:28 +00001207 return;
1208
Simon Kelleye25db1f2013-01-29 22:10:26 +00001209 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1210 {
1211 if (!option_bool(OPT_CLEVERBIND))
Simon Kelley115ac3e2013-05-20 11:28:32 +01001212 enumerate_interfaces(0);
Simon Kelley3f2873d2013-05-14 11:28:47 +01001213 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1214 !label_exception(if_index, listen->family, &dst_addr))
Simon Kelleye25db1f2013-01-29 22:10:26 +00001215 return;
1216 }
1217
Simon Kelley552af8b2012-02-29 20:10:31 +00001218 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1219 {
1220 struct irec *iface;
1221
1222 /* get the netmask of the interface whch has the address we were sent to.
1223 This is no neccessarily the interface we arrived on. */
1224
1225 for (iface = daemon->interfaces; iface; iface = iface->next)
1226 if (iface->addr.sa.sa_family == AF_INET &&
1227 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1228 break;
1229
1230 /* interface may be new */
Simon Kelleye25db1f2013-01-29 22:10:26 +00001231 if (!iface && !option_bool(OPT_CLEVERBIND))
Simon Kelley115ac3e2013-05-20 11:28:32 +01001232 enumerate_interfaces(0);
Simon Kelley552af8b2012-02-29 20:10:31 +00001233
1234 for (iface = daemon->interfaces; iface; iface = iface->next)
1235 if (iface->addr.sa.sa_family == AF_INET &&
1236 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1237 break;
1238
1239 /* If we failed, abandon localisation */
1240 if (iface)
1241 netmask = iface->netmask;
1242 else
1243 dst_addr_4.s_addr = 0;
1244 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001245 }
1246
Simon Kelleycdeda282006-03-16 20:16:06 +00001247 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
Simon Kelley44a2a312004-03-10 20:04:35 +00001248 {
Simon Kelleyb485ed92013-10-18 22:00:39 +01001249#ifdef HAVE_AUTH
1250 struct auth_zone *zone;
1251#endif
Simon Kelley610e7822014-02-06 14:45:17 +00001252 char *types = querystr(auth_dns ? "auth" : "query", type);
1253
Simon Kelley44a2a312004-03-10 20:04:35 +00001254 if (listen->family == AF_INET)
Simon Kelley3be34542004-09-11 19:12:13 +01001255 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +01001256 (struct all_addr *)&source_addr.in.sin_addr, types);
Simon Kelley44a2a312004-03-10 20:04:35 +00001257#ifdef HAVE_IPV6
1258 else
Simon Kelley3be34542004-09-11 19:12:13 +01001259 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
Simon Kelley1a6bca82008-07-11 11:11:42 +01001260 (struct all_addr *)&source_addr.in6.sin6_addr, types);
Simon Kelley44a2a312004-03-10 20:04:35 +00001261#endif
Simon Kelley44a2a312004-03-10 20:04:35 +00001262
Simon Kelley4820dce2012-12-18 18:30:30 +00001263#ifdef HAVE_AUTH
Simon Kelleyb485ed92013-10-18 22:00:39 +01001264 /* find queries for zones we're authoritative for, and answer them directly */
Simon Kelley6008bdb2013-10-21 21:47:03 +01001265 if (!auth_dns)
1266 for (zone = daemon->auth_zones; zone; zone = zone->next)
1267 if (in_zone(zone, daemon->namebuff, NULL))
1268 {
1269 auth_dns = 1;
1270 local_auth = 1;
1271 break;
1272 }
Simon Kelleyb485ed92013-10-18 22:00:39 +01001273#endif
1274 }
1275
1276#ifdef HAVE_AUTH
Simon Kelley4f7b3042012-11-28 21:27:02 +00001277 if (auth_dns)
Simon Kelley824af852008-02-12 20:43:05 +00001278 {
Simon Kelley60b68062014-01-08 12:10:28 +00001279 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001280 if (m >= 1)
Simon Kelleyb485ed92013-10-18 22:00:39 +01001281 {
1282 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1283 (char *)header, m, &source_addr, &dst_addr, if_index);
1284 daemon->auth_answer++;
1285 }
Simon Kelley824af852008-02-12 20:43:05 +00001286 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001287 else
Simon Kelley4820dce2012-12-18 18:30:30 +00001288#endif
Simon Kelley4f7b3042012-11-28 21:27:02 +00001289 {
Simon Kelley613ad152014-02-25 23:02:28 +00001290 int ad_reqd, do_bit;
Simon Kelley60b68062014-01-08 12:10:28 +00001291 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
Simon Kelley613ad152014-02-25 23:02:28 +00001292 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001293
1294 if (m >= 1)
1295 {
1296 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1297 (char *)header, m, &source_addr, &dst_addr, if_index);
1298 daemon->local_answer++;
1299 }
1300 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
Simon Kelley613ad152014-02-25 23:02:28 +00001301 header, (size_t)n, now, NULL, ad_reqd, do_bit))
Simon Kelley4f7b3042012-11-28 21:27:02 +00001302 daemon->queries_forwarded++;
1303 else
1304 daemon->local_answer++;
1305 }
Simon Kelley44a2a312004-03-10 20:04:35 +00001306}
1307
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001308#ifdef HAVE_DNSSEC
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001309
1310/* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1311 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1312 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1313static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
1314{
1315 struct crec *crecp;
1316 char *name_start = name;
1317 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1318
1319 if (status != STAT_INSECURE)
1320 return status;
1321
1322 while (1)
1323 {
1324 crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1325
1326 if (crecp && (crecp->flags & F_DNSSECOK))
1327 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1328
1329 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1330 {
1331 name_start++; /* chop a label off and try again */
1332 continue;
1333 }
1334
Simon Kelley4e1fe442014-03-26 12:24:19 +00001335 /* Reached the root */
1336 if (!name_start)
1337 return STAT_BOGUS;
1338
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001339 strcpy(keyname, name_start);
1340 return STAT_NEED_DS_NEG;
1341 }
1342}
1343
1344/* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1345static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
1346
1347{
1348 char *name_start;
1349 unsigned char *p;
Simon Kelley4872aa72014-04-26 22:13:31 +01001350 int status;
1351
1352 /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a
1353 suitable NSEC reply to DS queries. */
1354 if (RCODE(header) != SERVFAIL)
1355 {
1356 status = dnssec_validate_ds(now, header, plen, name, keyname, class);
1357
1358 if (status != STAT_INSECURE)
1359 {
1360 if (status == STAT_NO_DS)
1361 status = STAT_INSECURE;
1362 return status;
1363 }
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001364 }
1365
1366 p = (unsigned char *)(header+1);
1367
1368 if (extract_name(header, plen, &p, name, 1, 4) &&
1369 (name_start = strchr(name, '.')))
1370 {
1371 name_start++; /* chop a label off and try again */
1372 strcpy(keyname, name_start);
1373 return STAT_NEED_DS_NEG;
1374 }
1375
1376 return STAT_BOGUS;
1377}
1378
1379/* Move toward the root, until we find a signed non-existance of a DS, in which case
1380 an unsigned answer is OK, or we find a signed DS, in which case there should be
1381 a signature, and the answer is BOGUS */
1382static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1383 char *keyname, struct server *server, int *keycount)
1384{
1385 size_t m;
1386 unsigned char *packet, *payload;
1387 u16 *length;
1388 unsigned char *p = (unsigned char *)(header+1);
1389 int status;
1390 char *name_start = name;
1391
1392 /* Get first insecure entry in CNAME chain */
1393 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1394 if (status == STAT_BOGUS)
1395 return STAT_BOGUS;
1396
1397 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1398 return STAT_BOGUS;
1399
1400 payload = &packet[2];
1401 header = (struct dns_header *)payload;
1402 length = (u16 *)packet;
1403
1404 while (1)
1405 {
1406 unsigned char *newhash, hash[HASH_SIZE];
1407 unsigned char c1, c2;
1408 struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1409
1410 if (--(*keycount) == 0)
Tomas Hozzafc2833f2014-03-25 20:43:21 +00001411 {
1412 free(packet);
1413 return STAT_BOGUS;
1414 }
1415
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001416 if (crecp && (crecp->flags & F_DNSSECOK))
1417 {
1418 free(packet);
1419 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1420 }
1421
1422 /* If we have cached insecurely that a DS doesn't exist,
1423 ise that is a hit for where to start looking for the secure one */
1424 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1425 {
1426 name_start++; /* chop a label off and try again */
1427 continue;
1428 }
1429
Simon Kelley4e1fe442014-03-26 12:24:19 +00001430 /* reached the root */
1431 if (!name_start)
1432 {
1433 free(packet);
1434 return STAT_BOGUS;
1435 }
1436
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001437 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1438
1439 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1440 if ((newhash = hash_questions(header, (unsigned int)m, name)))
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001441 {
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001442 memcpy(hash, newhash, HASH_SIZE);
1443
1444 *length = htons(m);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001445
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001446 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1447 read_write(server->tcpfd, &c1, 1, 1) &&
1448 read_write(server->tcpfd, &c2, 1, 1) &&
1449 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001450 {
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001451 m = (c1 << 8) | c2;
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001452
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001453 newhash = hash_questions(header, (unsigned int)m, name);
1454 if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001455 {
Simon Kelley1fc02682014-04-29 12:30:18 +01001456 /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a
1457 suitable NSEC reply to DS queries. */
1458 if (RCODE(header) == SERVFAIL)
1459 status = STAT_INSECURE;
1460 else
1461 /* Note this trashes all three name workspaces */
1462 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001463
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001464 /* We've found a DS which proves the bit of the DNS where the
1465 original query is, is unsigned, so the answer is OK,
1466 if unvalidated. */
1467 if (status == STAT_NO_DS)
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001468 {
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001469 free(packet);
1470 return STAT_INSECURE;
1471 }
1472
1473 /* No DS, not got to DNSSEC-land yet, go up. */
1474 if (status == STAT_INSECURE)
1475 {
1476 p = (unsigned char *)(header+1);
1477
1478 if (extract_name(header, plen, &p, name, 1, 4) &&
1479 (name_start = strchr(name, '.')))
1480 {
1481 name_start++; /* chop a label off and try again */
1482 continue;
1483 }
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001484 }
1485 }
1486 }
1487 }
1488
1489 free(packet);
1490
1491 return STAT_BOGUS;
1492 }
1493}
1494
Simon Kelley7fa836e2014-02-10 20:11:24 +00001495static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1496 int class, char *name, char *keyname, struct server *server, int *keycount)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001497{
1498 /* Recurse up the key heirarchy */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001499 int new_status;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001500
Simon Kelley7fa836e2014-02-10 20:11:24 +00001501 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1502 if (--(*keycount) == 0)
1503 return STAT_INSECURE;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001504
Simon Kelley7fa836e2014-02-10 20:11:24 +00001505 if (status == STAT_NEED_KEY)
1506 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001507 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1508 {
1509 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1510 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1511 new_status = STAT_INSECURE;
1512 }
1513 else if (status == STAT_CHASE_CNAME)
1514 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1515 else
1516 {
1517 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1518
1519 if (new_status == STAT_NO_SIG)
1520 {
1521 if (option_bool(OPT_DNSSEC_NO_SIGN))
1522 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1523 else
1524 new_status = STAT_INSECURE;
1525 }
1526 }
1527
Simon Kelley7fa836e2014-02-10 20:11:24 +00001528 /* Can't validate because we need a key/DS whose name now in keyname.
1529 Make query for same, and recurse to validate */
1530 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001531 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001532 size_t m;
1533 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1534 unsigned char *payload = &packet[2];
1535 struct dns_header *new_header = (struct dns_header *)payload;
1536 u16 *length = (u16 *)packet;
1537 unsigned char c1, c2;
1538
1539 if (!packet)
1540 return STAT_INSECURE;
1541
1542 another_tcp_key:
1543 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1544 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001545
Simon Kelley7fa836e2014-02-10 20:11:24 +00001546 *length = htons(m);
1547
1548 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1549 !read_write(server->tcpfd, &c1, 1, 1) ||
1550 !read_write(server->tcpfd, &c2, 1, 1) ||
1551 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1552 new_status = STAT_INSECURE;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001553 else
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001554 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001555 m = (c1 << 8) | c2;
1556
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001557 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1558
1559 if (new_status == STAT_SECURE)
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001560 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001561 /* Reached a validated record, now try again at this level.
1562 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1563 If so, go round again. */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001564
Simon Kelley7fa836e2014-02-10 20:11:24 +00001565 if (status == STAT_NEED_KEY)
1566 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
Simon Kelley00a5b5d2014-02-28 18:10:55 +00001567 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1568 {
1569 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1570 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1571 new_status = STAT_INSECURE; /* Validated no DS */
1572 }
1573 else if (status == STAT_CHASE_CNAME)
1574 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1575 else
1576 {
1577 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1578
1579 if (new_status == STAT_NO_SIG)
1580 {
1581 if (option_bool(OPT_DNSSEC_NO_SIGN))
1582 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1583 else
1584 new_status = STAT_INSECURE;
1585 }
1586 }
1587
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001588 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
Simon Kelley7fa836e2014-02-10 20:11:24 +00001589 goto another_tcp_key;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001590 }
1591 }
Simon Kelley7fa836e2014-02-10 20:11:24 +00001592
1593 free(packet);
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001594 }
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001595 return new_status;
1596}
1597#endif
1598
1599
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001600/* The daemon forks before calling this: it should deal with one connection,
1601 blocking as neccessary, and then return. Note, need to be a bit careful
1602 about resources for debug mode, when the fork is suppressed: that's
1603 done by the caller. */
Simon Kelley5aabfc72007-08-29 11:24:47 +01001604unsigned char *tcp_request(int confd, time_t now,
Simon Kelley4f7b3042012-11-28 21:27:02 +00001605 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001606{
Simon Kelley28866e92011-02-14 20:19:14 +00001607 size_t size = 0;
1608 int norebind = 0;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001609#ifdef HAVE_AUTH
Simon Kelley19b16892013-10-20 10:19:39 +01001610 int local_auth = 0;
Vladislav Grishenko3b195962013-11-26 11:08:21 +00001611#endif
Simon Kelley613ad152014-02-25 23:02:28 +00001612 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1613 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
Simon Kelleycdeda282006-03-16 20:16:06 +00001614 size_t m;
Simon Kelleyee86ce62012-12-07 11:54:46 +00001615 unsigned short qtype;
1616 unsigned int gotname;
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001617 unsigned char c1, c2;
Simon Kelley4b5ea122013-04-22 10:18:26 +01001618 /* Max TCP packet + slop + size */
1619 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1620 unsigned char *payload = &packet[2];
1621 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1622 struct dns_header *header = (struct dns_header *)payload;
1623 u16 *length = (u16 *)packet;
Simon Kelley3be34542004-09-11 19:12:13 +01001624 struct server *last_server;
Simon Kelley7de060b2011-08-26 17:24:52 +01001625 struct in_addr dst_addr_4;
1626 union mysockaddr peer_addr;
1627 socklen_t peer_len = sizeof(union mysockaddr);
Simon Kelley3be34542004-09-11 19:12:13 +01001628
Simon Kelley7de060b2011-08-26 17:24:52 +01001629 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1630 return packet;
Simon Kelleyc8a80482014-03-05 14:29:54 +00001631
1632 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1633 if (option_bool(OPT_LOCAL_SERVICE))
1634 {
1635 struct addrlist *addr;
1636#ifdef HAVE_IPV6
1637 if (peer_addr.sa.sa_family == AF_INET6)
1638 {
1639 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1640 if ((addr->flags & ADDRLIST_IPV6) &&
1641 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1642 break;
1643 }
1644 else
1645#endif
1646 {
1647 struct in_addr netmask;
1648 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1649 {
1650 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1651 if (!(addr->flags & ADDRLIST_IPV6) &&
1652 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1653 break;
1654 }
1655 }
1656 if (!addr)
1657 {
1658 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1659 return packet;
1660 }
1661 }
Simon Kelley7de060b2011-08-26 17:24:52 +01001662
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001663 while (1)
1664 {
1665 if (!packet ||
1666 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1667 !(size = c1 << 8 | c2) ||
Simon Kelley4b5ea122013-04-22 10:18:26 +01001668 !read_write(confd, payload, size, 1))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001669 return packet;
1670
Simon Kelley572b41e2011-02-18 18:11:18 +00001671 if (size < (int)sizeof(struct dns_header))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001672 continue;
1673
Simon Kelleyed4c0762013-10-08 20:46:34 +01001674 check_subnet = 0;
1675
Simon Kelley28866e92011-02-14 20:19:14 +00001676 /* save state of "cd" flag in query */
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001677 if ((checking_disabled = header->hb4 & HB4_CD))
1678 no_cache_dnssec = 1;
Simon Kelley28866e92011-02-14 20:19:14 +00001679
Simon Kelley3be34542004-09-11 19:12:13 +01001680 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001681 {
Simon Kelleyb485ed92013-10-18 22:00:39 +01001682#ifdef HAVE_AUTH
1683 struct auth_zone *zone;
1684#endif
Simon Kelley610e7822014-02-06 14:45:17 +00001685 char *types = querystr(auth_dns ? "auth" : "query", qtype);
Simon Kelley7de060b2011-08-26 17:24:52 +01001686
1687 if (peer_addr.sa.sa_family == AF_INET)
1688 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1689 (struct all_addr *)&peer_addr.in.sin_addr, types);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001690#ifdef HAVE_IPV6
Simon Kelley7de060b2011-08-26 17:24:52 +01001691 else
1692 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1693 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001694#endif
Simon Kelleyb485ed92013-10-18 22:00:39 +01001695
1696#ifdef HAVE_AUTH
1697 /* find queries for zones we're authoritative for, and answer them directly */
Simon Kelley6008bdb2013-10-21 21:47:03 +01001698 if (!auth_dns)
1699 for (zone = daemon->auth_zones; zone; zone = zone->next)
1700 if (in_zone(zone, daemon->namebuff, NULL))
1701 {
1702 auth_dns = 1;
1703 local_auth = 1;
1704 break;
1705 }
Simon Kelleyb485ed92013-10-18 22:00:39 +01001706#endif
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001707 }
1708
Simon Kelley7de060b2011-08-26 17:24:52 +01001709 if (local_addr->sa.sa_family == AF_INET)
1710 dst_addr_4 = local_addr->in.sin_addr;
1711 else
1712 dst_addr_4.s_addr = 0;
1713
Simon Kelley4820dce2012-12-18 18:30:30 +00001714#ifdef HAVE_AUTH
Simon Kelley4f7b3042012-11-28 21:27:02 +00001715 if (auth_dns)
Simon Kelley19b16892013-10-20 10:19:39 +01001716 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001717 else
Simon Kelley4820dce2012-12-18 18:30:30 +00001718#endif
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001719 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001720 /* m > 0 if answered from cache */
1721 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
Simon Kelley613ad152014-02-25 23:02:28 +00001722 dst_addr_4, netmask, now, &ad_question, &do_bit);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001723
Simon Kelley4f7b3042012-11-28 21:27:02 +00001724 /* Do this by steam now we're not in the select() loop */
1725 check_log_writer(NULL);
1726
1727 if (m == 0)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001728 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001729 unsigned int flags = 0;
1730 struct all_addr *addrp = NULL;
1731 int type = 0;
1732 char *domain = NULL;
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001733
Simon Kelley4f7b3042012-11-28 21:27:02 +00001734 if (option_bool(OPT_ADD_MAC))
1735 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
Simon Kelleyed4c0762013-10-08 20:46:34 +01001736
1737 if (option_bool(OPT_CLIENT_SUBNET))
1738 {
1739 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1740 if (size != new)
1741 {
1742 size = new;
1743 check_subnet = 1;
1744 }
1745 }
1746
Simon Kelley4f7b3042012-11-28 21:27:02 +00001747 if (gotname)
1748 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1749
1750 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1751 last_server = daemon->servers;
1752 else
1753 last_server = daemon->last_server;
1754
1755 if (!flags && last_server)
1756 {
1757 struct server *firstsendto = NULL;
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001758#ifdef HAVE_DNSSEC
Simon Kelley703c7ff2014-01-25 23:46:23 +00001759 unsigned char *newhash, hash[HASH_SIZE];
Simon Kelley63758382014-04-16 22:20:55 +01001760 if ((newhash = hash_questions(header, (unsigned int)size, daemon->namebuff)))
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001761 memcpy(hash, newhash, HASH_SIZE);
Tomas Hozzab37f8b92014-03-25 20:52:28 +00001762 else
1763 memset(hash, 0, HASH_SIZE);
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001764#else
Simon Kelley4f7b3042012-11-28 21:27:02 +00001765 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001766#endif
Simon Kelley4f7b3042012-11-28 21:27:02 +00001767 /* Loop round available servers until we succeed in connecting to one.
1768 Note that this code subtley ensures that consecutive queries on this connection
1769 which can go to the same server, do so. */
1770 while (1)
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001771 {
Simon Kelley4f7b3042012-11-28 21:27:02 +00001772 if (!firstsendto)
1773 firstsendto = last_server;
1774 else
1775 {
1776 if (!(last_server = last_server->next))
1777 last_server = daemon->servers;
1778
1779 if (last_server == firstsendto)
1780 break;
1781 }
1782
1783 /* server for wrong domain */
1784 if (type != (last_server->flags & SERV_TYPE) ||
1785 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)))
Simon Kelley7de060b2011-08-26 17:24:52 +01001786 continue;
1787
Simon Kelley4f7b3042012-11-28 21:27:02 +00001788 if (last_server->tcpfd == -1)
1789 {
1790 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1791 continue;
1792
1793 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1794 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1795 {
1796 close(last_server->tcpfd);
1797 last_server->tcpfd = -1;
1798 continue;
1799 }
1800
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001801#ifdef HAVE_DNSSEC
1802 if (option_bool(OPT_DNSSEC_VALID))
1803 {
Simon Kelley613ad152014-02-25 23:02:28 +00001804 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1805
Simon Kelley2ecd9bd2014-02-13 16:42:02 +00001806 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1807 this allows it to select auth servers when one is returning bad data. */
1808 if (option_bool(OPT_DNSSEC_DEBUG))
1809 header->hb4 |= HB4_CD;
Simon Kelley613ad152014-02-25 23:02:28 +00001810
1811 if (size != new_size)
1812 added_pheader = 1;
1813
1814 size = new_size;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001815 }
1816#endif
1817
Simon Kelley4f7b3042012-11-28 21:27:02 +00001818#ifdef HAVE_CONNTRACK
1819 /* Copy connection mark of incoming query to outgoing connection. */
1820 if (option_bool(OPT_CONNTRACK))
1821 {
1822 unsigned int mark;
1823 struct all_addr local;
1824#ifdef HAVE_IPV6
1825 if (local_addr->sa.sa_family == AF_INET6)
1826 local.addr.addr6 = local_addr->in6.sin6_addr;
1827 else
1828#endif
1829 local.addr.addr4 = local_addr->in.sin_addr;
1830
1831 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1832 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1833 }
1834#endif
1835 }
1836
Simon Kelley4b5ea122013-04-22 10:18:26 +01001837 *length = htons(size);
Simon Kelley1fc02682014-04-29 12:30:18 +01001838
1839 /* get query name again for logging - may have been overwritten */
1840 if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1841 strcpy(daemon->namebuff, "query");
Simon Kelley4f7b3042012-11-28 21:27:02 +00001842
Simon Kelley4b5ea122013-04-22 10:18:26 +01001843 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
Simon Kelley4f7b3042012-11-28 21:27:02 +00001844 !read_write(last_server->tcpfd, &c1, 1, 1) ||
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001845 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1846 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
Simon Kelley7de060b2011-08-26 17:24:52 +01001847 {
1848 close(last_server->tcpfd);
1849 last_server->tcpfd = -1;
1850 continue;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001851 }
1852
1853 m = (c1 << 8) | c2;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001854
Simon Kelley4f7b3042012-11-28 21:27:02 +00001855 if (last_server->addr.sa.sa_family == AF_INET)
1856 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1857 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001858#ifdef HAVE_IPV6
Simon Kelley4f7b3042012-11-28 21:27:02 +00001859 else
1860 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1861 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001862#endif
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001863
1864#ifdef HAVE_DNSSEC
1865 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1866 {
Simon Kelley7fa836e2014-02-10 20:11:24 +00001867 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1868 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1869 char *result;
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001870
Simon Kelley7fa836e2014-02-10 20:11:24 +00001871 if (keycount == 0)
1872 result = "ABANDONED";
1873 else
1874 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1875
1876 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1877
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001878 if (status == STAT_BOGUS)
1879 no_cache_dnssec = 1;
Simon Kelley7fa836e2014-02-10 20:11:24 +00001880
Simon Kelley7d7b7b32014-01-08 15:53:35 +00001881 if (status == STAT_SECURE)
1882 cache_secure = 1;
1883 }
1884#endif
1885
1886 /* restore CD bit to the value in the query */
1887 if (checking_disabled)
1888 header->hb4 |= HB4_CD;
1889 else
1890 header->hb4 &= ~HB4_CD;
Simon Kelley4f7b3042012-11-28 21:27:02 +00001891
1892 /* There's no point in updating the cache, since this process will exit and
1893 lose the information after a few queries. We make this call for the alias and
1894 bogus-nxdomain side-effects. */
1895 /* If the crc of the question section doesn't match the crc we sent, then
1896 someone might be attempting to insert bogus values into the cache by
1897 sending replies containing questions and bogus answers. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001898#ifdef HAVE_DNSSEC
1899 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1900 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
Simon Kelley703c7ff2014-01-25 23:46:23 +00001901 {
1902 m = 0;
1903 break;
1904 }
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001905#else
1906 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
Simon Kelley703c7ff2014-01-25 23:46:23 +00001907 {
1908 m = 0;
1909 break;
1910 }
Simon Kelley8a9be9e2014-01-25 23:17:21 +00001911#endif
1912
1913 m = process_reply(header, now, last_server, (unsigned int)m,
1914 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
Simon Kelley613ad152014-02-25 23:02:28 +00001915 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
Simon Kelley4f7b3042012-11-28 21:27:02 +00001916
1917 break;
1918 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001919 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001920
1921 /* In case of local answer or no connections made. */
1922 if (m == 0)
1923 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001924 }
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001925 }
Simon Kelley4f7b3042012-11-28 21:27:02 +00001926
Simon Kelley5aabfc72007-08-29 11:24:47 +01001927 check_log_writer(NULL);
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001928
Simon Kelley4b5ea122013-04-22 10:18:26 +01001929 *length = htons(m);
1930
1931 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
Simon Kelleyfeba5c12004-07-27 20:28:58 +01001932 return packet;
1933 }
1934}
1935
Simon Kelley16972692006-10-16 20:04:18 +01001936static struct frec *allocate_frec(time_t now)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001937{
Simon Kelley16972692006-10-16 20:04:18 +01001938 struct frec *f;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001939
Simon Kelley5aabfc72007-08-29 11:24:47 +01001940 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001941 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01001942 f->next = daemon->frec_list;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001943 f->time = now;
Simon Kelley832af0b2007-01-21 20:01:28 +00001944 f->sentto = NULL;
Simon Kelley1a6bca82008-07-11 11:11:42 +01001945 f->rfd4 = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +00001946 f->flags = 0;
Simon Kelley1a6bca82008-07-11 11:11:42 +01001947#ifdef HAVE_IPV6
1948 f->rfd6 = NULL;
1949#endif
Simon Kelley3a237152013-12-12 12:15:50 +00001950#ifdef HAVE_DNSSEC
Simon Kelley97bc7982014-01-31 10:19:52 +00001951 f->dependent = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00001952 f->blocking_query = NULL;
Simon Kelley4619d942014-01-16 19:53:06 +00001953 f->stash = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00001954#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +01001955 daemon->frec_list = f;
Simon Kelley9e4abcb2004-01-22 19:47:41 +00001956 }
Simon Kelley16972692006-10-16 20:04:18 +01001957
1958 return f;
1959}
1960
Simon Kelley1a6bca82008-07-11 11:11:42 +01001961static struct randfd *allocate_rfd(int family)
1962{
1963 static int finger = 0;
1964 int i;
1965
1966 /* limit the number of sockets we have open to avoid starvation of
1967 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1968
1969 for (i = 0; i < RANDOM_SOCKS; i++)
Simon Kelley9009d742008-11-14 20:04:27 +00001970 if (daemon->randomsocks[i].refcount == 0)
Simon Kelley1a6bca82008-07-11 11:11:42 +01001971 {
Simon Kelley9009d742008-11-14 20:04:27 +00001972 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
1973 break;
1974
Simon Kelley1a6bca82008-07-11 11:11:42 +01001975 daemon->randomsocks[i].refcount = 1;
1976 daemon->randomsocks[i].family = family;
1977 return &daemon->randomsocks[i];
1978 }
1979
Simon Kelley9009d742008-11-14 20:04:27 +00001980 /* No free ones or cannot get new socket, grab an existing one */
Simon Kelley1a6bca82008-07-11 11:11:42 +01001981 for (i = 0; i < RANDOM_SOCKS; i++)
1982 {
1983 int j = (i+finger) % RANDOM_SOCKS;
Simon Kelley9009d742008-11-14 20:04:27 +00001984 if (daemon->randomsocks[j].refcount != 0 &&
1985 daemon->randomsocks[j].family == family &&
1986 daemon->randomsocks[j].refcount != 0xffff)
Simon Kelley1a6bca82008-07-11 11:11:42 +01001987 {
1988 finger = j;
1989 daemon->randomsocks[j].refcount++;
1990 return &daemon->randomsocks[j];
1991 }
1992 }
1993
1994 return NULL; /* doom */
1995}
Simon Kelley1a6bca82008-07-11 11:11:42 +01001996static void free_frec(struct frec *f)
1997{
1998 if (f->rfd4 && --(f->rfd4->refcount) == 0)
1999 close(f->rfd4->fd);
2000
2001 f->rfd4 = NULL;
2002 f->sentto = NULL;
Simon Kelley28866e92011-02-14 20:19:14 +00002003 f->flags = 0;
Simon Kelley1a6bca82008-07-11 11:11:42 +01002004
2005#ifdef HAVE_IPV6
2006 if (f->rfd6 && --(f->rfd6->refcount) == 0)
2007 close(f->rfd6->fd);
2008
2009 f->rfd6 = NULL;
2010#endif
Simon Kelley3a237152013-12-12 12:15:50 +00002011
2012#ifdef HAVE_DNSSEC
2013 if (f->stash)
Simon Kelley0fc2f312014-01-08 10:26:58 +00002014 {
2015 blockdata_free(f->stash);
2016 f->stash = NULL;
2017 }
Simon Kelley3a237152013-12-12 12:15:50 +00002018
2019 /* Anything we're waiting on is pointless now, too */
2020 if (f->blocking_query)
2021 free_frec(f->blocking_query);
2022 f->blocking_query = NULL;
Simon Kelley39048ad2014-01-21 17:33:58 +00002023 f->dependent = NULL;
Simon Kelley3a237152013-12-12 12:15:50 +00002024#endif
Simon Kelley1a6bca82008-07-11 11:11:42 +01002025}
2026
Simon Kelley16972692006-10-16 20:04:18 +01002027/* if wait==NULL return a free or older than TIMEOUT record.
2028 else return *wait zero if one available, or *wait is delay to
Simon Kelley1a6bca82008-07-11 11:11:42 +01002029 when the oldest in-use record will expire. Impose an absolute
Simon Kelley3a237152013-12-12 12:15:50 +00002030 limit of 4*TIMEOUT before we wipe things (for random sockets).
2031 If force is set, always return a result, even if we have
2032 to allocate above the limit. */
2033struct frec *get_new_frec(time_t now, int *wait, int force)
Simon Kelley16972692006-10-16 20:04:18 +01002034{
Simon Kelley1a6bca82008-07-11 11:11:42 +01002035 struct frec *f, *oldest, *target;
Simon Kelley16972692006-10-16 20:04:18 +01002036 int count;
2037
2038 if (wait)
2039 *wait = 0;
2040
Simon Kelley1a6bca82008-07-11 11:11:42 +01002041 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
Simon Kelley832af0b2007-01-21 20:01:28 +00002042 if (!f->sentto)
Simon Kelley1a6bca82008-07-11 11:11:42 +01002043 target = f;
2044 else
Simon Kelley16972692006-10-16 20:04:18 +01002045 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01002046 if (difftime(now, f->time) >= 4*TIMEOUT)
2047 {
2048 free_frec(f);
2049 target = f;
2050 }
2051
2052 if (!oldest || difftime(f->time, oldest->time) <= 0)
2053 oldest = f;
Simon Kelley16972692006-10-16 20:04:18 +01002054 }
Simon Kelley1a6bca82008-07-11 11:11:42 +01002055
2056 if (target)
2057 {
2058 target->time = now;
2059 return target;
2060 }
Simon Kelley16972692006-10-16 20:04:18 +01002061
2062 /* can't find empty one, use oldest if there is one
2063 and it's older than timeout */
2064 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2065 {
2066 /* keep stuff for twice timeout if we can by allocating a new
2067 record instead */
2068 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2069 count <= daemon->ftabsize &&
2070 (f = allocate_frec(now)))
2071 return f;
2072
2073 if (!wait)
2074 {
Simon Kelley1a6bca82008-07-11 11:11:42 +01002075 free_frec(oldest);
Simon Kelley16972692006-10-16 20:04:18 +01002076 oldest->time = now;
2077 }
2078 return oldest;
2079 }
2080
2081 /* none available, calculate time 'till oldest record expires */
Simon Kelley3a237152013-12-12 12:15:50 +00002082 if (!force && count > daemon->ftabsize)
Simon Kelley16972692006-10-16 20:04:18 +01002083 {
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +01002084 static time_t last_log = 0;
2085
Simon Kelley16972692006-10-16 20:04:18 +01002086 if (oldest && wait)
2087 *wait = oldest->time + (time_t)TIMEOUT - now;
Marcelo Salhab Brogliato0da5e892013-05-31 11:49:06 +01002088
2089 if ((int)difftime(now, last_log) > 5)
2090 {
2091 last_log = now;
2092 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2093 }
2094
Simon Kelley16972692006-10-16 20:04:18 +01002095 return NULL;
2096 }
2097
2098 if (!(f = allocate_frec(now)) && wait)
2099 /* wait one second on malloc failure */
2100 *wait = 1;
2101
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002102 return f; /* OK if malloc fails and this is NULL */
2103}
2104
Simon Kelley832af0b2007-01-21 20:01:28 +00002105/* crc is all-ones if not known. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002106static struct frec *lookup_frec(unsigned short id, void *hash)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002107{
2108 struct frec *f;
2109
Simon Kelley1a6bca82008-07-11 11:11:42 +01002110 for(f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002111 if (f->sentto && f->new_id == id &&
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002112 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002113 return f;
2114
2115 return NULL;
2116}
2117
2118static struct frec *lookup_frec_by_sender(unsigned short id,
Simon Kelleyfd9fa482004-10-21 20:24:00 +01002119 union mysockaddr *addr,
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002120 void *hash)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002121{
Simon Kelleyfeba5c12004-07-27 20:28:58 +01002122 struct frec *f;
2123
Simon Kelley1a6bca82008-07-11 11:11:42 +01002124 for(f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002125 if (f->sentto &&
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002126 f->orig_id == id &&
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002127 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002128 sockaddr_isequal(&f->source, addr))
2129 return f;
2130
2131 return NULL;
2132}
2133
Simon Kelley849a8352006-06-09 21:02:31 +01002134/* A server record is going away, remove references to it */
Simon Kelley5aabfc72007-08-29 11:24:47 +01002135void server_gone(struct server *server)
Simon Kelley849a8352006-06-09 21:02:31 +01002136{
2137 struct frec *f;
2138
Simon Kelley1a6bca82008-07-11 11:11:42 +01002139 for (f = daemon->frec_list; f; f = f->next)
Simon Kelley832af0b2007-01-21 20:01:28 +00002140 if (f->sentto && f->sentto == server)
Simon Kelley1a6bca82008-07-11 11:11:42 +01002141 free_frec(f);
Simon Kelley849a8352006-06-09 21:02:31 +01002142
2143 if (daemon->last_server == server)
2144 daemon->last_server = NULL;
2145
2146 if (daemon->srv_save == server)
2147 daemon->srv_save = NULL;
2148}
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002149
Simon Kelley316e2732010-01-22 20:16:09 +00002150/* return unique random ids. */
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002151static unsigned short get_id(void)
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002152{
2153 unsigned short ret = 0;
Simon Kelley832af0b2007-01-21 20:01:28 +00002154
Simon Kelley316e2732010-01-22 20:16:09 +00002155 do
Simon Kelley832af0b2007-01-21 20:01:28 +00002156 ret = rand16();
Simon Kelley8a9be9e2014-01-25 23:17:21 +00002157 while (lookup_frec(ret, NULL));
Simon Kelley832af0b2007-01-21 20:01:28 +00002158
Simon Kelley9e4abcb2004-01-22 19:47:41 +00002159 return ret;
2160}
2161
2162
2163
2164
2165