[thirdparty/pdns.git] / pdns / ixfrdist.cc

/*
 * This file is part of PowerDNS or dnsdist.
 * Copyright -- PowerDNS.COM B.V. and its contributors
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * In addition, for the avoidance of any doubt, permission is granted to
 * link this program with OpenSSL and to (re)distribute the binaries
 * produced as the result of such linking.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <boost/program_options.hpp>
#include <arpa/inet.h>
#include <sys/types.h>
#include <grp.h>
#include <pwd.h>
#include <sys/stat.h>
#include <mutex>
#include <thread>
#include <dirent.h>
#include <queue>
#include <condition_variable>
#include "ixfr.hh"
#include "ixfrutils.hh"
#include "resolver.hh"
#include "dns_random.hh"
#include "sstuff.hh"
#include "mplexer.hh"
#include "misc.hh"
#include "iputils.hh"
#include "logger.hh"
#include <yaml-cpp/yaml.h>

/* BEGIN Needed because of deeper dependencies */
#include "arguments.hh"
#include "statbag.hh"
StatBag S;

ArgvMap &arg()
{
  static ArgvMap theArg;
  return theArg;
}
/* END Needed because of deeper dependencies */

// Allows reading/writing ComboAddresses and DNSNames in YAML-cpp
namespace YAML {
template<>
struct convert<ComboAddress> {
  static Node encode(const ComboAddress& rhs) {
    return Node(rhs.toStringWithPort());
  }
  static bool decode(const Node& node, ComboAddress& rhs) {
    if (!node.IsScalar()) {
      return false;
    }
    try {
      rhs = ComboAddress(node.as<string>());
      return true;
    } catch(const runtime_error &e) {
      return false;
    } catch (const PDNSException &e) {
      return false;
    }
  }
};

template<>
struct convert<DNSName> {
  static Node encode(const DNSName& rhs) {
    return Node(rhs.toStringRootDot());
  }
  static bool decode(const Node& node, DNSName& rhs) {
    if (!node.IsScalar()) {
      return false;
    }
    try {
      rhs = DNSName(node.as<string>());
      return true;
    } catch(const runtime_error &e) {
      return false;
    } catch (const PDNSException &e) {
      return false;
    }
  }
};
} // namespace YAML

// Why a struct? This way we can add more options to a domain in the future
struct ixfrdistdomain_t {
  set<ComboAddress> masters; // A set so we can do multiple master addresses in the future
};

// For all the listen-sockets
FDMultiplexer* g_fdm;

// This contains the configuration for each domain
map<DNSName, ixfrdistdomain_t> g_domainConfigs;

// Map domains and their data
std::map<DNSName, ixfrinfo_t> g_soas;
std::mutex g_soas_mutex;

// Condition variable for TCP handling
std::condition_variable g_tcpHandlerCV;
std::queue<pair<int, ComboAddress>> g_tcpRequestFDs;
std::mutex g_tcpRequestFDsMutex;

using namespace boost::multi_index;

namespace po = boost::program_options;
po::variables_map g_vm;
string g_workdir;

bool g_exiting = false;

#define KEEP_DEFAULT 20
uint16_t g_keep = KEEP_DEFAULT;

#define AXFRTIMEOUT_DEFAULT 20
uint16_t g_axfrTimeout = AXFRTIMEOUT_DEFAULT;

NetmaskGroup g_acl;

void handleSignal(int signum) {
  g_log<<Logger::Notice<<"Got "<<strsignal(signum)<<" signal";
  if (g_exiting) {
    g_log<<Logger::Notice<<", this is the second time we were asked to stop, forcefully exiting"<<endl;
    exit(EXIT_FAILURE);
  }
  g_log<<Logger::Notice<<", stopping"<<endl;
  g_exiting = true;
}

void usage(po::options_description &desc) {
  cerr << "Usage: ixfrdist [OPTION]..."<<endl;
  cerr << desc << "\n";
}

// The compiler does not like using rfc1982LessThan in std::sort directly
bool sortSOA(uint32_t i, uint32_t j) {
  return rfc1982LessThan(i, j);
}

void cleanUpDomain(const DNSName& domain) {
  string dir = g_workdir + "/" + domain.toString();
  DIR *dp;
  dp = opendir(dir.c_str());
  if (dp == nullptr) {
    return;
  }
  vector<uint32_t> zoneVersions;
  struct dirent *d;
  while ((d = readdir(dp)) != nullptr) {
    if(!strcmp(d->d_name, ".") || !strcmp(d->d_name, "..")) {
      continue;
    }
    zoneVersions.push_back(std::stoi(d->d_name));
  }
  closedir(dp);
  g_log<<Logger::Info<<"Found "<<zoneVersions.size()<<" versions of "<<domain<<", asked to keep "<<g_keep<<", ";
  if (zoneVersions.size() <= g_keep) {
    g_log<<Logger::Info<<"not cleaning up"<<endl;
    return;
  }
  g_log<<Logger::Info<<"cleaning up the oldest "<<zoneVersions.size() - g_keep<<endl;

  // Sort the versions
  std::sort(zoneVersions.begin(), zoneVersions.end(), sortSOA);

  // And delete all the old ones
  {
    // Lock to ensure no one reads this.
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    for (auto iter = zoneVersions.cbegin(); iter != zoneVersions.cend() - g_keep; ++iter) {
      string fname = dir + "/" + std::to_string(*iter);
      g_log<<Logger::Debug<<"Removing "<<fname<<endl;
      unlink(fname.c_str());
    }
  }
}

static shared_ptr<SOARecordContent> getSOAFromRecords(const records_t& records) {
  for (const auto& dnsrecord : records) {
    if (dnsrecord.d_type == QType::SOA) {
      auto soa = getRR<SOARecordContent>(dnsrecord);
      if (soa == nullptr) {
        throw PDNSException("Unable to determine SOARecordContent from old records");
      }
      return soa;
    }
  }
  throw PDNSException("No SOA in supplied records");
}

static void makeIXFRDiff(const records_t& from, const records_t& to, ixfrdiff_t& diff, const shared_ptr<SOARecordContent>& fromSOA = nullptr, const shared_ptr<SOARecordContent>& toSOA = nullptr) {
  set_difference(from.cbegin(), from.cend(), to.cbegin(), to.cend(), back_inserter(diff.removals), from.value_comp());
  set_difference(to.cbegin(), to.cend(), from.cbegin(), from.cend(), back_inserter(diff.additions), from.value_comp());
  diff.oldSOA = fromSOA;
  if (fromSOA == nullptr) {
    getSOAFromRecords(from);
  }
  diff.newSOA = toSOA;
  if (toSOA == nullptr) {
    getSOAFromRecords(to);
  }
}

void updateThread() {
  std::map<DNSName, time_t> lastCheck;

  // Initialize the serials we have
  for (const auto &domainConfig : g_domainConfigs) {
    DNSName domain = domainConfig.first;
    lastCheck[domain] = 0;
    string dir = g_workdir + "/" + domain.toString();
    try {
      g_log<<Logger::Info<<"Trying to initially load domain "<<domain<<" from disk"<<endl;
      auto serial = getSerialsFromDir(dir);
      shared_ptr<SOARecordContent> soa;
      {
        string fname = g_workdir + "/" + domain.toString() + "/" + std::to_string(serial);
        loadSOAFromDisk(domain, fname, soa);
        records_t records;
        if (soa != nullptr) {
          loadZoneFromDisk(records, fname, domain);
        }
        std::lock_guard<std::mutex> guard(g_soas_mutex);
        g_soas[domain].latestAXFR = records;
        g_soas[domain].soa = soa;
      }
      if (soa != nullptr) {
        g_log<<Logger::Notice<<"Loaded zone "<<domain<<" with serial "<<soa->d_st.serial<<endl;
        // Initial cleanup
        cleanUpDomain(domain);
      }
    } catch (runtime_error &e) {
      // Most likely, the directory does not exist.
      g_log<<Logger::Info<<e.what()<<", attempting to create"<<endl;
      // Attempt to create it, if _that_ fails, there is no hope
      if (mkdir(dir.c_str(), 0777) == -1 && errno != EEXIST) {
        g_log<<Logger::Error<<"Could not create '"<<dir<<"': "<<strerror(errno)<<endl;
        exit(EXIT_FAILURE);
      }
    }
  }

  g_log<<Logger::Notice<<"Update Thread started"<<endl;

  while (true) {
    if (g_exiting) {
      g_log<<Logger::Notice<<"UpdateThread stopped"<<endl;
      break;
    }
    time_t now = time(nullptr);
    for (const auto &domainConfig : g_domainConfigs) {
      DNSName domain = domainConfig.first;
      shared_ptr<SOARecordContent> current_soa;
      {
        std::lock_guard<std::mutex> guard(g_soas_mutex);
        if (g_soas.find(domain) != g_soas.end()) {
          current_soa = g_soas[domain].soa;
        }
      }
      if ((current_soa != nullptr && now - lastCheck[domain] < current_soa->d_st.refresh) || // Only check if we have waited `refresh` seconds
          (current_soa == nullptr && now - lastCheck[domain] < 30))  {                       // Or if we could not get an update at all still, every 30 seconds
        continue;
      }

      // TODO Keep track of 'down' masters
      set<ComboAddress>::const_iterator it(g_domainConfigs[domain].masters.begin());
      std::advance(it, random() % g_domainConfigs[domain].masters.size());
      ComboAddress master = *it;

      string dir = g_workdir + "/" + domain.toString();
      g_log<<Logger::Info<<"Attempting to retrieve SOA Serial update for '"<<domain<<"' from '"<<master.toStringWithPort()<<"'"<<endl;
      shared_ptr<SOARecordContent> sr;
      try {
        lastCheck[domain] = now;
        auto newSerial = getSerialFromMaster(master, domain, sr); // TODO TSIG
        if(current_soa != nullptr) {
          g_log<<Logger::Info<<"Got SOA Serial for "<<domain<<" from "<<master.toStringWithPort()<<": "<< newSerial<<", had Serial: "<<current_soa->d_st.serial;
          if (newSerial == current_soa->d_st.serial) {
            g_log<<Logger::Info<<", not updating."<<endl;
            continue;
          }
          g_log<<Logger::Info<<", will update."<<endl;
        }
      } catch (runtime_error &e) {
        g_log<<Logger::Warning<<"Unable to get SOA serial update for '"<<domain<<"': "<<e.what()<<endl;
        continue;
      }
      // Now get the full zone!
      g_log<<Logger::Info<<"Attempting to receive full zonedata for '"<<domain<<"'"<<endl;
      ComboAddress local = master.isIPv4() ? ComboAddress("0.0.0.0") : ComboAddress("::");
      TSIGTriplet tt;

      // The *new* SOA
      shared_ptr<SOARecordContent> soa;
      try {
        AXFRRetriever axfr(master, domain, tt, &local);
        unsigned int nrecords=0;
        Resolver::res_t nop;
        vector<DNSRecord> chunk;
        records_t records;
        time_t t_start = time(nullptr);
        time_t axfr_now = time(nullptr);
        while(axfr.getChunk(nop, &chunk, (axfr_now - t_start + g_axfrTimeout))) {
          for(auto& dr : chunk) {
            if(dr.d_type == QType::TSIG)
              continue;
            dr.d_name.makeUsRelative(domain);
            records.insert(dr);
            nrecords++;
            if (dr.d_type == QType::SOA) {
              soa = getRR<SOARecordContent>(dr);
            }
          }
          axfr_now = time(nullptr);
          if (axfr_now - t_start > g_axfrTimeout) {
            throw PDNSException("Total AXFR time exceeded!");
          }
        }
        if (soa == nullptr) {
          g_log<<Logger::Warning<<"No SOA was found in the AXFR of "<<domain<<endl;
          continue;
        }
        g_log<<Logger::Notice<<"Retrieved all zone data for "<<domain<<". Received "<<nrecords<<" records."<<endl;
        writeZoneToDisk(records, domain, dir);
        g_log<<Logger::Notice<<"Wrote zonedata for "<<domain<<" with serial "<<soa->d_st.serial<<" to "<<dir<<endl;
        {
          std::lock_guard<std::mutex> guard(g_soas_mutex);
          ixfrdiff_t diff;
          if (!g_soas[domain].latestAXFR.empty()) {
            makeIXFRDiff(g_soas[domain].latestAXFR, records, diff, g_soas[domain].soa, soa);
            g_soas[domain].ixfrDiffs.push_back(diff);
          }
          // Clean up the diffs
          while (g_soas[domain].ixfrDiffs.size() > g_keep) {
            g_soas[domain].ixfrDiffs.erase(g_soas[domain].ixfrDiffs.begin());
          }
          g_soas[domain].latestAXFR = records;
          g_soas[domain].soa = soa;
        }
      } catch (PDNSException &e) {
        g_log<<Logger::Warning<<"Could not retrieve AXFR for '"<<domain<<"': "<<e.reason<<endl;
      } catch (runtime_error &e) {
        g_log<<Logger::Warning<<"Could not save zone '"<<domain<<"' to disk: "<<e.what()<<endl;
      }
      // Now clean up the directory
      cleanUpDomain(domain);
    } /* for (const auto &domain : domains) */
    sleep(1);
  } /* while (true) */
} /* updateThread */

bool checkQuery(const MOADNSParser& mdp, const ComboAddress& saddr, const bool udp = true, const string& logPrefix="") {
  vector<string> info_msg;

  g_log<<Logger::Debug<<logPrefix<<"Had "<<mdp.d_qname<<"|"<<QType(mdp.d_qtype).getName()<<" query from "<<saddr.toStringWithPort()<<endl;

  if (udp && mdp.d_qtype != QType::SOA && mdp.d_qtype != QType::IXFR) {
    info_msg.push_back("QType is unsupported (" + QType(mdp.d_qtype).getName() + " is not in {SOA,IXFR}");
  }

  if (!udp && mdp.d_qtype != QType::SOA && mdp.d_qtype != QType::IXFR && mdp.d_qtype != QType::AXFR) {
    info_msg.push_back("QType is unsupported (" + QType(mdp.d_qtype).getName() + " is not in {SOA,IXFR,AXFR}");
  }

  {
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    if (g_domainConfigs.find(mdp.d_qname) == g_domainConfigs.end()) {
      info_msg.push_back("Domain name '" + mdp.d_qname.toLogString() + "' is not configured for distribution");
    }

    if (g_soas.find(mdp.d_qname) == g_soas.end()) {
      info_msg.push_back("Domain has not been transferred yet");
    }
  }

  if (!info_msg.empty()) {
    g_log<<Logger::Warning<<logPrefix<<"Ignoring "<<mdp.d_qname<<"|"<<QType(mdp.d_qtype).getName()<<" query from "<<saddr.toStringWithPort();
    g_log<<Logger::Warning<<": ";
    bool first = true;
    for (const auto& s : info_msg) {
      if (!first) {
        g_log<<Logger::Warning<<", ";
        first = false;
      }
      g_log<<Logger::Warning<<s;
    }
    g_log<<Logger::Warning<<endl;
    return false;
  }

  return true;
}

/*
 * Returns a vector<uint8_t> that represents the full response to a SOA
 * query. QNAME is read from mdp.
 */
bool makeSOAPacket(const MOADNSParser& mdp, vector<uint8_t>& packet) {
  DNSPacketWriter pw(packet, mdp.d_qname, mdp.d_qtype);
  pw.getHeader()->id = mdp.d_header.id;
  pw.getHeader()->rd = mdp.d_header.rd;
  pw.getHeader()->qr = 1;

  pw.startRecord(mdp.d_qname, QType::SOA);
  {
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    g_soas[mdp.d_qname].soa->toPacket(pw);
  }
  pw.commit();

  return true;
}

vector<uint8_t> getSOAPacket(const MOADNSParser& mdp, const shared_ptr<SOARecordContent>& soa) {
  vector<uint8_t> packet;
  DNSPacketWriter pw(packet, mdp.d_qname, mdp.d_qtype);
  pw.getHeader()->id = mdp.d_header.id;
  pw.getHeader()->rd = mdp.d_header.rd;
  pw.getHeader()->qr = 1;

  // Add the first SOA
  pw.startRecord(mdp.d_qname, QType::SOA);
  soa->toPacket(pw);
  pw.commit();
  return packet;
}

bool makeAXFRPackets(const MOADNSParser& mdp, vector<vector<uint8_t>>& packets) {
  shared_ptr<SOARecordContent> soa;
  records_t records;
  {
    // Make copies of what we have
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    soa = g_soas[mdp.d_qname].soa;
    records = g_soas[mdp.d_qname].latestAXFR;
  }

  // Initial SOA
  packets.push_back(getSOAPacket(mdp, soa));

  for (auto const &record : records) {
    if (record.d_type == QType::SOA) {
      continue;
    }
    vector<uint8_t> packet;
    DNSPacketWriter pw(packet, mdp.d_qname, mdp.d_qtype);
    pw.getHeader()->id = mdp.d_header.id;
    pw.getHeader()->rd = mdp.d_header.rd;
    pw.getHeader()->qr = 1;
    pw.startRecord(record.d_name + mdp.d_qname, record.d_type);
    record.d_content->toPacket(pw);
    pw.commit();
    packets.push_back(packet);
  }

  // Final SOA
  packets.push_back(getSOAPacket(mdp, soa));

  return true;
}

void makeXFRPacketsFromDNSRecords(const MOADNSParser& mdp, const vector<DNSRecord>& records, vector<vector<uint8_t>>& packets) {
  for(const auto& r : records) {
    if (r.d_type == QType::SOA) {
      continue;
    }
    vector<uint8_t> packet;
    DNSPacketWriter pw(packet, mdp.d_qname, mdp.d_qtype);
    pw.getHeader()->id = mdp.d_header.id;
    pw.getHeader()->rd = mdp.d_header.rd;
    pw.getHeader()->qr = 1;
    pw.startRecord(r.d_name + mdp.d_qname, r.d_type);
    r.d_content->toPacket(pw);
    pw.commit();
    packets.push_back(packet);
  }
}

/* Produces an IXFR if one can be made according to the rules in RFC 1995 and
 * creates a SOA or AXFR packet when required by the RFC.
 */
bool makeIXFRPackets(const MOADNSParser& mdp, const shared_ptr<SOARecordContent>& clientSOA, vector<vector<uint8_t>>& packets) {
  // Get the new SOA only once, so it will not change under our noses from the
  // updateThread.
  vector<ixfrdiff_t> toSend;
  uint32_t ourLatestSerial;
  {
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    ourLatestSerial = g_soas[mdp.d_qname].soa->d_st.serial;
  }

  if (rfc1982LessThan(ourLatestSerial, clientSOA->d_st.serial) || ourLatestSerial == clientSOA->d_st.serial){
    /* RFC 1995 Section 2
     *    If an IXFR query with the same or newer version number than that of
     *    the server is received, it is replied to with a single SOA record of
     *    the server's current version, just as in AXFR.
     */
    vector<uint8_t> packet;
    bool ret = makeSOAPacket(mdp, packet);
    if (ret) {
      packets.push_back(packet);
    }
    return ret;
  }

  {
    // as we use push_back in the updater, we know the vector is sorted as oldest first
    bool shouldAdd = false;
    // Get all relevant IXFR differences
    std::lock_guard<std::mutex> guard(g_soas_mutex);
    for (const auto& diff : g_soas[mdp.d_qname].ixfrDiffs) {
      if (shouldAdd) {
        toSend.push_back(diff);
        continue;
      }
      if (diff.oldSOA->d_st.serial == clientSOA->d_st.serial) {
        toSend.push_back(diff);
        // Add all consecutive diffs
        shouldAdd = true;
      }
    }
  }

  if (toSend.empty()) {
    g_log<<Logger::Warning<<"No IXFR available from serial "<<clientSOA->d_st.serial<<" for zone "<<mdp.d_qname<<", attempting to send AXFR"<<endl;
    return makeAXFRPackets(mdp, packets);
  }

  for (const auto& diff : toSend) {
    /* An IXFR packet's ANSWER section looks as follows:
     * SOA new_serial
     * SOA old_serial
     * ... removed records ...
     * SOA new_serial
     * ... added records ...
     * SOA new_serial
     */
    packets.push_back(getSOAPacket(mdp, diff.newSOA));
    packets.push_back(getSOAPacket(mdp, diff.oldSOA));
    makeXFRPacketsFromDNSRecords(mdp, diff.removals, packets);
    packets.push_back(getSOAPacket(mdp, diff.newSOA));
    makeXFRPacketsFromDNSRecords(mdp, diff.additions, packets);
    packets.push_back(getSOAPacket(mdp, diff.newSOA));
  }

  return true;
}

bool allowedByACL(const ComboAddress& addr) {
  return g_acl.match(addr);
}

void handleUDPRequest(int fd, boost::any&) {
  // TODO make the buffer-size configurable
  char buf[4096];
  ComboAddress saddr;
  socklen_t fromlen = sizeof(saddr);
  int res = recvfrom(fd, buf, sizeof(buf), 0, (struct sockaddr*) &saddr, &fromlen);

  if (res == 0) {
    g_log<<Logger::Warning<<"Got an empty message from "<<saddr.toStringWithPort()<<endl;
    return;
  }

  if(res < 0) {
    auto savedErrno = errno;
    g_log<<Logger::Warning<<"Could not read message from "<<saddr.toStringWithPort()<<": "<<strerror(savedErrno)<<endl;
    return;
  }

  if (saddr == ComboAddress("0.0.0.0", 0)) {
    g_log<<Logger::Warning<<"Could not determine source of message"<<endl;
    return;
  }

  if (!allowedByACL(saddr)) {
    g_log<<Logger::Warning<<"UDP query from "<<saddr.toString()<<" is not allowed, dropping"<<endl;
    return;
  }

  MOADNSParser mdp(true, string(buf, res));
  if (!checkQuery(mdp, saddr)) {
    return;
  }

  /* RFC 1995 Section 2
   *    Transport of a query may be by either UDP or TCP.  If an IXFR query
   *    is via UDP, the IXFR server may attempt to reply using UDP if the
   *    entire response can be contained in a single DNS packet.  If the UDP
   *    reply does not fit, the query is responded to with a single SOA
   *    record of the server's current version to inform the client that a
   *    TCP query should be initiated.
   *
   * Let's not complicate this with IXFR over UDP (and looking if we need to truncate etc).
   * Just send the current SOA and let the client try over TCP
   */
  vector<uint8_t> packet;
  makeSOAPacket(mdp, packet);
  if(sendto(fd, &packet[0], packet.size(), 0, (struct sockaddr*) &saddr, fromlen) < 0) {
    auto savedErrno = errno;
    g_log<<Logger::Warning<<"Could not send reply for "<<mdp.d_qname<<"|"<<QType(mdp.d_qtype).getName()<<" to "<<saddr.toStringWithPort()<<": "<<strerror(savedErrno)<<endl;
  }
  return;
}

void handleTCPRequest(int fd, boost::any&) {
  ComboAddress saddr;
  int cfd = 0;

  try {
    cfd = SAccept(fd, saddr);
    setBlocking(cfd);
  } catch(runtime_error &e) {
    g_log<<Logger::Error<<e.what()<<endl;
    return;
  }

  if (saddr == ComboAddress("0.0.0.0", 0)) {
    g_log<<Logger::Warning<<"Could not determine source of message"<<endl;
    close(cfd);
    return;
  }

  if (!allowedByACL(saddr)) {
    g_log<<Logger::Warning<<"TCP query from "<<saddr.toString()<<" is not allowed, dropping"<<endl;
    close(cfd);
    return;
  }

  {
    std::lock_guard<std::mutex> lg(g_tcpRequestFDsMutex);
    g_tcpRequestFDs.push({cfd, saddr});
  }
  g_tcpHandlerCV.notify_one();
}

/* Thread to handle TCP traffic
 */
void tcpWorker(int tid) {
  string prefix = "TCP Worker " + std::to_string(tid) + ": ";

  while(true) {
    g_log<<Logger::Debug<<prefix<<"ready for a new request!"<<endl;
    std::unique_lock<std::mutex> lk(g_tcpRequestFDsMutex);
    g_tcpHandlerCV.wait(lk, []{return g_tcpRequestFDs.size() || g_exiting ;});
    if (g_exiting) {
      g_log<<Logger::Debug<<prefix<<"Stopping thread"<<endl;
      break;
    }
    g_log<<Logger::Debug<<prefix<<"Going to handle a query"<<endl;
    auto request = g_tcpRequestFDs.front();
    g_tcpRequestFDs.pop();
    lk.unlock();

    int cfd = request.first;
    ComboAddress saddr = request.second;

    char buf[4096];
    ssize_t res;
    try {
      uint16_t toRead;
      readn2(cfd, &toRead, sizeof(toRead));
      toRead = std::min(ntohs(toRead), static_cast<uint16_t>(sizeof(buf)));
      res = readn2WithTimeout(cfd, &buf, toRead, 2);
      g_log<<Logger::Debug<<prefix<<"Had message of "<<std::to_string(toRead)<<" bytes from "<<saddr.toStringWithPort()<<endl;
    } catch (runtime_error &e) {
      g_log<<Logger::Warning<<prefix<<"Could not read message from "<<saddr.toStringWithPort()<<": "<<e.what()<<endl;
      close(cfd);
      continue;
    }

    try {
      MOADNSParser mdp(true, string(buf, res));

      if (!checkQuery(mdp, saddr, false, prefix)) {
        close(cfd);
        continue;
      }

      vector<vector<uint8_t>> packets;
      if (mdp.d_qtype == QType::SOA) {
        vector<uint8_t> packet;
        bool ret = makeSOAPacket(mdp, packet);
        if (!ret) {
          close(cfd);
          continue;
        }
        packets.push_back(packet);
      }

      if (mdp.d_qtype == QType::AXFR) {
        if (!makeAXFRPackets(mdp, packets)) {
          close(cfd);
          continue;
        }
      }

      if (mdp.d_qtype == QType::IXFR) {
        /* RFC 1995 section 3:
         *  The IXFR query packet format is the same as that of a normal DNS
         *  query, but with the query type being IXFR and the authority section
         *  containing the SOA record of client's version of the zone.
         */
        shared_ptr<SOARecordContent> clientSOA;
        for (auto &answer : mdp.d_answers) {
          // from dnsparser.hh:
          // typedef vector<pair<DNSRecord, uint16_t > > answers_t;
          if (answer.first.d_type == QType::SOA && answer.first.d_place == DNSResourceRecord::AUTHORITY) {
            clientSOA = getRR<SOARecordContent>(answer.first);
            if (clientSOA != nullptr) {
              break;
            }
          }
        } /* for (auto const &answer : mdp.d_answers) */

        if (clientSOA == nullptr) {
          g_log<<Logger::Warning<<prefix<<"IXFR request packet did not contain a SOA record in the AUTHORITY section"<<endl;
          close(cfd);
          continue;
        }

        if (!makeIXFRPackets(mdp, clientSOA, packets)) {
          close(cfd);
          continue;
        }
      } /* if (mdp.d_qtype == QType::IXFR) */

      g_log<<Logger::Debug<<prefix<<"Sending "<<packets.size()<<" packets to "<<saddr.toStringWithPort()<<endl;
      for (const auto& packet : packets) {
        char sendBuf[2];
        sendBuf[0]=packet.size()/256;
        sendBuf[1]=packet.size()%256;

        ssize_t send = writen2(cfd, sendBuf, 2);
        send += writen2(cfd, &packet[0], packet.size());
      }
      shutdown(cfd, 2);
    } catch (MOADNSException &e) {
      g_log<<Logger::Warning<<prefix<<"Could not parse DNS packet from "<<saddr.toStringWithPort()<<": "<<e.what()<<endl;
    } catch (runtime_error &e) {
      g_log<<Logger::Warning<<prefix<<"Could not write reply to "<<saddr.toStringWithPort()<<": "<<e.what()<<endl;
    }
    // bye!
    close(cfd);

    if (g_exiting) {
      break;
    }
  }
}

/* Parses the configuration file in configpath into config, adding defaults for
 * missing parameters (if applicable), returning true if the config file was
 * good, false otherwise. Will log all issues with the config
 */
bool parseAndCheckConfig(const string& configpath, YAML::Node& config) {
  g_log<<Logger::Info<<"Loading configuration file from "<<g_vm["config"].as<string>()<<endl;
  try {
    config = YAML::LoadFile(configpath);
  } catch (const runtime_error &e) {
    g_log<<Logger::Error<<"Unable to load configuration file '"<<g_vm["config"].as<string>()<<"': "<<e.what()<<endl;
    return false;
  }

  bool retval = true;

  if (config["keep"]) {
    try {
      config["keep"].as<uint16_t>();
    } catch (const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'keep' value: "<<e.what()<<endl;
      retval = false;
    }
  } else {
    config["keep"] = KEEP_DEFAULT;
  }

  if (config["axfr-timeout"]) {
    try {
      config["axfr-timeout"].as<uint16_t>();
    } catch (const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'axfr-timeout' value: "<<e.what()<<endl;
    }
  } else {
    config["axfr-timeout"] = AXFRTIMEOUT_DEFAULT;
  }

  if (config["tcp-in-threads"]) {
    try {
      config["tcp-in-threads"].as<uint16_t>();
    } catch (const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'tcp-in-thread' value: "<<e.what()<<endl;
    }
  } else {
    config["tcp-in-threads"] = 10;
  }

  if (config["listen"]) {
    try {
      config["listen"].as<vector<ComboAddress>>();
    } catch (const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'listen' value: "<<e.what()<<endl;
      retval = false;
    }
  } else {
    config["listen"].push_back("127.0.0.1:53");
    config["listen"].push_back("[::1]:53");
  }

  if (config["acl"]) {
    try {
      config["acl"].as<vector<string>>();
    } catch (const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'acl' value: "<<e.what()<<endl;
      retval = false;
    }
  } else {
    config["acl"].push_back("127.0.0.0/8");
    config["acl"].push_back("::1/128");
  }

  if (config["work-dir"]) {
    try {
      config["work-dir"].as<string>();
    } catch(const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'work-dir' value: "<<e.what()<<endl;
      retval = false;
    }
  } else {
    char tmp[512];
    config["work-dir"] = getcwd(tmp, sizeof(tmp)) ? string(tmp) : "";;
  }

  if (config["uid"]) {
    try {
      config["uid"].as<string>();
    } catch(const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'uid' value: "<<e.what()<<endl;
      retval = false;
    }
  }

  if (config["gid"]) {
    try {
      config["gid"].as<string>();
    } catch(const runtime_error &e) {
      g_log<<Logger::Error<<"Unable to read 'gid' value: "<<e.what()<<endl;
      retval = false;
    }
  }

  if (config["domains"]) {
    if (config["domains"].size() == 0) {
      g_log<<Logger::Error<<"No domains configured"<<endl;
      retval = false;
    }
    for (auto const &domain : config["domains"]) {
      try {
        if (!domain["domain"]) {
          g_log<<Logger::Error<<"An entry in 'domains' is missing a 'domain' key!"<<endl;
          retval = false;
          continue;
        }
        domain["domain"].as<DNSName>();
      } catch (const runtime_error &e) {
        g_log<<Logger::Error<<"Unable to read domain '"<<domain["domain"].as<string>()<<"': "<<e.what()<<endl;
      }
      try {
        if (!domain["master"]) {
          g_log<<Logger::Error<<"Domain '"<<domain["domain"].as<string>()<<"' has no master configured!"<<endl;
          retval = false;
          continue;
        }
        domain["master"].as<ComboAddress>();
      } catch (const runtime_error &e) {
        g_log<<Logger::Error<<"Unable to read domain '"<<domain["domain"].as<string>()<<"' master address: "<<e.what()<<endl;
        retval = false;
      }
    }
  } else {
    g_log<<Logger::Error<<"No domains configured"<<endl;
    retval = false;
  }

  return retval;
}

int main(int argc, char** argv) {
  g_log.setLoglevel(Logger::Notice);
  g_log.toConsole(Logger::Notice);
  g_log.setPrefixed(true);
  g_log.disableSyslog(true);
  g_log.setTimestamps(false);
  try {
    po::options_description desc("IXFR distribution tool");
    desc.add_options()
      ("help", "produce help message")
      ("version", "Display the version of ixfrdist")
      ("verbose", "Be verbose")
      ("debug", "Be even more verbose")
      ("config", po::value<string>()->default_value(SYSCONFDIR + string("/ixfrdist.yml")), "Configuration file to use")
      ;

    po::store(po::command_line_parser(argc, argv).options(desc).run(), g_vm);
    po::notify(g_vm);

    if (g_vm.count("help") > 0) {
      usage(desc);
      return EXIT_SUCCESS;
    }

    if (g_vm.count("version") > 0) {
      cout<<"ixfrdist "<<VERSION<<endl;
      return EXIT_SUCCESS;
    }
  } catch (po::error &e) {
    g_log<<Logger::Error<<e.what()<<". See `ixfrdist --help` for valid options"<<endl;
    return(EXIT_FAILURE);
  }

  bool had_error = false;

  if (g_vm.count("verbose")) {
    g_log.setLoglevel(Logger::Info);
    g_log.toConsole(Logger::Info);
  }

  if (g_vm.count("debug") > 0) {
    g_log.setLoglevel(Logger::Debug);
    g_log.toConsole(Logger::Debug);
  }

  YAML::Node config;
  if (!parseAndCheckConfig(g_vm["config"].as<string>(), config)) {
    // parseAndCheckConfig already logged whatever was wrong
    return EXIT_FAILURE;
  }

  /*  From hereon out, we known that all the values in config are valid. */

  for (auto const &domain : config["domains"]) {
    set<ComboAddress> s;
    s.insert(domain["master"].as<ComboAddress>());
    g_domainConfigs[domain["domain"].as<DNSName>()].masters = s;
  }

  g_workdir = config["work-dir"].as<string>();

  for (const auto &addr : config["acl"].as<vector<string>>()) {
    try {
      g_acl.addMask(addr);
    } catch (const NetmaskException &e) {
      g_log<<Logger::Error<<e.reason<<endl;
      had_error = true;
    }
  }
  g_log<<Logger::Notice<<"ACL set to "<<g_acl.toString()<<"."<<endl;

  g_fdm = FDMultiplexer::getMultiplexerSilent();
  if (g_fdm == nullptr) {
    g_log<<Logger::Error<<"Could not enable a multiplexer for the listen sockets!"<<endl;
    return EXIT_FAILURE;
  }

  set<int> allSockets;
  for (const auto& addr : config["listen"].as<vector<ComboAddress>>()) {
    for (const auto& stype : {SOCK_DGRAM, SOCK_STREAM}) {
      try {
        int s = SSocket(addr.sin4.sin_family, stype, 0);
        setNonBlocking(s);
        setReuseAddr(s);
        SBind(s, addr);
        if (stype == SOCK_STREAM) {
          SListen(s, 30); // TODO make this configurable
        }
        g_fdm->addReadFD(s, stype == SOCK_DGRAM ? handleUDPRequest : handleTCPRequest);
        allSockets.insert(s);
      } catch(runtime_error &e) {
        g_log<<Logger::Error<<e.what()<<endl;
        had_error = true;
        continue;
      }
    }
  }

  int newgid = 0;

  if (config["gid"]) {
    string gid = config["gid"].as<string>();
    if (!(newgid = atoi(gid.c_str()))) {
      struct group *gr = getgrnam(gid.c_str());
      if (gr == nullptr) {
        g_log<<Logger::Error<<"Can not determine group-id for gid "<<gid<<endl;
        had_error = true;
      } else {
        newgid = gr->gr_gid;
      }
    }
    g_log<<Logger::Notice<<"Dropping effective group-id to "<<newgid<<endl;
    if (setgid(newgid) < 0) {
      g_log<<Logger::Error<<"Could not set group id to "<<newgid<<": "<<stringerror()<<endl;
      had_error = true;
    }
  }

  int newuid = 0;

  if (config["uid"]) {
    string uid = config["uid"].as<string>();
    if (!(newuid = atoi(uid.c_str()))) {
      struct passwd *pw = getpwnam(uid.c_str());
      if (pw == nullptr) {
        g_log<<Logger::Error<<"Can not determine user-id for uid "<<uid<<endl;
        had_error = true;
      } else {
        newuid = pw->pw_uid;
      }
    }

    struct passwd *pw = getpwuid(newuid);
    if (pw == nullptr) {
      if (setgroups(0, nullptr) < 0) {
        g_log<<Logger::Error<<"Unable to drop supplementary gids: "<<stringerror()<<endl;
        had_error = true;
      }
    } else {
      if (initgroups(pw->pw_name, newgid) < 0) {
        g_log<<Logger::Error<<"Unable to set supplementary groups: "<<stringerror()<<endl;
        had_error = true;
      }
    }

    g_log<<Logger::Notice<<"Dropping effective user-id to "<<newuid<<endl;
    if (setuid(pw->pw_uid) < 0) {
      g_log<<Logger::Error<<"Could not set user id to "<<newuid<<": "<<stringerror()<<endl;
      had_error = true;
    }
  }

  if (had_error) {
    // We have already sent the errors to stderr, just die
    return EXIT_FAILURE;
  }

  // It all starts here
  signal(SIGTERM, handleSignal);
  signal(SIGINT, handleSignal);
  signal(SIGSTOP, handleSignal);
  signal(SIGPIPE, SIG_IGN);

  // Init the things we need
  reportAllTypes();

  // TODO read from urandom (perhaps getrandom(2)?
  dns_random_init("0123456789abcdef");

  g_log<<Logger::Notice<<"IXFR distributor starting up!"<<endl;

  std::thread ut(updateThread);

  vector<std::thread> tcpHandlers;
  tcpHandlers.reserve(config["tcp-in-threads"].as<uint16_t>());
  for (size_t i = 0; i < tcpHandlers.capacity(); ++i) {
    tcpHandlers.push_back(std::thread(tcpWorker, i));
  }

  struct timeval now;
  for(;;) {
    gettimeofday(&now, 0);
    g_fdm->run(&now);
    if (g_exiting) {
      g_log<<Logger::Notice<<"Shutting down!"<<endl;
      for (const int& fd : allSockets) {
        try {
          closesocket(fd);
        } catch(PDNSException &e) {
          g_log<<Logger::Error<<e.reason<<endl;
        }
      }
      break;
    }
  }
  g_tcpHandlerCV.notify_all();
  ut.join();
  for (auto &t : tcpHandlers) {
    t.join();
  }
  g_log<<Logger::Notice<<"IXFR distributor stopped"<<endl;
  return EXIT_SUCCESS;
}