pdns/dnsdist.hh

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #pragma once
  23 #include "config.h"
  24 #include "ext/luawrapper/include/LuaContext.hpp"
  25 #include <time.h>
  26 #include "misc.hh"
  27 #include "iputils.hh"
  28 #include "dnsname.hh"
  29 #include <atomic>
  30 #include <boost/circular_buffer.hpp>
  31 #include <boost/variant.hpp>
  32 #include <mutex>
  33 #include <thread>
  34 #include <unistd.h>
  35 #include "sholder.hh"
  36 #include "dnscrypt.hh"
  37 #include "dnsdist-cache.hh"
  38 #include "gettime.hh"
  39 #include "dnsdist-dynbpf.hh"
  40 #include "bpf-filter.hh"
  41
  42 #ifdef HAVE_PROTOBUF
  43 #include <boost/uuid/uuid.hpp>
  44 #include <boost/uuid/uuid_generators.hpp>
  45 #endif
  46
  47 void* carbonDumpThread();
  48 uint64_t uptimeOfProcess(const std::string& str);
  49
  50 struct DynBlock
  51 {
  52   DynBlock& operator=(const DynBlock& rhs)
  53   {
  54     reason=rhs.reason;
  55     until=rhs.until;
  56     domain=rhs.domain;
  57     blocks.store(rhs.blocks);
  58     return *this;
  59   }
  60
  61   string reason;
  62   struct timespec until;
  63   DNSName domain;
  64   mutable std::atomic<unsigned int> blocks;
  65 };
  66
  67 extern GlobalStateHolder<NetmaskTree<DynBlock>> g_dynblockNMG;
  68
  69 extern vector<pair<struct timeval, std::string> > g_confDelta;
  70
  71 struct DNSDistStats
  72 {
  73   using stat_t=std::atomic<uint64_t>; // aww yiss ;-)
  74   stat_t responses{0};
  75   stat_t servfailResponses{0};
  76   stat_t queries{0};
  77   stat_t nonCompliantQueries{0};
  78   stat_t nonCompliantResponses{0};
  79   stat_t rdQueries{0};
  80   stat_t emptyQueries{0};
  81   stat_t aclDrops{0};
  82   stat_t blockFilter{0};
  83   stat_t dynBlocked{0};
  84   stat_t ruleDrop{0};
  85   stat_t ruleNXDomain{0};
  86   stat_t ruleRefused{0};
  87   stat_t selfAnswered{0};
  88   stat_t downstreamTimeouts{0};
  89   stat_t downstreamSendErrors{0};
  90   stat_t truncFail{0};
  91   stat_t noPolicy{0};
  92   stat_t cacheHits{0};
  93   stat_t cacheMisses{0};
  94   stat_t latency0_1{0}, latency1_10{0}, latency10_50{0}, latency50_100{0}, latency100_1000{0}, latencySlow{0};
  95
  96   double latencyAvg100{0}, latencyAvg1000{0}, latencyAvg10000{0}, latencyAvg1000000{0};
  97   typedef std::function<uint64_t(const std::string&)> statfunction_t;
  98   typedef boost::variant<stat_t*, double*, statfunction_t> entry_t;
  99   std::vector<std::pair<std::string, entry_t>> entries{
 100     {"responses", &responses},
 101     {"servfail-responses", &servfailResponses},
 102     {"queries", &queries},
 103     {"acl-drops", &aclDrops},
 104     {"block-filter", &blockFilter},
 105     {"rule-drop", &ruleDrop},
 106     {"rule-nxdomain", &ruleNXDomain},
 107     {"rule-refused", &ruleRefused},
 108     {"self-answered", &selfAnswered},
 109     {"downstream-timeouts", &downstreamTimeouts},
 110     {"downstream-send-errors", &downstreamSendErrors},
 111     {"trunc-failures", &truncFail},
 112     {"no-policy", &noPolicy},
 113     {"latency0-1", &latency0_1},
 114     {"latency1-10", &latency1_10},
 115     {"latency10-50", &latency10_50},
 116     {"latency50-100", &latency50_100},
 117     {"latency100-1000", &latency100_1000},
 118     {"latency-slow", &latencySlow},
 119     {"latency-avg100", &latencyAvg100},
 120     {"latency-avg1000", &latencyAvg1000},
 121     {"latency-avg10000", &latencyAvg10000},
 122     {"latency-avg1000000", &latencyAvg1000000},
 123     {"uptime", uptimeOfProcess},
 124     {"real-memory-usage", getRealMemoryUsage},
 125     {"noncompliant-queries", &nonCompliantQueries},
 126     {"noncompliant-responses", &nonCompliantResponses},
 127     {"rdqueries", &rdQueries},
 128     {"empty-queries", &emptyQueries},
 129     {"cache-hits", &cacheHits},
 130     {"cache-misses", &cacheMisses},
 131     {"cpu-user-msec", getCPUTimeUser},
 132     {"cpu-sys-msec", getCPUTimeSystem},
 133     {"fd-usage", getOpenFileDescriptors},
 134     {"dyn-blocked", &dynBlocked},
 135     {"dyn-block-nmg-size", [](const std::string&) { return g_dynblockNMG.getLocal()->size(); }}
 136   };
 137 };
 138
 139
 140 extern struct DNSDistStats g_stats;
 141
 142
 143 struct StopWatch
 144 {
 145   StopWatch(bool realTime=false): d_needRealTime(realTime)
 146   {
 147   }
 148   struct timespec d_start{0,0};
 149   bool d_needRealTime{false};
 150
 151   void start() {
 152     if(gettime(&d_start, d_needRealTime) < 0)
 153       unixDie("Getting timestamp");
 154
 155   }
 156
 157   double udiff() const {
 158     struct timespec now;
 159     if(gettime(&now, d_needRealTime) < 0)
 160       unixDie("Getting timestamp");
 161
 162     return 1000000.0*(now.tv_sec - d_start.tv_sec) + (now.tv_nsec - d_start.tv_nsec)/1000.0;
 163   }
 164
 165   double udiffAndSet() {
 166     struct timespec now;
 167     if(gettime(&now, d_needRealTime) < 0)
 168       unixDie("Getting timestamp");
 169
 170     auto ret= 1000000.0*(now.tv_sec - d_start.tv_sec) + (now.tv_nsec - d_start.tv_nsec)/1000.0;
 171     d_start = now;
 172     return ret;
 173   }
 174
 175 };
 176
 177 class QPSLimiter
 178 {
 179 public:
 180   QPSLimiter()
 181   {
 182   }
 183
 184   QPSLimiter(unsigned int rate, unsigned int burst) : d_rate(rate), d_burst(burst), d_tokens(burst)
 185   {
 186     d_passthrough=false;
 187     d_prev.start();
 188   }
 189
 190   unsigned int getRate() const
 191   {
 192     return d_passthrough? 0 : d_rate;
 193   }
 194
 195   int getPassed() const
 196   {
 197     return d_passed;
 198   }
 199   int getBlocked() const
 200   {
 201     return d_blocked;
 202   }
 203
 204   bool check() const // this is not quite fair
 205   {
 206     if(d_passthrough)
 207       return true;
 208     auto delta = d_prev.udiffAndSet();
 209
 210     d_tokens += 1.0*d_rate * (delta/1000000.0);
 211
 212     if(d_tokens > d_burst)
 213       d_tokens = d_burst;
 214
 215     bool ret=false;
 216     if(d_tokens >= 1.0) { // we need this because burst=1 is weird otherwise
 217       ret=true;
 218       --d_tokens;
 219       d_passed++;
 220     }
 221     else
 222       d_blocked++;
 223
 224     return ret;
 225   }
 226 private:
 227   bool d_passthrough{true};
 228   unsigned int d_rate;
 229   unsigned int d_burst;
 230   mutable double d_tokens;
 231   mutable StopWatch d_prev;
 232   mutable unsigned int d_passed{0};
 233   mutable unsigned int d_blocked{0};
 234 };
 235
 236 struct IDState
 237 {
 238   IDState() : origFD(-1), sentTime(true), delayMsec(0) { origDest.sin4.sin_family = 0;}
 239   IDState(const IDState& orig)
 240   {
 241     origFD = orig.origFD;
 242     origID = orig.origID;
 243     origRemote = orig.origRemote;
 244     origDest = orig.origDest;
 245     delayMsec = orig.delayMsec;
 246     age.store(orig.age.load());
 247   }
 248
 249   int origFD;  // set to <0 to indicate this state is empty   // 4
 250
 251   ComboAddress origRemote;                                    // 28
 252   ComboAddress origDest;                                      // 28
 253   StopWatch sentTime;                                         // 16
 254   DNSName qname;                                              // 80
 255 #ifdef HAVE_DNSCRYPT
 256   std::shared_ptr<DnsCryptQuery> dnsCryptQuery{0};
 257 #endif
 258 #ifdef HAVE_PROTOBUF
 259   boost::uuids::uuid uniqueId;
 260 #endif
 261   std::shared_ptr<DNSDistPacketCache> packetCache{nullptr};
 262   uint32_t cacheKey;                                          // 8
 263   std::atomic<uint16_t> age;                                  // 4
 264   uint16_t qtype;                                             // 2
 265   uint16_t qclass;                                            // 2
 266   uint16_t origID;                                            // 2
 267   uint16_t origFlags;                                         // 2
 268   int delayMsec;
 269   bool ednsAdded{false};
 270   bool ecsAdded{false};
 271   bool skipCache{false};
 272   bool destHarvested{false}; // if true, origDest holds the original dest addr, otherwise the listening addr
 273 };
 274
 275 struct Rings {
 276   Rings()
 277   {
 278     queryRing.set_capacity(10000);
 279     respRing.set_capacity(10000);
 280     pthread_rwlock_init(&queryLock, 0);
 281   }
 282   struct Query
 283   {
 284     struct timespec when;
 285     ComboAddress requestor;
 286     DNSName name;
 287     uint16_t size;
 288     uint16_t qtype;
 289     struct dnsheader dh;
 290   };
 291   boost::circular_buffer<Query> queryRing;
 292   struct Response
 293   {
 294     struct timespec when;
 295     ComboAddress requestor;
 296     DNSName name;
 297     uint16_t qtype;
 298     unsigned int usec;
 299     unsigned int size;
 300     struct dnsheader dh;
 301     ComboAddress ds; // who handled it
 302   };
 303   boost::circular_buffer<Response> respRing;
 304   std::mutex respMutex;
 305   pthread_rwlock_t queryLock;
 306
 307   std::unordered_map<int, vector<boost::variant<string,double> > > getTopBandwidth(unsigned int numentries);
 308   size_t numDistinctRequestors();
 309 };
 310
 311 extern Rings g_rings;
 312
 313 typedef std::unordered_map<string, unsigned int> QueryCountRecords;
 314 typedef std::function<std::tuple<bool, string>(DNSQuestion dq)> QueryCountFilter;
 315 struct QueryCount {
 316   QueryCount()
 317   {
 318     pthread_rwlock_init(&queryLock, 0);
 319   }
 320   QueryCountRecords records;
 321   QueryCountFilter filter;
 322   pthread_rwlock_t queryLock;
 323   bool enabled{false};
 324 };
 325
 326 extern QueryCount g_qcount;
 327
 328 struct ClientState
 329 {
 330   ComboAddress local;
 331 #ifdef HAVE_DNSCRYPT
 332   DnsCryptContext* dnscryptCtx{0};
 333 #endif
 334   std::atomic<uint64_t> queries{0};
 335   int udpFD{-1};
 336   int tcpFD{-1};
 337
 338   int getSocket() const
 339   {
 340     return udpFD != -1 ? udpFD : tcpFD;
 341   }
 342
 343 #ifdef HAVE_EBPF
 344   shared_ptr<BPFFilter> d_filter;
 345
 346   void detachFilter()
 347   {
 348     if (d_filter) {
 349       d_filter->removeSocket(getSocket());
 350       d_filter = nullptr;
 351     }
 352   }
 353
 354   void attachFilter(shared_ptr<BPFFilter> bpf)
 355   {
 356     detachFilter();
 357
 358     bpf->addSocket(getSocket());
 359     d_filter = bpf;
 360   }
 361 #endif /* HAVE_EBPF */
 362 };
 363
 364 class TCPClientCollection {
 365   std::vector<int> d_tcpclientthreads;
 366   std::atomic<uint64_t> d_pos{0};
 367 public:
 368   std::atomic<uint64_t> d_queued{0}, d_numthreads{0};
 369   uint64_t d_maxthreads{0};
 370
 371   TCPClientCollection(size_t maxThreads)
 372   {
 373     d_maxthreads = maxThreads;
 374     d_tcpclientthreads.reserve(maxThreads);
 375   }
 376
 377   int getThread()
 378   {
 379     uint64_t pos = d_pos++;
 380     ++d_queued;
 381     return d_tcpclientthreads[pos % d_numthreads];
 382   }
 383   void addTCPClientThread();
 384 };
 385
 386 extern std::shared_ptr<TCPClientCollection> g_tcpclientthreads;
 387
 388 struct DownstreamState
 389 {
 390   DownstreamState(const ComboAddress& remote_, const ComboAddress& sourceAddr_, unsigned int sourceItf);
 391   DownstreamState(const ComboAddress& remote_): DownstreamState(remote_, ComboAddress(), 0) {}
 392   ~DownstreamState()
 393   {
 394     if (fd >= 0)
 395       close(fd);
 396   }
 397
 398   int fd{-1};
 399   std::thread tid;
 400   ComboAddress remote;
 401   QPSLimiter qps;
 402   vector<IDState> idStates;
 403   ComboAddress sourceAddr;
 404   DNSName checkName{"a.root-servers.net."};
 405   QType checkType{QType::A};
 406   std::atomic<uint64_t> idOffset{0};
 407   std::atomic<uint64_t> sendErrors{0};
 408   std::atomic<uint64_t> outstanding{0};
 409   std::atomic<uint64_t> reuseds{0};
 410   std::atomic<uint64_t> queries{0};
 411   struct {
 412     std::atomic<uint64_t> sendErrors{0};
 413     std::atomic<uint64_t> reuseds{0};
 414     std::atomic<uint64_t> queries{0};
 415   } prev;
 416   string name;
 417   double queryLoad{0.0};
 418   double dropRate{0.0};
 419   double latencyUsec{0.0};
 420   int order{1};
 421   int weight{1};
 422   int tcpRecvTimeout{30};
 423   int tcpSendTimeout{30};
 424   unsigned int sourceItf{0};
 425   uint16_t retries{5};
 426   uint8_t currentCheckFailures{0};
 427   uint8_t maxCheckFailures{1};
 428   StopWatch sw;
 429   set<string> pools;
 430   enum class Availability { Up, Down, Auto} availability{Availability::Auto};
 431   bool mustResolve{false};
 432   bool upStatus{false};
 433   bool useECS{false};
 434   bool setCD{false};
 435   bool isUp() const
 436   {
 437     if(availability == Availability::Down)
 438       return false;
 439     if(availability == Availability::Up)
 440       return true;
 441     return upStatus;
 442   }
 443   void setUp() { availability = Availability::Up; }
 444   void setDown() { availability = Availability::Down; }
 445   void setAuto() { availability = Availability::Auto; }
 446   string getName() const {
 447     if (name.empty()) {
 448       return remote.toStringWithPort();
 449     }
 450     return name;
 451   }
 452   string getNameWithAddr() const {
 453     if (name.empty()) {
 454       return remote.toStringWithPort();
 455     }
 456     return name + " (" + remote.toStringWithPort()+ ")";
 457   }
 458
 459 };
 460 using servers_t =vector<std::shared_ptr<DownstreamState>>;
 461
 462 extern uint16_t g_ECSSourcePrefixV4;
 463 extern uint16_t g_ECSSourcePrefixV6;
 464 extern bool g_ECSOverride;
 465
 466 struct DNSQuestion
 467 {
 468   DNSQuestion(const DNSName* name, uint16_t type, uint16_t class_, const ComboAddress* lc, const ComboAddress* rem, struct dnsheader* header, size_t bufferSize, uint16_t queryLen, bool isTcp): qname(name), qtype(type), qclass(class_), local(lc), remote(rem), dh(header), size(bufferSize), len(queryLen), ecsPrefixLength(rem->sin4.sin_family == AF_INET ? g_ECSSourcePrefixV4 : g_ECSSourcePrefixV6), tcp(isTcp), ecsOverride(g_ECSOverride) { }
 469
 470 #ifdef HAVE_PROTOBUF
 471   boost::uuids::uuid uniqueId;
 472 #endif
 473   const DNSName* qname;
 474   const uint16_t qtype;
 475   const uint16_t qclass;
 476   const ComboAddress* local;
 477   const ComboAddress* remote;
 478   struct dnsheader* dh;
 479   size_t size;
 480   uint16_t len;
 481   uint16_t ecsPrefixLength;
 482   const bool tcp;
 483   bool skipCache{false};
 484   bool ecsOverride;
 485   bool useECS{true};
 486 };
 487
 488 struct DNSResponse : DNSQuestion
 489 {
 490   DNSResponse(const DNSName* name, uint16_t type, uint16_t class_, const ComboAddress* lc, const ComboAddress* rem, struct dnsheader* header, size_t bufferSize, uint16_t queryLen, bool isTcp, const struct timespec* queryTime_): DNSQuestion(name, type, class_, lc, rem, header, bufferSize, queryLen, isTcp), queryTime(queryTime_) { }
 491
 492   const struct timespec* queryTime;
 493 };
 494
 495 typedef std::function<bool(const DNSQuestion*)> blockfilter_t;
 496 template <class T> using NumberedVector = std::vector<std::pair<unsigned int, T> >;
 497
 498 void* responderThread(std::shared_ptr<DownstreamState> state);
 499 extern std::mutex g_luamutex;
 500 extern LuaContext g_lua;
 501 extern std::string g_outputBuffer; // locking for this is ok, as locked by g_luamutex
 502
 503 class DNSRule
 504 {
 505 public:
 506   virtual bool matches(const DNSQuestion* dq) const =0;
 507   virtual string toString() const = 0;
 508   mutable std::atomic<uint64_t> d_matches{0};
 509 };
 510
 511 /* so what could you do:
 512    drop,
 513    fake up nxdomain,
 514    provide actual answer,
 515    allow & and stop processing,
 516    continue processing,
 517    modify header:    (servfail|refused|notimp), set TC=1,
 518    send to pool */
 519
 520 class DNSAction
 521 {
 522 public:
 523   enum class Action { Drop, Nxdomain, Refused, Spoof, Allow, HeaderModify, Pool, Delay, None};
 524   virtual Action operator()(DNSQuestion*, string* ruleresult) const =0;
 525   virtual string toString() const = 0;
 526   virtual std::unordered_map<string, double> getStats() const
 527   {
 528     return {{}};
 529   }
 530 };
 531
 532 class DNSResponseAction
 533 {
 534 public:
 535   enum class Action { Allow, Delay, Drop, HeaderModify, None };
 536   virtual Action operator()(DNSResponse*, string* ruleresult) const =0;
 537   virtual string toString() const = 0;
 538 };
 539
 540 using NumberedServerVector = NumberedVector<shared_ptr<DownstreamState>>;
 541 typedef std::function<shared_ptr<DownstreamState>(const NumberedServerVector& servers, const DNSQuestion*)> policyfunc_t;
 542
 543 struct ServerPolicy
 544 {
 545   string name;
 546   policyfunc_t policy;
 547 };
 548
 549 struct ServerPool
 550 {
 551   const std::shared_ptr<DNSDistPacketCache> getCache() const { return packetCache; };
 552
 553   NumberedVector<shared_ptr<DownstreamState>> servers;
 554   std::shared_ptr<DNSDistPacketCache> packetCache{nullptr};
 555 };
 556 using pools_t=map<std::string,std::shared_ptr<ServerPool>>;
 557 void addServerToPool(pools_t& pools, const string& poolName, std::shared_ptr<DownstreamState> server);
 558 void removeServerFromPool(pools_t& pools, const string& poolName, std::shared_ptr<DownstreamState> server);
 559
 560 struct CarbonConfig
 561 {
 562   ComboAddress server;
 563   std::string ourname;
 564   unsigned int interval;
 565 };
 566
 567 enum ednsHeaderFlags {
 568   EDNS_HEADER_FLAG_NONE = 0,
 569   EDNS_HEADER_FLAG_DO = 32768
 570 };
 571
 572 /* Quest in life: serve as a rapid block list. If you add a DNSName to a root SuffixMatchNode,
 573    anything part of that domain will return 'true' in check */
 574 template<typename T>
 575 struct SuffixMatchTree
 576 {
 577   SuffixMatchTree(const std::string& name_="", bool endNode_=false) : name(name_), endNode(endNode_)
 578   {}
 579
 580   SuffixMatchTree(const SuffixMatchTree& rhs)
 581   {
 582     name = rhs.name;
 583     d_human = rhs.d_human;
 584     children = rhs.children;
 585     endNode = rhs.endNode;
 586     d_value = rhs.d_value;
 587   }
 588   std::string name;
 589   std::string d_human;
 590   mutable std::set<SuffixMatchTree> children;
 591   mutable bool endNode;
 592   mutable T d_value;
 593   bool operator<(const SuffixMatchTree& rhs) const
 594   {
 595     return strcasecmp(name.c_str(), rhs.name.c_str()) < 0;
 596   }
 597   typedef SuffixMatchTree value_type;
 598
 599   template<typename V>
 600   void visit(const V& v) const {
 601     for(const auto& c : children)
 602       c.visit(v);
 603     if(endNode)
 604       v(*this);
 605   }
 606
 607   void add(const DNSName& name, const T& t)
 608   {
 609     add(name.getRawLabels(), t);
 610   }
 611
 612   void add(std::vector<std::string> labels, const T& value) const
 613   {
 614     if(labels.empty()) { // this allows insertion of the root
 615       endNode=true;
 616       d_value=value;
 617     }
 618     else if(labels.size()==1) {
 619       SuffixMatchTree newChild(*labels.begin(), true);
 620       newChild.d_value=value;
 621       children.insert(newChild);
 622     }
 623     else {
 624       SuffixMatchTree newnode(*labels.rbegin(), false);
 625       auto res=children.insert(newnode);
 626       if(!res.second) {
 627         children.erase(newnode);
 628         res=children.insert(newnode);
 629       }
 630       labels.pop_back();
 631       res.first->add(labels, value);
 632     }
 633   }
 634
 635   T* lookup(const DNSName& name)  const
 636   {
 637     if(children.empty()) { // speed up empty set
 638       if(endNode)
 639         return &d_value;
 640       return 0;
 641     }
 642     return lookup(name.getRawLabels());
 643   }
 644
 645   T* lookup(std::vector<std::string> labels) const
 646   {
 647     if(labels.empty()) { // optimization
 648       if(endNode)
 649         return &d_value;
 650       return 0;
 651     }
 652
 653     SuffixMatchTree smn(*labels.rbegin());
 654     auto child = children.find(smn);
 655     if(child == children.end()) {
 656       if(endNode)
 657         return &d_value;
 658       return 0;
 659     }
 660     labels.pop_back();
 661     return child->lookup(labels);
 662   }
 663
 664 };
 665
 666 extern GlobalStateHolder<SuffixMatchTree<DynBlock>> g_dynblockSMT;
 667 extern DNSAction::Action g_dynBlockAction;
 668
 669 extern GlobalStateHolder<vector<CarbonConfig> > g_carbon;
 670 extern GlobalStateHolder<ServerPolicy> g_policy;
 671 extern GlobalStateHolder<servers_t> g_dstates;
 672 extern GlobalStateHolder<pools_t> g_pools;
 673 extern GlobalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSAction> > > > g_rulactions;
 674 extern GlobalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSResponseAction> > > > g_resprulactions;
 675 extern GlobalStateHolder<NetmaskGroup> g_ACL;
 676
 677 extern ComboAddress g_serverControl; // not changed during runtime
 678
 679 extern std::vector<std::tuple<ComboAddress, bool, bool, int>> g_locals; // not changed at runtime (we hope XXX)
 680 extern vector<ClientState*> g_frontends;
 681 extern std::string g_key; // in theory needs locking
 682 extern bool g_truncateTC;
 683 extern bool g_fixupCase;
 684 extern int g_tcpRecvTimeout;
 685 extern int g_tcpSendTimeout;
 686 extern int g_udpTimeout;
 687 extern uint16_t g_maxOutstanding;
 688 extern std::atomic<bool> g_configurationDone;
 689 extern uint64_t g_maxTCPClientThreads;
 690 extern uint64_t g_maxTCPQueuedConnections;
 691 extern std::atomic<uint16_t> g_cacheCleaningDelay;
 692 extern bool g_verboseHealthChecks;
 693 extern uint32_t g_staleCacheEntriesTTL;
 694 extern bool g_apiReadWrite;
 695 extern std::string g_apiConfigDirectory;
 696 extern bool g_servFailOnNoPolicy;
 697
 698 struct ConsoleKeyword {
 699   std::string name;
 700   bool function;
 701   std::string parameters;
 702   std::string description;
 703   std::string toString() const
 704   {
 705     std::string res(name);
 706     if (function) {
 707       res += "(" + parameters + ")";
 708     }
 709     res += ": ";
 710     res += description;
 711     return res;
 712   }
 713 };
 714 extern const std::vector<ConsoleKeyword> g_consoleKeywords;
 715
 716 #ifdef HAVE_EBPF
 717 extern shared_ptr<BPFFilter> g_defaultBPFFilter;
 718 extern std::vector<std::shared_ptr<DynBPFFilter> > g_dynBPFFilters;
 719 #endif /* HAVE_EBPF */
 720
 721 struct dnsheader;
 722
 723 void controlThread(int fd, ComboAddress local);
 724 vector<std::function<void(void)>> setupLua(bool client, const std::string& config);
 725 std::shared_ptr<ServerPool> getPool(const pools_t& pools, const std::string& poolName);
 726 std::shared_ptr<ServerPool> createPoolIfNotExists(pools_t& pools, const string& poolName);
 727 const NumberedServerVector& getDownstreamCandidates(const pools_t& pools, const std::string& poolName);
 728
 729 std::shared_ptr<DownstreamState> firstAvailable(const NumberedServerVector& servers, const DNSQuestion* dq);
 730
 731 std::shared_ptr<DownstreamState> leastOutstanding(const NumberedServerVector& servers, const DNSQuestion* dq);
 732 std::shared_ptr<DownstreamState> wrandom(const NumberedServerVector& servers, const DNSQuestion* dq);
 733 std::shared_ptr<DownstreamState> whashed(const NumberedServerVector& servers, const DNSQuestion* dq);
 734 std::shared_ptr<DownstreamState> roundrobin(const NumberedServerVector& servers, const DNSQuestion* dq);
 735 int getEDNSZ(const char* packet, unsigned int len);
 736 void spoofResponseFromString(DNSQuestion& dq, const string& spoofContent);
 737 uint16_t getEDNSOptionCode(const char * packet, size_t len);
 738 void dnsdistWebserverThread(int sock, const ComboAddress& local, const string& password, const string& apiKey, const boost::optional<std::map<std::string, std::string> >&);
 739 bool getMsgLen32(int fd, uint32_t* len);
 740 bool putMsgLen32(int fd, uint32_t len);
 741 void* tcpAcceptorThread(void* p);
 742
 743 void moreLua(bool client);
 744 void doClient(ComboAddress server, const std::string& command);
 745 void doConsole();
 746 void controlClientThread(int fd, ComboAddress client);
 747 extern "C" {
 748 char** my_completion( const char * text , int start,  int end);
 749 }
 750 void setLuaNoSideEffect(); // if nothing has been declared, set that there are no side effects
 751 void setLuaSideEffect();   // set to report a side effect, cancelling all _no_ side effect calls
 752 bool getLuaNoSideEffect(); // set if there were only explicit declarations of _no_ side effect
 753 void resetLuaSideEffect(); // reset to indeterminate state
 754
 755 bool responseContentMatches(const char* response, const uint16_t responseLen, const DNSName& qname, const uint16_t qtype, const uint16_t qclass, const ComboAddress& remote);
 756 bool processQuery(LocalStateHolder<NetmaskTree<DynBlock> >& localDynBlockNMG,
 757                   LocalStateHolder<SuffixMatchTree<DynBlock> >& localDynBlockSMT, LocalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSAction> > > >& localRulactions, blockfilter_t blockFilter, DNSQuestion& dq, string& poolname, int* delayMsec, const struct timespec& now);
 758 bool processResponse(LocalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSResponseAction> > > >& localRespRulactions, DNSResponse& dr, int* delayMsec);
 759 bool fixUpResponse(char** response, uint16_t* responseLen, size_t* responseSize, const DNSName& qname, uint16_t origFlags, bool ednsAdded, bool ecsAdded, std::vector<uint8_t>& rewrittenResponse, uint16_t addRoom);
 760 void restoreFlags(struct dnsheader* dh, uint16_t origFlags);
 761
 762 #ifdef HAVE_DNSCRYPT
 763 extern std::vector<std::tuple<ComboAddress,DnsCryptContext,bool,int>> g_dnsCryptLocals;
 764
 765 int handleDnsCryptQuery(DnsCryptContext* ctx, char* packet, uint16_t len, std::shared_ptr<DnsCryptQuery>& query, uint16_t* decryptedQueryLen, bool tcp, std::vector<uint8_t>& reponse);
 766 bool encryptResponse(char* response, uint16_t* responseLen, size_t responseSize, bool tcp, std::shared_ptr<DnsCryptQuery> dnsCryptQuery);
 767 #endif