pdns/ixfr.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #include "ixfr.hh"
  23 #include "sstuff.hh"
  24 #include "dns_random.hh"
  25 #include "dnsrecords.hh"
  26 #include "dnssecinfra.hh"
  27 #include "tsigverifier.hh"
  28
  29 vector<pair<vector<DNSRecord>, vector<DNSRecord> > > processIXFRRecords(const ComboAddress& master, const DNSName& zone,
  30                                                                         const vector<DNSRecord>& records, const std::shared_ptr<SOARecordContent> masterSOA)
  31 {
  32   vector<pair<vector<DNSRecord>, vector<DNSRecord> > >  ret;
  33
  34   if (records.size() == 0 || masterSOA == nullptr) {
  35     return ret;
  36   }
  37
  38   // we start at 1 to skip the first SOA record
  39   // we don't increase pos because the final SOA
  40   // of the previous sequence is also the first SOA
  41   // of this one
  42   for(unsigned int pos = 1; pos < records.size(); ) {
  43     vector<DNSRecord> remove, add;
  44
  45     // cerr<<"Looking at record in position "<<pos<<" of type "<<QType(records[pos].d_type).getName()<<endl;
  46
  47     if (records[pos].d_type != QType::SOA) {
  48       // this is an actual AXFR!
  49       return {{remove, records}};
  50     }
  51
  52     auto sr = getRR<SOARecordContent>(records[pos]);
  53     if (!sr) {
  54       throw std::runtime_error("Error getting the content of the first SOA record of this IXFR sequence for zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort()+"'");
  55     }
  56
  57     // cerr<<"Serial is "<<sr->d_st.serial<<", final serial is "<<masterSOA->d_st.serial<<endl;
  58
  59     // the serial of this SOA record is the serial of the
  60     // zone before the removals and updates of this sequence
  61     if (sr->d_st.serial == masterSOA->d_st.serial) {
  62       // if it's the final SOA, there is nothing for us to see
  63       break;
  64     }
  65
  66     remove.push_back(records[pos]); // this adds the SOA
  67
  68     // process removals
  69     for(pos++; pos < records.size() && records[pos].d_type != QType::SOA; ++pos) {
  70       remove.push_back(records[pos]);
  71     }
  72
  73     if (pos >= records.size()) {
  74       throw std::runtime_error("No SOA record to finish the removals part of the IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
  75     }
  76
  77     sr = getRR<SOARecordContent>(records[pos]);
  78     if (!sr) {
  79       throw std::runtime_error("Invalid SOA record to finish the removals part of the IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
  80     }
  81
  82     // this is the serial of the zone after the removals
  83     // and updates, but that might not be the final serial
  84     // because there might be several sequences
  85     uint32_t newSerial = sr->d_st.serial;
  86     add.push_back(records[pos]); // this adds the new SOA
  87
  88     // process additions
  89     for(pos++; pos < records.size() && records[pos].d_type != QType::SOA; ++pos)  {
  90       add.push_back(records[pos]);
  91     }
  92
  93     if (pos >= records.size()) {
  94       throw std::runtime_error("No SOA record to finish the additions part of the IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
  95     }
  96
  97     sr = getRR<SOARecordContent>(records[pos]);
  98     if (!sr) {
  99       throw std::runtime_error("Invalid SOA record to finish the additions part of the IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
 100     }
 101
 102     if (sr->d_st.serial != newSerial) {
 103       throw std::runtime_error("Invalid serial (" + std::to_string(sr->d_st.serial) + ", expecting " + std::to_string(newSerial) + ") in the SOA record finishing the additions part of the IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
 104     }
 105
 106     if (newSerial == masterSOA->d_st.serial) {
 107       // this was the last sequence
 108       if (pos != (records.size() - 1)) {
 109         throw std::runtime_error("Trailing records after the last IXFR sequence of zone '" + zone.toLogString() + "' from " + master.toStringWithPort());
 110       }
 111     }
 112
 113     ret.push_back(make_pair(remove,add));
 114   }
 115
 116   return ret;
 117 }
 118
 119 // Returns pairs of "remove & add" vectors. If you get an empty remove, it means you got an AXFR!
 120 vector<pair<vector<DNSRecord>, vector<DNSRecord> > > getIXFRDeltas(const ComboAddress& master, const DNSName& zone, const DNSRecord& oursr,
 121                                                                    const TSIGTriplet& tt, const ComboAddress* laddr, size_t maxReceivedBytes)
 122 {
 123   vector<pair<vector<DNSRecord>, vector<DNSRecord> > >  ret;
 124   vector<uint8_t> packet;
 125   DNSPacketWriter pw(packet, zone, QType::IXFR);
 126   pw.getHeader()->qr=0;
 127   pw.getHeader()->rd=0;
 128   pw.getHeader()->id=dns_random(0xffff);
 129   pw.startRecord(zone, QType::SOA, 0, QClass::IN, DNSResourceRecord::AUTHORITY);
 130   oursr.d_content->toPacket(pw);
 131
 132   pw.commit();
 133   TSIGRecordContent trc;
 134   TSIGTCPVerifier tsigVerifier(tt, master, trc);
 135   if(!tt.algo.empty()) {
 136     TSIGHashEnum the;
 137     getTSIGHashEnum(tt.algo, the);
 138     try {
 139       trc.d_algoName = getTSIGAlgoName(the);
 140     } catch(PDNSException& pe) {
 141       throw std::runtime_error("TSIG algorithm '"+tt.algo.toLogString()+"' is unknown.");
 142     }
 143     trc.d_time = time((time_t*)NULL);
 144     trc.d_fudge = 300;
 145     trc.d_origID=ntohs(pw.getHeader()->id);
 146     trc.d_eRcode=0;
 147     addTSIG(pw, trc, tt.name, tt.secret, "", false);
 148   }
 149   uint16_t len=htons(packet.size());
 150   string msg((const char*)&len, 2);
 151   msg.append((const char*)&packet[0], packet.size());
 152
 153   Socket s(master.sin4.sin_family, SOCK_STREAM);
 154   //  cout<<"going to connect"<<endl;
 155   if(laddr)
 156     s.bind(*laddr);
 157   s.connect(master);
 158   //  cout<<"Connected"<<endl;
 159   s.writen(msg);
 160
 161   // CURRENT MASTER SOA
 162   // REPEAT:
 163   //   SOA WHERE THIS DELTA STARTS
 164   //   RECORDS TO REMOVE
 165   //   SOA WHERE THIS DELTA GOES
 166   //   RECORDS TO ADD
 167   // CURRENT MASTER SOA
 168   std::shared_ptr<SOARecordContent> masterSOA = nullptr;
 169   vector<DNSRecord> records;
 170   size_t receivedBytes = 0;
 171   int8_t ixfrInProgress = -2;
 172   std::string reply;
 173
 174   for(;;) {
 175     // IXFR end
 176     if (ixfrInProgress >= 0)
 177       break;
 178
 179     if(s.read((char*)&len, sizeof(len)) != sizeof(len))
 180       break;
 181
 182     len=ntohs(len);
 183     //    cout<<"Got chunk of "<<len<<" bytes"<<endl;
 184     if(!len)
 185       break;
 186
 187     if (maxReceivedBytes > 0 && (maxReceivedBytes - receivedBytes) < (size_t) len)
 188       throw std::runtime_error("Reached the maximum number of received bytes in an IXFR delta for zone '"+zone.toLogString()+"' from master "+master.toStringWithPort());
 189
 190     reply.resize(len);
 191     readn2(s.getHandle(), &reply.at(0), len);
 192     receivedBytes += len;
 193
 194     MOADNSParser mdp(false, reply);
 195     if(mdp.d_header.rcode)
 196       throw std::runtime_error("Got an error trying to IXFR zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort()+"': "+RCode::to_s(mdp.d_header.rcode));
 197
 198     //    cout<<"Got a response, rcode: "<<mdp.d_header.rcode<<", got "<<mdp.d_answers.size()<<" answers"<<endl;
 199
 200     if(!tt.algo.empty()) { // TSIG verify message
 201       tsigVerifier.check(reply, mdp);
 202     }
 203
 204     for(auto& r: mdp.d_answers) {
 205       //      cout<<r.first.d_name<< " " <<r.first.d_content->getZoneRepresentation()<<endl;
 206       if(!masterSOA) {
 207         // we have not seen the first SOA record yet
 208         if (r.first.d_type != QType::SOA) {
 209           throw std::runtime_error("The first record of the IXFR answer for zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort()+"' is not a SOA ("+QType(r.first.d_type).getName()+")");
 210         }
 211
 212         auto sr = getRR<SOARecordContent>(r.first);
 213         if (!sr) {
 214           throw std::runtime_error("Error getting the content of the first SOA record of the IXFR answer for zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort()+"'");
 215         }
 216
 217         if(sr->d_st.serial == std::dynamic_pointer_cast<SOARecordContent>(oursr.d_content)->d_st.serial) {
 218           // we are up to date
 219           return ret;
 220         }
 221         masterSOA = sr;
 222       } else if (r.first.d_type == QType::SOA) {
 223         auto sr = getRR<SOARecordContent>(r.first);
 224         if (!sr) {
 225           throw std::runtime_error("Error getting the content of SOA record of IXFR answer for zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort()+"'");
 226         }
 227
 228         // we hit the last SOA record
 229         // IXFR is considered to be done if we hit the last SOA record twice
 230         if (masterSOA->d_st.serial == sr->d_st.serial) {
 231           ixfrInProgress++;
 232         }
 233       }
 234
 235       if(r.first.d_place != DNSResourceRecord::ANSWER) {
 236         if(r.first.d_type == QType::TSIG)
 237           continue;
 238
 239         if(r.first.d_type == QType::OPT)
 240           continue;
 241
 242         throw std::runtime_error("Unexpected record (" +QType(r.first.d_type).getName()+") in non-answer section ("+std::to_string(r.first.d_place)+")in IXFR response for zone '"+zone.toLogString()+"' from master '"+master.toStringWithPort());
 243       }
 244
 245       r.first.d_name.makeUsRelative(zone);
 246       records.push_back(r.first);
 247     }
 248   }
 249
 250   //  cout<<"Got "<<records.size()<<" records"<<endl;
 251
 252   return processIXFRRecords(master, zone, records, masterSOA);
 253 }