pdns/resolver.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #ifdef HAVE_CONFIG_H
  23 #include "config.h"
  24 #endif
  25 #include "utility.hh"
  26 #include "resolver.hh"
  27 #include <pthread.h>
  28 #include <semaphore.h>
  29 #include <iostream>
  30 #include <errno.h>
  31 #include "misc.hh"
  32 #include <algorithm>
  33 #include <sstream>
  34 #include "dnsrecords.hh"
  35 #include <cstring>
  36 #include <string>
  37 #include <vector>
  38 #include <boost/algorithm/string.hpp>
  39 #include "dns.hh"
  40 #include "qtype.hh"
  41
  42 #include "pdnsexception.hh"
  43 #include "arguments.hh"
  44 #include "base64.hh"
  45 #include "dnswriter.hh"
  46 #include "dnsparser.hh"
  47
  48
  49 #include "dns_random.hh"
  50 #include <poll.h>
  51 #include "gss_context.hh"
  52 #include "namespaces.hh"
  53
  54 int makeQuerySocket(const ComboAddress& local, bool udpOrTCP, bool nonLocalBind)
  55 {
  56   ComboAddress ourLocal(local);
  57
  58   int sock=socket(ourLocal.sin4.sin_family, udpOrTCP ? SOCK_DGRAM : SOCK_STREAM, 0);
  59   if(sock < 0) {
  60     if(errno == EAFNOSUPPORT && local.sin4.sin_family == AF_INET6) {
  61         return -1;
  62     }
  63     unixDie("Creating local resolver socket for "+ourLocal.toString());
  64   }
  65
  66   setCloseOnExec(sock);
  67
  68   if(nonLocalBind)
  69     Utility::setBindAny(local.sin4.sin_family, sock);
  70
  71   if(udpOrTCP) {
  72     // udp, try hard to bind an unpredictable port
  73     int tries=10;
  74     while(--tries) {
  75       ourLocal.sin4.sin_port = htons(10000+(dns_random(10000)));
  76
  77       if (::bind(sock, (struct sockaddr *)&ourLocal, ourLocal.getSocklen()) >= 0)
  78         break;
  79     }
  80     // cerr<<"bound udp port "<<ourLocal.sin4.sin_port<<", "<<tries<<" tries left"<<endl;
  81
  82     if(!tries) {
  83       closesocket(sock);
  84       throw PDNSException("Resolver binding to local UDP socket on "+ourLocal.toString()+": "+stringerror());
  85     }
  86   }
  87   else {
  88     // tcp, let the kernel figure out the port
  89     // cerr<<"letting kernel pick TCP port"<<endl;
  90     ourLocal.sin4.sin_port = 0;
  91     if(::bind(sock, (struct sockaddr *)&ourLocal, ourLocal.getSocklen()) < 0)
  92       throw PDNSException("Resolver binding to local TCP socket on "+ourLocal.toString()+": "+stringerror());
  93   }
  94   return sock;
  95 }
  96
  97 Resolver::Resolver()
  98 {
  99   locals["default4"] = -1;
 100   locals["default6"] = -1;
 101   try {
 102     locals["default4"] = makeQuerySocket(ComboAddress(::arg()["query-local-address"]), true, ::arg().mustDo("non-local-bind"));
 103     if(!::arg()["query-local-address6"].empty())
 104       locals["default6"] = makeQuerySocket(ComboAddress(::arg()["query-local-address6"]), true, ::arg().mustDo("non-local-bind"));
 105   }
 106   catch(...) {
 107     if(locals["default4"]>=0)
 108       close(locals["default4"]);
 109     throw;
 110   }
 111 }
 112
 113 Resolver::~Resolver()
 114 {
 115   for(std::map<std::string,int>::iterator iter = locals.begin(); iter != locals.end(); iter++) {
 116     if (iter->second >= 0)
 117       close(iter->second);
 118   }
 119 }
 120
 121 uint16_t Resolver::sendResolve(const ComboAddress& remote, const ComboAddress& local,
 122                                const DNSName &domain, int type, bool dnssecOK,
 123                                const DNSName& tsigkeyname, const DNSName& tsigalgorithm,
 124                                const string& tsigsecret)
 125 {
 126   uint16_t randomid;
 127   vector<uint8_t> packet;
 128   DNSPacketWriter pw(packet, domain, type);
 129   pw.getHeader()->id = randomid = dns_random(0xffff);
 130
 131   if(dnssecOK) {
 132     pw.addOpt(2800, 0, EDNSOpts::DNSSECOK);
 133     pw.commit();
 134   }
 135
 136   if(!tsigkeyname.empty()) {
 137     // cerr<<"Adding TSIG to notification, key name: '"<<tsigkeyname<<"', algo: '"<<tsigalgorithm<<"', secret: "<<Base64Encode(tsigsecret)<<endl;
 138     TSIGRecordContent trc;
 139     if (tsigalgorithm == DNSName("hmac-md5"))
 140       trc.d_algoName = tsigalgorithm + DNSName("sig-alg.reg.int");
 141     else
 142       trc.d_algoName = tsigalgorithm;
 143     trc.d_time = time(0);
 144     trc.d_fudge = 300;
 145     trc.d_origID=ntohs(randomid);
 146     trc.d_eRcode=0;
 147     addTSIG(pw, trc, tsigkeyname, tsigsecret, "", false);
 148   }
 149
 150   int sock;
 151
 152   // choose socket based on local
 153   if (local.sin4.sin_family == 0) {
 154     // up to us.
 155     sock = remote.sin4.sin_family == AF_INET ? locals["default4"] : locals["default6"];
 156   } else {
 157     std::string lstr = local.toString();
 158     std::map<std::string, int>::iterator lptr;
 159     // see if there is a local
 160
 161     if ((lptr = locals.find(lstr)) != locals.end()) {
 162       sock = lptr->second;
 163     } else {
 164       // try to make socket
 165       sock = makeQuerySocket(local, true);
 166       if (sock < 0)
 167         throw ResolverException("Unable to create socket to "+remote.toStringWithPort()+": "+stringerror());
 168       setNonBlocking( sock );
 169       locals[lstr] = sock;
 170     }
 171   }
 172
 173   if(sendto(sock, &packet[0], packet.size(), 0, (struct sockaddr*)(&remote), remote.getSocklen()) < 0) {
 174     throw ResolverException("Unable to ask query of "+remote.toStringWithPort()+": "+stringerror());
 175   }
 176   return randomid;
 177 }
 178
 179 uint16_t Resolver::sendResolve(const ComboAddress& remote, const DNSName &domain,
 180                                int type, bool dnssecOK,
 181                                const DNSName& tsigkeyname, const DNSName& tsigalgorithm,
 182                                const string& tsigsecret)
 183 {
 184   ComboAddress local;
 185   local.sin4.sin_family = 0;
 186   return this->sendResolve(remote, local, domain, type, dnssecOK, tsigkeyname, tsigalgorithm, tsigsecret);
 187 }
 188
 189 static int parseResult(MOADNSParser& mdp, const DNSName& origQname, uint16_t origQtype, uint16_t id, Resolver::res_t* result)
 190 {
 191   result->clear();
 192
 193   if(mdp.d_header.rcode)
 194     return mdp.d_header.rcode;
 195
 196   if(origQname.countLabels()) {  // not AXFR
 197     if(mdp.d_header.id != id)
 198       throw ResolverException("Remote nameserver replied with wrong id");
 199     if(mdp.d_header.qdcount != 1)
 200       throw ResolverException("resolver: received answer with wrong number of questions ("+itoa(mdp.d_header.qdcount)+")");
 201     if(mdp.d_qname != origQname)
 202       throw ResolverException(string("resolver: received an answer to another question (")+mdp.d_qname.toString()+"!="+ origQname.toString()+".)");
 203   }
 204
 205   vector<DNSResourceRecord> ret;
 206   DNSResourceRecord rr;
 207   for(MOADNSParser::answers_t::const_iterator i=mdp.d_answers.begin(); i!=mdp.d_answers.end(); ++i) {
 208     rr.qname = i->first.d_name;
 209     rr.qtype = i->first.d_type;
 210     rr.ttl = i->first.d_ttl;
 211     rr.content = i->first.d_content->getZoneRepresentation(true);
 212     result->push_back(rr);
 213   }
 214
 215   return 0;
 216 }
 217
 218 bool Resolver::tryGetSOASerial(DNSName *domain, uint32_t *theirSerial, uint32_t *theirInception, uint32_t *theirExpire, uint16_t* id)
 219 {
 220   auto fds = std::unique_ptr<struct pollfd[]>(new struct pollfd[locals.size()]);
 221   size_t i = 0, k;
 222   int sock;
 223
 224   for(std::map<string,int>::iterator iter=locals.begin(); iter != locals.end(); iter++, i++) {
 225     fds[i].fd = iter->second;
 226     fds[i].events = POLLIN;
 227   }
 228
 229   if (poll(fds.get(), i, 250) < 1) { // wait for 0.25s
 230     return false;
 231   }
 232
 233   sock = -1;
 234
 235   // determine who
 236   for(k=0;k<i;k++) {
 237     if ((fds[k].revents & POLLIN) == POLLIN) {
 238       sock = fds[k].fd;
 239       break;
 240     }
 241   }
 242
 243   if (sock < 0) return false; // false alarm
 244
 245   int err;
 246   ComboAddress fromaddr;
 247   socklen_t addrlen=fromaddr.getSocklen();
 248   char buf[3000];
 249   err = recvfrom(sock, buf, sizeof(buf), 0,(struct sockaddr*)(&fromaddr), &addrlen);
 250   if(err < 0) {
 251     if(errno == EAGAIN)
 252       return false;
 253
 254     throw ResolverException("recvfrom error waiting for answer: "+stringerror());
 255   }
 256
 257   MOADNSParser mdp(false, (char*)buf, err);
 258   *id=mdp.d_header.id;
 259   *domain = mdp.d_qname;
 260
 261   if(domain->empty())
 262     throw ResolverException("SOA query to '" + fromaddr.toStringWithPort() + "' produced response without domain name (RCode: " + RCode::to_s(mdp.d_header.rcode) + ")");
 263
 264   if(mdp.d_answers.empty())
 265     throw ResolverException("Query to '" + fromaddr.toStringWithPort() + "' for SOA of '" + domain->toString() + "' produced no results (RCode: " + RCode::to_s(mdp.d_header.rcode) + ")");
 266
 267   if(mdp.d_qtype != QType::SOA)
 268     throw ResolverException("Query to '" + fromaddr.toStringWithPort() + "' for SOA of '" + domain->toString() + "' returned wrong record type");
 269
 270   *theirInception = *theirExpire = 0;
 271   bool gotSOA=false;
 272   for(const MOADNSParser::answers_t::value_type& drc :  mdp.d_answers) {
 273     if(drc.first.d_type == QType::SOA) {
 274       shared_ptr<SOARecordContent> src=getRR<SOARecordContent>(drc.first);
 275       if (src) {
 276         *theirSerial=src->d_st.serial;
 277         gotSOA = true;
 278       }
 279     }
 280     if(drc.first.d_type == QType::RRSIG) {
 281       shared_ptr<RRSIGRecordContent> rrc=getRR<RRSIGRecordContent>(drc.first);
 282       if(rrc && rrc->d_type == QType::SOA) {
 283         *theirInception= std::max(*theirInception, rrc->d_siginception);
 284         *theirExpire = std::max(*theirExpire, rrc->d_sigexpire);
 285       }
 286     }
 287   }
 288   if(!gotSOA)
 289     throw ResolverException("Query to '" + fromaddr.toString() + "' for SOA of '" + domain->toString() + "' did not return a SOA");
 290   return true;
 291 }
 292
 293 int Resolver::resolve(const string &ipport, const DNSName &domain, int type, Resolver::res_t* res, const ComboAddress &local)
 294 {
 295   try {
 296     ComboAddress to(ipport, 53);
 297
 298     int id = sendResolve(to, local, domain, type);
 299     int sock;
 300
 301     // choose socket based on local
 302     if (local.sin4.sin_family == 0) {
 303       // up to us.
 304       sock = to.sin4.sin_family == AF_INET ? locals["default4"] : locals["default6"];
 305     } else {
 306       std::string lstr = local.toString();
 307       std::map<std::string, int>::iterator lptr;
 308       // see if there is a local
 309
 310       if ((lptr = locals.find(lstr)) != locals.end()) sock = lptr->second;
 311       else throw ResolverException("sendResolve did not create socket for " + lstr);
 312     }
 313
 314     int err=waitForData(sock, 0, 3000000);
 315
 316     if(!err) {
 317       throw ResolverException("Timeout waiting for answer");
 318     }
 319     if(err < 0)
 320       throw ResolverException("Error waiting for answer: "+stringerror());
 321
 322     ComboAddress from;
 323     socklen_t addrlen = sizeof(from);
 324     char buffer[3000];
 325     int len;
 326
 327     if((len=recvfrom(sock, buffer, sizeof(buffer), 0,(struct sockaddr*)(&from), &addrlen)) < 0)
 328       throw ResolverException("recvfrom error waiting for answer: "+stringerror());
 329
 330     MOADNSParser mdp(false, buffer, len);
 331     return parseResult(mdp, domain, type, id, res);
 332   }
 333   catch(ResolverException &re) {
 334     throw ResolverException(re.reason+" from "+ipport);
 335   }
 336   return -1;
 337 }
 338
 339 int Resolver::resolve(const string &ipport, const DNSName &domain, int type, Resolver::res_t* res) {
 340   ComboAddress local;
 341   local.sin4.sin_family = 0;
 342   return resolve(ipport, domain, type, res, local);
 343 }
 344
 345 void Resolver::getSoaSerial(const string &ipport, const DNSName &domain, uint32_t *serial)
 346 {
 347   vector<DNSResourceRecord> res;
 348   int ret = resolve(ipport, domain, QType::SOA, &res);
 349
 350   if(ret || res.empty())
 351     throw ResolverException("Query to '" + ipport + "' for SOA of '" + domain.toString() + "' produced no answers");
 352
 353   if(res[0].qtype.getCode() != QType::SOA)
 354     throw ResolverException("Query to '" + ipport + "' for SOA of '" + domain.toString() + "' produced a "+res[0].qtype.getName()+" record");
 355
 356   vector<string>parts;
 357   stringtok(parts, res[0].content);
 358   if(parts.size()<3)
 359     throw ResolverException("Query to '" + ipport + "' for SOA of '" + domain.toString() + "' produced an unparseable response");
 360
 361   try {
 362     *serial=pdns_stou(parts[2]);
 363   }
 364   catch(const std::out_of_range& oor) {
 365     throw ResolverException("Query to '" + ipport + "' for SOA of '" + domain.toString() + "' produced an unparseable serial");
 366   }
 367 }
 368
 369 AXFRRetriever::AXFRRetriever(const ComboAddress& remote,
 370                              const DNSName& domain,
 371                              const TSIGTriplet& tt,
 372                              const ComboAddress* laddr,
 373                              size_t maxReceivedBytes,
 374                              uint16_t timeout)
 375   : d_tsigVerifier(tt, remote, d_trc), d_receivedBytes(0), d_maxReceivedBytes(maxReceivedBytes)
 376 {
 377   ComboAddress local;
 378   if (laddr != NULL) {
 379     local = (ComboAddress) (*laddr);
 380   } else {
 381     if(remote.sin4.sin_family == AF_INET)
 382       local=ComboAddress(::arg()["query-local-address"]);
 383     else if(!::arg()["query-local-address6"].empty())
 384       local=ComboAddress(::arg()["query-local-address6"]);
 385     else
 386       local=ComboAddress("::");
 387   }
 388   d_sock = -1;
 389   try {
 390     d_sock = makeQuerySocket(local, false); // make a TCP socket
 391     if (d_sock < 0)
 392       throw ResolverException("Error creating socket for AXFR request to "+d_remote.toStringWithPort());
 393     d_buf = shared_array<char>(new char[65536]);
 394     d_remote = remote; // mostly for error reporting
 395     this->connect(timeout);
 396     d_soacount = 0;
 397
 398     vector<uint8_t> packet;
 399     DNSPacketWriter pw(packet, domain, QType::AXFR);
 400     pw.getHeader()->id = dns_random(0xffff);
 401
 402     if(!tt.name.empty()) {
 403       if (tt.algo == DNSName("hmac-md5"))
 404         d_trc.d_algoName = tt.algo + DNSName("sig-alg.reg.int");
 405       else
 406         d_trc.d_algoName = tt.algo;
 407       d_trc.d_time = time(0);
 408       d_trc.d_fudge = 300;
 409       d_trc.d_origID=ntohs(pw.getHeader()->id);
 410       d_trc.d_eRcode=0;
 411       addTSIG(pw, d_trc, tt.name, tt.secret, "", false);
 412     }
 413
 414     uint16_t replen=htons(packet.size());
 415     Utility::iovec iov[2];
 416     iov[0].iov_base=reinterpret_cast<char*>(&replen);
 417     iov[0].iov_len=2;
 418     iov[1].iov_base=packet.data();
 419     iov[1].iov_len=packet.size();
 420
 421     int ret=Utility::writev(d_sock, iov, 2);
 422     if(ret < 0)
 423       throw ResolverException("Error sending question to "+d_remote.toStringWithPort()+": "+stringerror());
 424     if(ret != (int)(2+packet.size())) {
 425       throw ResolverException("Partial write on AXFR request to "+d_remote.toStringWithPort());
 426     }
 427
 428     int res = waitForData(d_sock, timeout, 0);
 429
 430     if(!res)
 431       throw ResolverException("Timeout waiting for answer from "+d_remote.toStringWithPort()+" during AXFR");
 432     if(res<0)
 433       throw ResolverException("Error waiting for answer from "+d_remote.toStringWithPort()+": "+stringerror());
 434   }
 435   catch(...) {
 436     if(d_sock >= 0)
 437       close(d_sock);
 438     d_sock = -1;
 439     throw;
 440   }
 441 }
 442
 443 AXFRRetriever::~AXFRRetriever()
 444 {
 445   close(d_sock);
 446 }
 447
 448
 449
 450 int AXFRRetriever::getChunk(Resolver::res_t &res, vector<DNSRecord>* records, uint16_t timeout) // Implementation is making sure RFC2845 4.4 is followed.
 451 {
 452   if(d_soacount > 1)
 453     return false;
 454
 455   // d_sock is connected and is about to spit out a packet
 456   int len=getLength(timeout);
 457   if(len<0)
 458     throw ResolverException("EOF trying to read axfr chunk from remote TCP client");
 459
 460   if (d_maxReceivedBytes > 0 && (d_maxReceivedBytes - d_receivedBytes) < (size_t) len)
 461     throw ResolverException("Reached the maximum number of received bytes during AXFR");
 462
 463   timeoutReadn(len, timeout);
 464
 465   d_receivedBytes += (uint16_t) len;
 466
 467   MOADNSParser mdp(false, d_buf.get(), len);
 468
 469   int err;
 470   if(!records)
 471     err=parseResult(mdp, DNSName(), 0, 0, &res);
 472   else {
 473     records->clear();
 474     for(const auto& r: mdp.d_answers)
 475       records->push_back(r.first);
 476     err = mdp.d_header.rcode;
 477   }
 478
 479   if(err)
 480     throw ResolverException("AXFR chunk error: " + RCode::to_s(err));
 481
 482   for(const MOADNSParser::answers_t::value_type& answer :  mdp.d_answers)
 483     if (answer.first.d_type == QType::SOA)
 484       d_soacount++;
 485
 486   try {
 487     d_tsigVerifier.check(std::string(d_buf.get(), len), mdp);
 488   }
 489   catch(const std::runtime_error& re) {
 490     throw ResolverException(re.what());
 491   }
 492
 493   return true;
 494 }
 495
 496 void AXFRRetriever::timeoutReadn(uint16_t bytes, uint16_t timeoutsec)
 497 {
 498   time_t start=time(nullptr);
 499   int n=0;
 500   int numread;
 501   while(n<bytes) {
 502     int res=waitForData(d_sock, timeoutsec-(time(nullptr)-start));
 503     if(res<0)
 504       throw ResolverException("Reading data from remote nameserver over TCP: "+stringerror());
 505     if(!res)
 506       throw ResolverException("Timeout while reading data from remote nameserver over TCP");
 507
 508     numread=recv(d_sock, d_buf.get()+n, bytes-n, 0);
 509     if(numread<0)
 510       throw ResolverException("Reading data from remote nameserver over TCP: "+stringerror());
 511     if(numread==0)
 512       throw ResolverException("Remote nameserver closed TCP connection");
 513     n+=numread;
 514   }
 515 }
 516
 517 void AXFRRetriever::connect(uint16_t timeout)
 518 {
 519   setNonBlocking( d_sock );
 520
 521   int err;
 522
 523   if((err=::connect(d_sock,(struct sockaddr*)&d_remote, d_remote.getSocklen()))<0 && errno!=EINPROGRESS) {
 524     try {
 525       closesocket(d_sock);
 526     }
 527     catch(const PDNSException& e) {
 528       d_sock=-1;
 529       throw ResolverException("Error closing AXFR socket after connect() failed: "+e.reason);
 530     }
 531
 532     throw ResolverException("connect: "+stringerror());
 533   }
 534
 535   if(!err)
 536     goto done;
 537
 538   err=waitForRWData(d_sock, false, timeout, 0); // wait for writeability
 539
 540   if(!err) {
 541     try {
 542       closesocket(d_sock); // timeout
 543     }
 544     catch(const PDNSException& e) {
 545       d_sock=-1;
 546       throw ResolverException("Error closing AXFR socket after timeout: "+e.reason);
 547     }
 548
 549     d_sock=-1;
 550     errno=ETIMEDOUT;
 551
 552     throw ResolverException("Timeout connecting to server");
 553   }
 554   else if(err < 0) {
 555     throw ResolverException("Error connecting: "+string(strerror(errno)));
 556   }
 557   else {
 558     Utility::socklen_t len=sizeof(err);
 559     if(getsockopt(d_sock, SOL_SOCKET,SO_ERROR,(char *)&err,&len)<0)
 560       throw ResolverException("Error connecting: "+stringerror()); // Solaris
 561
 562     if(err)
 563       throw ResolverException("Error connecting: "+string(strerror(err)));
 564   }
 565
 566  done:
 567   setBlocking( d_sock );
 568   // d_sock now connected
 569 }
 570
 571 int AXFRRetriever::getLength(uint16_t timeout)
 572 {
 573   timeoutReadn(2, timeout);
 574   return (unsigned char)d_buf[0]*256+(unsigned char)d_buf[1];
 575 }
 576