2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 #include "arguments.hh"
27 #include "cachecleaner.hh"
28 #include "dns_random.hh"
29 #include "dnsparser.hh"
30 #include "dnsrecords.hh"
31 #include "ednssubnet.hh"
33 #include "lua-recursor4.hh"
34 #include "rec-lua-conf.hh"
36 #include "validate-recursor.hh"
38 thread_local
SyncRes::ThreadLocalStorage
SyncRes::t_sstorage
;
40 std::unordered_set
<DNSName
> SyncRes::s_delegationOnly
;
41 std::unique_ptr
<NetmaskGroup
> SyncRes::s_dontQuery
{nullptr};
42 NetmaskGroup
SyncRes::s_ednssubnets
;
43 SuffixMatchNode
SyncRes::s_ednsdomains
;
44 string
SyncRes::s_serverID
;
45 SyncRes::LogMode
SyncRes::s_lm
;
47 unsigned int SyncRes::s_maxnegttl
;
48 unsigned int SyncRes::s_maxcachettl
;
49 unsigned int SyncRes::s_maxqperq
;
50 unsigned int SyncRes::s_maxtotusec
;
51 unsigned int SyncRes::s_maxdepth
;
52 unsigned int SyncRes::s_minimumTTL
;
53 unsigned int SyncRes::s_packetcachettl
;
54 unsigned int SyncRes::s_packetcacheservfailttl
;
55 unsigned int SyncRes::s_serverdownmaxfails
;
56 unsigned int SyncRes::s_serverdownthrottletime
;
57 std::atomic
<uint64_t> SyncRes::s_queries
;
58 std::atomic
<uint64_t> SyncRes::s_outgoingtimeouts
;
59 std::atomic
<uint64_t> SyncRes::s_outgoing4timeouts
;
60 std::atomic
<uint64_t> SyncRes::s_outgoing6timeouts
;
61 std::atomic
<uint64_t> SyncRes::s_outqueries
;
62 std::atomic
<uint64_t> SyncRes::s_tcpoutqueries
;
63 std::atomic
<uint64_t> SyncRes::s_throttledqueries
;
64 std::atomic
<uint64_t> SyncRes::s_dontqueries
;
65 std::atomic
<uint64_t> SyncRes::s_nodelegated
;
66 std::atomic
<uint64_t> SyncRes::s_unreachables
;
67 uint8_t SyncRes::s_ecsipv4limit
;
68 uint8_t SyncRes::s_ecsipv6limit
;
69 bool SyncRes::s_doIPv6
;
70 bool SyncRes::s_nopacketcache
;
71 bool SyncRes::s_rootNXTrust
;
72 bool SyncRes::s_noEDNS
;
74 #define LOG(x) if(d_lm == Log) { L <<Logger::Warning << x; } else if(d_lm == Store) { d_trace << x; }
76 static void accountAuthLatency(int usec
, int family
)
78 if(family
== AF_INET
) {
80 g_stats
.auth4Answers0_1
++;
82 g_stats
.auth4Answers1_10
++;
83 else if(usec
< 100000)
84 g_stats
.auth4Answers10_100
++;
85 else if(usec
< 1000000)
86 g_stats
.auth4Answers100_1000
++;
88 g_stats
.auth4AnswersSlow
++;
91 g_stats
.auth6Answers0_1
++;
93 g_stats
.auth6Answers1_10
++;
94 else if(usec
< 100000)
95 g_stats
.auth6Answers10_100
++;
96 else if(usec
< 1000000)
97 g_stats
.auth6Answers100_1000
++;
99 g_stats
.auth6AnswersSlow
++;
105 SyncRes::SyncRes(const struct timeval
& now
) : d_outqueries(0), d_tcpoutqueries(0), d_throttledqueries(0), d_timeouts(0), d_unreachables(0),
106 d_totUsec(0), d_now(now
),
107 d_cacheonly(false), d_doDNSSEC(false), d_doEDNS0(false), d_lm(s_lm
)
112 /** everything begins here - this is the entry point just after receiving a packet */
113 int SyncRes::beginResolve(const DNSName
&qname
, const QType
&qtype
, uint16_t qclass
, vector
<DNSRecord
>&ret
)
115 vState state
= Indeterminate
;
118 d_wasOutOfBand
=false;
120 if (doSpecialNamesResolve(qname
, qtype
, qclass
, ret
)) {
121 d_queryValidationState
= Secure
;
125 if( (qtype
.getCode() == QType::AXFR
) || (qtype
.getCode() == QType::IXFR
))
128 if(qclass
==QClass::ANY
)
130 else if(qclass
!=QClass::IN
)
133 set
<GetBestNSAnswer
> beenthere
;
134 int res
=doResolve(qname
, qtype
, ret
, 0, beenthere
, state
);
135 d_queryValidationState
= state
;
139 /*! Handles all special, built-in names
140 * Fills ret with an answer and returns true if it handled the query.
142 * Handles the following queries (and their ANY variants):
145 * - localhost. IN AAAA
146 * - 1.0.0.127.in-addr.arpa. IN PTR
147 * - 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. IN PTR
148 * - version.bind. CH TXT
149 * - version.pdns. CH TXT
150 * - id.server. CH TXT
152 bool SyncRes::doSpecialNamesResolve(const DNSName
&qname
, const QType
&qtype
, const uint16_t qclass
, vector
<DNSRecord
> &ret
)
154 static const DNSName
arpa("1.0.0.127.in-addr.arpa."), ip6_arpa("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa."),
155 localhost("localhost."), versionbind("version.bind."), idserver("id.server."), versionpdns("version.pdns.");
157 bool handled
= false;
158 vector
<pair
<QType::typeenum
, string
> > answers
;
160 if ((qname
== arpa
|| qname
== ip6_arpa
) &&
161 qclass
== QClass::IN
) {
163 if (qtype
== QType::PTR
|| qtype
== QType::ANY
)
164 answers
.push_back({QType::PTR
, "localhost."});
167 if (qname
== localhost
&&
168 qclass
== QClass::IN
) {
170 if (qtype
== QType::A
|| qtype
== QType::ANY
)
171 answers
.push_back({QType::A
, "127.0.0.1"});
172 if (qtype
== QType::AAAA
|| qtype
== QType::ANY
)
173 answers
.push_back({QType::AAAA
, "::1"});
176 if ((qname
== versionbind
|| qname
== idserver
|| qname
== versionpdns
) &&
177 qclass
== QClass::CHAOS
) {
179 if (qtype
== QType::TXT
|| qtype
== QType::ANY
) {
180 if(qname
== versionbind
|| qname
== versionpdns
)
181 answers
.push_back({QType::TXT
, "\""+::arg()["version-string"]+"\""});
183 answers
.push_back({QType::TXT
, "\""+s_serverID
+"\""});
187 if (handled
&& !answers
.empty()) {
193 dr
.d_place
= DNSResourceRecord::ANSWER
;
196 for (const auto& ans
: answers
) {
197 dr
.d_type
= ans
.first
;
198 dr
.d_content
= DNSRecordContent::mastermake(ans
.first
, qclass
, ans
.second
);
207 //! This is the 'out of band resolver', in other words, the authoritative server
208 void SyncRes::AuthDomain::addSOA(std::vector
<DNSRecord
>& records
) const
210 SyncRes::AuthDomain::records_t::const_iterator ziter
= d_records
.find(boost::make_tuple(getName(), QType::SOA
));
211 if (ziter
!= d_records
.end()) {
212 DNSRecord dr
= *ziter
;
213 dr
.d_place
= DNSResourceRecord::AUTHORITY
;
214 records
.push_back(dr
);
217 // cerr<<qname<<": can't find SOA record '"<<getName()<<"' in our zone!"<<endl;
221 int SyncRes::AuthDomain::getRecords(const DNSName
& qname
, uint16_t qtype
, std::vector
<DNSRecord
>& records
) const
223 int result
= RCode::NoError
;
227 std::pair
<records_t::const_iterator
,records_t::const_iterator
> range
= d_records
.equal_range(tie(qname
));
229 SyncRes::AuthDomain::records_t::const_iterator ziter
;
230 bool somedata
= false;
232 for(ziter
= range
.first
; ziter
!= range
.second
; ++ziter
) {
235 if(qtype
== QType::ANY
|| ziter
->d_type
== qtype
|| ziter
->d_type
== QType::CNAME
) {
236 // let rest of nameserver do the legwork on this one
237 records
.push_back(*ziter
);
239 else if (ziter
->d_type
== QType::NS
&& ziter
->d_name
.countLabels() > getName().countLabels()) {
240 // we hit a delegation point!
241 DNSRecord dr
= *ziter
;
242 dr
.d_place
=DNSResourceRecord::AUTHORITY
;
243 records
.push_back(dr
);
247 if (!records
.empty()) {
248 /* We have found an exact match, we're done */
249 // cerr<<qname<<": exact match in zone '"<<getName()<<"'"<<endl;
254 /* We have records for that name, but not of the wanted qtype */
255 // cerr<<qname<<": found record in '"<<getName()<<"', but nothing of the right type, sending SOA"<<endl;
261 // cerr<<qname<<": nothing found so far in '"<<getName()<<"', trying wildcards"<<endl;
262 DNSName
wcarddomain(qname
);
263 while(wcarddomain
!= getName() && wcarddomain
.chopOff()) {
264 // cerr<<qname<<": trying '*."<<wcarddomain<<"' in "<<getName()<<endl;
265 range
= d_records
.equal_range(boost::make_tuple(g_wildcarddnsname
+ wcarddomain
));
266 if (range
.first
==range
.second
)
269 for(ziter
= range
.first
; ziter
!= range
.second
; ++ziter
) {
270 DNSRecord dr
= *ziter
;
271 // if we hit a CNAME, just answer that - rest of recursor will do the needful & follow
272 if(dr
.d_type
== qtype
|| qtype
== QType::ANY
|| dr
.d_type
== QType::CNAME
) {
274 dr
.d_place
= DNSResourceRecord::ANSWER
;
275 records
.push_back(dr
);
279 if (records
.empty()) {
283 // cerr<<qname<<": in '"<<getName()<<"', had wildcard match on '*."<<wcarddomain<<"'"<<endl;
287 /* Nothing for this name, no wildcard, let's see if there is some NS */
288 DNSName
nsdomain(qname
);
289 while (nsdomain
.chopOff() && nsdomain
!= getName()) {
290 range
= d_records
.equal_range(boost::make_tuple(nsdomain
,QType::NS
));
291 if(range
.first
== range
.second
)
294 for(ziter
= range
.first
; ziter
!= range
.second
; ++ziter
) {
295 DNSRecord dr
= *ziter
;
296 dr
.d_place
= DNSResourceRecord::AUTHORITY
;
297 records
.push_back(dr
);
301 if(records
.empty()) {
302 // cerr<<qname<<": no NS match in zone '"<<getName()<<"' either, handing out SOA"<<endl;
304 result
= RCode::NXDomain
;
310 bool SyncRes::doOOBResolve(const AuthDomain
& domain
, const DNSName
&qname
, const QType
&qtype
, vector
<DNSRecord
>&ret
, int& res
) const
312 res
= domain
.getRecords(qname
, qtype
.getCode(), ret
);
316 bool SyncRes::doOOBResolve(const DNSName
&qname
, const QType
&qtype
, vector
<DNSRecord
>&ret
, unsigned int depth
, int& res
)
321 prefix
.append(depth
, ' ');
324 DNSName
authdomain(qname
);
325 domainmap_t::const_iterator iter
=getBestAuthZone(&authdomain
);
326 if(iter
==t_sstorage
.domainmap
->end() || !iter
->second
.isAuth()) {
327 LOG(prefix
<<qname
<<": auth storage has no zone for this query!"<<endl
);
331 LOG(prefix
<<qname
<<": auth storage has data, zone='"<<authdomain
<<"'"<<endl
);
332 return doOOBResolve(iter
->second
, qname
, qtype
, ret
, res
);
335 void SyncRes::doEDNSDumpAndClose(int fd
)
337 FILE* fp
=fdopen(fd
, "w");
341 fprintf(fp
,"IP Address\tMode\tMode last updated at\n");
342 for(const auto& eds
: t_sstorage
.ednsstatus
) {
343 fprintf(fp
, "%s\t%d\t%s", eds
.first
.toString().c_str(), (int)eds
.second
.mode
, ctime(&eds
.second
.modeSetAt
));
349 uint64_t SyncRes::doDumpNSSpeeds(int fd
)
351 FILE* fp
=fdopen(dup(fd
), "w");
354 fprintf(fp
, "; nsspeed dump from thread follows\n;\n");
357 for(const auto& i
: t_sstorage
.nsSpeeds
)
360 fprintf(fp
, "%s -> ", i
.first
.toString().c_str());
361 for(const auto& j
: i
.second
.d_collection
)
363 // typedef vector<pair<ComboAddress, DecayingEwma> > collection_t;
364 fprintf(fp
, "%s/%f ", j
.first
.toString().c_str(), j
.second
.peek());
372 /* so here is the story. First we complete the full resolution process for a domain name. And only THEN do we decide
373 to also do DNSSEC validation, which leads to new queries. To make this simple, we *always* ask for DNSSEC records
374 so that if there are RRSIGs for a name, we'll have them.
376 However, some hosts simply can't answer questions which ask for DNSSEC. This can manifest itself as:
381 The cause of "No answer" may be fragmentation, and it is tempting to probe if smaller answers would get through.
382 Another cause of "No answer" may simply be a network condition.
383 Nonsense answers are a clearer indication this host won't be able to do DNSSEC evah.
385 Previous implementations have suffered from turning off DNSSEC questions for an authoritative server based on timeouts.
386 A clever idea is to only turn off DNSSEC if we know a domain isn't signed anyhow. The problem with that really
387 clever idea however is that at this point in PowerDNS, we may simply not know that yet. All the DNSSEC thinking happens
388 elsewhere. It may not have happened yet.
390 For now this means we can't be clever, but will turn off DNSSEC if you reply with FormError or gibberish.
393 int SyncRes::asyncresolveWrapper(const ComboAddress
& ip
, bool ednsMANDATORY
, const DNSName
& domain
, int type
, bool doTCP
, bool sendRDQuery
, struct timeval
* now
, boost::optional
<Netmask
>& srcmask
, LWResult
* res
) const
395 /* what is your QUEST?
396 the goal is to get as many remotes as possible on the highest level of EDNS support
399 0) UNKNOWN Unknown state
400 1) EDNS: Honors EDNS0
401 2) EDNSIGNORANT: Ignores EDNS0, gives replies without EDNS0
402 3) NOEDNS: Generates FORMERR/NOTIMP on EDNS queries
404 Everybody starts out assumed to be '0'.
405 If '0', send out EDNS0
406 If you FORMERR us, go to '3',
407 If no EDNS in response, go to '2'
408 If '1', send out EDNS0
409 If FORMERR, downgrade to 3
410 If '2', keep on including EDNS0, see what happens
412 If '3', send bare queries
415 SyncRes::EDNSStatus
* ednsstatus
;
416 ednsstatus
= &t_sstorage
.ednsstatus
[ip
]; // does this include port? YES
418 if(ednsstatus
->modeSetAt
&& ednsstatus
->modeSetAt
+ 3600 < d_now
.tv_sec
) {
419 *ednsstatus
=SyncRes::EDNSStatus();
420 // cerr<<"Resetting EDNS Status for "<<ip.toString()<<endl);
423 SyncRes::EDNSStatus::EDNSMode
& mode
=ednsstatus
->mode
;
424 SyncRes::EDNSStatus::EDNSMode oldmode
= mode
;
426 auto luaconfsLocal
= g_luaconfs
.getLocal();
429 ctx
.d_initialRequestId
= d_initialRequestId
;
433 for(int tries
= 0; tries
< 3; ++tries
) {
434 // cerr<<"Remote '"<<ip.toString()<<"' currently in mode "<<mode<<endl;
436 if(mode
==EDNSStatus::NOEDNS
) {
437 g_stats
.noEdnsOutQueries
++;
438 EDNSLevel
= 0; // level != mode
440 else if(ednsMANDATORY
|| mode
==EDNSStatus::UNKNOWN
|| mode
==EDNSStatus::EDNSOK
|| mode
==EDNSStatus::EDNSIGNORANT
)
443 if (d_asyncResolve
) {
444 ret
= d_asyncResolve(ip
, domain
, type
, doTCP
, sendRDQuery
, EDNSLevel
, now
, srcmask
, ctx
, luaconfsLocal
->outgoingProtobufServer
, res
);
447 ret
=asyncresolve(ip
, domain
, type
, doTCP
, sendRDQuery
, EDNSLevel
, now
, srcmask
, ctx
, luaconfsLocal
->outgoingProtobufServer
, res
);
450 return ret
; // transport error, nothing to learn here
453 if(ret
== 0) { // timeout, not doing anything with it now
456 else if(mode
==EDNSStatus::UNKNOWN
|| mode
==EDNSStatus::EDNSOK
|| mode
== EDNSStatus::EDNSIGNORANT
) {
457 if(res
->d_rcode
== RCode::FormErr
|| res
->d_rcode
== RCode::NotImp
) {
458 // cerr<<"Downgrading to NOEDNS because of "<<RCode::to_s(res->d_rcode)<<" for query to "<<ip.toString()<<" for '"<<domain<<"'"<<endl;
459 mode
= EDNSStatus::NOEDNS
;
462 else if(!res
->d_haveEDNS
) {
463 if(mode
!= EDNSStatus::EDNSIGNORANT
) {
464 mode
= EDNSStatus::EDNSIGNORANT
;
465 // cerr<<"We find that "<<ip.toString()<<" is an EDNS-ignorer for '"<<domain<<"', moving to mode 3"<<endl;
469 mode
= EDNSStatus::EDNSOK
;
470 // cerr<<"We find that "<<ip.toString()<<" is EDNS OK!"<<endl;
474 if(oldmode
!= mode
|| !ednsstatus
->modeSetAt
)
475 ednsstatus
->modeSetAt
=d_now
.tv_sec
;
476 // cerr<<"Result: ret="<<ret<<", EDNS-level: "<<EDNSLevel<<", haveEDNS: "<<res->d_haveEDNS<<", new mode: "<<mode<<endl;
482 /*! This function will check the cache and go out to the internet if the answer is not in cache
484 * \param qname The name we need an answer for
486 * \param ret The vector of DNSRecords we need to fill with the answers
487 * \param depth The recursion depth we are in
489 * \return DNS RCODE or -1 (Error) or -2 (RPZ hit)
491 int SyncRes::doResolve(const DNSName
&qname
, const QType
&qtype
, vector
<DNSRecord
>&ret
, unsigned int depth
, set
<GetBestNSAnswer
>& beenthere
, vState
& state
)
496 prefix
.append(depth
, ' ');
499 LOG(prefix
<<qname
<<": Wants "<< (d_doDNSSEC
? "" : "NO ") << "DNSSEC processing, "<<(d_requireAuthData
? "" : "NO ")<<"auth data in query for "<<qtype
.getName()<<endl
);
501 state
= Indeterminate
;
503 if(s_maxdepth
&& depth
> s_maxdepth
)
504 throw ImmediateServFailException("More than "+std::to_string(s_maxdepth
)+" (max-recursion-depth) levels of recursion needed while resolving "+qname
.toLogString());
508 // This is a difficult way of expressing "this is a normal query", i.e. not getRootNS.
509 if(!(d_updatingRootNS
&& qtype
.getCode()==QType::NS
&& qname
.isRoot())) {
510 if(d_cacheonly
) { // very limited OOB support
512 LOG(prefix
<<qname
<<": Recursion not requested for '"<<qname
<<"|"<<qtype
.getName()<<"', peeking at auth/forward zones"<<endl
);
513 DNSName
authname(qname
);
514 domainmap_t::const_iterator iter
=getBestAuthZone(&authname
);
515 if(iter
!= t_sstorage
.domainmap
->end()) {
516 if(iter
->second
.isAuth()) {
518 d_wasOutOfBand
= doOOBResolve(qname
, qtype
, ret
, depth
, res
);
522 const vector
<ComboAddress
>& servers
= iter
->second
.d_servers
;
523 const ComboAddress remoteIP
= servers
.front();
524 LOG(prefix
<<qname
<<": forwarding query to hardcoded nameserver '"<< remoteIP
.toStringWithPort()<<"' for zone '"<<authname
<<"'"<<endl
);
526 boost::optional
<Netmask
> nm
;
527 res
=asyncresolveWrapper(remoteIP
, d_doDNSSEC
, qname
, qtype
.getCode(), false, false, &d_now
, nm
, &lwr
);
528 // filter out the good stuff from lwr.result()
530 for(const auto& rec
: lwr
.d_records
) {
531 if(rec
.d_place
== DNSResourceRecord::ANSWER
)
537 return RCode::ServFail
;
543 if(!d_skipCNAMECheck
&& doCNAMECacheCheck(qname
,qtype
,ret
,depth
,res
,state
)) // will reroute us if needed
546 if(doCacheCheck(qname
,qtype
,ret
,depth
,res
,state
)) // we done
553 LOG(prefix
<<qname
<<": No cache hit for '"<<qname
<<"|"<<qtype
.getName()<<"', trying to find an appropriate NS record"<<endl
);
555 DNSName
subdomain(qname
);
556 if(qtype
== QType::DS
) subdomain
.chopOff();
559 bool flawedNSSet
=false;
561 const SyncRes::zonesStates_t cuts
= computeZoneCuts(qname
, g_rootdnsname
, depth
);
563 // the two retries allow getBestNSNamesFromCache&co to reprime the root
564 // hints, in case they ever go missing
565 for(int tries
=0;tries
<2 && nsset
.empty();++tries
) {
566 subdomain
=getBestNSNamesFromCache(subdomain
, qtype
, nsset
, &flawedNSSet
, depth
, beenthere
); // pass beenthere to both occasions
569 state
= getValidationStatus(cuts
, subdomain
);
571 LOG("Initial validation status for "<<qname
<<" inherited from "<<subdomain
<<" is "<<vStates
[state
]<<endl
);
573 if(!(res
=doResolveAt(nsset
, subdomain
, flawedNSSet
, qname
, qtype
, ret
, depth
, beenthere
, state
, cuts
)))
576 LOG(prefix
<<qname
<<": failed (res="<<res
<<")"<<endl
);
581 return res
<0 ? RCode::ServFail
: res
;
585 // for testing purposes
586 static bool ipv6First(const ComboAddress
& a
, const ComboAddress
& b
)
588 return !(a
.sin4
.sin_family
< a
.sin4
.sin_family
);
592 /** This function explicitly goes out for A or AAAA addresses
594 vector
<ComboAddress
> SyncRes::getAddrs(const DNSName
&qname
, unsigned int depth
, set
<GetBestNSAnswer
>& beenthere
)
596 typedef vector
<DNSRecord
> res_t
;
599 typedef vector
<ComboAddress
> ret_t
;
603 bool oldRequireAuthData
= d_requireAuthData
;
604 d_requireAuthData
= false;
606 for(int j
=1; j
<2+s_doIPv6
; j
++)
621 vState newState
= Indeterminate
;
622 if(!doResolve(qname
, type
, res
,depth
+1, beenthere
, newState
) && !res
.empty()) { // this consults cache, OR goes out
623 for(res_t::const_iterator i
=res
.begin(); i
!= res
.end(); ++i
) {
624 if(i
->d_type
== QType::A
|| i
->d_type
== QType::AAAA
) {
625 if(auto rec
= std::dynamic_pointer_cast
<ARecordContent
>(i
->d_content
))
626 ret
.push_back(rec
->getCA(53));
627 else if(auto aaaarec
= std::dynamic_pointer_cast
<AAAARecordContent
>(i
->d_content
))
628 ret
.push_back(aaaarec
->getCA(53));
634 if(j
==1 && s_doIPv6
) { // we got an A record, see if we have some AAAA lying around
635 vector
<DNSRecord
> cset
;
636 if(t_RC
->get(d_now
.tv_sec
, qname
, QType(QType::AAAA
), false, &cset
, d_requestor
) > 0) {
637 for(auto k
=cset
.cbegin();k
!=cset
.cend();++k
) {
638 if(k
->d_ttl
> (unsigned int)d_now
.tv_sec
) {
639 if (auto drc
= std::dynamic_pointer_cast
<AAAARecordContent
>(k
->d_content
)) {
640 ComboAddress ca
=drc
->getCA(53);
651 d_requireAuthData
= oldRequireAuthData
;
654 random_shuffle(ret
.begin(), ret
.end(), dns_random
);
656 // move 'best' address for this nameserver name up front
657 nsspeeds_t::iterator best
= t_sstorage
.nsSpeeds
.find(qname
);
659 if(best
!= t_sstorage
.nsSpeeds
.end())
660 for(ret_t::iterator i
=ret
.begin(); i
!= ret
.end(); ++i
) {
661 if(*i
==best
->second
.d_best
) { // got the fastest one
664 *ret
.begin()=best
->second
.d_best
;
674 void SyncRes::getBestNSFromCache(const DNSName
&qname
, const QType
& qtype
, vector
<DNSRecord
>& bestns
, bool* flawedNSSet
, unsigned int depth
, set
<GetBestNSAnswer
>& beenthere
)
677 DNSName
subdomain(qname
);
680 prefix
.append(depth
, ' ');
686 LOG(prefix
<<qname
<<": Checking if we have NS in cache for '"<<subdomain
<<"'"<<endl
);
687 vector
<DNSRecord
> ns
;
688 *flawedNSSet
= false;
690 if(t_RC
->get(d_now
.tv_sec
, subdomain
, QType(QType::NS
), false, &ns
, d_requestor
) > 0) {
691 for(auto k
=ns
.cbegin();k
!=ns
.cend(); ++k
) {
692 if(k
->d_ttl
> (unsigned int)d_now
.tv_sec
) {
693 vector
<DNSRecord
> aset
;
695 const DNSRecord
& dr
=*k
;
696 auto nrr
= getRR
<NSRecordContent
>(dr
);
697 if(nrr
&& (!nrr
->getNS().isPartOf(subdomain
) || t_RC
->get(d_now
.tv_sec
, nrr
->getNS(), s_doIPv6
? QType(QType::ADDR
) : QType(QType::A
),
698 false, doLog() ? &aset
: nullptr, d_requestor
) > 5)) {
699 bestns
.push_back(dr
);
700 LOG(prefix
<<qname
<<": NS (with ip, or non-glue) in cache for '"<<subdomain
<<"' -> '"<<nrr
->getNS()<<"'"<<endl
);
701 LOG(prefix
<<qname
<<": within bailiwick: "<< nrr
->getNS().isPartOf(subdomain
));
703 LOG(", in cache, ttl="<<(unsigned int)(((time_t)aset
.begin()->d_ttl
- d_now
.tv_sec
))<<endl
);
706 LOG(", not in cache / did not look at cache"<<endl
);
711 LOG(prefix
<<qname
<<": NS in cache for '"<<subdomain
<<"', but needs glue ("<<nrr
->getNS()<<") which we miss or is expired"<<endl
);
716 if(!bestns
.empty()) {
717 GetBestNSAnswer answer
;
719 answer
.qtype
=qtype
.getCode();
720 for(const auto& dr
: bestns
)
721 answer
.bestns
.insert(make_pair(dr
.d_name
, getRR
<NSRecordContent
>(dr
)->getNS()));
723 if(beenthere
.count(answer
)) {
725 LOG(prefix
<<qname
<<": We have NS in cache for '"<<subdomain
<<"' but part of LOOP (already seen "<<answer
.qname
<<")! Trying less specific NS"<<endl
);
728 for( set
<GetBestNSAnswer
>::const_iterator j
=beenthere
.begin();j
!=beenthere
.end();++j
) {
729 bool neo
= !(*j
< answer
|| answer
<*j
);
730 LOG(prefix
<<qname
<<": beenthere"<<(neo
?"*":"")<<": "<<j
->qname
<<"|"<<DNSRecordContent::NumberToType(j
->qtype
)<<" ("<<(unsigned int)j
->bestns
.size()<<")"<<endl
);
735 beenthere
.insert(answer
);
736 LOG(prefix
<<qname
<<": We have NS in cache for '"<<subdomain
<<"' (flawedNSSet="<<*flawedNSSet
<<")"<<endl
);
741 LOG(prefix
<<qname
<<": no valid/useful NS in cache for '"<<subdomain
<<"'"<<endl
);
743 if(subdomain
.isRoot() && !brokeloop
) {
744 // We lost the root NS records
746 LOG(prefix
<<qname
<<": reprimed the root"<<endl
);
747 /* let's prevent an infinite loop */
748 if (!d_updatingRootNS
) {
749 getRootNS(d_now
, d_asyncResolve
);
752 } while(subdomain
.chopOff());
755 SyncRes::domainmap_t::const_iterator
SyncRes::getBestAuthZone(DNSName
* qname
) const
757 SyncRes::domainmap_t::const_iterator ret
;
759 ret
=t_sstorage
.domainmap
->find(*qname
);
760 if(ret
!=t_sstorage
.domainmap
->end())
762 }while(qname
->chopOff());
766 /** doesn't actually do the work, leaves that to getBestNSFromCache */
767 DNSName
SyncRes::getBestNSNamesFromCache(const DNSName
&qname
, const QType
& qtype
, NsSet
& nsset
, bool* flawedNSSet
, unsigned int depth
, set
<GetBestNSAnswer
>&beenthere
)
769 DNSName
subdomain(qname
);
770 DNSName
authdomain(qname
);
772 domainmap_t::const_iterator iter
=getBestAuthZone(&authdomain
);
773 if(iter
!=t_sstorage
.domainmap
->end()) {
774 if( iter
->second
.isAuth() )
775 // this gets picked up in doResolveAt, the empty DNSName, combined with the
776 // empty vector means 'we are auth for this zone'
777 nsset
.insert({DNSName(), {{}, false}});
779 // Again, picked up in doResolveAt. An empty DNSName, combined with a
780 // non-empty vector of ComboAddresses means 'this is a forwarded domain'
781 // This is actually picked up in retrieveAddressesForNS called from doResolveAt.
782 nsset
.insert({DNSName(), {iter
->second
.d_servers
, iter
->second
.shouldRecurse() }});
787 vector
<DNSRecord
> bestns
;
788 getBestNSFromCache(subdomain
, qtype
, bestns
, flawedNSSet
, depth
, beenthere
);
790 for(auto k
=bestns
.cbegin() ; k
!= bestns
.cend(); ++k
) {
791 // The actual resolver code will not even look at the ComboAddress or bool
792 nsset
.insert({std::dynamic_pointer_cast
<NSRecordContent
>(k
->d_content
)->getNS(), {{}, false}});
793 if(k
==bestns
.cbegin())
799 bool SyncRes::doCNAMECacheCheck(const DNSName
&qname
, const QType
&qtype
, vector
<DNSRecord
>& ret
, unsigned int depth
, int &res
, vState
& state
)
804 prefix
.append(depth
, ' ');
807 if((depth
>9 && d_outqueries
>10 && d_throttledqueries
>5) || depth
> 15) {
808 LOG(prefix
<<qname
<<": recursing (CNAME or other indirection) too deep, depth="<<depth
<<endl
);
813 LOG(prefix
<<qname
<<": Looking for CNAME cache hit of '"<<qname
<<"|CNAME"<<"'"<<endl
);
814 vector
<DNSRecord
> cset
;
815 vector
<std::shared_ptr
<RRSIGRecordContent
>> signatures
;
816 vector
<std::shared_ptr
<DNSRecord
>> authorityRecs
;
817 if(t_RC
->get(d_now
.tv_sec
, qname
, QType(QType::CNAME
), d_requireAuthData
, &cset
, d_requestor
, d_doDNSSEC
? &signatures
: nullptr, d_doDNSSEC
? &authorityRecs
: nullptr, &d_wasVariable
, &state
) > 0) {
819 for(auto j
=cset
.cbegin() ; j
!= cset
.cend() ; ++j
) {
820 if(j
->d_ttl
>(unsigned int) d_now
.tv_sec
) {
821 LOG(prefix
<<qname
<<": Found cache CNAME hit for '"<< qname
<< "|CNAME" <<"' to '"<<j
->d_content
->getZoneRepresentation()<<"', validation state is "<<vStates
[state
]<<endl
);
823 dr
.d_ttl
-=d_now
.tv_sec
;
826 for(const auto& signature
: signatures
) {
828 sigdr
.d_type
=QType::RRSIG
;
830 sigdr
.d_ttl
=j
->d_ttl
- d_now
.tv_sec
;
831 sigdr
.d_content
=signature
;
832 sigdr
.d_place
=DNSResourceRecord::ANSWER
;
833 sigdr
.d_class
=QClass::IN
;
834 ret
.push_back(sigdr
);
837 for(const auto& rec
: authorityRecs
) {
839 dr
.d_ttl
=j
->d_ttl
- d_now
.tv_sec
;
843 if(qtype
!= QType::CNAME
) { // perhaps they really wanted a CNAME!
844 set
<GetBestNSAnswer
>beenthere
;
846 vState cnameState
= Indeterminate
;
847 res
=doResolve(std::dynamic_pointer_cast
<CNAMERecordContent
>(j
->d_content
)->getTarget(), qtype
, ret
, depth
+1, beenthere
, cnameState
);
848 LOG("Updating validation state for response to "<<qname
<<" from "<<vStates
[state
]<<" with the state from the CNAME quest: "<<vStates
[cnameState
]<<endl
);
849 updateValidationState(state
, cnameState
);
858 LOG(prefix
<<qname
<<": No CNAME cache hit of '"<< qname
<< "|CNAME" <<"' found"<<endl
);
863 * Convience function to push the records from records into ret with a new TTL
865 * \param records DNSRecords that need to go into ret
866 * \param ttl The new TTL for these records
867 * \param ret The vector of DNSRecords that should contian the records with the modified TTL
869 static void addTTLModifiedRecords(const vector
<DNSRecord
>& records
, const uint32_t ttl
, vector
<DNSRecord
>& ret
) {
870 for (const auto& rec
: records
) {
878 bool SyncRes::doCacheCheck(const DNSName
&qname
, const QType
&qtype
, vector
<DNSRecord
>&ret
, unsigned int depth
, int &res
, vState
& state
)
880 bool giveNegative
=false;
885 prefix
.append(depth
, ' ');
888 // sqname and sqtype are used contain 'higher' names if we have them (e.g. powerdns.com|SOA when we find a negative entry for doesnotexists.powerdns.com|A)
889 DNSName
sqname(qname
);
892 // cout<<"Lookup for '"<<qname<<"|"<<qtype.getName()<<"' -> "<<getLastLabel(qname)<<endl;
894 DNSName
authname(qname
);
896 bool wasForwardedOrAuth
= false;
897 bool wasAuth
= false;
898 domainmap_t::const_iterator iter
=getBestAuthZone(&authname
);
899 if(iter
!= t_sstorage
.domainmap
->end()) {
900 wasForwardedOrAuth
= true;
901 const vector
<ComboAddress
>& servers
= iter
->second
.d_servers
;
902 if(servers
.empty()) {
906 NegCache::NegCacheEntry ne
;
909 t_sstorage
.negcache
.getRootNXTrust(qname
, d_now
, ne
) &&
910 ne
.d_auth
.isRoot() &&
911 !(wasForwardedOrAuth
&& !authname
.isRoot())) { // when forwarding, the root may only neg-cache if it was forwarded to.
912 sttl
= ne
.d_ttd
- d_now
.tv_sec
;
913 LOG(prefix
<<qname
<<": Entire name '"<<qname
<<"', is negatively cached via '"<<ne
.d_auth
<<"' & '"<<ne
.d_name
<<"' for another "<<sttl
<<" seconds"<<endl
);
914 res
= RCode::NXDomain
;
916 cachedState
= ne
.d_validationState
;
918 else if (t_sstorage
.negcache
.get(qname
, qtype
, d_now
, ne
) &&
919 !(wasForwardedOrAuth
&& ne
.d_auth
!= authname
)) { // Only the authname nameserver can neg cache entries
921 sttl
= ne
.d_ttd
- d_now
.tv_sec
;
923 cachedState
= ne
.d_validationState
;
924 if(ne
.d_qtype
.getCode()) {
925 LOG(prefix
<<qname
<<": "<<qtype
.getName()<<" is negatively cached via '"<<ne
.d_auth
<<"' for another "<<sttl
<<" seconds"<<endl
);
926 res
= RCode::NoError
;
929 LOG(prefix
<<qname
<<": Entire name '"<<qname
<<"', is negatively cached via '"<<ne
.d_auth
<<"' for another "<<sttl
<<" seconds"<<endl
);
930 res
= RCode::NXDomain
;
933 addTTLModifiedRecords(ne
.DNSSECRecords
.records
, sttl
, ret
);
934 addTTLModifiedRecords(ne
.DNSSECRecords
.signatures
, sttl
, ret
);
939 // Transplant SOA to the returned packet
940 addTTLModifiedRecords(ne
.authoritySOA
.records
, sttl
, ret
);
942 addTTLModifiedRecords(ne
.authoritySOA
.signatures
, sttl
, ret
);
944 LOG("Updating validation state with negative cache content for "<<qname
<<" to "<<vStates
[cachedState
]<<endl
);
949 vector
<DNSRecord
> cset
;
950 bool found
=false, expired
=false;
951 vector
<std::shared_ptr
<RRSIGRecordContent
>> signatures
;
952 vector
<std::shared_ptr
<DNSRecord
>> authorityRecs
;
954 if(t_RC
->get(d_now
.tv_sec
, sqname
, sqt
, d_requireAuthData
, &cset
, d_requestor
, d_doDNSSEC
? &signatures
: nullptr, d_doDNSSEC
? &authorityRecs
: nullptr, &d_wasVariable
, &cachedState
) > 0) {
955 LOG(prefix
<<sqname
<<": Found cache hit for "<<sqt
.getName()<<": ");
956 for(auto j
=cset
.cbegin() ; j
!= cset
.cend() ; ++j
) {
957 LOG(j
->d_content
->getZoneRepresentation());
958 if(j
->d_ttl
>(unsigned int) d_now
.tv_sec
) {
960 ttl
= (dr
.d_ttl
-=d_now
.tv_sec
);
962 LOG("[ttl="<<dr
.d_ttl
<<"] ");
971 for(const auto& signature
: signatures
) {
973 dr
.d_type
=QType::RRSIG
;
976 dr
.d_content
=signature
;
977 dr
.d_place
= DNSResourceRecord::ANSWER
;
978 dr
.d_class
=QClass::IN
;
982 for(const auto& rec
: authorityRecs
) {
989 if(found
&& !expired
) {
992 d_wasOutOfBand
= wasAuth
;
993 LOG("Updating validation state with cache content for "<<qname
<<" to "<<vStates
[cachedState
]<<endl
);
998 LOG(prefix
<<qname
<<": cache had only stale entries"<<endl
);
1004 bool SyncRes::moreSpecificThan(const DNSName
& a
, const DNSName
&b
) const
1006 return (a
.isPartOf(b
) && a
.countLabels() > b
.countLabels());
1011 speedOrder(map
<DNSName
,double> &speeds
) : d_speeds(speeds
) {}
1012 bool operator()(const DNSName
&a
, const DNSName
&b
) const
1014 return d_speeds
[a
] < d_speeds
[b
];
1016 map
<DNSName
, double>& d_speeds
;
1019 inline vector
<DNSName
> SyncRes::shuffleInSpeedOrder(NsSet
&tnameservers
, const string
&prefix
)
1021 vector
<DNSName
> rnameservers
;
1022 rnameservers
.reserve(tnameservers
.size());
1023 for(const auto& tns
:tnameservers
) {
1024 rnameservers
.push_back(tns
.first
);
1026 map
<DNSName
, double> speeds
;
1028 for(const auto& val
: rnameservers
) {
1030 speed
=t_sstorage
.nsSpeeds
[val
].get(&d_now
);
1033 random_shuffle(rnameservers
.begin(),rnameservers
.end(), dns_random
);
1034 speedOrder
so(speeds
);
1035 stable_sort(rnameservers
.begin(),rnameservers
.end(), so
);
1038 LOG(prefix
<<"Nameservers: ");
1039 for(vector
<DNSName
>::const_iterator i
=rnameservers
.begin();i
!=rnameservers
.end();++i
) {
1040 if(i
!=rnameservers
.begin()) {
1042 if(!((i
-rnameservers
.begin())%3)) {
1043 LOG(endl
<<prefix
<<" ");
1046 LOG((i
->empty() ? string("<empty>") : i
->toString())<<"(" << (boost::format("%0.2f") % (speeds
[*i
]/1000.0)).str() <<"ms)");
1050 return rnameservers
;
1053 static bool magicAddrMatch(const QType
& query
, const QType
& answer
)
1055 if(query
.getCode() != QType::ADDR
)
1057 return answer
.getCode() == QType::A
|| answer
.getCode() == QType::AAAA
;
1060 static const set
<uint16_t> nsecTypes
= {QType::NSEC
, QType::NSEC3
};
1062 /* Fills the authoritySOA and DNSSECRecords fields from ne with those found in the records
1064 * \param records The records to parse for the authority SOA and NSEC(3) records
1065 * \param ne The NegCacheEntry to be filled out (will not be cleared, only appended to
1067 static void harvestNXRecords(const vector
<DNSRecord
>& records
, NegCache::NegCacheEntry
& ne
) {
1068 for(const auto& rec
: records
) {
1069 if(rec
.d_place
!= DNSResourceRecord::AUTHORITY
)
1070 // RFC 4035 section 3.1.3. indicates that NSEC records MUST be placed in
1071 // the AUTHORITY section. Section 3.1.1 indicates that that RRSIGs for
1072 // records MUST be in the same section as the records they cover.
1073 // Hence, we ignore all records outside of the AUTHORITY section.
1076 if(rec
.d_type
== QType::RRSIG
) {
1077 auto rrsig
= getRR
<RRSIGRecordContent
>(rec
);
1079 if(rrsig
->d_type
== QType::SOA
) {
1080 ne
.authoritySOA
.signatures
.push_back(rec
);
1082 if(nsecTypes
.count(rrsig
->d_type
)) {
1083 ne
.DNSSECRecords
.signatures
.push_back(rec
);
1088 if(rec
.d_type
== QType::SOA
) {
1089 ne
.authoritySOA
.records
.push_back(rec
);
1092 if(nsecTypes
.count(rec
.d_type
)) {
1093 ne
.DNSSECRecords
.records
.push_back(rec
);
1099 static cspmap_t
harvestCSPFromNE(const NegCache::NegCacheEntry
& ne
)
1102 for(const auto& rec
: ne
.DNSSECRecords
.signatures
) {
1103 if(rec
.d_type
== QType::RRSIG
) {
1104 auto rrc
= getRR
<RRSIGRecordContent
>(rec
);
1106 cspmap
[{rec
.d_name
,rrc
->d_type
}].signatures
.push_back(rrc
);
1110 for(const auto& rec
: ne
.DNSSECRecords
.records
) {
1111 cspmap
[{rec
.d_name
, rec
.d_type
}].records
.push_back(rec
.d_content
);
1116 // TODO remove after processRecords is fixed!
1117 // Adds the RRSIG for the SOA and the NSEC(3) + RRSIGs to ret
1118 static void addNXNSECS(vector
<DNSRecord
>&ret
, const vector
<DNSRecord
>& records
)
1120 NegCache::NegCacheEntry ne
;
1121 harvestNXRecords(records
, ne
);
1122 ret
.insert(ret
.end(), ne
.authoritySOA
.signatures
.begin(), ne
.authoritySOA
.signatures
.end());
1123 ret
.insert(ret
.end(), ne
.DNSSECRecords
.records
.begin(), ne
.DNSSECRecords
.records
.end());
1124 ret
.insert(ret
.end(), ne
.DNSSECRecords
.signatures
.begin(), ne
.DNSSECRecords
.signatures
.end());
1127 bool SyncRes::nameserversBlockedByRPZ(const DNSFilterEngine
& dfe
, const NsSet
& nameservers
)
1130 for (auto const &ns
: nameservers
) {
1131 d_appliedPolicy
= dfe
.getProcessingPolicy(ns
.first
, d_discardedPolicies
);
1132 if (d_appliedPolicy
.d_kind
!= DNSFilterEngine::PolicyKind::NoAction
) { // client query needs an RPZ response
1133 LOG(", however nameserver "<<ns
.first
<<" was blocked by RPZ policy '"<<(d_appliedPolicy
.d_name
? *d_appliedPolicy
.d_name
: "")<<"'"<<endl
);
1137 // Traverse all IP addresses for this NS to see if they have an RPN NSIP policy
1138 for (auto const &address
: ns
.second
.first
) {
1139 d_appliedPolicy
= dfe
.getProcessingPolicy(address
, d_discardedPolicies
);
1140 if (d_appliedPolicy
.d_kind
!= DNSFilterEngine::PolicyKind::NoAction
) { // client query needs an RPZ response
1141 LOG(", however nameserver "<<ns
.first
<<" IP address "<<address
.toString()<<" was blocked by RPZ policy '"<<(d_appliedPolicy
.d_name
? *d_appliedPolicy
.d_name
: "")<<"'"<<endl
);
1150 bool SyncRes::nameserverIPBlockedByRPZ(const DNSFilterEngine
& dfe
, const ComboAddress
& remoteIP
)
1153 d_appliedPolicy
= dfe
.getProcessingPolicy(remoteIP
, d_discardedPolicies
);
1154 if (d_appliedPolicy
.d_kind
!= DNSFilterEngine::PolicyKind::NoAction
) {
1155 LOG(" (blocked by RPZ policy '"+(d_appliedPolicy
.d_name
? *d_appliedPolicy
.d_name
: "")+"')");
1162 vector
<ComboAddress
> SyncRes::retrieveAddressesForNS(const std::string
& prefix
, const DNSName
& qname
, vector
<DNSName
>::const_iterator
& tns
, const unsigned int depth
, set
<GetBestNSAnswer
>& beenthere
, const vector
<DNSName
>& rnameservers
, NsSet
& nameservers
, bool& sendRDQuery
, bool& pierceDontQuery
, bool& flawedNSSet
)
1164 vector
<ComboAddress
> result
;
1167 LOG(prefix
<<qname
<<": Trying to resolve NS '"<<*tns
<< "' ("<<1+tns
-rnameservers
.begin()<<"/"<<(unsigned int)rnameservers
.size()<<")"<<endl
);
1168 result
= getAddrs(*tns
, depth
+2, beenthere
);
1169 pierceDontQuery
=false;
1172 LOG(prefix
<<qname
<<": Domain has hardcoded nameserver");
1174 result
= nameservers
[*tns
].first
;
1175 if(result
.size() > 1) {
1180 sendRDQuery
= nameservers
[*tns
].second
;
1181 pierceDontQuery
=true;
1186 bool SyncRes::throttledOrBlocked(const std::string
& prefix
, const ComboAddress
& remoteIP
, const DNSName
& qname
, const QType
& qtype
, bool pierceDontQuery
)
1188 if(t_sstorage
.throttle
.shouldThrottle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, "", 0))) {
1189 LOG(prefix
<<qname
<<": server throttled "<<endl
);
1190 s_throttledqueries
++; d_throttledqueries
++;
1193 else if(t_sstorage
.throttle
.shouldThrottle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, qname
, qtype
.getCode()))) {
1194 LOG(prefix
<<qname
<<": query throttled "<<remoteIP
.toString()<<", "<<qname
<<"; "<<qtype
.getName()<<endl
);
1195 s_throttledqueries
++; d_throttledqueries
++;
1198 else if(!pierceDontQuery
&& s_dontQuery
&& s_dontQuery
->match(&remoteIP
)) {
1199 LOG(prefix
<<qname
<<": not sending query to " << remoteIP
.toString() << ", blocked by 'dont-query' setting" << endl
);
1206 bool SyncRes::validationEnabled() const
1208 return g_dnssecmode
!= DNSSECMode::Off
&& g_dnssecmode
!= DNSSECMode::ProcessNoValidate
;
1211 uint32_t SyncRes::computeLowestTTD(const std::vector
<DNSRecord
>& records
, const std::vector
<std::shared_ptr
<RRSIGRecordContent
> >& signatures
, uint32_t signaturesTTL
) const
1213 uint32_t lowestTTD
= std::numeric_limits
<uint32_t>::max();
1214 for(const auto& record
: records
)
1215 lowestTTD
= min(lowestTTD
, record
.d_ttl
);
1217 if (validationEnabled() && !signatures
.empty()) {
1218 /* if we are validating, we don't want to cache records after their signatures
1220 /* records TTL are now TTD, let's add 'now' to the signatures lowest TTL */
1221 lowestTTD
= min(lowestTTD
, static_cast<uint32_t>(signaturesTTL
+ d_now
.tv_sec
));
1223 for(const auto& sig
: signatures
) {
1224 if (sig
->d_siginception
<= d_now
.tv_sec
&& sig
->d_sigexpire
> d_now
.tv_sec
) {
1225 // we don't decerement d_sigexpire by 'now' because we actually want a TTD, not a TTL */
1226 lowestTTD
= min(lowestTTD
, static_cast<uint32_t>(sig
->d_sigexpire
));
1234 void SyncRes::updateValidationState(vState
& state
, const vState stateUpdate
)
1236 LOG(d_prefix
<<"validation state was "<<std::string(vStates
[state
])<<", state update is "<<std::string(vStates
[stateUpdate
])<<endl
);
1238 if (stateUpdate
== TA
) {
1241 else if (stateUpdate
== NTA
) {
1244 else if (stateUpdate
== Bogus
) {
1247 else if (state
== Indeterminate
) {
1248 state
= stateUpdate
;
1250 else if (stateUpdate
== Insecure
) {
1251 if (state
!= Bogus
) {
1255 LOG(d_prefix
<<" validation state is now "<<std::string(vStates
[state
])<<endl
);
1258 vState
SyncRes::getTA(const DNSName
& zone
, dsmap_t
& ds
)
1260 auto luaLocal
= g_luaconfs
.getLocal();
1262 if (luaLocal
->dsAnchors
.empty()) {
1263 /* We have no TA, everything is insecure */
1268 if (haveNegativeTrustAnchor(luaLocal
->negAnchors
, zone
, reason
)) {
1269 LOG("Got NTA for "<<zone
<<endl
);
1273 if (getTrustAnchor(luaLocal
->dsAnchors
, zone
, ds
)) {
1274 LOG("Got TA for "<<zone
<<endl
);
1278 if (zone
.isRoot()) {
1279 /* No TA for the root */
1283 return Indeterminate
;
1286 static size_t countSupportedDS(const dsmap_t
& dsmap
)
1290 for (const auto& ds
: dsmap
) {
1291 if (isSupportedDS(ds
)) {
1299 vState
SyncRes::getDSRecords(const DNSName
& zone
, dsmap_t
& ds
, bool taOnly
, unsigned int depth
)
1301 vState result
= getTA(zone
, ds
);
1303 if (result
!= Indeterminate
|| taOnly
) {
1304 if ((result
== Secure
|| result
== TA
) && countSupportedDS(ds
) == 0) {
1312 bool oldSkipCNAME
= d_skipCNAMECheck
;
1313 bool oldRequireAuthData
= d_requireAuthData
;
1314 d_skipCNAMECheck
= true;
1315 d_requireAuthData
= false;
1317 std::set
<GetBestNSAnswer
> beenthere
;
1318 std::vector
<DNSRecord
> dsrecords
;
1320 vState state
= Indeterminate
;
1321 int rcode
= doResolve(zone
, QType(QType::DS
), dsrecords
, depth
+ 1, beenthere
, state
);
1322 d_skipCNAMECheck
= oldSkipCNAME
;
1323 d_requireAuthData
= oldRequireAuthData
;
1325 if (rcode
== RCode::NoError
) {
1326 if (state
== Secure
) {
1327 for (const auto& record
: dsrecords
) {
1328 if (record
.d_type
== QType::DS
) {
1329 const auto dscontent
= getRR
<DSRecordContent
>(record
);
1330 if (dscontent
&& isSupportedDS(*dscontent
)) {
1331 ds
.insert(*dscontent
);
1344 LOG("Returning Bogus state from "<<__func__
<<"("<<zone
<<")"<<endl
);
1348 vState
SyncRes::getValidationStatus(const SyncRes::zonesStates_t
& cuts
, const DNSName
& subdomain
)
1350 vState result
= Indeterminate
;
1352 if (!validationEnabled()) {
1355 DNSName
name(subdomain
);
1357 const auto& it
= cuts
.find(name
);
1358 if (it
!= cuts
.cend()) {
1362 while (name
.chopOff());
1368 vState
SyncRes::getValidationStatus(const DNSName
& subdomain
, unsigned int depth
)
1370 if (!validationEnabled()) {
1371 return Indeterminate
;
1375 vState result
= getTA(subdomain
, ds
);
1376 if (result
!= Indeterminate
) {
1380 else if (result
== NTA
) {
1384 if (result
== Secure
&& countSupportedDS(ds
) == 0) {
1392 vector
<DNSRecord
> cset
;
1393 if(t_RC
->get(d_now
.tv_sec
, subdomain
, QType(QType::DS
), false, &cset
, d_requestor
, nullptr, nullptr, nullptr, &result
) > 0) {
1394 if (result
!= Indeterminate
) {
1399 /* we are out of luck */
1400 DNSName
higher(subdomain
);
1401 if (!higher
.chopOff()) {
1402 /* No (N)TA for ".", something is very wrong */
1406 result
= getValidationStatus(higher
, depth
);
1408 if (result
!= Secure
) {
1409 /* we know we don't have any (N)TA, so we are done */
1413 /* get subdomain DS */
1414 result
= getDSRecords(subdomain
, ds
, false, depth
);
1419 else if (result
!= Secure
) {
1420 if (result
== NTA
) {
1434 SyncRes::zonesStates_t
SyncRes::computeZoneCuts(const DNSName
& begin
, const DNSName
& end
, unsigned int depth
)
1436 SyncRes::zonesStates_t cuts
;
1438 vState cutState
= getDSRecords(end
, ds
, false, depth
);
1439 if (cutState
== TA
) {
1442 else if (cutState
== NTA
) {
1443 cutState
= Insecure
;
1445 cuts
[end
] = cutState
;
1447 cerr
<<__func__
<<", from "<<begin
.toString()<<" to "<<end
.toString()<<endl
;
1449 #warning using d_requireAuthData here seems wrong
1450 if (!validationEnabled() || !d_requireAuthData
) {
1454 if(!begin
.isPartOf(end
)) {
1455 //throw PDNSException(end.toLogString() + " is not part of " + begin.toString());
1456 cerr
<<end
.toLogString()<<" is not part of "<<begin
.toString()<<endl
;
1460 std::vector
<string
> labelsToAdd
= begin
.makeRelative(end
).getRawLabels();
1462 while(qname
!= begin
) {
1463 bool foundCut
= false;
1464 if (labelsToAdd
.empty())
1467 qname
.prependRawLabel(labelsToAdd
.back());
1468 labelsToAdd
.pop_back();
1469 cerr
<<"- Looking for a cut at "<<qname
<<endl
;
1471 bool oldSkipCNAME
= d_skipCNAMECheck
;
1472 bool oldRequireAuthData
= d_requireAuthData
;
1473 d_skipCNAMECheck
= true;
1474 d_requireAuthData
= false;
1476 std::set
<GetBestNSAnswer
> beenthere
;
1477 std::vector
<DNSRecord
> nsrecords
;
1479 vState state
= Indeterminate
;
1480 int rcode
= doResolve(qname
, QType(QType::NS
), nsrecords
, depth
+ 1, beenthere
, state
);
1481 d_skipCNAMECheck
= oldSkipCNAME
;
1482 d_requireAuthData
= oldRequireAuthData
;
1484 if (rcode
== RCode::NoError
&& !nsrecords
.empty()) {
1485 for (const auto& record
: nsrecords
) {
1486 if(record
.d_type
!= QType::NS
|| record
.d_name
!= qname
)
1492 cerr
<<"- Found cut at "<<qname
<<endl
;
1494 cutState
= getDSRecords(qname
, ds
, cutState
== Insecure
|| cutState
== Bogus
, depth
);
1495 cerr
<<"New state is "<<vStates
[cutState
]<<endl
;
1496 if (cutState
== TA
) {
1499 else if (cutState
== NTA
) {
1500 cutState
= Insecure
;
1502 cuts
[qname
] = cutState
;
1507 cerr
<<"List of cuts from "<<begin
<<" to "<<end
<<endl
;
1508 for (const auto& cut
: cuts
) {
1509 cerr
<<" - "<<cut
.first
<<": "<<vStates
[cut
.second
]<<endl
;
1515 void SyncRes::updateValidationStatusAfterReferral(const DNSName
& qname
, const DNSName
& oldauth
, const DNSName
& newauth
, vState
& state
, unsigned int depth
)
1517 if (!validationEnabled()) {
1522 vState newState
= getDSRecords(newauth
, ds
, state
== Insecure
|| state
== Bogus
, depth
);
1524 if (newState
== Indeterminate
) {
1529 if (newState
== Secure
) {
1531 updateValidationState(state
, Insecure
);
1534 updateValidationState(state
, Secure
);
1538 updateValidationState(state
, newState
);
1542 vState
SyncRes::validateDNSKeys(const DNSName
& zone
, const std::vector
<DNSRecord
>& dnskeys
, const std::vector
<std::shared_ptr
<RRSIGRecordContent
> >& signatures
, unsigned int depth
)
1545 if (!signatures
.empty()) {
1546 DNSName signer
= getSigner(signatures
);
1548 if (!signer
.empty() && signer
.isPartOf(zone
)) {
1549 vState state
= getDSRecords(signer
, ds
, false, depth
);
1554 if (state
!= Secure
) {
1563 skeyset_t tentativeKeys
;
1564 std::vector
<shared_ptr
<DNSRecordContent
> > toSign
;
1566 for (const auto& dnskey
: dnskeys
) {
1567 if (dnskey
.d_type
== QType::DNSKEY
) {
1568 auto content
= getRR
<DNSKEYRecordContent
>(dnskey
);
1570 tentativeKeys
.insert(content
);
1571 toSign
.push_back(content
);
1576 LOG("Trying to validate "<<std::to_string(tentativeKeys
.size())<<" DNSKEYs with "<<std::to_string(ds
.size())<<" DS"<<endl
);
1577 skeyset_t validatedKeys
;
1578 validateDNSKeysAgainstDS(d_now
.tv_sec
, zone
, ds
, tentativeKeys
, toSign
, signatures
, validatedKeys
);
1580 LOG("We now have "<<std::to_string(validatedKeys
.size())<<" DNSKEYs"<<endl
);
1582 if (validatedKeys
.size() != tentativeKeys
.size()) {
1583 LOG("Returning Bogus state from "<<__func__
<<"("<<zone
<<")"<<endl
);
1590 vState
SyncRes::getDNSKeys(const DNSName
& signer
, skeyset_t
& keys
, unsigned int depth
)
1592 std::vector
<DNSRecord
> records
;
1593 std::set
<GetBestNSAnswer
> beenthere
;
1594 LOG("Retrieving DNSKeys for "<<signer
<<endl
);
1596 vState state
= Indeterminate
;
1597 int rcode
= doResolve(signer
, QType(QType::DNSKEY
), records
, depth
+ 1, beenthere
, state
);
1599 if (rcode
== RCode::NoError
) {
1600 if (state
== Secure
) {
1601 for (const auto& key
: records
) {
1602 if (key
.d_type
== QType::DNSKEY
) {
1603 auto content
= getRR
<DNSKEYRecordContent
>(key
);
1605 keys
.insert(content
);
1610 LOG("Retrieved "<<keys
.size()<<" DNSKeys for "<<signer
<<", state is "<<vStates
[state
]<<endl
);
1614 LOG("Returning Bogus state from "<<__func__
<<"("<<signer
<<")"<<endl
);
1618 vState
SyncRes::validateRecordsWithSigs(unsigned int depth
, const DNSName
& name
, const std::vector
<DNSRecord
>& records
, const std::vector
<std::shared_ptr
<RRSIGRecordContent
> >& signatures
)
1621 if (!signatures
.empty()) {
1622 const DNSName signer
= getSigner(signatures
);
1623 if (!signer
.empty() && name
.isPartOf(signer
)) {
1624 vState state
= getDNSKeys(signer
, keys
, depth
);
1625 if (state
!= Secure
) {
1630 LOG("Bogus!"<<endl
);
1634 std::vector
<std::shared_ptr
<DNSRecordContent
> > recordcontents
;
1635 for (const auto& record
: records
) {
1636 recordcontents
.push_back(record
.d_content
);
1639 LOG("Going to validate "<<recordcontents
.size()<< " record contents with "<<signatures
.size()<<" sigs and "<<keys
.size()<<" keys for "<<name
<<endl
);
1640 if (validateWithKeySet(d_now
.tv_sec
, name
, recordcontents
, signatures
, keys
, false)) {
1641 LOG("Secure!"<<endl
);
1645 LOG("Bogus!"<<endl
);
1649 RCode::rcodes_
SyncRes::updateCacheFromRecords(unsigned int depth
, LWResult
& lwr
, const DNSName
& qname
, const DNSName
& auth
, bool wasForwarded
, const boost::optional
<Netmask
> ednsmask
, vState
& state
, const SyncRes::zonesStates_t
& cuts
, bool& needWildcardProof
)
1653 vector
<DNSRecord
> records
;
1654 vector
<shared_ptr
<RRSIGRecordContent
>> signatures
;
1655 uint32_t signaturesTTL
{std::numeric_limits
<uint32_t>::max()};
1661 DNSResourceRecord::Place place
;
1662 bool operator<(const CacheKey
& rhs
) const {
1663 return tie(name
, type
) < tie(rhs
.name
, rhs
.type
);
1666 typedef map
<CacheKey
, CacheEntry
> tcache_t
;
1672 prefix
.append(depth
, ' ');
1675 std::vector
<std::shared_ptr
<DNSRecord
>> authorityRecs
;
1676 for(const auto& rec
: lwr
.d_records
) {
1677 if(needWildcardProof
) {
1678 if (nsecTypes
.count(rec
.d_type
)) {
1679 authorityRecs
.push_back(std::make_shared
<DNSRecord
>(rec
));
1681 else if (rec
.d_type
== QType::RRSIG
) {
1682 auto rrsig
= getRR
<RRSIGRecordContent
>(rec
);
1683 if (rrsig
&& nsecTypes
.count(rrsig
->d_type
)) {
1684 authorityRecs
.push_back(std::make_shared
<DNSRecord
>(rec
));
1688 if(rec
.d_type
== QType::RRSIG
) {
1689 auto rrsig
= getRR
<RRSIGRecordContent
>(rec
);
1691 if (rec
.d_name
== qname
&& rrsig
->d_labels
< rec
.d_name
.countLabels()) {
1692 LOG(prefix
<<qname
<<": RRSIG indicates the name was expanded from a wildcard, we need a wildcard proof"<<endl
);
1693 needWildcardProof
= true;
1696 // cerr<<"Got an RRSIG for "<<DNSRecordContent::NumberToType(rrsig->d_type)<<" with name '"<<rec.d_name<<"'"<<endl;
1697 tcache
[{rec
.d_name
, rrsig
->d_type
, rec
.d_place
}].signatures
.push_back(rrsig
);
1698 tcache
[{rec
.d_name
, rrsig
->d_type
, rec
.d_place
}].signaturesTTL
= std::min(tcache
[{rec
.d_name
, rrsig
->d_type
, rec
.d_place
}].signaturesTTL
, rec
.d_ttl
);
1703 // reap all answers from this packet that are acceptable
1704 for(auto& rec
: lwr
.d_records
) {
1705 if(rec
.d_type
== QType::OPT
) {
1706 LOG(prefix
<<qname
<<": OPT answer '"<<rec
.d_name
<<"' from '"<<auth
<<"' nameservers" <<endl
);
1709 LOG(prefix
<<qname
<<": accept answer '"<<rec
.d_name
<<"|"<<DNSRecordContent::NumberToType(rec
.d_type
)<<"|"<<rec
.d_content
->getZoneRepresentation()<<"' from '"<<auth
<<"' nameservers? "<<(int)rec
.d_place
<<" ");
1710 if(rec
.d_type
== QType::ANY
) {
1711 LOG("NO! - we don't accept 'ANY' data"<<endl
);
1715 if(rec
.d_name
.isPartOf(auth
)) {
1716 if(rec
.d_type
== QType::RRSIG
) {
1717 LOG("RRSIG - separate"<<endl
);
1719 else if(lwr
.d_aabit
&& lwr
.d_rcode
==RCode::NoError
&& rec
.d_place
==DNSResourceRecord::ANSWER
&& ((rec
.d_type
!= QType::DNSKEY
&& rec
.d_type
!= QType::DS
) || rec
.d_name
!= auth
) && s_delegationOnly
.count(auth
)) {
1720 LOG("NO! Is from delegation-only zone"<<endl
);
1722 return RCode::NXDomain
;
1725 bool haveLogged
= false;
1726 if (!t_sstorage
.domainmap
->empty()) {
1727 // Check if we are authoritative for a zone in this answer
1728 DNSName
tmp_qname(rec
.d_name
);
1729 auto auth_domain_iter
=getBestAuthZone(&tmp_qname
);
1730 if(auth_domain_iter
!=t_sstorage
.domainmap
->end() &&
1731 auth
.countLabels() <= auth_domain_iter
->first
.countLabels()) {
1732 if (auth_domain_iter
->first
!= auth
) {
1733 LOG("NO! - we are authoritative for the zone "<<auth_domain_iter
->first
<<endl
);
1736 LOG("YES! - This answer was ");
1737 if (!wasForwarded
) {
1738 LOG("retrieved from the local auth store.");
1740 LOG("received from a server we forward to.");
1751 rec
.d_ttl
=min(s_maxcachettl
, rec
.d_ttl
);
1754 dr
.d_ttl
+= d_now
.tv_sec
;
1755 dr
.d_place
=DNSResourceRecord::ANSWER
;
1756 tcache
[{rec
.d_name
,rec
.d_type
,rec
.d_place
}].records
.push_back(dr
);
1764 for(tcache_t::iterator i
= tcache
.begin(); i
!= tcache
.end(); ++i
) {
1765 if((i
->second
.records
.size() + i
->second
.signatures
.size()) > 1) { // need to group the ttl to be the minimum of the RRSET (RFC 2181, 5.2)
1766 uint32_t lowestTTD
=computeLowestTTD(i
->second
.records
, i
->second
.signatures
, i
->second
.signaturesTTL
);
1768 for(auto& record
: i
->second
.records
)
1769 record
.d_ttl
= lowestTTD
; // boom
1772 // cout<<"Have "<<i->second.records.size()<<" records and "<<i->second.signatures.size()<<" signatures for "<<i->first.name;
1773 // cout<<'|'<<DNSRecordContent::NumberToType(i->first.type)<<endl;
1776 for(tcache_t::iterator i
= tcache
.begin(); i
!= tcache
.end(); ++i
) {
1778 if(i
->second
.records
.empty()) // this happens when we did store signatures, but passed on the records themselves
1781 // vState recordState = state;
1782 vState recordState
= getValidationStatus(cuts
, i
->first
.name
);
1783 cerr
<<"Got status "<<vStates
[recordState
]<<" for record "<<i
->first
.name
<<endl
;
1785 if (validationEnabled() && recordState
== Secure
) {
1787 if (i
->first
.place
!= DNSResourceRecord::ADDITIONAL
) {
1788 /* the additional entries can be insecure,
1790 "Glue address RRsets associated with delegations MUST NOT be signed"
1792 if (i
->first
.type
== QType::DNSKEY
&& i
->first
.place
== DNSResourceRecord::ANSWER
) {
1793 LOG("Validating DNSKEY for "<<i
->first
.name
<<endl
);
1794 recordState
= validateDNSKeys(i
->first
.name
, i
->second
.records
, i
->second
.signatures
, depth
);
1797 LOG("Validating non-additional record for "<<i
->first
.name
<<endl
);
1798 recordState
= validateRecordsWithSigs(depth
, i
->first
.name
, i
->second
.records
, i
->second
.signatures
);
1803 /* for non authoritative answer, we only care about the DS record (or lack of) */
1804 if ((i
->first
.type
== QType::DS
|| i
->first
.type
== QType::NSEC
|| i
->first
.type
== QType::NSEC3
) && i
->first
.place
== DNSResourceRecord::AUTHORITY
) {
1805 LOG("Validating DS record for "<<i
->first
.name
<<endl
);
1806 recordState
= validateRecordsWithSigs(depth
, i
->first
.name
, i
->second
.records
, i
->second
.signatures
);
1809 updateValidationState(state
, recordState
);
1812 if (validationEnabled()) {
1813 LOG("Skipping validation because the current state is "<<vStates
[state
]<<endl
);
1817 t_RC
->replace(d_now
.tv_sec
, i
->first
.name
, QType(i
->first
.type
), i
->second
.records
, i
->second
.signatures
, authorityRecs
, lwr
.d_aabit
, i
->first
.place
== DNSResourceRecord::ANSWER
? ednsmask
: boost::none
, recordState
);
1819 if(i
->first
.place
== DNSResourceRecord::ANSWER
&& ednsmask
)
1823 return RCode::NoError
;
1826 void SyncRes::getDenialValidationState(NegCache::NegCacheEntry
& ne
, vState
& state
, const dState expectedState
, bool allowOptOut
)
1828 ne
.d_validationState
= state
;
1830 if (state
== Secure
) {
1831 cspmap_t csp
= harvestCSPFromNE(ne
);
1832 dState res
= getDenial(csp
, ne
.d_name
, ne
.d_qtype
.getCode());
1833 if (res
!= expectedState
) {
1834 if (res
== OPTOUT
&& allowOptOut
) {
1835 LOG("OPT-out denial found for "<<ne
.d_name
<<", retuning Insecure"<<endl
);
1836 ne
.d_validationState
= Secure
;
1837 updateValidationState(state
, Insecure
);
1840 else if (res
== INSECURE
) {
1841 LOG("Insecure denial found for "<<ne
.d_name
<<", retuning Insecure"<<endl
);
1842 ne
.d_validationState
= Insecure
;
1845 LOG("Invalid denial found for "<<ne
.d_name
<<", retuning Bogus"<<endl
);
1846 ne
.d_validationState
= Bogus
;
1848 updateValidationState(state
, ne
.d_validationState
);
1853 bool SyncRes::processRecords(const std::string
& prefix
, const DNSName
& qname
, const QType
& qtype
, const DNSName
& auth
, LWResult
& lwr
, const bool sendRDQuery
, vector
<DNSRecord
>& ret
, set
<DNSName
>& nsset
, DNSName
& newtarget
, DNSName
& newauth
, bool& realreferral
, bool& negindic
, vState
& state
, bool needWildcardProof
)
1857 for(auto& rec
: lwr
.d_records
) {
1858 if (rec
.d_type
!=QType::OPT
&& rec
.d_class
!=QClass::IN
)
1861 if(rec
.d_place
==DNSResourceRecord::AUTHORITY
&& rec
.d_type
==QType::SOA
&&
1862 lwr
.d_rcode
==RCode::NXDomain
&& qname
.isPartOf(rec
.d_name
) && rec
.d_name
.isPartOf(auth
)) {
1863 LOG(prefix
<<qname
<<": got negative caching indication for name '"<<qname
<<"' (accept="<<rec
.d_name
.isPartOf(auth
)<<"), newtarget='"<<newtarget
<<"'"<<endl
);
1865 rec
.d_ttl
= min(rec
.d_ttl
, s_maxnegttl
);
1866 if(newtarget
.empty()) // only add a SOA if we're not going anywhere after this
1868 if(!wasVariable()) {
1869 NegCache::NegCacheEntry ne
;
1871 ne
.d_ttd
= d_now
.tv_sec
+ rec
.d_ttl
;
1873 ne
.d_qtype
= QType(0); // this encodes 'whole record'
1874 ne
.d_auth
= rec
.d_name
;
1875 harvestNXRecords(lwr
.d_records
, ne
);
1876 getDenialValidationState(ne
, state
, NXDOMAIN
, false);
1877 t_sstorage
.negcache
.add(ne
);
1878 if(s_rootNXTrust
&& ne
.d_auth
.isRoot() && auth
.isRoot()) {
1879 ne
.d_name
= ne
.d_name
.getLastLabel();
1880 t_sstorage
.negcache
.add(ne
);
1886 else if(rec
.d_place
==DNSResourceRecord::ANSWER
&& rec
.d_type
==QType::CNAME
&& (!(qtype
==QType(QType::CNAME
))) && rec
.d_name
== qname
) {
1888 if (auto content
= getRR
<CNAMERecordContent
>(rec
)) {
1889 newtarget
=content
->getTarget();
1892 else if((rec
.d_type
==QType::RRSIG
|| rec
.d_type
==QType::NSEC
|| rec
.d_type
==QType::NSEC3
) && rec
.d_place
==DNSResourceRecord::ANSWER
) {
1893 if(rec
.d_type
!= QType::RRSIG
|| rec
.d_name
== qname
)
1894 ret
.push_back(rec
); // enjoy your DNSSEC
1896 else if(needWildcardProof
&& (rec
.d_type
==QType::RRSIG
|| rec
.d_type
==QType::NSEC
|| rec
.d_type
==QType::NSEC3
) && rec
.d_place
==DNSResourceRecord::AUTHORITY
) {
1897 ret
.push_back(rec
); // enjoy your DNSSEC
1899 // for ANY answers we *must* have an authoritative answer, unless we are forwarding recursively
1900 else if(rec
.d_place
==DNSResourceRecord::ANSWER
&& rec
.d_name
== qname
&&
1902 rec
.d_type
==qtype
.getCode() || (lwr
.d_aabit
&& (qtype
==QType(QType::ANY
) || magicAddrMatch(qtype
, QType(rec
.d_type
)) ) ) || sendRDQuery
1906 LOG(prefix
<<qname
<<": answer is in: resolved to '"<< rec
.d_content
->getZoneRepresentation()<<"|"<<DNSRecordContent::NumberToType(rec
.d_type
)<<"'"<<endl
);
1911 else if(rec
.d_place
==DNSResourceRecord::AUTHORITY
&& rec
.d_type
==QType::NS
&& qname
.isPartOf(rec
.d_name
)) {
1912 if(moreSpecificThan(rec
.d_name
,auth
)) {
1914 LOG(prefix
<<qname
<<": got NS record '"<<rec
.d_name
<<"' -> '"<<rec
.d_content
->getZoneRepresentation()<<"'"<<endl
);
1918 LOG(prefix
<<qname
<<": got upwards/level NS record '"<<rec
.d_name
<<"' -> '"<<rec
.d_content
->getZoneRepresentation()<<"', had '"<<auth
<<"'"<<endl
);
1920 if (auto content
= getRR
<NSRecordContent
>(rec
)) {
1921 nsset
.insert(content
->getNS());
1924 else if(rec
.d_place
==DNSResourceRecord::AUTHORITY
&& rec
.d_type
==QType::DS
&& qname
.isPartOf(rec
.d_name
)) {
1925 LOG(prefix
<<qname
<<": got DS record '"<<rec
.d_name
<<"' -> '"<<rec
.d_content
->getZoneRepresentation()<<"'"<<endl
);
1927 else if(realreferral
&& rec
.d_place
==DNSResourceRecord::AUTHORITY
&& (rec
.d_type
==QType::NSEC
|| rec
.d_type
==QType::NSEC3
) && newauth
.isPartOf(auth
)) {
1928 /* we might have received a denial of the DS, let's check */
1929 if (state
== Secure
) {
1930 NegCache::NegCacheEntry ne
;
1932 ne
.d_ttd
= d_now
.tv_sec
+ rec
.d_ttl
;
1933 ne
.d_name
= newauth
;
1934 ne
.d_qtype
= QType::DS
;
1935 harvestNXRecords(lwr
.d_records
, ne
);
1936 cspmap_t csp
= harvestCSPFromNE(ne
);
1937 dState denialState
= getDenial(csp
, newauth
, QType::DS
);
1938 if (denialState
== NXQTYPE
|| denialState
== OPTOUT
|| denialState
== INSECURE
) {
1939 ne
.d_validationState
= Secure
;
1940 rec
.d_ttl
= min(s_maxnegttl
, rec
.d_ttl
);
1941 LOG(prefix
<<qname
<<": got negative indication of DS record for '"<<newauth
<<"'"<<endl
);
1942 updateValidationState(state
, Insecure
);
1943 if(!wasVariable()) {
1944 t_sstorage
.negcache
.add(ne
);
1949 else if(!done
&& rec
.d_place
==DNSResourceRecord::AUTHORITY
&& rec
.d_type
==QType::SOA
&&
1950 lwr
.d_rcode
==RCode::NoError
&& qname
.isPartOf(rec
.d_name
)) {
1951 LOG(prefix
<<qname
<<": got negative caching indication for '"<< qname
<<"|"<<qtype
.getName()<<"'"<<endl
);
1953 if(!newtarget
.empty()) {
1954 LOG(prefix
<<qname
<<": Hang on! Got a redirect to '"<<newtarget
<<"' already"<<endl
);
1957 rec
.d_ttl
= min(s_maxnegttl
, rec
.d_ttl
);
1959 if(!wasVariable()) {
1960 NegCache::NegCacheEntry ne
;
1961 ne
.d_auth
= rec
.d_name
;
1962 ne
.d_ttd
= d_now
.tv_sec
+ rec
.d_ttl
;
1965 harvestNXRecords(lwr
.d_records
, ne
);
1966 getDenialValidationState(ne
, state
, NXQTYPE
, qtype
== QType::DS
);
1967 if(qtype
.getCode()) { // prevents us from blacking out a whole domain
1968 t_sstorage
.negcache
.add(ne
);
1979 bool SyncRes::doResolveAtThisIP(const std::string
& prefix
, const DNSName
& qname
, const QType
& qtype
, LWResult
& lwr
, boost::optional
<Netmask
>& ednsmask
, const DNSName
& auth
, bool const sendRDQuery
, const DNSName
& nsName
, const ComboAddress
& remoteIP
, bool doTCP
, bool* truncated
)
1985 if(d_outqueries
+ d_throttledqueries
> s_maxqperq
) {
1986 throw ImmediateServFailException("more than "+std::to_string(s_maxqperq
)+" (max-qperq) queries sent while resolving "+qname
.toLogString());
1989 if(s_maxtotusec
&& d_totUsec
> s_maxtotusec
) {
1990 throw ImmediateServFailException("Too much time waiting for "+qname
.toLogString()+"|"+qtype
.getName()+", timeouts: "+std::to_string(d_timeouts
) +", throttles: "+std::to_string(d_throttledqueries
) + ", queries: "+std::to_string(d_outqueries
)+", "+std::to_string(d_totUsec
/1000)+"msec");
1994 LOG(prefix
<<qname
<<": using TCP with "<< remoteIP
.toStringWithPort() <<endl
);
1999 if(d_pdl
&& d_pdl
->preoutquery(remoteIP
, d_requestor
, qname
, qtype
, doTCP
, lwr
.d_records
, resolveret
)) {
2000 LOG(prefix
<<qname
<<": query handled by Lua"<<endl
);
2003 ednsmask
=getEDNSSubnetMask(d_requestor
, qname
, remoteIP
);
2005 LOG(prefix
<<qname
<<": Adding EDNS Client Subnet Mask "<<ednsmask
->toString()<<" to query"<<endl
);
2007 resolveret
= asyncresolveWrapper(remoteIP
, d_doDNSSEC
, qname
, qtype
.getCode(),
2008 doTCP
, sendRDQuery
, &d_now
, ednsmask
, &lwr
); // <- we go out on the wire!
2010 LOG(prefix
<<qname
<<": Received EDNS Client Subnet Mask "<<ednsmask
->toString()<<" on response"<<endl
);
2014 /* preoutquery killed the query by setting dq.rcode to -3 */
2015 if(resolveret
==-3) {
2016 throw ImmediateServFailException("Query killed by policy");
2019 d_totUsec
+= lwr
.d_usec
;
2020 accountAuthLatency(lwr
.d_usec
, remoteIP
.sin4
.sin_family
);
2022 if(resolveret
!= 1) {
2023 /* Error while resolving */
2024 if(resolveret
== 0) {
2027 LOG(prefix
<<qname
<<": timeout resolving after "<<lwr
.d_usec
/1000.0<<"msec "<< (doTCP
? "over TCP" : "")<<endl
);
2029 s_outgoingtimeouts
++;
2031 if(remoteIP
.sin4
.sin_family
== AF_INET
)
2032 s_outgoing4timeouts
++;
2034 s_outgoing6timeouts
++;
2036 else if(resolveret
== -2) {
2037 /* OS resource limit reached */
2038 LOG(prefix
<<qname
<<": hit a local resource limit resolving"<< (doTCP
? " over TCP" : "")<<", probable error: "<<stringerror()<<endl
);
2039 g_stats
.resourceLimits
++;
2042 /* -1 means server unreachable */
2045 LOG(prefix
<<qname
<<": error resolving from "<<remoteIP
.toString()<< (doTCP
? " over TCP" : "") <<", possible error: "<<strerror(errno
)<< endl
);
2048 if(resolveret
!= -2) { // don't account for resource limits, they are our own fault
2049 t_sstorage
.nsSpeeds
[nsName
].submit(remoteIP
, 1000000, &d_now
); // 1 sec
2051 // code below makes sure we don't filter COM or the root
2052 if (s_serverdownmaxfails
> 0 && (auth
!= g_rootdnsname
) && t_sstorage
.fails
.incr(remoteIP
) >= s_serverdownmaxfails
) {
2053 LOG(prefix
<<qname
<<": Max fails reached resolving on "<< remoteIP
.toString() <<". Going full throttle for "<< s_serverdownthrottletime
<<" seconds" <<endl
);
2054 // mark server as down
2055 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, "", 0), s_serverdownthrottletime
, 10000);
2057 else if (resolveret
== -1) {
2058 // unreachable, 1 minute or 100 queries
2059 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, qname
, qtype
.getCode()), 60, 100);
2063 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, qname
, qtype
.getCode()), 10, 5);
2070 /* we got an answer */
2071 if(lwr
.d_rcode
==RCode::ServFail
|| lwr
.d_rcode
==RCode::Refused
) {
2072 LOG(prefix
<<qname
<<": "<<nsName
<<" ("<<remoteIP
.toString()<<") returned a "<< (lwr
.d_rcode
==RCode::ServFail
? "ServFail" : "Refused") << ", trying sibling IP or NS"<<endl
);
2073 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, qname
, qtype
.getCode()), 60, 3);
2077 /* this server sent a valid answer, mark it backup up if it was down */
2078 if(s_serverdownmaxfails
> 0) {
2079 t_sstorage
.fails
.clear(remoteIP
);
2086 LOG(prefix
<<qname
<<": truncated bit set, over TCP?"<<endl
);
2087 /* let's treat that as a ServFail answer from this server */
2088 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(remoteIP
, qname
, qtype
.getCode()), 60, 3);
2098 bool SyncRes::processAnswer(unsigned int depth
, LWResult
& lwr
, const DNSName
& qname
, const QType
& qtype
, DNSName
& auth
, bool wasForwarded
, const boost::optional
<Netmask
> ednsmask
, bool sendRDQuery
, NsSet
&nameservers
, std::vector
<DNSRecord
>& ret
, const DNSFilterEngine
& dfe
, bool* gotNewServers
, int* rcode
, vState
& state
, const SyncRes::zonesStates_t
& cuts
)
2103 prefix
.append(depth
, ' ');
2107 for(auto& rec
: lwr
.d_records
) {
2108 rec
.d_ttl
= max(rec
.d_ttl
, s_minimumTTL
);
2112 bool needWildcardProof
= false;
2113 *rcode
= updateCacheFromRecords(depth
, lwr
, qname
, auth
, wasForwarded
, ednsmask
, state
, cuts
, needWildcardProof
);
2114 if (*rcode
!= RCode::NoError
) {
2118 LOG(prefix
<<qname
<<": determining status after receiving this packet"<<endl
);
2121 bool realreferral
=false, negindic
=false;
2125 bool done
= processRecords(prefix
, qname
, qtype
, auth
, lwr
, sendRDQuery
, ret
, nsset
, newtarget
, newauth
, realreferral
, negindic
, state
, needWildcardProof
);
2128 LOG(prefix
<<qname
<<": status=got results, this level of recursion done"<<endl
);
2129 *rcode
= RCode::NoError
;
2133 if(!newtarget
.empty()) {
2134 if(newtarget
== qname
) {
2135 LOG(prefix
<<qname
<<": status=got a CNAME referral to self, returning SERVFAIL"<<endl
);
2136 *rcode
= RCode::ServFail
;
2141 LOG(prefix
<<qname
<<": status=got a CNAME referral, but recursing too deep, returning SERVFAIL"<<endl
);
2142 *rcode
= RCode::ServFail
;
2146 LOG(prefix
<<qname
<<": status=got a CNAME referral, starting over with "<<newtarget
<<endl
);
2148 set
<GetBestNSAnswer
> beenthere2
;
2149 vState cnameState
= Indeterminate
;
2150 *rcode
= doResolve(newtarget
, qtype
, ret
, depth
+ 1, beenthere2
, cnameState
);
2151 LOG("Updating validation state for response to "<<qname
<<" from "<<vStates
[state
]<<" with the state from the CNAME quest: "<<vStates
[cnameState
]<<endl
);
2152 updateValidationState(state
, cnameState
);
2157 if(lwr
.d_rcode
== RCode::NXDomain
) {
2158 LOG(prefix
<<qname
<<": status=NXDOMAIN, we are done "<<(negindic
? "(have negative SOA)" : "")<<endl
);
2161 addNXNSECS(ret
, lwr
.d_records
);
2163 *rcode
= RCode::NXDomain
;
2167 if(nsset
.empty() && !lwr
.d_rcode
&& (negindic
|| lwr
.d_aabit
|| sendRDQuery
)) {
2168 LOG(prefix
<<qname
<<": status=noerror, other types may exist, but we are done "<<(negindic
? "(have negative SOA) " : "")<<(lwr
.d_aabit
? "(have aa bit) " : "")<<endl
);
2171 addNXNSECS(ret
, lwr
.d_records
);
2173 *rcode
= RCode::NoError
;
2178 LOG(prefix
<<qname
<<": status=did not resolve, got "<<(unsigned int)nsset
.size()<<" NS, ");
2180 nameservers
.clear();
2181 for (auto const &nameserver
: nsset
) {
2183 d_appliedPolicy
= dfe
.getProcessingPolicy(nameserver
, d_discardedPolicies
);
2184 if (d_appliedPolicy
.d_kind
!= DNSFilterEngine::PolicyKind::NoAction
) { // client query needs an RPZ response
2185 LOG("however "<<nameserver
<<" was blocked by RPZ policy '"<<(d_appliedPolicy
.d_name
? *d_appliedPolicy
.d_name
: "")<<"'"<<endl
);
2190 nameservers
.insert({nameserver
, {{}, false}});
2192 LOG("looping to them"<<endl
);
2193 *gotNewServers
= true;
2194 //updateValidationStatusAfterReferral(qname, auth, newauth, state, depth);
2204 * -1 in case of no results
2205 * -2 when a FilterEngine Policy was hit
2208 int SyncRes::doResolveAt(NsSet
&nameservers
, DNSName auth
, bool flawedNSSet
, const DNSName
&qname
, const QType
&qtype
,
2209 vector
<DNSRecord
>&ret
,
2210 unsigned int depth
, set
<GetBestNSAnswer
>&beenthere
, vState
& state
, const SyncRes::zonesStates_t
& cuts
)
2212 auto luaconfsLocal
= g_luaconfs
.getLocal();
2216 prefix
.append(depth
, ' ');
2219 LOG(prefix
<<qname
<<": Cache consultations done, have "<<(unsigned int)nameservers
.size()<<" NS to contact");
2221 if (nameserversBlockedByRPZ(luaconfsLocal
->dfe
, nameservers
)) {
2227 for(;;) { // we may get more specific nameservers
2228 vector
<DNSName
> rnameservers
= shuffleInSpeedOrder(nameservers
, doLog() ? (prefix
+qname
.toString()+": ") : string() );
2230 for(auto tns
=rnameservers
.cbegin();;++tns
) {
2231 if(tns
==rnameservers
.cend()) {
2232 LOG(prefix
<<qname
<<": Failed to resolve via any of the "<<(unsigned int)rnameservers
.size()<<" offered NS at level '"<<auth
<<"'"<<endl
);
2233 if(!auth
.isRoot() && flawedNSSet
) {
2234 LOG(prefix
<<qname
<<": Ageing nameservers for level '"<<auth
<<"', next query might succeed"<<endl
);
2236 if(t_RC
->doAgeCache(d_now
.tv_sec
, auth
, QType::NS
, 10))
2237 g_stats
.nsSetInvalidations
++;
2242 // this line needs to identify the 'self-resolving' behaviour, but we get it wrong now
2243 if(qname
== *tns
&& qtype
.getCode()==QType::A
&& rnameservers
.size() > (size_t)(1+1*s_doIPv6
)) {
2244 LOG(prefix
<<qname
<<": Not using NS to resolve itself! ("<<(1+tns
-rnameservers
.cbegin())<<"/"<<rnameservers
.size()<<")"<<endl
);
2248 typedef vector
<ComboAddress
> remoteIPs_t
;
2249 remoteIPs_t remoteIPs
;
2250 remoteIPs_t::const_iterator remoteIP
;
2251 bool pierceDontQuery
=false;
2252 bool sendRDQuery
=false;
2253 boost::optional
<Netmask
> ednsmask
;
2255 const bool wasForwarded
= tns
->empty() && (!nameservers
[*tns
].first
.empty());
2256 int rcode
= RCode::NoError
;
2257 bool gotNewServers
= false;
2259 if(tns
->empty() && !wasForwarded
) {
2260 LOG(prefix
<<qname
<<": Domain is out-of-band"<<endl
);
2262 d_wasOutOfBand
= doOOBResolve(qname
, qtype
, lwr
.d_records
, depth
, lwr
.d_rcode
);
2266 /* we have received an answer, are we done ? */
2267 bool done
= processAnswer(depth
, lwr
, qname
, qtype
, auth
, false, ednsmask
, sendRDQuery
, nameservers
, ret
, luaconfsLocal
->dfe
, &gotNewServers
, &rcode
, state
, cuts
);
2271 if (gotNewServers
) {
2276 /* if tns is empty, retrieveAddressesForNS() knows we have hardcoded servers (i.e. "forwards") */
2277 remoteIPs
= retrieveAddressesForNS(prefix
, qname
, tns
, depth
, beenthere
, rnameservers
, nameservers
, sendRDQuery
, pierceDontQuery
, flawedNSSet
);
2279 if(remoteIPs
.empty()) {
2280 LOG(prefix
<<qname
<<": Failed to get IP for NS "<<*tns
<<", trying next if available"<<endl
);
2285 bool hitPolicy
{false};
2286 LOG(prefix
<<qname
<<": Resolved '"<<auth
<<"' NS "<<*tns
<<" to: ");
2287 for(remoteIP
= remoteIPs
.cbegin(); remoteIP
!= remoteIPs
.cend(); ++remoteIP
) {
2288 if(remoteIP
!= remoteIPs
.cbegin()) {
2291 LOG(remoteIP
->toString());
2292 if(nameserverIPBlockedByRPZ(luaconfsLocal
->dfe
, *remoteIP
)) {
2297 if (hitPolicy
) //implies d_wantsRPZ
2301 for(remoteIP
= remoteIPs
.cbegin(); remoteIP
!= remoteIPs
.cend(); ++remoteIP
) {
2302 LOG(prefix
<<qname
<<": Trying IP "<< remoteIP
->toStringWithPort() <<", asking '"<<qname
<<"|"<<qtype
.getName()<<"'"<<endl
);
2304 if (throttledOrBlocked(prefix
, *remoteIP
, qname
, qtype
, pierceDontQuery
)) {
2308 bool truncated
= false;
2309 bool gotAnswer
= doResolveAtThisIP(prefix
, qname
, qtype
, lwr
, ednsmask
, auth
, sendRDQuery
,
2310 *tns
, *remoteIP
, false, &truncated
);
2311 if (gotAnswer
&& truncated
) {
2312 /* retry, over TCP this time */
2313 gotAnswer
= doResolveAtThisIP(prefix
, qname
, qtype
, lwr
, ednsmask
, auth
, sendRDQuery
,
2314 *tns
, *remoteIP
, true, &truncated
);
2321 LOG(prefix
<<qname
<<": Got "<<(unsigned int)lwr
.d_records
.size()<<" answers from "<<*tns
<<" ("<< remoteIP
->toString() <<"), rcode="<<lwr
.d_rcode
<<" ("<<RCode::to_s(lwr
.d_rcode
)<<"), aa="<<lwr
.d_aabit
<<", in "<<lwr
.d_usec
/1000<<"ms"<<endl
);
2323 /* // for you IPv6 fanatics :-)
2324 if(remoteIP->sin4.sin_family==AF_INET6)
2327 // cout<<"msec: "<<lwr.d_usec/1000.0<<", "<<g_avgLatency/1000.0<<'\n';
2329 t_sstorage
.nsSpeeds
[*tns
].submit(*remoteIP
, lwr
.d_usec
, &d_now
);
2331 /* we have received an answer, are we done ? */
2332 bool done
= processAnswer(depth
, lwr
, qname
, qtype
, auth
, wasForwarded
, ednsmask
, sendRDQuery
, nameservers
, ret
, luaconfsLocal
->dfe
, &gotNewServers
, &rcode
, state
, cuts
);
2336 if (gotNewServers
) {
2340 t_sstorage
.throttle
.throttle(d_now
.tv_sec
, boost::make_tuple(*remoteIP
, qname
, qtype
.getCode()), 60, 100);
2343 if (gotNewServers
) {
2347 if(remoteIP
== remoteIPs
.cend()) // we tried all IP addresses, none worked
2356 boost::optional
<Netmask
> SyncRes::getEDNSSubnetMask(const ComboAddress
& local
, const DNSName
&dn
, const ComboAddress
& rem
)
2358 boost::optional
<Netmask
> result
;
2361 if(d_incomingECSFound
) {
2362 if (d_incomingECS
->source
.getBits() == 0) {
2363 /* RFC7871 says we MUST NOT send any ECS if the source scope is 0 */
2366 trunc
= d_incomingECS
->source
.getMaskedNetwork();
2367 bits
= d_incomingECS
->source
.getBits();
2369 else if(!local
.isIPv4() || local
.sin4
.sin_addr
.s_addr
) { // detect unset 'requestor'
2371 bits
= local
.isIPv4() ? 32 : 128;
2374 /* nothing usable */
2378 if(s_ednsdomains
.check(dn
) || s_ednssubnets
.match(rem
)) {
2379 bits
= std::min(bits
, (trunc
.isIPv4() ? s_ecsipv4limit
: s_ecsipv6limit
));
2380 trunc
.truncate(bits
);
2381 return boost::optional
<Netmask
>(Netmask(trunc
, bits
));
2387 void SyncRes::parseEDNSSubnetWhitelist(const std::string
& wlist
)
2389 vector
<string
> parts
;
2390 stringtok(parts
, wlist
, ",; ");
2391 for(const auto& a
: parts
) {
2393 s_ednssubnets
.addMask(Netmask(a
));
2396 s_ednsdomains
.add(DNSName(a
));
2401 // used by PowerDNSLua - note that this neglects to add the packet count & statistics back to pdns_ercursor.cc
2402 int directResolve(const DNSName
& qname
, const QType
& qtype
, int qclass
, vector
<DNSRecord
>& ret
)
2405 gettimeofday(&now
, 0);
2408 int res
= sr
.beginResolve(qname
, QType(qtype
), qclass
, ret
);
2413 int SyncRes::getRootNS(struct timeval now
, asyncresolve_t asyncCallback
) {
2415 sr
.setDoEDNS0(true);
2416 sr
.setUpdatingRootNS();
2417 sr
.setDoDNSSEC(g_dnssecmode
!= DNSSECMode::Off
);
2418 sr
.setAsyncCallback(asyncCallback
);
2420 vector
<DNSRecord
> ret
;
2423 res
=sr
.beginResolve(g_rootdnsname
, QType(QType::NS
), 1, ret
);
2424 if (g_dnssecmode
!= DNSSECMode::Off
&& g_dnssecmode
!= DNSSECMode::ProcessNoValidate
) {
2425 auto state
= sr
.getValidationState();
2427 throw PDNSException("Got Bogus validation result for .|NS");
2431 catch(const PDNSException
& e
) {
2432 L
<<Logger::Error
<<"Failed to update . records, got an exception: "<<e
.reason
<<endl
;
2434 catch(const ImmediateServFailException
& e
) {
2435 L
<<Logger::Error
<<"Failed to update . records, got an exception: "<<e
.reason
<<endl
;
2437 catch(const std::exception
& e
) {
2438 L
<<Logger::Error
<<"Failed to update . records, got an exception: "<<e
.what()<<endl
;
2441 L
<<Logger::Error
<<"Failed to update . records, got an exception"<<endl
;
2445 L
<<Logger::Notice
<<"Refreshed . records"<<endl
;
2448 L
<<Logger::Error
<<"Failed to update . records, RCODE="<<res
<<endl
;