]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
27 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
28 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
);
29 static int do_check_sign(struct frec
*forward
, int status
, time_t now
, char *name
, char *keyname
);
30 static int send_check_sign(struct frec
*forward
, time_t now
, struct dns_header
*header
, size_t plen
,
31 char *name
, char *keyname
);
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
38 union mysockaddr
*to
, struct all_addr
*source
,
44 struct cmsghdr align
; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
47 #elif defined(IP_SENDSRCADDR)
48 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
51 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
55 iov
[0].iov_base
= packet
;
58 msg
.msg_control
= NULL
;
59 msg
.msg_controllen
= 0;
62 msg
.msg_namelen
= sa_len(to
);
68 struct cmsghdr
*cmptr
;
69 msg
.msg_control
= &control_u
;
70 msg
.msg_controllen
= sizeof(control_u
);
71 cmptr
= CMSG_FIRSTHDR(&msg
);
73 if (to
->sa
.sa_family
== AF_INET
)
75 #if defined(HAVE_LINUX_NETWORK)
78 p
.ipi_spec_dst
= source
->addr
.addr4
;
79 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
80 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
81 cmptr
->cmsg_level
= IPPROTO_IP
;
82 cmptr
->cmsg_type
= IP_PKTINFO
;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
85 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
86 cmptr
->cmsg_level
= IPPROTO_IP
;
87 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
94 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
95 p
.ipi6_addr
= source
->addr
.addr6
;
96 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
97 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
98 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
99 cmptr
->cmsg_level
= IPPROTO_IPV6
;
102 (void)iface
; /* eliminate warning */
106 while (retry_send(sendmsg(fd
, &msg
, 0)));
108 /* If interface is still in DAD, EINVAL results - ignore that. */
109 if (errno
!= 0 && errno
!= EINVAL
)
111 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
118 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
119 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
122 /* If the query ends in the domain in one of our servers, set
123 domain to point to that name. We find the largest match to allow both
124 domain.org and sub.domain.org to exist. */
126 unsigned int namelen
= strlen(qdomain
);
127 unsigned int matchlen
= 0;
129 unsigned int flags
= 0;
131 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
132 /* domain matches take priority over NODOTS matches */
133 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
135 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
136 *type
= SERV_FOR_NODOTS
;
137 if (serv
->flags
& SERV_NO_ADDR
)
139 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
144 if (serv
->addr
.sa
.sa_family
== AF_INET
)
145 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
148 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
151 else if (!flags
|| (flags
& F_NXDOMAIN
))
155 else if (serv
->flags
& SERV_HAS_DOMAIN
)
157 unsigned int domainlen
= strlen(serv
->domain
);
158 char *matchstart
= qdomain
+ namelen
- domainlen
;
159 if (namelen
>= domainlen
&&
160 hostname_isequal(matchstart
, serv
->domain
) &&
161 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
163 if (serv
->flags
& SERV_NO_REBIND
)
167 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
168 /* implement priority rules for --address and --server for same domain.
169 --address wins if the address is for the correct AF
170 --server wins otherwise. */
171 if (domainlen
!= 0 && domainlen
== matchlen
)
173 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
175 if (!(sflag
& qtype
) && flags
== 0)
180 if (flags
& (F_IPV4
| F_IPV6
))
185 if (domainlen
>= matchlen
)
187 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
188 *domain
= serv
->domain
;
189 matchlen
= domainlen
;
190 if (serv
->flags
& SERV_NO_ADDR
)
192 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
197 if (serv
->addr
.sa
.sa_family
== AF_INET
)
198 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
201 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
204 else if (!flags
|| (flags
& F_NXDOMAIN
))
214 if (flags
== 0 && !(qtype
& F_QUERY
) &&
215 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
216 /* don't forward A or AAAA queries for simple names, except the empty name */
219 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
226 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
227 logflags
= F_NEG
| qtype
;
229 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
231 else if ((*type
) & SERV_USE_RESOLV
)
233 *type
= 0; /* use normal servers for this domain */
239 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
240 struct all_addr
*dst_addr
, unsigned int dst_iface
,
241 struct dns_header
*header
, size_t plen
, time_t now
,
242 struct frec
*forward
, int ad_reqd
, int do_bit
)
245 int type
= 0, norebind
= 0;
246 struct all_addr
*addrp
= NULL
;
247 unsigned int flags
= 0;
248 struct server
*start
= NULL
;
250 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
252 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
255 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
256 unsigned char *pheader
;
260 /* may be no servers available. */
261 if (!daemon
->servers
)
263 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
265 /* If we didn't get an answer advertising a maximal packet in EDNS,
266 fall back to 1280, which should work everywhere on IPv6.
267 If that generates an answer, it will become the new default
269 forward
->flags
|= FREC_TEST_PKTSZ
;
272 /* If we've already got an answer to this query, but we're awaiting keys for validation,
273 there's no point retrying the query, retry the key query instead...... */
274 if (forward
->blocking_query
)
278 forward
->flags
&= ~FREC_TEST_PKTSZ
;
280 while (forward
->blocking_query
)
281 forward
= forward
->blocking_query
;
283 forward
->flags
|= FREC_TEST_PKTSZ
;
285 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
286 plen
= forward
->stash_len
;
288 if (find_pseudoheader(header
, plen
, NULL
, &pheader
, NULL
))
289 PUTSHORT((forward
->flags
& FREC_TEST_PKTSZ
) ? SAFE_PKTSZ
: forward
->sentto
->edns_pktsz
, pheader
);
291 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET
)
292 log_query(F_NOEXTRA
| F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
295 log_query(F_NOEXTRA
| F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
298 if (forward
->sentto
->sfd
)
299 fd
= forward
->sentto
->sfd
->fd
;
303 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
304 fd
= forward
->rfd6
->fd
;
307 fd
= forward
->rfd4
->fd
;
310 while (retry_send( sendto(fd
, (char *)header
, plen
, 0,
311 &forward
->sentto
->addr
.sa
,
312 sa_len(&forward
->sentto
->addr
))));
318 /* retry on existing query, send to all available servers */
319 domain
= forward
->sentto
->domain
;
320 forward
->sentto
->failed_queries
++;
321 if (!option_bool(OPT_ORDER
))
323 forward
->forwardall
= 1;
324 daemon
->last_server
= NULL
;
326 type
= forward
->sentto
->flags
& SERV_TYPE
;
327 if (!(start
= forward
->sentto
->next
))
328 start
= daemon
->servers
; /* at end of list, recycle */
329 header
->id
= htons(forward
->new_id
);
334 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
336 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
337 /* table full - server failure. */
342 forward
->source
= *udpaddr
;
343 forward
->dest
= *dst_addr
;
344 forward
->iface
= dst_iface
;
345 forward
->orig_id
= ntohs(header
->id
);
346 forward
->new_id
= get_id();
348 memcpy(forward
->hash
, hash
, HASH_SIZE
);
349 forward
->forwardall
= 0;
352 forward
->flags
|= FREC_NOREBIND
;
353 if (header
->hb4
& HB4_CD
)
354 forward
->flags
|= FREC_CHECKING_DISABLED
;
356 forward
->flags
|= FREC_AD_QUESTION
;
358 forward
->work_counter
= DNSSEC_WORK
;
360 forward
->flags
|= FREC_DO_QUESTION
;
363 header
->id
= htons(forward
->new_id
);
365 /* In strict_order mode, always try servers in the order
366 specified in resolv.conf, if a domain is given
367 always try all the available servers,
368 otherwise, use the one last known to work. */
372 if (option_bool(OPT_ORDER
))
373 start
= daemon
->servers
;
374 else if (!(start
= daemon
->last_server
) ||
375 daemon
->forwardcount
++ > FORWARD_TEST
||
376 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
378 start
= daemon
->servers
;
379 forward
->forwardall
= 1;
380 daemon
->forwardcount
= 0;
381 daemon
->forwardtime
= now
;
386 start
= daemon
->servers
;
387 if (!option_bool(OPT_ORDER
))
388 forward
->forwardall
= 1;
393 /* check for send errors here (no route to host)
394 if we fail to send to all nameservers, send back an error
395 packet straight away (helps modem users when offline) */
397 if (!flags
&& forward
)
399 struct server
*firstsentto
= start
;
402 /* If a query is retried, use the log_id for the retry when logging the answer. */
403 forward
->log_id
= daemon
->log_id
;
405 if (option_bool(OPT_ADD_MAC
))
406 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
408 if (option_bool(OPT_CLIENT_SUBNET
))
410 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
414 forward
->flags
|= FREC_HAS_SUBNET
;
419 if (option_bool(OPT_DNSSEC_VALID
))
421 size_t new_plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
423 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
424 this allows it to select auth servers when one is returning bad data. */
425 if (option_bool(OPT_DNSSEC_DEBUG
))
426 header
->hb4
|= HB4_CD
;
428 if (new_plen
!= plen
)
429 forward
->flags
|= FREC_ADDED_PHEADER
;
437 /* only send to servers dealing with our domain.
438 domain may be NULL, in which case server->domain
439 must be NULL also. */
441 if (type
== (start
->flags
& SERV_TYPE
) &&
442 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
443 !(start
->flags
& (SERV_LITERAL_ADDRESS
| SERV_LOOP
)))
447 /* find server socket to use, may need to get random one. */
453 if (start
->addr
.sa
.sa_family
== AF_INET6
)
455 if (!forward
->rfd6
&&
456 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
458 daemon
->rfd_save
= forward
->rfd6
;
459 fd
= forward
->rfd6
->fd
;
464 if (!forward
->rfd4
&&
465 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
467 daemon
->rfd_save
= forward
->rfd4
;
468 fd
= forward
->rfd4
->fd
;
471 #ifdef HAVE_CONNTRACK
472 /* Copy connection mark of incoming query to outgoing connection. */
473 if (option_bool(OPT_CONNTRACK
))
476 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
477 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
482 if (find_pseudoheader(header
, plen
, NULL
, &pheader
, NULL
))
483 PUTSHORT((forward
->flags
& FREC_TEST_PKTSZ
) ? SAFE_PKTSZ
: start
->edns_pktsz
, pheader
);
485 if (retry_send(sendto(fd
, (char *)header
, plen
, 0,
487 sa_len(&start
->addr
))))
492 /* Keep info in case we want to re-send this packet */
493 daemon
->srv_save
= start
;
494 daemon
->packet_len
= plen
;
497 strcpy(daemon
->namebuff
, "query");
498 if (start
->addr
.sa
.sa_family
== AF_INET
)
499 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
500 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
503 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
504 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
508 forward
->sentto
= start
;
509 if (!forward
->forwardall
)
511 forward
->forwardall
++;
515 if (!(start
= start
->next
))
516 start
= daemon
->servers
;
518 if (start
== firstsentto
)
525 /* could not send on, prepare to return */
526 header
->id
= htons(forward
->orig_id
);
527 free_frec(forward
); /* cancel */
530 /* could not send on, return empty answer or address if known for whole domain */
533 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
534 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
540 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
541 int no_cache
, int cache_secure
, int bogusanswer
, int ad_reqd
, int do_bit
, int added_pheader
,
542 int check_subnet
, union mysockaddr
*query_source
)
544 unsigned char *pheader
, *sizep
;
546 int munged
= 0, is_sign
;
554 if (daemon
->ipsets
&& extract_request(header
, n
, daemon
->namebuff
, NULL
))
556 /* Similar algorithm to search_servers. */
557 struct ipsets
*ipset_pos
;
558 unsigned int namelen
= strlen(daemon
->namebuff
);
559 unsigned int matchlen
= 0;
560 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
562 unsigned int domainlen
= strlen(ipset_pos
->domain
);
563 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
564 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
565 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
566 domainlen
>= matchlen
)
568 matchlen
= domainlen
;
569 sets
= ipset_pos
->sets
;
575 /* If upstream is advertising a larger UDP packet size
576 than we allow, trim it so that we don't get overlarge
577 requests for the client. We can't do this for signed packets. */
579 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
581 unsigned short udpsz
;
582 unsigned char *psave
= sizep
;
584 GETSHORT(udpsz
, sizep
);
586 if (!is_sign
&& udpsz
> daemon
->edns_pktsz
)
587 PUTSHORT(daemon
->edns_pktsz
, psave
);
589 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
591 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
598 header
->arcount
= htons(0);
602 /* RFC 4035 sect 4.6 para 3 */
603 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
604 header
->hb4
&= ~HB4_AD
;
606 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
607 return resize_packet(header
, n
, pheader
, plen
);
609 /* Complain loudly if the upstream server is non-recursive. */
610 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
611 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
613 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
614 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
615 if (!option_bool(OPT_LOG
))
616 server
->flags
|= SERV_WARNED_RECURSIVE
;
619 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
620 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
623 SET_RCODE(header
, NXDOMAIN
);
624 header
->hb3
&= ~HB3_AA
;
631 if (RCODE(header
) == NXDOMAIN
&&
632 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
633 check_for_local_domain(daemon
->namebuff
, now
))
635 /* if we forwarded a query for a locally known name (because it was for
636 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
637 since we know that the domain exists, even if upstream doesn't */
639 header
->hb3
|= HB3_AA
;
640 SET_RCODE(header
, NOERROR
);
644 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
646 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
656 if (bogusanswer
&& !(header
->hb4
& HB4_CD
))
658 if (!option_bool(OPT_DNSSEC_DEBUG
))
660 /* Bogus reply, turn into SERVFAIL */
661 SET_RCODE(header
, SERVFAIL
);
666 if (option_bool(OPT_DNSSEC_VALID
))
667 header
->hb4
&= ~HB4_AD
;
669 if (!(header
->hb4
& HB4_CD
) && ad_reqd
&& cache_secure
)
670 header
->hb4
|= HB4_AD
;
672 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
674 n
= filter_rrsigs(header
, n
);
677 /* do this after extract_addresses. Ensure NODATA reply and remove
682 header
->ancount
= htons(0);
683 header
->nscount
= htons(0);
684 header
->arcount
= htons(0);
685 header
->hb3
&= ~HB3_TC
;
688 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
689 sections of the packet. Find the new length here and put back pseudoheader
690 if it was removed. */
691 return resize_packet(header
, n
, pheader
, plen
);
694 /* sets new last_server */
695 void reply_query(int fd
, int family
, time_t now
)
697 /* packet from peer server, extract data for cache, and send to
698 original requester */
699 struct dns_header
*header
;
700 union mysockaddr serveraddr
;
701 struct frec
*forward
;
702 socklen_t addrlen
= sizeof(serveraddr
);
703 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
705 struct server
*server
;
711 /* packet buffer overwritten */
712 daemon
->srv_save
= NULL
;
714 /* Determine the address of the server replying so that we can mark that as good */
715 serveraddr
.sa
.sa_family
= family
;
717 if (serveraddr
.sa
.sa_family
== AF_INET6
)
718 serveraddr
.in6
.sin6_flowinfo
= 0;
721 header
= (struct dns_header
*)daemon
->packet
;
723 if (n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
))
726 /* spoof check: answer must come from known server, */
727 for (server
= daemon
->servers
; server
; server
= server
->next
)
728 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
729 sockaddr_isequal(&server
->addr
, &serveraddr
))
736 hash
= hash_questions(header
, n
, daemon
->namebuff
);
739 crc
= questions_crc(header
, n
, daemon
->namebuff
);
742 if (!(forward
= lookup_frec(ntohs(header
->id
), hash
)))
745 /* log_query gets called indirectly all over the place, so
746 pass these in global variables - sorry. */
747 daemon
->log_display_id
= forward
->log_id
;
748 daemon
->log_source_addr
= &forward
->source
;
750 if (daemon
->ignore_addr
&& RCODE(header
) == NOERROR
&&
751 check_for_ignored_address(header
, n
, daemon
->ignore_addr
))
754 if (RCODE(header
) == REFUSED
&&
755 !option_bool(OPT_ORDER
) &&
756 forward
->forwardall
== 0)
757 /* for broken servers, attempt to send to another one. */
759 unsigned char *pheader
;
763 /* recreate query from reply */
764 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
767 header
->ancount
= htons(0);
768 header
->nscount
= htons(0);
769 header
->arcount
= htons(0);
770 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
772 header
->hb3
&= ~(HB3_QR
| HB3_AA
| HB3_TC
);
773 header
->hb4
&= ~(HB4_RA
| HB4_RCODE
);
774 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
, 0, 0);
780 server
= forward
->sentto
;
781 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
783 if (RCODE(header
) == REFUSED
)
787 struct server
*last_server
;
789 /* find good server by address if possible, otherwise assume the last one we sent to */
790 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
791 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
792 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
794 server
= last_server
;
798 if (!option_bool(OPT_ALL_SERVERS
))
799 daemon
->last_server
= server
;
802 /* We tried resending to this server with a smaller maximum size and got an answer.
803 Make that permanent. To avoid reduxing the packet size for an single dropped packet,
804 only do this when we get a truncated answer, or one larger than the safe size. */
805 if (server
&& (forward
->flags
& FREC_TEST_PKTSZ
) &&
806 ((header
->hb3
& HB3_TC
) || n
>= SAFE_PKTSZ
))
807 server
->edns_pktsz
= SAFE_PKTSZ
;
809 /* If the answer is an error, keep the forward record in place in case
810 we get a good reply from another server. Kill it when we've
811 had replies from all to avoid filling the forwarding table when
812 everything is broken */
813 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 || RCODE(header
) != SERVFAIL
)
815 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0, bogusanswer
= 0;
817 if (option_bool(OPT_NO_REBIND
))
818 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
820 /* Don't cache replies where DNSSEC validation was turned off, either
821 the upstream server told us so, or the original query specified it. */
822 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
826 if (server
&& option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
830 /* We've had a reply already, which we're validating. Ignore this duplicate */
831 if (forward
->blocking_query
)
834 if (header
->hb3
& HB3_TC
)
836 /* Truncated answer can't be validated.
837 If this is an answer to a DNSSEC-generated query, we still
838 need to get the client to retry over TCP, so return
839 an answer with the TC bit set, even if the actual answer fits.
841 status
= STAT_TRUNCATED
;
843 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
844 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
845 else if (forward
->flags
& FREC_DS_QUERY
)
847 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
848 /* Provably no DS, everything below is insecure, even if signatures are offered */
849 if (status
== STAT_NO_DS
)
850 /* We only cache sigs when we've validated a reply.
851 Avoid caching a reply with sigs if there's a vaildated break in the
852 DS chain, so we don't return replies from cache missing sigs. */
853 status
= STAT_INSECURE_DS
;
854 else if (status
== STAT_NO_NS
)
857 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
859 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
860 if (status
!= STAT_NEED_KEY
)
861 status
= do_check_sign(forward
, status
, now
, daemon
->namebuff
, daemon
->keyname
);
865 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
, NULL
);
866 if (status
== STAT_NO_SIG
)
868 if (option_bool(OPT_DNSSEC_NO_SIGN
))
869 status
= send_check_sign(forward
, now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
871 status
= STAT_INSECURE
;
874 /* Can't validate, as we're missing key data. Put this
875 answer aside, whilst we get that. */
876 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
878 struct frec
*new, *orig
;
880 /* Free any saved query */
882 blockdata_free(forward
->stash
);
884 /* Now save reply pending receipt of key data */
885 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
887 forward
->stash_len
= n
;
890 /* Find the original query that started it all.... */
891 for (orig
= forward
; orig
->dependent
; orig
= orig
->dependent
);
893 if (--orig
->work_counter
== 0 || !(new = get_new_frec(now
, NULL
, 1)))
894 status
= STAT_INSECURE
;
898 struct frec
*next
= new->next
;
899 *new = *forward
; /* copy everything, then overwrite */
901 new->blocking_query
= NULL
;
902 new->sentto
= server
;
904 new->orig_domain
= NULL
;
908 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
| FREC_CHECK_NOSIGN
);
910 new->dependent
= forward
; /* to find query awaiting new one. */
911 forward
->blocking_query
= new; /* for garbage cleaning */
912 /* validate routines leave name of required record in daemon->keyname */
913 if (status
== STAT_NEED_KEY
)
915 new->flags
|= FREC_DNSKEY_QUERY
;
916 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
917 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
, server
->edns_pktsz
);
921 if (status
== STAT_NEED_DS_NEG
)
922 new->flags
|= FREC_CHECK_NOSIGN
;
924 new->flags
|= FREC_DS_QUERY
;
925 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
926 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
, server
->edns_pktsz
);
928 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
929 memcpy(new->hash
, hash
, HASH_SIZE
);
930 new->new_id
= get_id();
931 header
->id
= htons(new->new_id
);
932 /* Save query for retransmission */
933 if (!(new->stash
= blockdata_alloc((char *)header
, nn
)))
938 /* Don't resend this. */
939 daemon
->srv_save
= NULL
;
942 fd
= server
->sfd
->fd
;
947 if (server
->addr
.sa
.sa_family
== AF_INET6
)
949 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
955 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
962 while (retry_send(sendto(fd
, (char *)header
, nn
, 0,
964 sa_len(&server
->addr
))));
972 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
973 Now wind back down, pulling back answers which wouldn't previously validate
974 and validate them with the new data. Note that if an answer needs multiple
975 keys to validate, we may find another key is needed, in which case we set off
976 down another branch of the tree. Once we get to the original answer
977 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
978 while (forward
->dependent
)
980 struct frec
*prev
= forward
->dependent
;
983 forward
->blocking_query
= NULL
; /* already gone */
984 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
985 n
= forward
->stash_len
;
987 if (status
== STAT_SECURE
)
989 if (forward
->flags
& FREC_DNSKEY_QUERY
)
990 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
991 else if (forward
->flags
& FREC_DS_QUERY
)
993 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
994 /* Provably no DS, everything below is insecure, even if signatures are offered */
995 if (status
== STAT_NO_DS
)
996 /* We only cache sigs when we've validated a reply.
997 Avoid caching a reply with sigs if there's a vaildated break in the
998 DS chain, so we don't return replies from cache missing sigs. */
999 status
= STAT_INSECURE_DS
;
1000 else if (status
== STAT_NO_NS
)
1001 status
= STAT_BOGUS
;
1003 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
1005 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
1006 if (status
!= STAT_NEED_KEY
)
1007 status
= do_check_sign(forward
, status
, now
, daemon
->namebuff
, daemon
->keyname
);
1011 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
, NULL
);
1012 if (status
== STAT_NO_SIG
)
1014 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1015 status
= send_check_sign(forward
, now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
1017 status
= STAT_INSECURE
;
1021 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
1026 no_cache_dnssec
= 0;
1028 if (status
== STAT_INSECURE_DS
)
1030 /* We only cache sigs when we've validated a reply.
1031 Avoid caching a reply with sigs if there's a vaildated break in the
1032 DS chain, so we don't return replies from cache missing sigs. */
1033 status
= STAT_INSECURE
;
1034 no_cache_dnssec
= 1;
1037 if (status
== STAT_TRUNCATED
)
1038 header
->hb3
|= HB3_TC
;
1041 char *result
, *domain
= "result";
1043 if (forward
->work_counter
== 0)
1045 result
= "ABANDONED";
1046 status
= STAT_BOGUS
;
1049 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1051 if (status
== STAT_BOGUS
&& extract_request(header
, n
, daemon
->namebuff
, NULL
))
1052 domain
= daemon
->namebuff
;
1054 log_query(F_KEYTAG
| F_SECSTAT
, domain
, NULL
, result
);
1057 if (status
== STAT_SECURE
)
1059 else if (status
== STAT_BOGUS
)
1061 no_cache_dnssec
= 1;
1067 /* restore CD bit to the value in the query */
1068 if (forward
->flags
& FREC_CHECKING_DISABLED
)
1069 header
->hb4
|= HB4_CD
;
1071 header
->hb4
&= ~HB4_CD
;
1073 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
, bogusanswer
,
1074 forward
->flags
& FREC_AD_QUESTION
, forward
->flags
& FREC_DO_QUESTION
,
1075 forward
->flags
& FREC_ADDED_PHEADER
, forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
1077 header
->id
= htons(forward
->orig_id
);
1078 header
->hb4
|= HB4_RA
; /* recursion if available */
1079 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
1080 &forward
->source
, &forward
->dest
, forward
->iface
);
1082 free_frec(forward
); /* cancel */
1087 void receive_query(struct listener
*listen
, time_t now
)
1089 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
1090 union mysockaddr source_addr
;
1091 unsigned short type
;
1092 struct all_addr dst_addr
;
1093 struct in_addr netmask
, dst_addr_4
;
1096 int if_index
= 0, auth_dns
= 0;
1100 struct iovec iov
[1];
1102 struct cmsghdr
*cmptr
;
1104 struct cmsghdr align
; /* this ensures alignment */
1106 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
1108 #if defined(HAVE_LINUX_NETWORK)
1109 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
1110 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1111 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1112 CMSG_SPACE(sizeof(unsigned int))];
1113 #elif defined(IP_RECVDSTADDR)
1114 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1115 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
1119 /* Can always get recvd interface for IPv6 */
1120 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
1122 int check_dst
= !option_bool(OPT_NOWILD
);
1125 /* packet buffer overwritten */
1126 daemon
->srv_save
= NULL
;
1128 dst_addr_4
.s_addr
= dst_addr
.addr
.addr4
.s_addr
= 0;
1131 if (option_bool(OPT_NOWILD
) && listen
->iface
)
1133 auth_dns
= listen
->iface
->dns_auth
;
1135 if (listen
->family
== AF_INET
)
1137 dst_addr_4
= dst_addr
.addr
.addr4
= listen
->iface
->addr
.in
.sin_addr
;
1138 netmask
= listen
->iface
->netmask
;
1142 iov
[0].iov_base
= daemon
->packet
;
1143 iov
[0].iov_len
= daemon
->edns_pktsz
;
1145 msg
.msg_control
= control_u
.control
;
1146 msg
.msg_controllen
= sizeof(control_u
);
1148 msg
.msg_name
= &source_addr
;
1149 msg
.msg_namelen
= sizeof(source_addr
);
1153 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1156 if (n
< (int)sizeof(struct dns_header
) ||
1157 (msg
.msg_flags
& MSG_TRUNC
) ||
1158 (header
->hb3
& HB3_QR
))
1161 source_addr
.sa
.sa_family
= listen
->family
;
1163 if (listen
->family
== AF_INET
)
1165 /* Source-port == 0 is an error, we can't send back to that.
1166 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1167 if (source_addr
.in
.sin_port
== 0)
1173 /* Source-port == 0 is an error, we can't send back to that. */
1174 if (source_addr
.in6
.sin6_port
== 0)
1176 source_addr
.in6
.sin6_flowinfo
= 0;
1180 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1181 if (option_bool(OPT_LOCAL_SERVICE
))
1183 struct addrlist
*addr
;
1185 if (listen
->family
== AF_INET6
)
1187 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1188 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1189 is_same_net6(&addr
->addr
.addr
.addr6
, &source_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1195 struct in_addr netmask
;
1196 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1198 netmask
.s_addr
= htonl(~(in_addr_t
)0 << (32 - addr
->prefixlen
));
1199 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1200 is_same_net(addr
->addr
.addr
.addr4
, source_addr
.in
.sin_addr
, netmask
))
1206 static int warned
= 0;
1209 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1220 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1223 #if defined(HAVE_LINUX_NETWORK)
1224 if (listen
->family
== AF_INET
)
1225 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1226 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1230 struct in_pktinfo
*p
;
1232 p
.c
= CMSG_DATA(cmptr
);
1233 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1234 if_index
= p
.p
->ipi_ifindex
;
1236 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1237 if (listen
->family
== AF_INET
)
1239 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1245 #ifndef HAVE_SOLARIS_NETWORK
1246 struct sockaddr_dl
*s
;
1249 p
.c
= CMSG_DATA(cmptr
);
1250 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1251 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1252 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1253 #ifdef HAVE_SOLARIS_NETWORK
1256 if_index
= p
.s
->sdl_index
;
1263 if (listen
->family
== AF_INET6
)
1265 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1266 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1270 struct in6_pktinfo
*p
;
1272 p
.c
= CMSG_DATA(cmptr
);
1274 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1275 if_index
= p
.p
->ipi6_ifindex
;
1280 /* enforce available interface configuration */
1282 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1285 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1287 if (!option_bool(OPT_CLEVERBIND
))
1288 enumerate_interfaces(0);
1289 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1290 !label_exception(if_index
, listen
->family
, &dst_addr
))
1294 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1298 /* get the netmask of the interface whch has the address we were sent to.
1299 This is no neccessarily the interface we arrived on. */
1301 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1302 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1303 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1306 /* interface may be new */
1307 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1308 enumerate_interfaces(0);
1310 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1311 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1312 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1315 /* If we failed, abandon localisation */
1317 netmask
= iface
->netmask
;
1319 dst_addr_4
.s_addr
= 0;
1323 /* log_query gets called indirectly all over the place, so
1324 pass these in global variables - sorry. */
1325 daemon
->log_display_id
= ++daemon
->log_id
;
1326 daemon
->log_source_addr
= &source_addr
;
1328 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1331 struct auth_zone
*zone
;
1333 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1335 if (listen
->family
== AF_INET
)
1336 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1337 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1340 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1341 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1345 /* find queries for zones we're authoritative for, and answer them directly */
1347 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1348 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1357 /* Check for forwarding loop */
1358 if (detect_loop(daemon
->namebuff
, type
))
1366 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1369 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1370 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1371 daemon
->auth_answer
++;
1377 int ad_reqd
, do_bit
;
1378 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1379 dst_addr_4
, netmask
, now
, &ad_reqd
, &do_bit
);
1383 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1384 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1385 daemon
->local_answer
++;
1387 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1388 header
, (size_t)n
, now
, NULL
, ad_reqd
, do_bit
))
1389 daemon
->queries_forwarded
++;
1391 daemon
->local_answer
++;
1397 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1398 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1399 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1400 static int send_check_sign(struct frec
*forward
, time_t now
, struct dns_header
*header
, size_t plen
,
1401 char *name
, char *keyname
)
1403 int status
= dnssec_chase_cname(now
, header
, plen
, name
, keyname
);
1405 if (status
!= STAT_INSECURE
)
1408 /* Store the domain we're trying to check. */
1409 forward
->name_start
= strlen(name
);
1410 forward
->name_len
= forward
->name_start
+ 1;
1411 if (!(forward
->orig_domain
= blockdata_alloc(name
, forward
->name_len
)))
1414 return do_check_sign(forward
, 0, now
, name
, keyname
);
1417 /* We either have a a reply (header non-NULL, or we need to start by looking in the cache */
1418 static int do_check_sign(struct frec
*forward
, int status
, time_t now
, char *name
, char *keyname
)
1420 /* get domain we're checking back from blockdata store, it's stored on the original query. */
1421 while (forward
->dependent
)
1422 forward
= forward
->dependent
;
1424 blockdata_retrieve(forward
->orig_domain
, forward
->name_len
, name
);
1434 /* Haven't received answer, see if in cache */
1435 if (!(crecp
= cache_find_by_name(NULL
, &name
[forward
->name_start
], now
, F_DS
)))
1437 /* put name of DS record we're missing into keyname */
1438 strcpy(keyname
, &name
[forward
->name_start
]);
1439 /* and wait for reply to arrive */
1440 return STAT_NEED_DS_NEG
;
1443 /* F_DNSSECOK misused in DS cache records to non-existance of NS record */
1444 if (!(crecp
->flags
& F_NEG
))
1445 status
= STAT_SECURE
;
1446 else if (crecp
->flags
& F_DNSSECOK
)
1447 status
= STAT_NO_DS
;
1449 status
= STAT_NO_NS
;
1452 /* Have entered non-signed part of DNS tree. */
1453 if (status
== STAT_NO_DS
)
1454 return STAT_INSECURE
;
1456 if (status
== STAT_BOGUS
)
1459 /* There's a proven DS record, or we're within a zone, where there doesn't need
1460 to be a DS record. Add a name and try again.
1461 If we've already tried the whole name, then fail */
1463 if (forward
->name_start
== 0)
1466 for (p
= &name
[forward
->name_start
-2]; (*p
!= '.') && (p
!= name
); p
--);
1471 forward
->name_start
= p
- name
;
1472 status
= 0; /* force to cache when we iterate. */
1476 /* Move down from the root, until we find a signed non-existance of a DS, in which case
1477 an unsigned answer is OK, or we find a signed DS, in which case there should be
1478 a signature, and the answer is BOGUS */
1479 static int tcp_check_for_unsigned_zone(time_t now
, struct dns_header
*header
, size_t plen
, int class, char *name
,
1480 char *keyname
, struct server
*server
, int *keycount
)
1483 unsigned char *packet
, *payload
;
1485 int status
, name_len
;
1486 struct blockdata
*block
;
1490 /* Get first insecure entry in CNAME chain */
1491 status
= tcp_key_recurse(now
, STAT_CHASE_CNAME
, header
, plen
, class, name
, keyname
, server
, keycount
);
1492 if (status
== STAT_BOGUS
)
1495 if (!(packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
))))
1498 payload
= &packet
[2];
1499 header
= (struct dns_header
*)payload
;
1500 length
= (u16
*)packet
;
1502 /* Stash the name away, since the buffer will be trashed when we recurse */
1503 name_len
= strlen(name
) + 1;
1504 name_start
= name
+ name_len
- 1;
1506 if (!(block
= blockdata_alloc(name
, name_len
)))
1514 unsigned char c1
, c2
;
1517 if (--(*keycount
) == 0)
1520 blockdata_free(block
);
1524 while ((crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
)))
1526 if ((crecp
->flags
& F_NEG
) && (crecp
->flags
& F_DNSSECOK
))
1528 /* Found a secure denial of DS - delegation is indeed insecure */
1530 blockdata_free(block
);
1531 return STAT_INSECURE
;
1534 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1535 Add another label and continue. */
1537 if (name_start
== name
)
1540 blockdata_free(block
);
1541 return STAT_BOGUS
; /* run out of labels */
1545 while (*name_start
!= '.' && name_start
!= name
)
1547 if (name_start
!= name
)
1551 /* Can't find it in the cache, have to send a query */
1553 m
= dnssec_generate_query(header
, ((char *) header
) + 65536, name_start
, class, T_DS
, &server
->addr
, server
->edns_pktsz
);
1557 if (read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) &&
1558 read_write(server
->tcpfd
, &c1
, 1, 1) &&
1559 read_write(server
->tcpfd
, &c2
, 1, 1) &&
1560 read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1564 /* Note this trashes all three name workspaces */
1565 status
= tcp_key_recurse(now
, STAT_NEED_DS_NEG
, header
, m
, class, name
, keyname
, server
, keycount
);
1567 if (status
== STAT_NO_DS
)
1569 /* Found a secure denial of DS - delegation is indeed insecure */
1571 blockdata_free(block
);
1572 return STAT_INSECURE
;
1575 if (status
== STAT_BOGUS
)
1578 blockdata_free(block
);
1582 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1583 Add another label and continue. */
1585 /* Get name we're checking back. */
1586 blockdata_retrieve(block
, name_len
, name
);
1588 if (name_start
== name
)
1591 blockdata_free(block
);
1592 return STAT_BOGUS
; /* run out of labels */
1596 while (*name_start
!= '.' && name_start
!= name
)
1598 if (name_start
!= name
)
1605 blockdata_free(block
);
1606 return STAT_BOGUS
; /* run out of labels */
1611 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
1612 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
)
1614 /* Recurse up the key heirarchy */
1617 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1618 if (--(*keycount
) == 0)
1619 return STAT_INSECURE
;
1621 if (status
== STAT_NEED_KEY
)
1622 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1623 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1625 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1626 if (status
== STAT_NEED_DS
)
1628 if (new_status
== STAT_NO_DS
)
1629 new_status
= STAT_INSECURE_DS
;
1630 else if (new_status
== STAT_NO_NS
)
1631 new_status
= STAT_BOGUS
;
1634 else if (status
== STAT_CHASE_CNAME
)
1635 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1638 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
, NULL
);
1640 if (new_status
== STAT_NO_SIG
)
1642 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1643 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1645 new_status
= STAT_INSECURE
;
1649 /* Can't validate because we need a key/DS whose name now in keyname.
1650 Make query for same, and recurse to validate */
1651 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1654 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1655 unsigned char *payload
= &packet
[2];
1656 struct dns_header
*new_header
= (struct dns_header
*)payload
;
1657 u16
*length
= (u16
*)packet
;
1658 unsigned char c1
, c2
;
1661 return STAT_INSECURE
;
1664 m
= dnssec_generate_query(new_header
, ((char *) new_header
) + 65536, keyname
, class,
1665 new_status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
, server
->edns_pktsz
);
1669 if (!read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) ||
1670 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1671 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1672 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1673 new_status
= STAT_INSECURE
;
1678 new_status
= tcp_key_recurse(now
, new_status
, new_header
, m
, class, name
, keyname
, server
, keycount
);
1680 if (new_status
== STAT_SECURE
)
1682 /* Reached a validated record, now try again at this level.
1683 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1684 If so, go round again. */
1686 if (status
== STAT_NEED_KEY
)
1687 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1688 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1690 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1691 if (status
== STAT_NEED_DS
)
1693 if (new_status
== STAT_NO_DS
)
1694 new_status
= STAT_INSECURE_DS
;
1695 else if (new_status
== STAT_NO_NS
)
1696 new_status
= STAT_BOGUS
; /* Validated no DS */
1699 else if (status
== STAT_CHASE_CNAME
)
1700 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1703 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
, NULL
);
1705 if (new_status
== STAT_NO_SIG
)
1707 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1708 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1710 new_status
= STAT_INSECURE
;
1714 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1715 goto another_tcp_key
;
1726 /* The daemon forks before calling this: it should deal with one connection,
1727 blocking as neccessary, and then return. Note, need to be a bit careful
1728 about resources for debug mode, when the fork is suppressed: that's
1729 done by the caller. */
1730 unsigned char *tcp_request(int confd
, time_t now
,
1731 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1738 int checking_disabled
, ad_question
, do_bit
, added_pheader
= 0;
1739 int check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0, bogusanswer
= 0;
1741 unsigned short qtype
;
1742 unsigned int gotname
;
1743 unsigned char c1
, c2
;
1744 /* Max TCP packet + slop + size */
1745 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1746 unsigned char *payload
= &packet
[2];
1747 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1748 struct dns_header
*header
= (struct dns_header
*)payload
;
1749 u16
*length
= (u16
*)packet
;
1750 struct server
*last_server
;
1751 struct in_addr dst_addr_4
;
1752 union mysockaddr peer_addr
;
1753 socklen_t peer_len
= sizeof(union mysockaddr
);
1754 int query_count
= 0;
1756 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1759 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1760 if (option_bool(OPT_LOCAL_SERVICE
))
1762 struct addrlist
*addr
;
1764 if (peer_addr
.sa
.sa_family
== AF_INET6
)
1766 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1767 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1768 is_same_net6(&addr
->addr
.addr
.addr6
, &peer_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1774 struct in_addr netmask
;
1775 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1777 netmask
.s_addr
= htonl(~(in_addr_t
)0 << (32 - addr
->prefixlen
));
1778 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1779 is_same_net(addr
->addr
.addr
.addr4
, peer_addr
.in
.sin_addr
, netmask
))
1785 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1792 if (query_count
== TCP_MAX_QUERIES
||
1794 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1795 !(size
= c1
<< 8 | c2
) ||
1796 !read_write(confd
, payload
, size
, 1))
1799 if (size
< (int)sizeof(struct dns_header
))
1804 /* log_query gets called indirectly all over the place, so
1805 pass these in global variables - sorry. */
1806 daemon
->log_display_id
= ++daemon
->log_id
;
1807 daemon
->log_source_addr
= &peer_addr
;
1811 /* save state of "cd" flag in query */
1812 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1813 no_cache_dnssec
= 1;
1815 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1818 struct auth_zone
*zone
;
1820 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1822 if (peer_addr
.sa
.sa_family
== AF_INET
)
1823 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1824 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1827 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1828 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1832 /* find queries for zones we're authoritative for, and answer them directly */
1834 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1835 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1844 if (local_addr
->sa
.sa_family
== AF_INET
)
1845 dst_addr_4
= local_addr
->in
.sin_addr
;
1847 dst_addr_4
.s_addr
= 0;
1851 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1855 /* m > 0 if answered from cache */
1856 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1857 dst_addr_4
, netmask
, now
, &ad_question
, &do_bit
);
1859 /* Do this by steam now we're not in the select() loop */
1860 check_log_writer(NULL
);
1864 unsigned int flags
= 0;
1865 struct all_addr
*addrp
= NULL
;
1867 char *domain
= NULL
;
1869 if (option_bool(OPT_ADD_MAC
))
1870 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1872 if (option_bool(OPT_CLIENT_SUBNET
))
1874 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1883 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1885 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1886 last_server
= daemon
->servers
;
1888 last_server
= daemon
->last_server
;
1890 if (!flags
&& last_server
)
1892 struct server
*firstsendto
= NULL
;
1894 unsigned char *newhash
, hash
[HASH_SIZE
];
1895 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->namebuff
)))
1896 memcpy(hash
, newhash
, HASH_SIZE
);
1898 memset(hash
, 0, HASH_SIZE
);
1900 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1902 /* Loop round available servers until we succeed in connecting to one.
1903 Note that this code subtley ensures that consecutive queries on this connection
1904 which can go to the same server, do so. */
1908 firstsendto
= last_server
;
1911 if (!(last_server
= last_server
->next
))
1912 last_server
= daemon
->servers
;
1914 if (last_server
== firstsendto
)
1918 /* server for wrong domain */
1919 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1920 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)) ||
1921 (last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_LOOP
)))
1924 if (last_server
->tcpfd
== -1)
1926 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1929 #ifdef HAVE_CONNTRACK
1930 /* Copy connection mark of incoming query to outgoing connection. */
1931 if (option_bool(OPT_CONNTRACK
))
1934 struct all_addr local
;
1936 if (local_addr
->sa
.sa_family
== AF_INET6
)
1937 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1940 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1942 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1943 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1947 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1948 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1950 close(last_server
->tcpfd
);
1951 last_server
->tcpfd
= -1;
1956 if (option_bool(OPT_DNSSEC_VALID
))
1958 size_t new_size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1960 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1961 this allows it to select auth servers when one is returning bad data. */
1962 if (option_bool(OPT_DNSSEC_DEBUG
))
1963 header
->hb4
|= HB4_CD
;
1965 if (size
!= new_size
)
1973 *length
= htons(size
);
1975 /* get query name again for logging - may have been overwritten */
1976 if (!(gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1977 strcpy(daemon
->namebuff
, "query");
1979 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1980 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1981 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1982 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1984 close(last_server
->tcpfd
);
1985 last_server
->tcpfd
= -1;
1991 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1992 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1993 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1996 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1997 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
2001 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
2003 int keycount
= DNSSEC_WORK
; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
2004 int status
= tcp_key_recurse(now
, STAT_TRUNCATED
, header
, m
, 0, daemon
->namebuff
, daemon
->keyname
, last_server
, &keycount
);
2005 char *result
, *domain
= "result";
2007 if (status
== STAT_INSECURE_DS
)
2009 /* We only cache sigs when we've validated a reply.
2010 Avoid caching a reply with sigs if there's a vaildated break in the
2011 DS chain, so we don't return replies from cache missing sigs. */
2012 status
= STAT_INSECURE
;
2013 no_cache_dnssec
= 1;
2018 result
= "ABANDONED";
2019 status
= STAT_BOGUS
;
2022 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
2024 if (status
== STAT_BOGUS
&& extract_request(header
, m
, daemon
->namebuff
, NULL
))
2025 domain
= daemon
->namebuff
;
2027 log_query(F_KEYTAG
| F_SECSTAT
, domain
, NULL
, result
);
2029 if (status
== STAT_BOGUS
)
2031 no_cache_dnssec
= 1;
2035 if (status
== STAT_SECURE
)
2040 /* restore CD bit to the value in the query */
2041 if (checking_disabled
)
2042 header
->hb4
|= HB4_CD
;
2044 header
->hb4
&= ~HB4_CD
;
2046 /* There's no point in updating the cache, since this process will exit and
2047 lose the information after a few queries. We make this call for the alias and
2048 bogus-nxdomain side-effects. */
2049 /* If the crc of the question section doesn't match the crc we sent, then
2050 someone might be attempting to insert bogus values into the cache by
2051 sending replies containing questions and bogus answers. */
2053 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
2054 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
2060 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
2067 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
2068 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
, cache_secure
, bogusanswer
,
2069 ad_question
, do_bit
, added_pheader
, check_subnet
, &peer_addr
);
2075 /* In case of local answer or no connections made. */
2077 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
2081 check_log_writer(NULL
);
2085 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
2090 static struct frec
*allocate_frec(time_t now
)
2094 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
2096 f
->next
= daemon
->frec_list
;
2105 f
->dependent
= NULL
;
2106 f
->blocking_query
= NULL
;
2108 f
->orig_domain
= NULL
;
2110 daemon
->frec_list
= f
;
2116 struct randfd
*allocate_rfd(int family
)
2118 static int finger
= 0;
2121 /* limit the number of sockets we have open to avoid starvation of
2122 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
2124 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
2125 if (daemon
->randomsocks
[i
].refcount
== 0)
2127 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
2130 daemon
->randomsocks
[i
].refcount
= 1;
2131 daemon
->randomsocks
[i
].family
= family
;
2132 return &daemon
->randomsocks
[i
];
2135 /* No free ones or cannot get new socket, grab an existing one */
2136 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
2138 int j
= (i
+finger
) % RANDOM_SOCKS
;
2139 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
2140 daemon
->randomsocks
[j
].family
== family
&&
2141 daemon
->randomsocks
[j
].refcount
!= 0xffff)
2144 daemon
->randomsocks
[j
].refcount
++;
2145 return &daemon
->randomsocks
[j
];
2149 return NULL
; /* doom */
2152 void free_rfd(struct randfd
*rfd
)
2154 if (rfd
&& --(rfd
->refcount
) == 0)
2158 static void free_frec(struct frec
*f
)
2173 blockdata_free(f
->stash
);
2179 blockdata_free(f
->orig_domain
);
2180 f
->orig_domain
= NULL
;
2183 /* Anything we're waiting on is pointless now, too */
2184 if (f
->blocking_query
)
2185 free_frec(f
->blocking_query
);
2186 f
->blocking_query
= NULL
;
2187 f
->dependent
= NULL
;
2191 /* if wait==NULL return a free or older than TIMEOUT record.
2192 else return *wait zero if one available, or *wait is delay to
2193 when the oldest in-use record will expire. Impose an absolute
2194 limit of 4*TIMEOUT before we wipe things (for random sockets).
2195 If force is set, always return a result, even if we have
2196 to allocate above the limit. */
2197 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
2199 struct frec
*f
, *oldest
, *target
;
2205 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
2210 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
2216 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
2226 /* can't find empty one, use oldest if there is one
2227 and it's older than timeout */
2228 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
2230 /* keep stuff for twice timeout if we can by allocating a new
2232 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
2233 count
<= daemon
->ftabsize
&&
2234 (f
= allocate_frec(now
)))
2245 /* none available, calculate time 'till oldest record expires */
2246 if (!force
&& count
> daemon
->ftabsize
)
2248 static time_t last_log
= 0;
2251 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
2253 if ((int)difftime(now
, last_log
) > 5)
2256 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
2262 if (!(f
= allocate_frec(now
)) && wait
)
2263 /* wait one second on malloc failure */
2266 return f
; /* OK if malloc fails and this is NULL */
2269 /* crc is all-ones if not known. */
2270 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
2274 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2275 if (f
->sentto
&& f
->new_id
== id
&&
2276 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
2282 static struct frec
*lookup_frec_by_sender(unsigned short id
,
2283 union mysockaddr
*addr
,
2288 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2291 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
2292 sockaddr_isequal(&f
->source
, addr
))
2298 /* Send query packet again, if we can. */
2301 if (daemon
->srv_save
)
2305 if (daemon
->srv_save
->sfd
)
2306 fd
= daemon
->srv_save
->sfd
->fd
;
2307 else if (daemon
->rfd_save
&& daemon
->rfd_save
->refcount
!= 0)
2308 fd
= daemon
->rfd_save
->fd
;
2312 while(retry_send(sendto(fd
, daemon
->packet
, daemon
->packet_len
, 0,
2313 &daemon
->srv_save
->addr
.sa
,
2314 sa_len(&daemon
->srv_save
->addr
))));
2318 /* A server record is going away, remove references to it */
2319 void server_gone(struct server
*server
)
2323 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
2324 if (f
->sentto
&& f
->sentto
== server
)
2327 if (daemon
->last_server
== server
)
2328 daemon
->last_server
= NULL
;
2330 if (daemon
->srv_save
== server
)
2331 daemon
->srv_save
= NULL
;
2334 /* return unique random ids. */
2335 static unsigned short get_id(void)
2337 unsigned short ret
= 0;
2341 while (lookup_frec(ret
, NULL
));