-/* dnsmasq is Copyright (c) 2000 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2008 Simon Kelley
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; version 2 dated June, 1991.
-
+ the Free Software Foundation; version 2 dated June, 1991, or
+ (at your option) version 3 dated 29 June, 2007.
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "dnsmasq.h"
-static int extract_name(HEADER *header, unsigned int plen, unsigned char **pp,
- unsigned char *name, int isExtract)
+static int add_resource_record(HEADER *header, char *limit, int *truncp,
+ unsigned int nameoffset, unsigned char **pp,
+ unsigned long ttl, unsigned int *offset, unsigned short type,
+ unsigned short class, char *format, ...);
+
+#define CHECK_LEN(header, pp, plen, len) \
+ ((size_t)((pp) - (unsigned char *)(header) + (len)) <= (plen))
+
+#define ADD_RDLEN(header, pp, plen, len) \
+ (!CHECK_LEN(header, pp, plen, len) ? 0 : (int)((pp) += (len)), 1)
+
+static int extract_name(HEADER *header, size_t plen, unsigned char **pp,
+ char *name, int isExtract, int extrabytes)
{
- unsigned char *cp = name, *p = *pp, *p1 = NULL;
+ unsigned char *cp = (unsigned char *)name, *p = *pp, *p1 = NULL;
unsigned int j, l, hops = 0;
int retvalue = 1;
- while ((l = *p++))
- {
- unsigned int label_type = l & 0xc0;
+ if (isExtract)
+ *cp = 0;
+
+ while (1)
+ {
+ unsigned int label_type;
+
+ if (!CHECK_LEN(header, p, plen, 1))
+ return 0;
+
+ if ((l = *p++) == 0)
+ /* end marker */
+ {
+ /* check that there are the correct no of bytes after the name */
+ if (!CHECK_LEN(header, p, plen, extrabytes))
+ return 0;
+
+ if (isExtract)
+ {
+ if (cp != (unsigned char *)name)
+ cp--;
+ *cp = 0; /* terminate: lose final period */
+ }
+ else if (*cp != 0)
+ retvalue = 2;
+
+ if (p1) /* we jumped via compression */
+ *pp = p1;
+ else
+ *pp = p;
+
+ return retvalue;
+ }
+
+ label_type = l & 0xc0;
+
if (label_type == 0xc0) /* pointer */
{
- if (p - (unsigned char *)header + 1u >= plen)
+ if (!CHECK_LEN(header, p, plen, 1))
return 0;
/* get offset */
l = (l&0x3f) << 8;
l |= *p++;
- if (l >= (unsigned int)plen)
- return 0;
if (!p1) /* first jump, save location to go back to */
p1 = p;
digs = ((count-1)>>2)+1;
/* output is \[x<hex>/siz]. which is digs+9 chars */
- if (cp - name + digs + 9 >= MAXDNAME)
+ if (cp - (unsigned char *)name + digs + 9 >= MAXDNAME)
return 0;
- if (p - (unsigned char *)header + ((count-1)>>3) + 1u >= plen)
+ if (!CHECK_LEN(header, p, plen, (count-1)>>3))
return 0;
*cp++ = '\\';
*cp++ = dig < 10 ? dig + '0' : dig + 'A' - 10;
}
- cp += sprintf(cp, "/%d]", count);
+ cp += sprintf((char *)cp, "/%d]", count);
/* do this here to overwrite the zero char from sprintf */
*cp++ = '.';
}
else
{ /* label_type = 0 -> label. */
- if (cp - name + l + 1 >= MAXDNAME)
+ if (cp - (unsigned char *)name + l + 1 >= MAXDNAME)
return 0;
- if (p - (unsigned char *)header + 1u >= plen)
+ if (!CHECK_LEN(header, p, plen, l))
return 0;
+
for(j=0; j<l; j++, p++)
if (isExtract)
{
if (isExtract)
*cp++ = '.';
- else
- if (*cp != 0 && *cp++ != '.')
- retvalue = 2;
+ else if (*cp != 0 && *cp++ != '.')
+ retvalue = 2;
}
-
- if ((unsigned int)(p - (unsigned char *)header) >= plen)
- return 0;
}
-
- if (isExtract)
- *--cp = 0; /* terminate: lose final period */
-
- if (p1) /* we jumped via compression */
- *pp = p1;
- else
- *pp = p;
-
- return retvalue;
}
/* Max size of input string (for IPv6) is 75 chars.) */
if (*name == '\\' && *(name+1) == '[' &&
(*(name+2) == 'x' || *(name+2) == 'X'))
{
- for (j = 0, cp1 = name+3; *cp1 && isxdigit(*cp1) && j < 32; cp1++, j++)
+ for (j = 0, cp1 = name+3; *cp1 && isxdigit((int) *cp1) && j < 32; cp1++, j++)
{
char xdig[2];
xdig[0] = *cp1;
return 0;
}
-static unsigned char *skip_questions(HEADER *header, unsigned int plen)
+static unsigned char *skip_name(unsigned char *ansp, HEADER *header, size_t plen, int extrabytes)
{
- int q, qdcount = ntohs(header->qdcount);
- unsigned char *ansp = (unsigned char *)(header+1);
-
- for (q=0; q<qdcount; q++)
+ while(1)
{
- while (1)
+ unsigned int label_type;
+
+ if (!CHECK_LEN(header, ansp, plen, 1))
+ return NULL;
+
+ label_type = (*ansp) & 0xc0;
+
+ if (label_type == 0xc0)
+ {
+ /* pointer for compression. */
+ ansp += 2;
+ break;
+ }
+ else if (label_type == 0x80)
+ return NULL; /* reserved */
+ else if (label_type == 0x40)
{
- unsigned int label_type = (*ansp) & 0xc0;
+ /* Extended label type */
+ unsigned int count;
- if ((unsigned int)(ansp - (unsigned char *)header) >= plen)
+ if (!CHECK_LEN(header, ansp, plen, 2))
return NULL;
- if (label_type == 0xc0)
- {
- /* pointer for compression. */
- ansp += 2;
- break;
- }
- else if (label_type == 0x80)
- return NULL; /* reserved */
- else if (label_type == 0x40)
- {
- /* Extended label type */
- unsigned int count;
-
- if (((*ansp++) & 0x3f) != 1)
- return NULL; /* we only understand bitstrings */
-
- count = *(ansp++); /* Bits in bitstring */
-
- if (count == 0) /* count == 0 means 256 bits */
- ansp += 32;
- else
- ansp += ((count-1)>>3)+1;
- }
+ if (((*ansp++) & 0x3f) != 1)
+ return NULL; /* we only understand bitstrings */
+
+ count = *(ansp++); /* Bits in bitstring */
+
+ if (count == 0) /* count == 0 means 256 bits */
+ ansp += 32;
else
- { /* label type == 0 Bottom six bits is length */
- unsigned int len = (*ansp++) & 0x3f;
- if (len == 0)
- break; /* zero length label marks the end. */
-
- ansp += len;
- }
+ ansp += ((count-1)>>3)+1;
+ }
+ else
+ { /* label type == 0 Bottom six bits is length */
+ unsigned int len = (*ansp++) & 0x3f;
+
+ if (!ADD_RDLEN(header, ansp, plen, len))
+ return NULL;
+
+ if (len == 0)
+ break; /* zero length label marks the end. */
}
- ansp += 4; /* class and type */
}
- if ((unsigned int)(ansp - (unsigned char *)header) > plen)
- return NULL;
+
+ if (!CHECK_LEN(header, ansp, plen, extrabytes))
+ return NULL;
return ansp;
}
-/* is addr in the non-globally-routed IP space? */
-static int private_net(struct all_addr *addrp)
+static unsigned char *skip_questions(HEADER *header, size_t plen)
{
- struct in_addr addr = *(struct in_addr *)addrp;
- if (inet_netof(addr) == 0xA ||
- (inet_netof(addr) >= 0xAC10 && inet_netof(addr) < 0xAC20) ||
- (inet_netof(addr) >> 8) == 0xC0A8)
- return 1;
- else
- return 0;
+ int q;
+ unsigned char *ansp = (unsigned char *)(header+1);
+
+ for (q = ntohs(header->qdcount); q != 0; q--)
+ {
+ if (!(ansp = skip_name(ansp, header, plen, 4)))
+ return NULL;
+ ansp += 4; /* class and type */
+ }
+
+ return ansp;
}
-
-static unsigned char *add_text_record(unsigned int nameoffset, unsigned char *p,
- unsigned long ttl, unsigned short pref,
- unsigned short type, char *name)
+
+static unsigned char *skip_section(unsigned char *ansp, int count, HEADER *header, size_t plen)
{
- unsigned char *sav, *cp;
- int j;
-
- PUTSHORT(nameoffset | 0xc000, p);
- PUTSHORT(type, p);
- PUTSHORT(C_IN, p);
- PUTLONG(ttl, p); /* TTL */
+ int i, rdlen;
- sav = p;
- PUTSHORT(0, p); /* dummy RDLENGTH */
+ for (i = 0; i < count; i++)
+ {
+ if (!(ansp = skip_name(ansp, header, plen, 10)))
+ return NULL;
+ ansp += 8; /* type, class, TTL */
+ GETSHORT(rdlen, ansp);
+ if (!ADD_RDLEN(header, ansp, plen, rdlen))
+ return NULL;
+ }
+
+ return ansp;
+}
- if (pref)
- PUTSHORT(pref, p);
+/* CRC the question section. This is used to safely detect query
+ retransmision and to detect answers to questions we didn't ask, which
+ might be poisoning attacks. Note that we decode the name rather
+ than CRC the raw bytes, since replies might be compressed differently.
+ We ignore case in the names for the same reason. Return all-ones
+ if there is not question section. */
+unsigned int questions_crc(HEADER *header, size_t plen, char *name)
+{
+ int q;
+ unsigned int crc = 0xffffffff;
+ unsigned char *p1, *p = (unsigned char *)(header+1);
- while (*name)
+ for (q = ntohs(header->qdcount); q != 0; q--)
{
- cp = p++;
- for (j=0; *name && (*name != '.'); name++, j++)
- *p++ = *name;
- *cp = j;
- if (*name)
- name++;
+ if (!extract_name(header, plen, &p, name, 1, 4))
+ return crc; /* bad packet */
+
+ for (p1 = (unsigned char *)name; *p1; p1++)
+ {
+ int i = 8;
+ char c = *p1;
+
+ if (c >= 'A' && c <= 'Z')
+ c += 'a' - 'A';
+
+ crc ^= c << 24;
+ while (i--)
+ crc = crc & 0x80000000 ? (crc << 1) ^ 0x04c11db7 : crc << 1;
+ }
+
+ /* CRC the class and type as well */
+ for (p1 = p; p1 < p+4; p1++)
+ {
+ int i = 8;
+ crc ^= *p1 << 24;
+ while (i--)
+ crc = crc & 0x80000000 ? (crc << 1) ^ 0x04c11db7 : crc << 1;
+ }
+
+ p += 4;
+ if (!CHECK_LEN(header, p, plen, 0))
+ return crc; /* bad packet */
}
- *p++ = 0;
- j = p - sav - 2;
- PUTSHORT(j, sav); /* Real RDLENGTH */
+
+ return crc;
+}
+
+
+size_t resize_packet(HEADER *header, size_t plen, unsigned char *pheader, size_t hlen)
+{
+ unsigned char *ansp = skip_questions(header, plen);
+
+ /* if packet is malformed, just return as-is. */
+ if (!ansp)
+ return plen;
- return p;
+ if (!(ansp = skip_section(ansp, ntohs(header->ancount) + ntohs(header->nscount) + ntohs(header->arcount),
+ header, plen)))
+ return plen;
+
+ /* restore pseudoheader */
+ if (pheader && ntohs(header->arcount) == 0)
+ {
+ /* must use memmove, may overlap */
+ memmove(ansp, pheader, hlen);
+ header->arcount = htons(1);
+ ansp += hlen;
+ }
+
+ return ansp - (unsigned char *)header;
}
-/* On receiving an NXDOMAIN or NODATA reply, determine which names are known
- not to exist for negative caching. name if a working buffer passed in. */
-void extract_neg_addrs(HEADER *header, unsigned int qlen, char *name, time_t now)
+unsigned char *find_pseudoheader(HEADER *header, size_t plen, size_t *len, unsigned char **p, int *is_sign)
{
- unsigned char *p;
- int i, found_soa = 0;
- int qtype, qclass, rdlen;
- unsigned long ttl, minttl = 0;
- unsigned short flags = F_NEG;
+ /* See if packet has an RFC2671 pseudoheader, and if so return a pointer to it.
+ also return length of pseudoheader in *len and pointer to the UDP size in *p
+ Finally, check to see if a packet is signed. If it is we cannot change a single bit before
+ forwarding. We look for SIG and TSIG in the addition section, and TKEY queries (for GSS-TSIG) */
+
+ int i, arcount = ntohs(header->arcount);
+ unsigned char *ansp = (unsigned char *)(header+1);
+ unsigned short rdlen, type, class;
+ unsigned char *ret = NULL;
+
+ if (is_sign)
+ {
+ *is_sign = 0;
- if (header->rcode == NXDOMAIN)
- flags |= F_NXDOMAIN;
+ if (header->opcode == QUERY)
+ {
+ for (i = ntohs(header->qdcount); i != 0; i--)
+ {
+ if (!(ansp = skip_name(ansp, header, plen, 4)))
+ return NULL;
+
+ GETSHORT(type, ansp);
+ GETSHORT(class, ansp);
+
+ if (class == C_IN && type == T_TKEY)
+ *is_sign = 1;
+ }
+ }
+ }
+ else
+ {
+ if (!(ansp = skip_questions(header, plen)))
+ return NULL;
+ }
+
+ if (arcount == 0)
+ return NULL;
- /* there may be more than one question with some questions
- answered. We don't generate negative entries from those. */
- if (ntohs(header->ancount) != 0)
- return;
+ if (!(ansp = skip_section(ansp, ntohs(header->ancount) + ntohs(header->nscount), header, plen)))
+ return NULL;
- if (!(p = skip_questions(header, qlen)))
- return; /* bad packet */
+ for (i = 0; i < arcount; i++)
+ {
+ unsigned char *save, *start = ansp;
+ if (!(ansp = skip_name(ansp, header, plen, 10)))
+ return NULL;
+
+ GETSHORT(type, ansp);
+ save = ansp;
+ GETSHORT(class, ansp);
+ ansp += 4; /* TTL */
+ GETSHORT(rdlen, ansp);
+ if (!ADD_RDLEN(header, ansp, plen, rdlen))
+ return NULL;
+ if (type == T_OPT)
+ {
+ if (len)
+ *len = ansp - start;
+ if (p)
+ *p = save;
+ ret = start;
+ }
+ else if (is_sign &&
+ i == arcount - 1 &&
+ class == C_ANY &&
+ (type == T_SIG || type == T_TSIG))
+ *is_sign = 1;
+ }
- /* we first need to find SOA records, to get min TTL, then we
- add a NEG cache entry for each question. */
+ return ret;
+}
+
+
+/* is addr in the non-globally-routed IP space? */
+static int private_net(struct in_addr addr)
+{
+ in_addr_t ip_addr = ntohl(addr.s_addr);
- for (i=0; i<ntohs(header->nscount); i++)
- {
- if (!extract_name(header, qlen, &p, name, 1))
- return; /* bad packet */
+ return
+ ((ip_addr & 0xFF000000) == 0x7F000000) /* 127.0.0.0/8 (loopback) */ ||
+ ((ip_addr & 0xFFFF0000) == 0xC0A80000) /* 192.168.0.0/16 (private) */ ||
+ ((ip_addr & 0xFF000000) == 0x0A000000) /* 10.0.0.0/8 (private) */ ||
+ ((ip_addr & 0xFFF00000) == 0xAC100000) /* 172.16.0.0/12 (private) */ ||
+ ((ip_addr & 0xFFFF0000) == 0xA9FE0000) /* 169.254.0.0/16 (zeroconf) */ ;
+}
+
+static unsigned char *do_doctor(unsigned char *p, int count, HEADER *header, size_t qlen)
+{
+ int i, qtype, qclass, rdlen;
+ unsigned long ttl;
+ for (i = count; i != 0; i--)
+ {
+ if (!(p = skip_name(p, header, qlen, 10)))
+ return 0; /* bad packet */
+
GETSHORT(qtype, p);
GETSHORT(qclass, p);
GETLONG(ttl, p);
GETSHORT(rdlen, p);
-
- if ((qclass == C_IN) && (qtype == T_SOA))
+
+ if ((qclass == C_IN) && (qtype == T_A))
{
- int dummy;
- /* MNAME */
- if (!extract_name(header, qlen, &p, name, 1))
- return;
- /* RNAME */
- if (!extract_name(header, qlen, &p, name, 1))
- return;
- GETLONG(dummy, p); /* SERIAL */
- GETLONG(dummy, p); /* REFRESH */
- GETLONG(dummy, p); /* RETRY */
- GETLONG(dummy, p); /* EXPIRE */
- if (!found_soa)
- {
- found_soa = 1;
- minttl = ttl;
- }
- else if (ttl < minttl)
- minttl = ttl;
- GETLONG(ttl, p); /* minTTL */
- if (ttl < minttl)
- minttl = ttl;
+ struct doctor *doctor;
+ struct in_addr addr;
+
+ if (!CHECK_LEN(header, p, qlen, INADDRSZ))
+ return 0;
+
+ /* alignment */
+ memcpy(&addr, p, INADDRSZ);
+
+ for (doctor = daemon->doctors; doctor; doctor = doctor->next)
+ if (is_same_net(doctor->in, addr, doctor->mask))
+ {
+ addr.s_addr &= ~doctor->mask.s_addr;
+ addr.s_addr |= (doctor->out.s_addr & doctor->mask.s_addr);
+ /* Since we munged the data, the server it came from is no longer authoritative */
+ header->aa = 0;
+ memcpy(p, &addr, INADDRSZ);
+ break;
+ }
}
- else
- p += rdlen;
-
- if ((unsigned int)(p - (unsigned char *)header) > qlen)
- return; /* bad packet */
+
+ if (!ADD_RDLEN(header, p, qlen, rdlen))
+ return 0; /* bad packet */
}
- if (!found_soa)
- return; /* failed to find SOA */
+ return p;
+}
- cache_start_insert();
+static int find_soa(HEADER *header, size_t qlen)
+{
+ unsigned char *p;
+ int qtype, qclass, rdlen;
+ unsigned long ttl, minttl = ULONG_MAX;
+ int i, found_soa = 0;
- p = (unsigned char *)(header+1);
+ /* first move to NS section and find TTL from any SOA section */
+ if (!(p = skip_questions(header, qlen)) ||
+ !(p = do_doctor(p, ntohs(header->ancount), header, qlen)))
+ return 0; /* bad packet */
- for (i=0; i<ntohs(header->qdcount); i++)
+ for (i = ntohs(header->nscount); i != 0; i--)
{
- struct all_addr addr;
- int is_arpa;
-
- if (!extract_name(header, qlen, &p, name, 1))
- return; /* bad packet */
+ if (!(p = skip_name(p, header, qlen, 10)))
+ return 0; /* bad packet */
GETSHORT(qtype, p);
GETSHORT(qclass, p);
+ GETLONG(ttl, p);
+ GETSHORT(rdlen, p);
- if (qclass == C_IN && qtype == T_PTR && (is_arpa = in_arpa_name_2_addr(name, &addr)))
- cache_insert(name, &addr, now, minttl , is_arpa | F_REVERSE | flags);
- else if (qclass == C_IN && qtype == T_A)
- cache_insert(name, NULL, now, minttl, F_IPV4 | F_FORWARD | flags);
-#ifdef HAVE_IPV6
- else if (qclass == C_IN && qtype == T_AAAA)
- cache_insert(name, NULL, now, minttl, F_IPV6 | F_FORWARD | flags);
-#endif
+ if ((qclass == C_IN) && (qtype == T_SOA))
+ {
+ found_soa = 1;
+ if (ttl < minttl)
+ minttl = ttl;
+
+ /* MNAME */
+ if (!(p = skip_name(p, header, qlen, 0)))
+ return 0;
+ /* RNAME */
+ if (!(p = skip_name(p, header, qlen, 20)))
+ return 0;
+ p += 16; /* SERIAL REFRESH RETRY EXPIRE */
+
+ GETLONG(ttl, p); /* minTTL */
+ if (ttl < minttl)
+ minttl = ttl;
+ }
+ else if (!ADD_RDLEN(header, p, qlen, rdlen))
+ return 0; /* bad packet */
}
- cache_end_insert();
-}
+ /* rewrite addresses in additioal section too */
+ if (!do_doctor(p, ntohs(header->arcount), header, qlen))
+ return 0;
+
+ if (!found_soa)
+ minttl = daemon->neg_ttl;
-static void dns_doctor(struct doctor *doctor, struct in_addr *addr)
-{
- for (; doctor; doctor = doctor->next)
- if (is_same_net(doctor->in, *addr, doctor->mask))
- {
- addr->s_addr &= ~doctor->mask.s_addr;
- addr->s_addr |= (doctor->out.s_addr & doctor->mask.s_addr);
- break;
- }
+ return minttl;
}
-void extract_addresses(HEADER *header, unsigned int qlen, char *name,
- time_t now, struct doctor *doctors)
+/* Note that the following code can create CNAME chains that don't point to a real record,
+ either because of lack of memory, or lack of SOA records. These are treated by the cache code as
+ expired and cleaned out that way.
+ Return 1 if we reject an address because it look like parct of dns-rebinding attack. */
+int extract_addresses(HEADER *header, size_t qlen, char *name, time_t now)
{
- unsigned char *p, *psave, *endrr;
- int qtype, qclass, rdlen;
- unsigned long ttl;
- int i;
-
- /* skip over questions */
- if (!(p = skip_questions(header, qlen)))
- return; /* bad packet */
-
+ unsigned char *p, *p1, *endrr, *namep;
+ int i, j, qtype, qclass, aqtype, aqclass, ardlen, res, searched_soa = 0;
+ unsigned long ttl = 0;
+ struct all_addr addr;
+
cache_start_insert();
+
+ /* find_soa is needed for dns_doctor side-effects, so don't call it lazily if there are any. */
+ if (daemon->doctors)
+ {
+ searched_soa = 1;
+ ttl = find_soa(header, qlen);
+ }
- psave = p;
+ /* go through the questions. */
+ p = (unsigned char *)(header+1);
- for (i=0; i<ntohs(header->ancount); i++)
+ for (i = ntohs(header->qdcount); i != 0; i--)
{
- unsigned char *origname = p;
- if (!extract_name(header, qlen, &p, name, 1))
- return; /* bad packet */
-
+ int found = 0, cname_count = 5;
+ struct crec *cpp = NULL;
+ int flags = header->rcode == NXDOMAIN ? F_NXDOMAIN : 0;
+ unsigned long cttl = ULONG_MAX, attl;
+
+ namep = p;
+ if (!extract_name(header, qlen, &p, name, 1, 4))
+ return 0; /* bad packet */
+
GETSHORT(qtype, p);
GETSHORT(qclass, p);
- GETLONG(ttl, p);
- GETSHORT(rdlen, p);
-
- endrr = p + rdlen;
- if ((unsigned int)(endrr - (unsigned char *)header) > qlen)
- return; /* bad packet */
if (qclass != C_IN)
- {
- p = endrr;
- continue;
- }
+ continue;
- if (qtype == T_A) /* A record. */
- {
- dns_doctor(doctors, (struct in_addr *)p);
- cache_insert(name, (struct all_addr *)p, now,
- ttl, F_IPV4 | F_FORWARD);
- }
-#ifdef HAVE_IPV6
- else if (qtype == T_AAAA) /* IPV6 address record. */
- cache_insert(name, (struct all_addr *)p, now,
- ttl, F_IPV6 | F_FORWARD);
-#endif
- else if (qtype == T_PTR)
- {
- /* PTR record */
- struct all_addr addr;
+ /* PTRs: we chase CNAMEs here, since we have no way to
+ represent them in the cache. */
+ if (qtype == T_PTR)
+ {
int name_encoding = in_arpa_name_2_addr(name, &addr);
- if (name_encoding)
- {
- if (!extract_name(header, qlen, &p, name, 1))
- return; /* bad packet */
- cache_insert(name, &addr, now,
- ttl, name_encoding | F_REVERSE);
- }
- }
- else if (qtype == T_CNAME)
- {
- /* CNAME, search whole answer section again */
- unsigned char *endrr1;
- unsigned long cttl;
- int j;
- unsigned char *targp = p;
-
- p = psave; /* rewind p */
- for (j=0; j<ntohs(header->ancount); j++)
+
+ if (!name_encoding)
+ continue;
+
+ if (!(flags & F_NXDOMAIN))
{
- int res;
- unsigned char *tmp = targp;
- /* copy since it gets altered by extract_name */
- /* get CNAME target each time round */
- if (!extract_name(header, qlen, &tmp, name, 1))
- return; /* bad packet */
- /* compare this name with target of CNAME in name buffer */
- if (!(res = extract_name(header, qlen, &p, name, 0)))
- return; /* bad packet */
-
- GETSHORT(qtype, p);
- GETSHORT(qclass, p);
- GETLONG(cttl, p);
- GETSHORT(rdlen, p);
+ cname_loop:
+ if (!(p1 = skip_questions(header, qlen)))
+ return 0;
- endrr1 = p+rdlen;
- if ((unsigned int)(endrr1 - (unsigned char *)header) > qlen)
- return; /* bad packet */
-
- /* is this RR name same as target of CNAME */
- if ((qclass != C_IN) || (res == 2))
+ for (j = ntohs(header->ancount); j != 0; j--)
{
- p = endrr1;
- continue;
- }
-
- /* match, use name of CNAME, data from this RR
- use min TTL of two */
-
- if (ttl < cttl)
- cttl = ttl;
-
- /* get orig. name back again */
- tmp = origname;
- if (!extract_name(header, qlen, &tmp, name, 1))
- return;
+ unsigned char *tmp = namep;
+ /* the loop body overwrites the original name, so get it back here. */
+ if (!extract_name(header, qlen, &tmp, name, 1, 0) ||
+ !(res = extract_name(header, qlen, &p1, name, 0, 10)))
+ return 0; /* bad packet */
+
+ GETSHORT(aqtype, p1);
+ GETSHORT(aqclass, p1);
+ GETLONG(attl, p1);
+ GETSHORT(ardlen, p1);
+ endrr = p1+ardlen;
+
+ /* TTL of record is minimum of CNAMES and PTR */
+ if (attl < cttl)
+ cttl = attl;
- if (qtype == T_A) /* A record. */
- {
- dns_doctor(doctors, (struct in_addr *)p);
- cache_insert(name, (struct all_addr *)p, now,
- cttl, F_IPV4 | F_FORWARD);
+ if (aqclass == C_IN && res != 2 && (aqtype == T_CNAME || aqtype == T_PTR))
+ {
+ if (!extract_name(header, qlen, &p1, name, 1, 0))
+ return 0;
+
+ if (aqtype == T_CNAME)
+ {
+ if (!cname_count--)
+ return 0; /* looped CNAMES */
+ goto cname_loop;
+ }
+
+ cache_insert(name, &addr, now, cttl, name_encoding | F_REVERSE);
+ found = 1;
+ }
+
+ p1 = endrr;
+ if (!CHECK_LEN(header, p1, qlen, 0))
+ return 0; /* bad packet */
}
-#ifdef HAVE_IPV6
- else if (qtype == T_AAAA) /* IPV6 address record. */
- cache_insert(name, (struct all_addr *)p, now,
- cttl, F_IPV6 | F_FORWARD);
-#endif
- else if (qtype == T_PTR)
+ }
+
+ if (!found && !(daemon->options & OPT_NO_NEG))
+ {
+ if (!searched_soa)
{
- /* PTR record extract address from CNAME name */
- struct all_addr addr;
- int name_encoding = in_arpa_name_2_addr(name, &addr);
- if (name_encoding)
- {
- if (!extract_name(header, qlen, &p, name, 1))
- return; /* bad packet */
- cache_insert(name, &addr, now, cttl,
- name_encoding | F_REVERSE);
- }
+ searched_soa = 1;
+ ttl = find_soa(header, qlen);
}
- p = endrr1;
+ if (ttl)
+ cache_insert(NULL, &addr, now, ttl, name_encoding | F_REVERSE | F_NEG | flags);
}
- }
- p = endrr;
- }
+ }
+ else
+ {
+ /* everything other than PTR */
+ struct crec *newc;
+ int addrlen;
- cache_end_insert();
-}
+ if (qtype == T_A)
+ {
+ addrlen = INADDRSZ;
+ flags |= F_IPV4;
+ }
+#ifdef HAVE_IPV6
+ else if (qtype == T_AAAA)
+ {
+ addrlen = IN6ADDRSZ;
+ flags |= F_IPV6;
+ }
+#endif
+ else
+ continue;
+
+ if (!(flags & F_NXDOMAIN))
+ {
+ cname_loop1:
+ if (!(p1 = skip_questions(header, qlen)))
+ return 0;
+
+ for (j = ntohs(header->ancount); j != 0; j--)
+ {
+ if (!(res = extract_name(header, qlen, &p1, name, 0, 10)))
+ return 0; /* bad packet */
+
+ GETSHORT(aqtype, p1);
+ GETSHORT(aqclass, p1);
+ GETLONG(attl, p1);
+ GETSHORT(ardlen, p1);
+ endrr = p1+ardlen;
+
+ if (aqclass == C_IN && res != 2 && (aqtype == T_CNAME || aqtype == qtype))
+ {
+ if (aqtype == T_CNAME)
+ {
+ if (!cname_count--)
+ return 0; /* looped CNAMES */
+ newc = cache_insert(name, NULL, now, attl, F_CNAME | F_FORWARD);
+ if (newc && cpp)
+ {
+ cpp->addr.cname.cache = newc;
+ cpp->addr.cname.uid = newc->uid;
+ }
+
+ cpp = newc;
+ if (attl < cttl)
+ cttl = attl;
+
+ if (!extract_name(header, qlen, &p1, name, 1, 0))
+ return 0;
+ goto cname_loop1;
+ }
+ else
+ {
+ found = 1;
+
+ /* copy address into aligned storage */
+ if (!CHECK_LEN(header, p1, qlen, addrlen))
+ return 0; /* bad packet */
+ memcpy(&addr, p1, addrlen);
+
+ /* check for returned address in private space */
+ if ((daemon->options & OPT_NO_REBIND) &&
+ (flags & F_IPV4) &&
+ private_net(addr.addr.addr4))
+ return 1;
+
+ newc = cache_insert(name, &addr, now, attl, flags | F_FORWARD);
+ if (newc && cpp)
+ {
+ cpp->addr.cname.cache = newc;
+ cpp->addr.cname.uid = newc->uid;
+ }
+ cpp = NULL;
+ }
+ }
+
+ p1 = endrr;
+ if (!CHECK_LEN(header, p1, qlen, 0))
+ return 0; /* bad packet */
+ }
+ }
+
+ if (!found && !(daemon->options & OPT_NO_NEG))
+ {
+ if (!searched_soa)
+ {
+ searched_soa = 1;
+ ttl = find_soa(header, qlen);
+ }
+ /* If there's no SOA to get the TTL from, but there is a CNAME
+ pointing at this, inherit its TTL */
+ if (ttl || cpp)
+ {
+ newc = cache_insert(name, NULL, now, ttl ? ttl : cttl, F_FORWARD | F_NEG | flags);
+ if (newc && cpp)
+ {
+ cpp->addr.cname.cache = newc;
+ cpp->addr.cname.uid = newc->uid;
+ }
+ }
+ }
+ }
+ }
+
+ /* Don't put stuff from a truncated packet into the cache, but do everything else */
+ if (!header->tc)
+ cache_end_insert();
+
+ return 0;
+}
/* If the packet holds exactly one query
- return 1 and leave the name from the query in name. */
+ return F_IPV4 or F_IPV6 and leave the name from the query in name.
+ Abuse F_BIGNAME to indicate an NS query - yuck. */
-unsigned short extract_request(HEADER *header,unsigned int qlen, char *name)
+unsigned short extract_request(HEADER *header, size_t qlen, char *name, unsigned short *typep)
{
unsigned char *p = (unsigned char *)(header+1);
int qtype, qclass;
+ if (typep)
+ *typep = 0;
+
if (ntohs(header->qdcount) != 1 || header->opcode != QUERY)
return 0; /* must be exactly one query. */
- if (!extract_name(header, qlen, &p, name, 1))
+ if (!extract_name(header, qlen, &p, name, 1, 4))
return 0; /* bad packet */
GETSHORT(qtype, p);
GETSHORT(qclass, p);
+ if (typep)
+ *typep = qtype;
+
if (qclass == C_IN)
{
if (qtype == T_A)
return F_IPV6;
if (qtype == T_ANY)
return F_IPV4 | F_IPV6;
+ if (qtype == T_NS || qtype == T_SOA)
+ return F_QUERY | F_BIGNAME;
}
return F_QUERY;
}
-int setup_reply(HEADER *header, unsigned int qlen,
+size_t setup_reply(HEADER *header, size_t qlen,
struct all_addr *addrp, unsigned short flags, unsigned long ttl)
{
unsigned char *p = skip_questions(header, qlen);
header->tc = 0; /* not truncated */
header->nscount = htons(0);
header->arcount = htons(0);
- header->ancount = htons(0); /* no answers unless changed below*/
+ header->ancount = htons(0); /* no answers unless changed below */
if (flags == F_NEG)
header->rcode = SERVFAIL; /* couldn't get memory */
- else if (flags == F_NOERR || flags == F_QUERY)
+ else if (flags == F_NOERR)
header->rcode = NOERROR; /* empty domain */
else if (flags == F_NXDOMAIN)
header->rcode = NXDOMAIN;
header->rcode = NOERROR;
header->ancount = htons(1);
header->aa = 1;
- PUTSHORT (sizeof(HEADER) | 0xc000, p);
- PUTSHORT(T_A, p);
- PUTSHORT(C_IN, p);
- PUTLONG(ttl, p); /* TTL */
- PUTSHORT(INADDRSZ, p);
- memcpy(p, addrp, INADDRSZ);
- p += INADDRSZ;
+ add_resource_record(header, NULL, NULL, sizeof(HEADER), &p, ttl, NULL, T_A, C_IN, "4", addrp);
}
#ifdef HAVE_IPV6
else if (p && flags == F_IPV6)
header->rcode = NOERROR;
header->ancount = htons(1);
header->aa = 1;
- PUTSHORT (sizeof(HEADER) | 0xc000, p);
- PUTSHORT(T_AAAA, p);
- PUTSHORT(C_IN, p);
- PUTLONG(ttl, p); /* TTL */
- PUTSHORT(IN6ADDRSZ, p);
- memcpy(p, addrp, IN6ADDRSZ);
- p += IN6ADDRSZ;
+ add_resource_record(header, NULL, NULL, sizeof(HEADER), &p, ttl, NULL, T_AAAA, C_IN, "6", addrp);
}
#endif
else /* nowhere to forward to */
return p - (unsigned char *)header;
}
-
+
+/* check if name matches local names ie from /etc/hosts or DHCP or local mx names. */
+int check_for_local_domain(char *name, time_t now)
+{
+ struct crec *crecp;
+ struct mx_srv_record *mx;
+ struct txt_record *txt;
+ struct interface_name *intr;
+ struct ptr_record *ptr;
+
+ if ((crecp = cache_find_by_name(NULL, name, now, F_IPV4 | F_IPV6)) &&
+ (crecp->flags & (F_HOSTS | F_DHCP)))
+ return 1;
+
+ for (mx = daemon->mxnames; mx; mx = mx->next)
+ if (hostname_isequal(name, mx->name))
+ return 1;
+
+ for (txt = daemon->txt; txt; txt = txt->next)
+ if (hostname_isequal(name, txt->name))
+ return 1;
+
+ for (intr = daemon->int_names; intr; intr = intr->next)
+ if (hostname_isequal(name, intr->name))
+ return 1;
+
+ for (ptr = daemon->ptr; ptr; ptr = ptr->next)
+ if (hostname_isequal(name, ptr->name))
+ return 1;
+
+ return 0;
+}
/* Is the packet a reply with the answer address equal to addr?
If so mung is into an NXDOMAIN reply and also put that information
in the cache. */
-int check_for_bogus_wildcard(HEADER *header, unsigned int qlen, char *name,
+int check_for_bogus_wildcard(HEADER *header, size_t qlen, char *name,
struct bogus_addr *baddr, time_t now)
{
unsigned char *p;
if (!(p = skip_questions(header, qlen)))
return 0; /* bad packet */
- for (i=0; i<ntohs(header->ancount); i++)
+ for (i = ntohs(header->ancount); i != 0; i--)
{
- if (!extract_name(header, qlen, &p, name, 1))
+ if (!extract_name(header, qlen, &p, name, 1, 10))
return 0; /* bad packet */
GETSHORT(qtype, p);
GETSHORT(rdlen, p);
if (qclass == C_IN && qtype == T_A)
- for (baddrp = baddr; baddrp; baddrp = baddrp->next)
- if (memcmp(&baddrp->addr, p, INADDRSZ) == 0)
- {
- /* Found a bogus address. Mangle the packet into an NXDOMAIN reply */
- header->aa = 0;
- header->ra = 1; /* recursion if available */
- header->nscount = htons(0);
- header->arcount = htons(0);
- header->ancount = htons(0);
- header->rcode = NXDOMAIN;
-
- cache_start_insert();
- cache_insert(name, NULL, now, ttl, F_IPV4 | F_FORWARD | F_NEG | F_NXDOMAIN | F_CONFIG);
- cache_end_insert();
-
- return 1;
- }
+ {
+ if (!CHECK_LEN(header, p, qlen, INADDRSZ))
+ return 0;
+
+ for (baddrp = baddr; baddrp; baddrp = baddrp->next)
+ if (memcmp(&baddrp->addr, p, INADDRSZ) == 0)
+ {
+ /* Found a bogus address. Insert that info here, since there no SOA record
+ to get the ttl from in the normal processing */
+ cache_start_insert();
+ cache_insert(name, NULL, now, ttl, F_IPV4 | F_FORWARD | F_NEG | F_NXDOMAIN | F_CONFIG);
+ cache_end_insert();
+
+ return 1;
+ }
+ }
- p += rdlen;
+ if (!ADD_RDLEN(header, p, qlen, rdlen))
+ return 0;
}
return 0;
}
+static int add_resource_record(HEADER *header, char *limit, int *truncp, unsigned int nameoffset, unsigned char **pp,
+ unsigned long ttl, unsigned int *offset, unsigned short type, unsigned short class, char *format, ...)
+{
+ va_list ap;
+ unsigned char *sav, *p = *pp;
+ int j;
+ unsigned short usval;
+ long lval;
+ char *sval;
+
+ if (truncp && *truncp)
+ return 0;
+
+ PUTSHORT(nameoffset | 0xc000, p);
+ PUTSHORT(type, p);
+ PUTSHORT(class, p);
+ PUTLONG(ttl, p); /* TTL */
+
+ sav = p; /* Save pointer to RDLength field */
+ PUTSHORT(0, p); /* Placeholder RDLength */
+
+ va_start(ap, format); /* make ap point to 1st unamed argument */
+
+ for (; *format; format++)
+ switch (*format)
+ {
+#ifdef HAVE_IPV6
+ case '6':
+ sval = va_arg(ap, char *);
+ memcpy(p, sval, IN6ADDRSZ);
+ p += IN6ADDRSZ;
+ break;
+#endif
+
+ case '4':
+ sval = va_arg(ap, char *);
+ memcpy(p, sval, INADDRSZ);
+ p += INADDRSZ;
+ break;
+
+ case 's':
+ usval = va_arg(ap, int);
+ PUTSHORT(usval, p);
+ break;
+
+ case 'l':
+ lval = va_arg(ap, long);
+ PUTLONG(lval, p);
+ break;
+
+ case 'd':
+ /* get domain-name answer arg and store it in RDATA field */
+ if (offset)
+ *offset = p - (unsigned char *)header;
+ p = do_rfc1035_name(p, va_arg(ap, char *));
+ *p++ = 0;
+ break;
+
+ case 't':
+ usval = va_arg(ap, int);
+ sval = va_arg(ap, char *);
+ memcpy(p, sval, usval);
+ p += usval;
+ break;
+
+ case 'z':
+ sval = va_arg(ap, char *);
+ usval = sval ? strlen(sval) : 0;
+ if (usval > 255)
+ usval = 255;
+ *p++ = (unsigned char)usval;
+ memcpy(p, sval, usval);
+ p += usval;
+ break;
+ }
+
+ va_end(ap); /* clean up variable argument pointer */
+
+ j = p - sav - 2;
+ PUTSHORT(j, sav); /* Now, store real RDLength */
+
+ /* check for overflow of buffer */
+ if (limit && ((unsigned char *)limit - p) < 0)
+ {
+ if (truncp)
+ *truncp = 1;
+ return 0;
+ }
+
+ *pp = p;
+ return 1;
+}
+
+static unsigned long crec_ttl(struct crec *crecp, time_t now)
+{
+ /* Return 0 ttl for DHCP entries, which might change
+ before the lease expires. */
+
+ if (crecp->flags & (F_IMMORTAL | F_DHCP))
+ return daemon->local_ttl;
+
+ return crecp->ttd - now;
+}
+
+
/* return zero if we can't answer from cache, or packet size if we can */
-int answer_request(HEADER *header, char *limit, unsigned int qlen, struct mx_record *mxnames,
- char *mxtarget, unsigned int options, time_t now,
- unsigned long local_ttl, char *name)
+size_t answer_request(HEADER *header, char *limit, size_t qlen,
+ struct in_addr local_addr, struct in_addr local_netmask, time_t now)
{
- unsigned char *p, *ansp;
- int qtype, qclass, is_arpa;
+ char *name = daemon->namebuff;
+ unsigned char *p, *ansp, *pheader;
+ int qtype, qclass;
struct all_addr addr;
unsigned int nameoffset;
- int q, qdcount = ntohs(header->qdcount);
- int ans, anscount = 0;
+ unsigned short flag;
+ int q, ans, anscount = 0, addncount = 0;
+ int dryrun = 0, sec_reqd = 0;
+ int is_sign;
struct crec *crecp;
- int nxdomain = 0, auth = 1;
+ int nxdomain = 0, auth = 1, trunc = 0;
+ struct mx_srv_record *rec;
+
+ /* If there is an RFC2671 pseudoheader then it will be overwritten by
+ partial replies, so we have to do a dry run to see if we can answer
+ the query. We check to see if the do bit is set, if so we always
+ forward rather than answering from the cache, which doesn't include
+ security information. */
- if (!qdcount || header->opcode != QUERY )
- return 0;
+ if (find_pseudoheader(header, qlen, NULL, &pheader, &is_sign))
+ {
+ unsigned short udpsz, ext_rcode, flags;
+ unsigned char *psave = pheader;
+
+ GETSHORT(udpsz, pheader);
+ GETSHORT(ext_rcode, pheader);
+ GETSHORT(flags, pheader);
+
+ sec_reqd = flags & 0x8000; /* do bit */
+
+ /* If our client is advertising a larger UDP packet size
+ than we allow, trim it so that we don't get an overlarge
+ response from upstream */
+ if (!is_sign && (udpsz > daemon->edns_pktsz))
+ PUTSHORT(daemon->edns_pktsz, psave);
+
+ dryrun = 1;
+ }
+
+ if (ntohs(header->qdcount) == 0 || header->opcode != QUERY )
+ return 0;
+
+ for (rec = daemon->mxnames; rec; rec = rec->next)
+ rec->offset = 0;
+
+ rerun:
/* determine end of question section (we put answers there) */
if (!(ansp = skip_questions(header, qlen)))
return 0; /* bad packet */
/* now process each question, answers go in RRs after the question */
p = (unsigned char *)(header+1);
-
- for (q=0; q<qdcount; q++)
+
+ for (q = ntohs(header->qdcount); q != 0; q--)
{
/* save pointer to name for copying into answers */
nameoffset = p - (unsigned char *)header;
/* now extract name as .-concatenated string into name */
- if (!extract_name(header, qlen, &p, name, 1))
+ if (!extract_name(header, qlen, &p, name, 1, 4))
return 0; /* bad packet */
-
- /* see if it's w.z.y.z.in-addr.arpa format */
-
- is_arpa = in_arpa_name_2_addr(name, &addr);
-
+
GETSHORT(qtype, p);
GETSHORT(qclass, p);
ans = 0; /* have we answered this question */
- if (qclass == C_CHAOS)
- /* special query to get version. */
+ if (qtype == T_TXT || qtype == T_ANY)
{
- if (qtype == T_TXT)
+ struct txt_record *t;
+ for(t = daemon->txt; t ; t = t->next)
{
- int len;
- if (hostname_isequal(name, "version.bind"))
- sprintf(name, "dnsmasq-%s", VERSION);
- else if (hostname_isequal(name, "authors.bind"))
- sprintf(name, "Simon Kelley");
- else
- *name = 0;
- len = strlen(name);
- PUTSHORT(nameoffset | 0xc000, ansp);
- PUTSHORT(T_TXT, ansp);
- PUTSHORT(C_CHAOS, ansp);
- PUTLONG(0, ansp);
- PUTSHORT(len+1, ansp);
- *ansp++ = len;
- memcpy(ansp, name, len);
- ansp += len;
- ans = 1;
- anscount++;
-
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
+ if (t->class == qclass && hostname_isequal(name, t->name))
+ {
+ ans = 1;
+ if (!dryrun)
+ {
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<TXT>");
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ daemon->local_ttl, NULL,
+ T_TXT, t->class, "t", t->len, t->txt))
+ anscount++;
+
+ }
+ }
}
- else
- return 0;
}
- else if (qclass != C_IN)
- return 0; /* we can't answer non-inet queries */
- else
+
+ if (qclass == C_IN)
{
-
- if ((options & OPT_FILTER) && (qtype == T_SOA || qtype == T_SRV))
- ans = 1;
-
if (qtype == T_PTR || qtype == T_ANY)
{
- crecp = NULL;
- while ((crecp = cache_find_by_addr(crecp, &addr, now, is_arpa)))
- {
- unsigned long ttl;
- /* Return 0 ttl for DHCP entries, which might change
- before the lease expires. */
- if (crecp->flags & (F_IMMORTAL | F_DHCP))
- ttl = local_ttl;
- else
- ttl = crecp->ttd - now;
-
- /* don't answer wildcard queries with data not from /etc/hosts
- or dhcp leases */
- if (qtype == T_ANY && !(crecp->flags & (F_HOSTS | F_DHCP)))
- return 0;
-
+ /* see if it's w.z.y.z.in-addr.arpa format */
+ int is_arpa = in_arpa_name_2_addr(name, &addr);
+ struct ptr_record *ptr;
+ struct interface_name* intr = NULL;
+
+ for (ptr = daemon->ptr; ptr; ptr = ptr->next)
+ if (hostname_isequal(name, ptr->name))
+ break;
+
+ if (is_arpa == F_IPV4)
+ for (intr = daemon->int_names; intr; intr = intr->next)
+ {
+ if (addr.addr.addr4.s_addr == get_ifaddr(intr->intr).s_addr)
+ break;
+ else
+ while (intr->next && strcmp(intr->intr, intr->next->intr) == 0)
+ intr = intr->next;
+ }
+
+ if (intr)
+ {
ans = 1;
- if (crecp->flags & F_NEG)
+ if (!dryrun)
{
- log_query(crecp->flags & ~F_FORWARD, name, &addr);
- auth = 0;
- if (crecp->flags & F_NXDOMAIN)
- nxdomain = 1;
+ log_query(F_IPV4 | F_REVERSE | F_CONFIG, intr->name, &addr, NULL);
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ daemon->local_ttl, NULL,
+ T_PTR, C_IN, "d", intr->name))
+ anscount++;
}
- else
- {
- if (!(crecp->flags & (F_HOSTS | F_DHCP)))
- auth = 0;
- ansp = add_text_record(nameoffset, ansp, ttl, 0, T_PTR,
- cache_get_name(crecp));
-
- log_query(crecp->flags & ~F_FORWARD, cache_get_name(crecp), &addr);
- anscount++;
-
- /* if last answer exceeded packet size, give up */
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
+ }
+ else if (ptr)
+ {
+ ans = 1;
+ if (!dryrun)
+ {
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<PTR>");
+ for (ptr = daemon->ptr; ptr; ptr = ptr->next)
+ if (hostname_isequal(name, ptr->name) &&
+ add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ daemon->local_ttl, NULL,
+ T_PTR, C_IN, "d", ptr->ptr))
+ anscount++;
+
}
}
-
- /* if not in cache, enabled and private IPV4 address, fake up answer */
- if (ans == 0 && is_arpa == F_IPV4 &&
- (options & OPT_BOGUSPRIV) &&
- private_net(&addr))
+ else if ((crecp = cache_find_by_addr(NULL, &addr, now, is_arpa)))
+ do
+ {
+ /* don't answer wildcard queries with data not from /etc/hosts or dhcp leases */
+ if (qtype == T_ANY && !(crecp->flags & (F_HOSTS | F_DHCP)))
+ continue;
+
+ if (crecp->flags & F_NEG)
+ {
+ ans = 1;
+ auth = 0;
+ if (crecp->flags & F_NXDOMAIN)
+ nxdomain = 1;
+ if (!dryrun)
+ log_query(crecp->flags & ~F_FORWARD, name, &addr, NULL);
+ }
+ else if ((crecp->flags & (F_HOSTS | F_DHCP)) || !sec_reqd)
+ {
+ ans = 1;
+ if (!(crecp->flags & (F_HOSTS | F_DHCP)))
+ auth = 0;
+ if (!dryrun)
+ {
+ log_query(crecp->flags & ~F_FORWARD, cache_get_name(crecp), &addr,
+ record_source(daemon->addn_hosts, crecp->uid));
+
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ crec_ttl(crecp, now), NULL,
+ T_PTR, C_IN, "d", cache_get_name(crecp)))
+ anscount++;
+ }
+ }
+ } while ((crecp = cache_find_by_addr(crecp, &addr, now, is_arpa)));
+ else if (is_arpa == F_IPV4 &&
+ (daemon->options & OPT_BOGUSPRIV) &&
+ private_net(addr.addr.addr4))
{
- struct in_addr addr4 = *((struct in_addr *)&addr);
- ansp = add_text_record(nameoffset, ansp, local_ttl, 0, T_PTR, inet_ntoa(addr4));
- log_query(F_CONFIG | F_REVERSE | F_IPV4, inet_ntoa(addr4), &addr);
- anscount++;
+ /* if not in cache, enabled and private IPV4 address, return NXDOMAIN */
ans = 1;
-
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
+ nxdomain = 1;
+ if (!dryrun)
+ log_query(F_CONFIG | F_REVERSE | F_IPV4 | F_NEG | F_NXDOMAIN,
+ name, &addr, NULL);
}
}
-
- if (qtype == T_A || qtype == T_ANY)
+
+ for (flag = F_IPV4; flag; flag = (flag == F_IPV4) ? F_IPV6 : 0)
{
- /* T_ANY queries for hostnames with underscores are spam
- from win2k - don't forward them. */
- if ((options & OPT_FILTER) &&
- qtype == T_ANY &&
- (strchr(name, '_') != NULL))
- ans = 1;
- else
- {
- crecp = NULL;
- while ((crecp = cache_find_by_name(crecp, name, now, F_IPV4)))
- {
- unsigned long ttl;
- if (crecp->flags & (F_IMMORTAL | F_DHCP))
- ttl = local_ttl;
- else
- ttl = crecp->ttd - now;
-
- /* don't answer wildcard queries with data not from /etc/hosts
- or DHCP leases */
- if (qtype == T_ANY && !(crecp->flags & (F_HOSTS | F_DHCP)))
- return 0;
-
- /* If we have negative cache entry, it's OK
- to return no answer. */
+ unsigned short type = T_A;
+
+ if (flag == F_IPV6)
+#ifdef HAVE_IPV6
+ type = T_AAAA;
+#else
+ break;
+#endif
+
+ if (qtype != type && qtype != T_ANY)
+ continue;
+
+ /* Check for "A for A" queries */
+ if (qtype == T_A && (addr.addr.addr4.s_addr = inet_addr(name)) != (in_addr_t) -1)
+ {
+ ans = 1;
+ if (!dryrun)
+ {
+ log_query(F_FORWARD | F_CONFIG | F_IPV4, name, &addr, NULL);
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ daemon->local_ttl, NULL, type, C_IN, "4", &addr))
+ anscount++;
+ }
+ continue;
+ }
+
+ /* interface name stuff */
+ if (qtype == T_A)
+ {
+ struct interface_name *intr;
+
+ for (intr = daemon->int_names; intr; intr = intr->next)
+ if (hostname_isequal(name, intr->name))
+ break;
+
+ if (intr)
+ {
ans = 1;
-
- if (crecp->flags & F_NEG)
+ if (!dryrun)
{
- log_query(crecp->flags, name, NULL);
- auth = 0;
- if (crecp->flags & F_NXDOMAIN)
- nxdomain = 1;
+ if ((addr.addr.addr4 = get_ifaddr(intr->intr)).s_addr == (in_addr_t) -1)
+ log_query(F_FORWARD | F_CONFIG | F_IPV4 | F_NEG, name, NULL, NULL);
+ else
+ {
+ log_query(F_FORWARD | F_CONFIG | F_IPV4, name, &addr, NULL);
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ daemon->local_ttl, NULL, type, C_IN, "4", &addr))
+ anscount++;
+ }
}
- else
- {
- if (!(crecp->flags & (F_HOSTS | F_DHCP)))
- auth = 0;
- log_query(crecp->flags & ~F_REVERSE, name, &crecp->addr);
-
- /* copy question as first part of answer (use compression) */
- PUTSHORT(nameoffset | 0xc000, ansp);
- PUTSHORT(T_A, ansp);
- PUTSHORT(C_IN, ansp);
- PUTLONG(ttl, ansp); /* TTL */
-
- PUTSHORT(INADDRSZ, ansp);
- memcpy(ansp, &crecp->addr, INADDRSZ);
- ansp += INADDRSZ;
- anscount++;
-
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
- }
-
+ continue;
}
}
- }
-
-#ifdef HAVE_IPV6
- if (qtype == T_AAAA || qtype == T_ANY)
- {
- /* T_ANY queries for hostnames with underscores are spam
- from win2k - don't forward them. */
- if ((options & OPT_FILTER) &&
- qtype == T_ANY
- && (strchr(name, '_') != NULL))
- ans = 1;
- else
- {
- crecp = NULL;
- while ((crecp = cache_find_by_name(crecp, name, now, F_IPV6)))
+
+ cname_restart:
+ if ((crecp = cache_find_by_name(NULL, name, now, flag | F_CNAME)))
+ {
+ int localise = 0;
+
+ /* See if a putative address is on the network from which we recieved
+ the query, is so we'll filter other answers. */
+ if (local_addr.s_addr != 0 && (daemon->options & OPT_LOCALISE) && flag == F_IPV4)
+ {
+ struct crec *save = crecp;
+ do {
+ if ((crecp->flags & F_HOSTS) &&
+ is_same_net(*((struct in_addr *)&crecp->addr), local_addr, local_netmask))
+ {
+ localise = 1;
+ break;
+ }
+ } while ((crecp = cache_find_by_name(crecp, name, now, flag | F_CNAME)));
+ crecp = save;
+ }
+
+ do
{
- unsigned long ttl;
- if (crecp->flags & (F_IMMORTAL | F_DHCP))
- ttl = local_ttl;
- else
- ttl = crecp->ttd - now;
-
/* don't answer wildcard queries with data not from /etc/hosts
or DHCP leases */
if (qtype == T_ANY && !(crecp->flags & (F_HOSTS | F_DHCP)))
- return 0;
+ break;
- /* If we have negative cache entry, it's OK
- to return no answer. */
- ans = 1;
+ if (crecp->flags & F_CNAME)
+ {
+ if (!dryrun)
+ {
+ log_query(crecp->flags, name, NULL, record_source(daemon->addn_hosts, crecp->uid));
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ crec_ttl(crecp, now), &nameoffset,
+ T_CNAME, C_IN, "d", cache_get_name(crecp->addr.cname.cache)))
+ anscount++;
+ }
+
+ strcpy(name, cache_get_name(crecp->addr.cname.cache));
+ goto cname_restart;
+ }
if (crecp->flags & F_NEG)
{
- log_query(crecp->flags, name, NULL);
+ ans = 1;
auth = 0;
if (crecp->flags & F_NXDOMAIN)
nxdomain = 1;
+ if (!dryrun)
+ log_query(crecp->flags, name, NULL, NULL);
}
- else
+ else if ((crecp->flags & (F_HOSTS | F_DHCP)) || !sec_reqd)
{
+ /* If we are returning local answers depending on network,
+ filter here. */
+ if (localise &&
+ (crecp->flags & F_HOSTS) &&
+ !is_same_net(*((struct in_addr *)&crecp->addr), local_addr, local_netmask))
+ continue;
+
if (!(crecp->flags & (F_HOSTS | F_DHCP)))
auth = 0;
- log_query(crecp->flags & ~F_REVERSE, name, &crecp->addr);
- /* copy question as first part of answer (use compression) */
- PUTSHORT(nameoffset | 0xc000, ansp);
- PUTSHORT(T_AAAA, ansp);
- PUTSHORT(C_IN, ansp);
- PUTLONG(ttl, ansp); /* TTL */
-
- PUTSHORT(IN6ADDRSZ, ansp);
- memcpy(ansp, &crecp->addr, IN6ADDRSZ);
- ansp += IN6ADDRSZ;
- anscount++;
-
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
+ ans = 1;
+ if (!dryrun)
+ {
+ log_query(crecp->flags & ~F_REVERSE, name, &crecp->addr.addr,
+ record_source(daemon->addn_hosts, crecp->uid));
+
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp,
+ crec_ttl(crecp, now), NULL, type, C_IN,
+ type == T_A ? "4" : "6", &crecp->addr))
+ anscount++;
+ }
}
- }
+ } while ((crecp = cache_find_by_name(crecp, name, now, flag | F_CNAME)));
}
}
-#endif
if (qtype == T_MX || qtype == T_ANY)
{
- struct mx_record *mx;
- for (mx = mxnames; mx; mx = mx->next)
- if (hostname_isequal(name, mx->mxname))
- break;
- if (mx)
- {
- ansp = add_text_record(nameoffset, ansp, local_ttl, 1, T_MX,
- mx->mxtarget ? mx->mxtarget : mxtarget);
- anscount++;
+ int found = 0;
+ for (rec = daemon->mxnames; rec; rec = rec->next)
+ if (!rec->issrv && hostname_isequal(name, rec->name))
+ {
+ ans = found = 1;
+ if (!dryrun)
+ {
+ unsigned int offset;
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<MX>");
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl,
+ &offset, T_MX, C_IN, "sd", rec->weight, rec->target))
+ {
+ anscount++;
+ if (rec->target)
+ rec->offset = offset;
+ }
+ }
+ }
+
+ if (!found && (daemon->options & (OPT_SELFMX | OPT_LOCALMX)) &&
+ cache_find_by_name(NULL, name, now, F_HOSTS | F_DHCP))
+ {
ans = 1;
+ if (!dryrun)
+ {
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<MX>");
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl, NULL,
+ T_MX, C_IN, "sd", 1,
+ (daemon->options & OPT_SELFMX) ? name : daemon->mxtarget))
+ anscount++;
+ }
}
- else if ((options & (OPT_SELFMX | OPT_LOCALMX)) &&
- cache_find_by_name(NULL, name, now, F_HOSTS | F_DHCP))
- {
- ansp = add_text_record(nameoffset, ansp, local_ttl, 1, T_MX,
- (options & OPT_SELFMX) ? name : mxtarget);
- anscount++;
+ }
+
+ if (qtype == T_SRV || qtype == T_ANY)
+ {
+ int found = 0;
+
+ for (rec = daemon->mxnames; rec; rec = rec->next)
+ if (rec->issrv && hostname_isequal(name, rec->name))
+ {
+ found = ans = 1;
+ if (!dryrun)
+ {
+ unsigned int offset;
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<SRV>");
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl,
+ &offset, T_SRV, C_IN, "sssd",
+ rec->priority, rec->weight, rec->srvport, rec->target))
+ {
+ anscount++;
+ if (rec->target)
+ rec->offset = offset;
+ }
+ }
+ }
+
+ if (!found && (daemon->options & OPT_FILTER) && (qtype == T_SRV || (qtype == T_ANY && strchr(name, '_'))))
+ {
ans = 1;
+ if (!dryrun)
+ log_query(F_CONFIG | F_NEG, name, NULL, NULL);
}
- if (((unsigned char *)limit - ansp) < 0)
- return 0;
+ }
+
+ if (qtype == T_NAPTR || qtype == T_ANY)
+ {
+ struct naptr *na;
+ for (na = daemon->naptr; na; na = na->next)
+ if (hostname_isequal(name, na->name))
+ {
+ ans = 1;
+ if (!dryrun)
+ {
+ log_query(F_CNAME | F_FORWARD | F_CONFIG | F_NXDOMAIN, name, NULL, "<NAPTR>");
+ if (add_resource_record(header, limit, &trunc, nameoffset, &ansp, daemon->local_ttl,
+ NULL, T_NAPTR, C_IN, "sszzzd",
+ na->order, na->pref, na->flags, na->services, na->regexp, na->replace))
+ anscount++;
+ }
+ }
}
if (qtype == T_MAILB)
ans = 1, nxdomain = 1;
-
+
+ if (qtype == T_SOA && (daemon->options & OPT_FILTER))
+ {
+ ans = 1;
+ if (!dryrun)
+ log_query(F_CONFIG | F_NEG, name, &addr, NULL);
+ }
}
-
+
if (!ans)
return 0; /* failed to answer a question */
-
}
+ if (dryrun)
+ {
+ dryrun = 0;
+ goto rerun;
+ }
+
+ /* create an additional data section, for stuff in SRV and MX record replies. */
+ for (rec = daemon->mxnames; rec; rec = rec->next)
+ if (rec->offset != 0)
+ {
+ /* squash dupes */
+ struct mx_srv_record *tmp;
+ for (tmp = rec->next; tmp; tmp = tmp->next)
+ if (tmp->offset != 0 && hostname_isequal(rec->target, tmp->target))
+ tmp->offset = 0;
+
+ crecp = NULL;
+ while ((crecp = cache_find_by_name(crecp, rec->target, now, F_IPV4 | F_IPV6)))
+ {
+#ifdef HAVE_IPV6
+ int type = crecp->flags & F_IPV4 ? T_A : T_AAAA;
+#else
+ int type = T_A;
+#endif
+ if (crecp->flags & F_NEG)
+ continue;
+
+ if (add_resource_record(header, limit, NULL, rec->offset, &ansp,
+ crec_ttl(crecp, now), NULL, type, C_IN,
+ crecp->flags & F_IPV4 ? "4" : "6", &crecp->addr))
+ addncount++;
+ }
+ }
+
/* done all questions, set up header and return length of result */
header->qr = 1; /* response */
header->aa = auth; /* authoritive - only hosts and DHCP derived names. */
header->ra = 1; /* recursion if available */
- header->tc = 0; /* truncation */
+ header->tc = trunc; /* truncation */
if (anscount == 0 && nxdomain)
header->rcode = NXDOMAIN;
else
header->rcode = NOERROR; /* no error */
header->ancount = htons(anscount);
header->nscount = htons(0);
- header->arcount = htons(0);
+ header->arcount = htons(addncount);
return ansp - (unsigned char *)header;
}
projects / people / ms / dnsmasq.git / blobdiff