]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
28 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
29 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
);
30 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class);
31 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
);
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
38 union mysockaddr
*to
, struct all_addr
*source
,
44 struct cmsghdr align
; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
47 #elif defined(IP_SENDSRCADDR)
48 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
51 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
55 iov
[0].iov_base
= packet
;
58 msg
.msg_control
= NULL
;
59 msg
.msg_controllen
= 0;
62 msg
.msg_namelen
= sa_len(to
);
68 struct cmsghdr
*cmptr
;
69 msg
.msg_control
= &control_u
;
70 msg
.msg_controllen
= sizeof(control_u
);
71 cmptr
= CMSG_FIRSTHDR(&msg
);
73 if (to
->sa
.sa_family
== AF_INET
)
75 #if defined(HAVE_LINUX_NETWORK)
78 p
.ipi_spec_dst
= source
->addr
.addr4
;
79 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
80 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
81 cmptr
->cmsg_level
= IPPROTO_IP
;
82 cmptr
->cmsg_type
= IP_PKTINFO
;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
85 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
86 cmptr
->cmsg_level
= IPPROTO_IP
;
87 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
94 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
95 p
.ipi6_addr
= source
->addr
.addr6
;
96 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
97 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
98 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
99 cmptr
->cmsg_level
= IPPROTO_IPV6
;
102 (void)iface
; /* eliminate warning */
106 while (sendmsg(fd
, &msg
, 0) == -1)
111 /* If interface is still in DAD, EINVAL results - ignore that. */
115 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
122 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
123 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
130 unsigned int namelen
= strlen(qdomain
);
131 unsigned int matchlen
= 0;
133 unsigned int flags
= 0;
135 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
139 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
140 *type
= SERV_FOR_NODOTS
;
141 if (serv
->flags
& SERV_NO_ADDR
)
143 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
148 if (serv
->addr
.sa
.sa_family
== AF_INET
)
149 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
152 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
155 else if (!flags
|| (flags
& F_NXDOMAIN
))
159 else if (serv
->flags
& SERV_HAS_DOMAIN
)
161 unsigned int domainlen
= strlen(serv
->domain
);
162 char *matchstart
= qdomain
+ namelen
- domainlen
;
163 if (namelen
>= domainlen
&&
164 hostname_isequal(matchstart
, serv
->domain
) &&
165 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
167 if (serv
->flags
& SERV_NO_REBIND
)
171 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen
!= 0 && domainlen
== matchlen
)
177 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
179 if (!(sflag
& qtype
) && flags
== 0)
184 if (flags
& (F_IPV4
| F_IPV6
))
189 if (domainlen
>= matchlen
)
191 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
192 *domain
= serv
->domain
;
193 matchlen
= domainlen
;
194 if (serv
->flags
& SERV_NO_ADDR
)
196 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
201 if (serv
->addr
.sa
.sa_family
== AF_INET
)
202 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
205 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
208 else if (!flags
|| (flags
& F_NXDOMAIN
))
218 if (flags
== 0 && !(qtype
& F_QUERY
) &&
219 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
223 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
230 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
231 logflags
= F_NEG
| qtype
;
233 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
235 else if ((*type
) & SERV_USE_RESOLV
)
237 *type
= 0; /* use normal servers for this domain */
243 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
244 struct all_addr
*dst_addr
, unsigned int dst_iface
,
245 struct dns_header
*header
, size_t plen
, time_t now
,
246 struct frec
*forward
, int ad_reqd
, int do_bit
)
249 int type
= 0, norebind
= 0;
250 struct all_addr
*addrp
= NULL
;
251 unsigned int flags
= 0;
252 struct server
*start
= NULL
;
254 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
256 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
259 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
263 /* may be no servers available. */
264 if (!daemon
->servers
)
266 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward
->blocking_query
)
275 while (forward
->blocking_query
)
276 forward
= forward
->blocking_query
;
278 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
279 plen
= forward
->stash_len
;
281 if (forward
->sentto
->addr
.sa
.sa_family
)
282 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
285 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
288 if (forward
->sentto
->sfd
)
289 fd
= forward
->sentto
->sfd
->fd
;
293 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
294 fd
= forward
->rfd6
->fd
;
297 fd
= forward
->rfd4
->fd
;
300 while (sendto(fd
, (char *)header
, plen
, 0,
301 &forward
->sentto
->addr
.sa
,
302 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
308 /* retry on existing query, send to all available servers */
309 domain
= forward
->sentto
->domain
;
310 forward
->sentto
->failed_queries
++;
311 if (!option_bool(OPT_ORDER
))
313 forward
->forwardall
= 1;
314 daemon
->last_server
= NULL
;
316 type
= forward
->sentto
->flags
& SERV_TYPE
;
317 if (!(start
= forward
->sentto
->next
))
318 start
= daemon
->servers
; /* at end of list, recycle */
319 header
->id
= htons(forward
->new_id
);
324 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
326 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
327 /* table full - server failure. */
332 forward
->source
= *udpaddr
;
333 forward
->dest
= *dst_addr
;
334 forward
->iface
= dst_iface
;
335 forward
->orig_id
= ntohs(header
->id
);
336 forward
->new_id
= get_id();
338 memcpy(forward
->hash
, hash
, HASH_SIZE
);
339 forward
->forwardall
= 0;
342 forward
->flags
|= FREC_NOREBIND
;
343 if (header
->hb4
& HB4_CD
)
344 forward
->flags
|= FREC_CHECKING_DISABLED
;
346 forward
->flags
|= FREC_AD_QUESTION
;
348 forward
->work_counter
= DNSSEC_WORK
;
350 forward
->flags
|= FREC_DO_QUESTION
;
353 header
->id
= htons(forward
->new_id
);
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
362 if (option_bool(OPT_ORDER
))
363 start
= daemon
->servers
;
364 else if (!(start
= daemon
->last_server
) ||
365 daemon
->forwardcount
++ > FORWARD_TEST
||
366 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
368 start
= daemon
->servers
;
369 forward
->forwardall
= 1;
370 daemon
->forwardcount
= 0;
371 daemon
->forwardtime
= now
;
376 start
= daemon
->servers
;
377 if (!option_bool(OPT_ORDER
))
378 forward
->forwardall
= 1;
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
387 if (!flags
&& forward
)
389 struct server
*firstsentto
= start
;
392 if (option_bool(OPT_ADD_MAC
))
393 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
395 if (option_bool(OPT_CLIENT_SUBNET
))
397 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
401 forward
->flags
|= FREC_HAS_SUBNET
;
406 if (option_bool(OPT_DNSSEC_VALID
))
408 size_t new_plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG
))
413 header
->hb4
|= HB4_CD
;
415 if (new_plen
!= plen
)
416 forward
->flags
|= FREC_ADDED_PHEADER
;
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
428 if (type
== (start
->flags
& SERV_TYPE
) &&
429 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
430 !(start
->flags
& SERV_LITERAL_ADDRESS
))
434 /* find server socket to use, may need to get random one. */
440 if (start
->addr
.sa
.sa_family
== AF_INET6
)
442 if (!forward
->rfd6
&&
443 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
445 daemon
->rfd_save
= forward
->rfd6
;
446 fd
= forward
->rfd6
->fd
;
451 if (!forward
->rfd4
&&
452 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
454 daemon
->rfd_save
= forward
->rfd4
;
455 fd
= forward
->rfd4
->fd
;
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK
))
463 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
464 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
469 if (sendto(fd
, (char *)header
, plen
, 0,
471 sa_len(&start
->addr
)) == -1)
478 /* Keep info in case we want to re-send this packet */
479 daemon
->srv_save
= start
;
480 daemon
->packet_len
= plen
;
483 strcpy(daemon
->namebuff
, "query");
484 if (start
->addr
.sa
.sa_family
== AF_INET
)
485 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
486 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
489 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
490 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
494 forward
->sentto
= start
;
495 if (!forward
->forwardall
)
497 forward
->forwardall
++;
501 if (!(start
= start
->next
))
502 start
= daemon
->servers
;
504 if (start
== firstsentto
)
511 /* could not send on, prepare to return */
512 header
->id
= htons(forward
->orig_id
);
513 free_frec(forward
); /* cancel */
516 /* could not send on, return empty answer or address if known for whole domain */
519 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
520 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
526 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
527 int no_cache
, int cache_secure
, int ad_reqd
, int do_bit
, int added_pheader
, int check_subnet
, union mysockaddr
*query_source
)
529 unsigned char *pheader
, *sizep
;
531 int munged
= 0, is_sign
;
538 /* Similar algorithm to search_servers. */
539 struct ipsets
*ipset_pos
;
540 unsigned int namelen
= strlen(daemon
->namebuff
);
541 unsigned int matchlen
= 0;
542 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
544 unsigned int domainlen
= strlen(ipset_pos
->domain
);
545 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
546 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
547 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
548 domainlen
>= matchlen
)
550 matchlen
= domainlen
;
551 sets
= ipset_pos
->sets
;
556 /* If upstream is advertising a larger UDP packet size
557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
560 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
562 unsigned short udpsz
;
563 unsigned char *psave
= sizep
;
565 GETSHORT(udpsz
, sizep
);
567 if (!is_sign
&& udpsz
> daemon
->edns_pktsz
)
568 PUTSHORT(daemon
->edns_pktsz
, psave
);
570 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
572 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
579 header
->arcount
= htons(0);
583 /* RFC 4035 sect 4.6 para 3 */
584 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
585 header
->hb4
&= ~HB4_AD
;
587 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
590 /* Complain loudly if the upstream server is non-recursive. */
591 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
592 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
594 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
595 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
596 if (!option_bool(OPT_LOG
))
597 server
->flags
|= SERV_WARNED_RECURSIVE
;
600 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
601 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
604 SET_RCODE(header
, NXDOMAIN
);
605 header
->hb3
&= ~HB3_AA
;
612 if (RCODE(header
) == NXDOMAIN
&&
613 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
614 check_for_local_domain(daemon
->namebuff
, now
))
616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
620 header
->hb3
|= HB3_AA
;
621 SET_RCODE(header
, NOERROR
);
625 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
627 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
637 if (no_cache
&& !(header
->hb4
& HB4_CD
))
639 if (!option_bool(OPT_DNSSEC_DEBUG
))
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header
, SERVFAIL
);
647 if (option_bool(OPT_DNSSEC_VALID
))
648 header
->hb4
&= ~HB4_AD
;
650 if (!(header
->hb4
& HB4_CD
) && ad_reqd
&& cache_secure
)
651 header
->hb4
|= HB4_AD
;
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
655 n
= filter_rrsigs(header
, n
);
658 /* do this after extract_addresses. Ensure NODATA reply and remove
663 header
->ancount
= htons(0);
664 header
->nscount
= htons(0);
665 header
->arcount
= htons(0);
668 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
669 sections of the packet. Find the new length here and put back pseudoheader
670 if it was removed. */
671 return resize_packet(header
, n
, pheader
, plen
);
674 /* sets new last_server */
675 void reply_query(int fd
, int family
, time_t now
)
677 /* packet from peer server, extract data for cache, and send to
678 original requester */
679 struct dns_header
*header
;
680 union mysockaddr serveraddr
;
681 struct frec
*forward
;
682 socklen_t addrlen
= sizeof(serveraddr
);
683 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
685 struct server
*server
;
691 /* packet buffer overwritten */
692 daemon
->srv_save
= NULL
;
694 /* Determine the address of the server replying so that we can mark that as good */
695 serveraddr
.sa
.sa_family
= family
;
697 if (serveraddr
.sa
.sa_family
== AF_INET6
)
698 serveraddr
.in6
.sin6_flowinfo
= 0;
701 /* spoof check: answer must come from known server, */
702 for (server
= daemon
->servers
; server
; server
= server
->next
)
703 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
704 sockaddr_isequal(&server
->addr
, &serveraddr
))
707 header
= (struct dns_header
*)daemon
->packet
;
710 hash
= hash_questions(header
, n
, daemon
->namebuff
);
713 crc
= questions_crc(header
, n
, daemon
->namebuff
);
717 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
718 !(forward
= lookup_frec(ntohs(header
->id
), hash
)))
721 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
722 !option_bool(OPT_ORDER
) &&
723 forward
->forwardall
== 0)
724 /* for broken servers, attempt to send to another one. */
726 unsigned char *pheader
;
730 /* recreate query from reply */
731 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
734 header
->ancount
= htons(0);
735 header
->nscount
= htons(0);
736 header
->arcount
= htons(0);
737 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
739 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
740 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
, 0, 0);
746 server
= forward
->sentto
;
748 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
750 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
754 struct server
*last_server
;
756 /* find good server by address if possible, otherwise assume the last one we sent to */
757 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
758 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
759 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
761 server
= last_server
;
765 if (!option_bool(OPT_ALL_SERVERS
))
766 daemon
->last_server
= server
;
769 /* If the answer is an error, keep the forward record in place in case
770 we get a good reply from another server. Kill it when we've
771 had replies from all to avoid filling the forwarding table when
772 everything is broken */
773 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
774 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
776 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
778 if (option_bool(OPT_NO_REBIND
))
779 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
781 /* Don't cache replies where DNSSEC validation was turned off, either
782 the upstream server told us so, or the original query specified it. */
783 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
787 if (option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
791 /* We've had a reply already, which we're validating. Ignore this duplicate */
792 if (forward
->blocking_query
)
795 if (header
->hb3
& HB3_TC
)
797 /* Truncated answer can't be validated.
798 If this is an answer to a DNSSEC-generated query, we still
799 need to get the client to retry over TCP, so return
800 an answer with the TC bit set, even if the actual answer fits.
802 status
= STAT_TRUNCATED
;
804 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
805 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
806 else if (forward
->flags
& FREC_DS_QUERY
)
808 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
809 if (status
== STAT_NO_DS
)
810 status
= STAT_INSECURE
;
812 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
813 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
816 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
817 if (status
== STAT_NO_SIG
)
819 if (option_bool(OPT_DNSSEC_NO_SIGN
))
820 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
822 status
= STAT_INSECURE
;
825 /* Can't validate, as we're missing key data. Put this
826 answer aside, whilst we get that. */
827 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
829 struct frec
*new, *orig
;
831 /* Free any saved query */
833 blockdata_free(forward
->stash
);
835 /* Now save reply pending receipt of key data */
836 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
838 forward
->stash_len
= n
;
841 /* Find the original query that started it all.... */
842 for (orig
= forward
; orig
->dependent
; orig
= orig
->dependent
);
844 if (--orig
->work_counter
== 0 || !(new = get_new_frec(now
, NULL
, 1)))
845 status
= STAT_INSECURE
;
849 struct frec
*next
= new->next
;
850 *new = *forward
; /* copy everything, then overwrite */
852 new->blocking_query
= NULL
;
857 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
| FREC_CHECK_NOSIGN
);
859 new->dependent
= forward
; /* to find query awaiting new one. */
860 forward
->blocking_query
= new; /* for garbage cleaning */
861 /* validate routines leave name of required record in daemon->keyname */
862 if (status
== STAT_NEED_KEY
)
864 new->flags
|= FREC_DNSKEY_QUERY
;
865 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
866 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
870 if (status
== STAT_NEED_DS_NEG
)
871 new->flags
|= FREC_CHECK_NOSIGN
;
873 new->flags
|= FREC_DS_QUERY
;
874 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
875 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
877 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
878 memcpy(new->hash
, hash
, HASH_SIZE
);
879 new->new_id
= get_id();
880 header
->id
= htons(new->new_id
);
881 /* Save query for retransmission */
882 new->stash
= blockdata_alloc((char *)header
, nn
);
885 /* Don't resend this. */
886 daemon
->srv_save
= NULL
;
889 fd
= server
->sfd
->fd
;
894 if (server
->addr
.sa
.sa_family
== AF_INET6
)
896 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
902 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
909 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
917 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
918 Now wind back down, pulling back answers which wouldn't previously validate
919 and validate them with the new data. Note that if an answer needs multiple
920 keys to validate, we may find another key is needed, in which case we set off
921 down another branch of the tree. Once we get to the original answer
922 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
923 while (forward
->dependent
)
925 struct frec
*prev
= forward
->dependent
;
928 forward
->blocking_query
= NULL
; /* already gone */
929 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
930 n
= forward
->stash_len
;
932 if (status
== STAT_SECURE
)
934 if (forward
->flags
& FREC_DNSKEY_QUERY
)
935 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
936 else if (forward
->flags
& FREC_DS_QUERY
)
938 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
939 if (status
== STAT_NO_DS
)
940 status
= STAT_INSECURE
;
942 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
943 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
946 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
947 if (status
== STAT_NO_SIG
)
949 if (option_bool(OPT_DNSSEC_NO_SIGN
))
950 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
952 status
= STAT_INSECURE
;
956 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
961 if (status
== STAT_TRUNCATED
)
962 header
->hb3
|= HB3_TC
;
967 if (forward
->work_counter
== 0)
968 result
= "ABANDONED";
970 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
972 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
977 if (status
== STAT_SECURE
)
979 else if (status
== STAT_BOGUS
)
984 /* restore CD bit to the value in the query */
985 if (forward
->flags
& FREC_CHECKING_DISABLED
)
986 header
->hb4
|= HB4_CD
;
988 header
->hb4
&= ~HB4_CD
;
990 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
991 forward
->flags
& FREC_AD_QUESTION
, forward
->flags
& FREC_DO_QUESTION
,
992 forward
->flags
& FREC_ADDED_PHEADER
, forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
994 header
->id
= htons(forward
->orig_id
);
995 header
->hb4
|= HB4_RA
; /* recursion if available */
996 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
997 &forward
->source
, &forward
->dest
, forward
->iface
);
999 free_frec(forward
); /* cancel */
1004 void receive_query(struct listener
*listen
, time_t now
)
1006 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
1007 union mysockaddr source_addr
;
1008 unsigned short type
;
1009 struct all_addr dst_addr
;
1010 struct in_addr netmask
, dst_addr_4
;
1013 int if_index
= 0, auth_dns
= 0;
1017 struct iovec iov
[1];
1019 struct cmsghdr
*cmptr
;
1021 struct cmsghdr align
; /* this ensures alignment */
1023 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
1025 #if defined(HAVE_LINUX_NETWORK)
1026 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
1027 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1028 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1029 CMSG_SPACE(sizeof(unsigned int))];
1030 #elif defined(IP_RECVDSTADDR)
1031 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1032 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
1036 /* Can always get recvd interface for IPv6 */
1037 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
1039 int check_dst
= !option_bool(OPT_NOWILD
);
1042 /* packet buffer overwritten */
1043 daemon
->srv_save
= NULL
;
1045 dst_addr_4
.s_addr
= 0;
1048 if (option_bool(OPT_NOWILD
) && listen
->iface
)
1050 auth_dns
= listen
->iface
->dns_auth
;
1052 if (listen
->family
== AF_INET
)
1054 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
1055 netmask
= listen
->iface
->netmask
;
1059 iov
[0].iov_base
= daemon
->packet
;
1060 iov
[0].iov_len
= daemon
->edns_pktsz
;
1062 msg
.msg_control
= control_u
.control
;
1063 msg
.msg_controllen
= sizeof(control_u
);
1065 msg
.msg_name
= &source_addr
;
1066 msg
.msg_namelen
= sizeof(source_addr
);
1070 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1073 if (n
< (int)sizeof(struct dns_header
) ||
1074 (msg
.msg_flags
& MSG_TRUNC
) ||
1075 (header
->hb3
& HB3_QR
))
1078 source_addr
.sa
.sa_family
= listen
->family
;
1080 if (listen
->family
== AF_INET6
)
1081 source_addr
.in6
.sin6_flowinfo
= 0;
1088 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1091 #if defined(HAVE_LINUX_NETWORK)
1092 if (listen
->family
== AF_INET
)
1093 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1094 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1098 struct in_pktinfo
*p
;
1100 p
.c
= CMSG_DATA(cmptr
);
1101 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1102 if_index
= p
.p
->ipi_ifindex
;
1104 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1105 if (listen
->family
== AF_INET
)
1107 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1113 #ifndef HAVE_SOLARIS_NETWORK
1114 struct sockaddr_dl
*s
;
1117 p
.c
= CMSG_DATA(cmptr
);
1118 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1119 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1120 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1121 #ifdef HAVE_SOLARIS_NETWORK
1124 if_index
= p
.s
->sdl_index
;
1131 if (listen
->family
== AF_INET6
)
1133 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1134 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1138 struct in6_pktinfo
*p
;
1140 p
.c
= CMSG_DATA(cmptr
);
1142 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1143 if_index
= p
.p
->ipi6_ifindex
;
1148 /* enforce available interface configuration */
1150 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1153 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1155 if (!option_bool(OPT_CLEVERBIND
))
1156 enumerate_interfaces(0);
1157 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1158 !label_exception(if_index
, listen
->family
, &dst_addr
))
1162 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1166 /* get the netmask of the interface whch has the address we were sent to.
1167 This is no neccessarily the interface we arrived on. */
1169 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1170 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1171 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1174 /* interface may be new */
1175 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1176 enumerate_interfaces(0);
1178 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1179 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1180 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1183 /* If we failed, abandon localisation */
1185 netmask
= iface
->netmask
;
1187 dst_addr_4
.s_addr
= 0;
1191 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1194 struct auth_zone
*zone
;
1196 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1198 if (listen
->family
== AF_INET
)
1199 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1200 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1203 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1204 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1208 /* find queries for zones we're authoritative for, and answer them directly */
1210 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1211 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1223 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1226 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1227 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1228 daemon
->auth_answer
++;
1234 int ad_reqd
, do_bit
;
1235 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1236 dst_addr_4
, netmask
, now
, &ad_reqd
, &do_bit
);
1240 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1241 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1242 daemon
->local_answer
++;
1244 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1245 header
, (size_t)n
, now
, NULL
, ad_reqd
, do_bit
))
1246 daemon
->queries_forwarded
++;
1248 daemon
->local_answer
++;
1254 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1255 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1256 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1257 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
)
1260 char *name_start
= name
;
1261 int status
= dnssec_chase_cname(now
, header
, plen
, name
, keyname
);
1263 if (status
!= STAT_INSECURE
)
1268 crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1270 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1271 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1273 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1275 name_start
++; /* chop a label off and try again */
1279 strcpy(keyname
, name_start
);
1280 return STAT_NEED_DS_NEG
;
1284 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1285 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class)
1290 int status
= dnssec_validate_ds(now
, header
, plen
, name
, keyname
, class);
1292 if (status
!= STAT_INSECURE
)
1294 if (status
== STAT_NO_DS
)
1295 status
= STAT_INSECURE
;
1299 p
= (unsigned char *)(header
+1);
1301 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1302 (name_start
= strchr(name
, '.')))
1304 name_start
++; /* chop a label off and try again */
1305 strcpy(keyname
, name_start
);
1306 return STAT_NEED_DS_NEG
;
1312 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1313 an unsigned answer is OK, or we find a signed DS, in which case there should be
1314 a signature, and the answer is BOGUS */
1315 static int tcp_check_for_unsigned_zone(time_t now
, struct dns_header
*header
, size_t plen
, int class, char *name
,
1316 char *keyname
, struct server
*server
, int *keycount
)
1319 unsigned char *packet
, *payload
;
1321 unsigned char *p
= (unsigned char *)(header
+1);
1323 char *name_start
= name
;
1325 /* Get first insecure entry in CNAME chain */
1326 status
= tcp_key_recurse(now
, STAT_CHASE_CNAME
, header
, plen
, class, name
, keyname
, server
, keycount
);
1327 if (status
== STAT_BOGUS
)
1330 if (!(packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
))))
1333 payload
= &packet
[2];
1334 header
= (struct dns_header
*)payload
;
1335 length
= (u16
*)packet
;
1339 unsigned char *newhash
, hash
[HASH_SIZE
];
1340 unsigned char c1
, c2
;
1341 struct crec
*crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1343 if (--(*keycount
) == 0)
1346 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1349 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1352 /* If we have cached insecurely that a DS doesn't exist,
1353 ise that is a hit for where to start looking for the secure one */
1354 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1356 name_start
++; /* chop a label off and try again */
1360 m
= dnssec_generate_query(header
, ((char *) header
) + 65536, name_start
, class, T_DS
, &server
->addr
);
1362 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1363 if ((newhash
= hash_questions(header
, (unsigned int)m
, name
)))
1364 memcpy(hash
, newhash
, HASH_SIZE
);
1368 if (read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) &&
1369 read_write(server
->tcpfd
, &c1
, 1, 1) &&
1370 read_write(server
->tcpfd
, &c2
, 1, 1) &&
1371 read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1375 newhash
= hash_questions(header
, (unsigned int)m
, name
);
1376 if (newhash
&& memcmp(hash
, newhash
, HASH_SIZE
) == 0)
1378 /* Note this trashes all three name workspaces */
1379 status
= tcp_key_recurse(now
, STAT_NEED_DS_NEG
, header
, m
, class, name
, keyname
, server
, keycount
);
1381 /* We've found a DS which proves the bit of the DNS where the
1382 original query is, is unsigned, so the answer is OK,
1384 if (status
== STAT_NO_DS
)
1387 return STAT_INSECURE
;
1390 /* No DS, not got to DNSSEC-land yet, go up. */
1391 if (status
== STAT_INSECURE
)
1393 p
= (unsigned char *)(header
+1);
1395 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1396 (name_start
= strchr(name
, '.')))
1398 name_start
++; /* chop a label off and try again */
1411 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
1412 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
)
1414 /* Recurse up the key heirarchy */
1417 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1418 if (--(*keycount
) == 0)
1419 return STAT_INSECURE
;
1421 if (status
== STAT_NEED_KEY
)
1422 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1423 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1425 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1426 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1427 new_status
= STAT_INSECURE
;
1429 else if (status
== STAT_CHASE_CNAME
)
1430 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1433 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1435 if (new_status
== STAT_NO_SIG
)
1437 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1438 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1440 new_status
= STAT_INSECURE
;
1444 /* Can't validate because we need a key/DS whose name now in keyname.
1445 Make query for same, and recurse to validate */
1446 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1449 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1450 unsigned char *payload
= &packet
[2];
1451 struct dns_header
*new_header
= (struct dns_header
*)payload
;
1452 u16
*length
= (u16
*)packet
;
1453 unsigned char c1
, c2
;
1456 return STAT_INSECURE
;
1459 m
= dnssec_generate_query(new_header
, ((char *) new_header
) + 65536, keyname
, class,
1460 new_status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1464 if (!read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) ||
1465 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1466 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1467 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1468 new_status
= STAT_INSECURE
;
1473 new_status
= tcp_key_recurse(now
, new_status
, new_header
, m
, class, name
, keyname
, server
, keycount
);
1475 if (new_status
== STAT_SECURE
)
1477 /* Reached a validated record, now try again at this level.
1478 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1479 If so, go round again. */
1481 if (status
== STAT_NEED_KEY
)
1482 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1483 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1485 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1486 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1487 new_status
= STAT_INSECURE
; /* Validated no DS */
1489 else if (status
== STAT_CHASE_CNAME
)
1490 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1493 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1495 if (new_status
== STAT_NO_SIG
)
1497 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1498 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1500 new_status
= STAT_INSECURE
;
1504 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1505 goto another_tcp_key
;
1516 /* The daemon forks before calling this: it should deal with one connection,
1517 blocking as neccessary, and then return. Note, need to be a bit careful
1518 about resources for debug mode, when the fork is suppressed: that's
1519 done by the caller. */
1520 unsigned char *tcp_request(int confd
, time_t now
,
1521 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1528 int checking_disabled
, ad_question
, do_bit
, added_pheader
= 0;
1529 int check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1531 unsigned short qtype
;
1532 unsigned int gotname
;
1533 unsigned char c1
, c2
;
1534 /* Max TCP packet + slop + size */
1535 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1536 unsigned char *payload
= &packet
[2];
1537 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1538 struct dns_header
*header
= (struct dns_header
*)payload
;
1539 u16
*length
= (u16
*)packet
;
1540 struct server
*last_server
;
1541 struct in_addr dst_addr_4
;
1542 union mysockaddr peer_addr
;
1543 socklen_t peer_len
= sizeof(union mysockaddr
);
1545 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1551 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1552 !(size
= c1
<< 8 | c2
) ||
1553 !read_write(confd
, payload
, size
, 1))
1556 if (size
< (int)sizeof(struct dns_header
))
1561 /* save state of "cd" flag in query */
1562 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1563 no_cache_dnssec
= 1;
1565 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1568 struct auth_zone
*zone
;
1570 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1572 if (peer_addr
.sa
.sa_family
== AF_INET
)
1573 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1574 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1577 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1578 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1582 /* find queries for zones we're authoritative for, and answer them directly */
1584 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1585 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1594 if (local_addr
->sa
.sa_family
== AF_INET
)
1595 dst_addr_4
= local_addr
->in
.sin_addr
;
1597 dst_addr_4
.s_addr
= 0;
1601 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1605 /* m > 0 if answered from cache */
1606 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1607 dst_addr_4
, netmask
, now
, &ad_question
, &do_bit
);
1609 /* Do this by steam now we're not in the select() loop */
1610 check_log_writer(NULL
);
1614 unsigned int flags
= 0;
1615 struct all_addr
*addrp
= NULL
;
1617 char *domain
= NULL
;
1619 if (option_bool(OPT_ADD_MAC
))
1620 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1622 if (option_bool(OPT_CLIENT_SUBNET
))
1624 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1633 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1635 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1636 last_server
= daemon
->servers
;
1638 last_server
= daemon
->last_server
;
1640 if (!flags
&& last_server
)
1642 struct server
*firstsendto
= NULL
;
1644 unsigned char *newhash
, hash
[HASH_SIZE
];
1645 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->keyname
)))
1646 memcpy(hash
, newhash
, HASH_SIZE
);
1648 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1650 /* Loop round available servers until we succeed in connecting to one.
1651 Note that this code subtley ensures that consecutive queries on this connection
1652 which can go to the same server, do so. */
1656 firstsendto
= last_server
;
1659 if (!(last_server
= last_server
->next
))
1660 last_server
= daemon
->servers
;
1662 if (last_server
== firstsendto
)
1666 /* server for wrong domain */
1667 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1668 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1671 if (last_server
->tcpfd
== -1)
1673 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1676 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1677 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1679 close(last_server
->tcpfd
);
1680 last_server
->tcpfd
= -1;
1685 if (option_bool(OPT_DNSSEC_VALID
))
1687 size_t new_size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1689 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1690 this allows it to select auth servers when one is returning bad data. */
1691 if (option_bool(OPT_DNSSEC_DEBUG
))
1692 header
->hb4
|= HB4_CD
;
1694 if (size
!= new_size
)
1701 #ifdef HAVE_CONNTRACK
1702 /* Copy connection mark of incoming query to outgoing connection. */
1703 if (option_bool(OPT_CONNTRACK
))
1706 struct all_addr local
;
1708 if (local_addr
->sa
.sa_family
== AF_INET6
)
1709 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1712 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1714 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1715 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1720 *length
= htons(size
);
1722 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1723 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1724 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1725 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1727 close(last_server
->tcpfd
);
1728 last_server
->tcpfd
= -1;
1735 strcpy(daemon
->namebuff
, "query");
1736 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1737 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1738 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1741 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1742 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1746 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1748 int keycount
= DNSSEC_WORK
; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1749 int status
= tcp_key_recurse(now
, STAT_TRUNCATED
, header
, m
, 0, daemon
->namebuff
, daemon
->keyname
, last_server
, &keycount
);
1753 result
= "ABANDONED";
1755 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1757 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
1759 if (status
== STAT_BOGUS
)
1760 no_cache_dnssec
= 1;
1762 if (status
== STAT_SECURE
)
1767 /* restore CD bit to the value in the query */
1768 if (checking_disabled
)
1769 header
->hb4
|= HB4_CD
;
1771 header
->hb4
&= ~HB4_CD
;
1773 /* There's no point in updating the cache, since this process will exit and
1774 lose the information after a few queries. We make this call for the alias and
1775 bogus-nxdomain side-effects. */
1776 /* If the crc of the question section doesn't match the crc we sent, then
1777 someone might be attempting to insert bogus values into the cache by
1778 sending replies containing questions and bogus answers. */
1780 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
1781 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
1787 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1794 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1795 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1796 cache_secure
, ad_question
, do_bit
, added_pheader
, check_subnet
, &peer_addr
);
1802 /* In case of local answer or no connections made. */
1804 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1808 check_log_writer(NULL
);
1812 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1817 static struct frec
*allocate_frec(time_t now
)
1821 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1823 f
->next
= daemon
->frec_list
;
1832 f
->dependent
= NULL
;
1833 f
->blocking_query
= NULL
;
1836 daemon
->frec_list
= f
;
1842 static struct randfd
*allocate_rfd(int family
)
1844 static int finger
= 0;
1847 /* limit the number of sockets we have open to avoid starvation of
1848 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1850 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1851 if (daemon
->randomsocks
[i
].refcount
== 0)
1853 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1856 daemon
->randomsocks
[i
].refcount
= 1;
1857 daemon
->randomsocks
[i
].family
= family
;
1858 return &daemon
->randomsocks
[i
];
1861 /* No free ones or cannot get new socket, grab an existing one */
1862 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1864 int j
= (i
+finger
) % RANDOM_SOCKS
;
1865 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1866 daemon
->randomsocks
[j
].family
== family
&&
1867 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1870 daemon
->randomsocks
[j
].refcount
++;
1871 return &daemon
->randomsocks
[j
];
1875 return NULL
; /* doom */
1877 static void free_frec(struct frec
*f
)
1879 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1887 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1896 blockdata_free(f
->stash
);
1900 /* Anything we're waiting on is pointless now, too */
1901 if (f
->blocking_query
)
1902 free_frec(f
->blocking_query
);
1903 f
->blocking_query
= NULL
;
1904 f
->dependent
= NULL
;
1908 /* if wait==NULL return a free or older than TIMEOUT record.
1909 else return *wait zero if one available, or *wait is delay to
1910 when the oldest in-use record will expire. Impose an absolute
1911 limit of 4*TIMEOUT before we wipe things (for random sockets).
1912 If force is set, always return a result, even if we have
1913 to allocate above the limit. */
1914 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
1916 struct frec
*f
, *oldest
, *target
;
1922 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1927 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1933 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1943 /* can't find empty one, use oldest if there is one
1944 and it's older than timeout */
1945 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1947 /* keep stuff for twice timeout if we can by allocating a new
1949 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1950 count
<= daemon
->ftabsize
&&
1951 (f
= allocate_frec(now
)))
1962 /* none available, calculate time 'till oldest record expires */
1963 if (!force
&& count
> daemon
->ftabsize
)
1965 static time_t last_log
= 0;
1968 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1970 if ((int)difftime(now
, last_log
) > 5)
1973 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1979 if (!(f
= allocate_frec(now
)) && wait
)
1980 /* wait one second on malloc failure */
1983 return f
; /* OK if malloc fails and this is NULL */
1986 /* crc is all-ones if not known. */
1987 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
1991 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1992 if (f
->sentto
&& f
->new_id
== id
&&
1993 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
1999 static struct frec
*lookup_frec_by_sender(unsigned short id
,
2000 union mysockaddr
*addr
,
2005 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2008 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
2009 sockaddr_isequal(&f
->source
, addr
))
2015 /* A server record is going away, remove references to it */
2016 void server_gone(struct server
*server
)
2020 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
2021 if (f
->sentto
&& f
->sentto
== server
)
2024 if (daemon
->last_server
== server
)
2025 daemon
->last_server
= NULL
;
2027 if (daemon
->srv_save
== server
)
2028 daemon
->srv_save
= NULL
;
2031 /* return unique random ids. */
2032 static unsigned short get_id(void)
2034 unsigned short ret
= 0;
2038 while (lookup_frec(ret
, NULL
));