]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Return SERVFAIL when validation abandoned.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25
26 #ifdef HAVE_DNSSEC
27 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
28 int class, char *name, char *keyname, struct server *server, int *keycount);
29 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname);
30 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
31 char *name, char *keyname);
32 #endif
33
34
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
39 unsigned int iface)
40 {
41 struct msghdr msg;
42 struct iovec iov[1];
43 union {
44 struct cmsghdr align; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47 #elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49 #endif
50 #ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52 #endif
53 } control_u;
54
55 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
58 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
60 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
65
66 if (!nowild)
67 {
68 struct cmsghdr *cmptr;
69 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
71 cmptr = CMSG_FIRSTHDR(&msg);
72
73 if (to->sa.sa_family == AF_INET)
74 {
75 #if defined(HAVE_LINUX_NETWORK)
76 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
80 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
81 cmptr->cmsg_level = IPPROTO_IP;
82 cmptr->cmsg_type = IP_PKTINFO;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
85 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
88 #endif
89 }
90 else
91 #ifdef HAVE_IPV6
92 {
93 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
97 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
98 cmptr->cmsg_type = daemon->v6pktinfo;
99 cmptr->cmsg_level = IPPROTO_IPV6;
100 }
101 #else
102 (void)iface; /* eliminate warning */
103 #endif
104 }
105
106 while (retry_send(sendmsg(fd, &msg, 0)));
107
108 /* If interface is still in DAD, EINVAL results - ignore that. */
109 if (errno != 0 && errno != EINVAL)
110 {
111 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
112 return 0;
113 }
114
115 return 1;
116 }
117
118 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
119 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
120
121 {
122 /* If the query ends in the domain in one of our servers, set
123 domain to point to that name. We find the largest match to allow both
124 domain.org and sub.domain.org to exist. */
125
126 unsigned int namelen = strlen(qdomain);
127 unsigned int matchlen = 0;
128 struct server *serv;
129 unsigned int flags = 0;
130
131 for (serv = daemon->servers; serv; serv=serv->next)
132 /* domain matches take priority over NODOTS matches */
133 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
134 {
135 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
136 *type = SERV_FOR_NODOTS;
137 if (serv->flags & SERV_NO_ADDR)
138 flags = F_NXDOMAIN;
139 else if (serv->flags & SERV_LITERAL_ADDRESS)
140 {
141 if (sflag & qtype)
142 {
143 flags = sflag;
144 if (serv->addr.sa.sa_family == AF_INET)
145 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
146 #ifdef HAVE_IPV6
147 else
148 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
149 #endif
150 }
151 else if (!flags || (flags & F_NXDOMAIN))
152 flags = F_NOERR;
153 }
154 }
155 else if (serv->flags & SERV_HAS_DOMAIN)
156 {
157 unsigned int domainlen = strlen(serv->domain);
158 char *matchstart = qdomain + namelen - domainlen;
159 if (namelen >= domainlen &&
160 hostname_isequal(matchstart, serv->domain) &&
161 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
162 {
163 if (serv->flags & SERV_NO_REBIND)
164 *norebind = 1;
165 else
166 {
167 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
168 /* implement priority rules for --address and --server for same domain.
169 --address wins if the address is for the correct AF
170 --server wins otherwise. */
171 if (domainlen != 0 && domainlen == matchlen)
172 {
173 if ((serv->flags & SERV_LITERAL_ADDRESS))
174 {
175 if (!(sflag & qtype) && flags == 0)
176 continue;
177 }
178 else
179 {
180 if (flags & (F_IPV4 | F_IPV6))
181 continue;
182 }
183 }
184
185 if (domainlen >= matchlen)
186 {
187 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
188 *domain = serv->domain;
189 matchlen = domainlen;
190 if (serv->flags & SERV_NO_ADDR)
191 flags = F_NXDOMAIN;
192 else if (serv->flags & SERV_LITERAL_ADDRESS)
193 {
194 if (sflag & qtype)
195 {
196 flags = sflag;
197 if (serv->addr.sa.sa_family == AF_INET)
198 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
199 #ifdef HAVE_IPV6
200 else
201 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
202 #endif
203 }
204 else if (!flags || (flags & F_NXDOMAIN))
205 flags = F_NOERR;
206 }
207 else
208 flags = 0;
209 }
210 }
211 }
212 }
213
214 if (flags == 0 && !(qtype & F_QUERY) &&
215 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
216 /* don't forward A or AAAA queries for simple names, except the empty name */
217 flags = F_NOERR;
218
219 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
220 flags = F_NOERR;
221
222 if (flags)
223 {
224 int logflags = 0;
225
226 if (flags == F_NXDOMAIN || flags == F_NOERR)
227 logflags = F_NEG | qtype;
228
229 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
230 }
231 else if ((*type) & SERV_USE_RESOLV)
232 {
233 *type = 0; /* use normal servers for this domain */
234 *domain = NULL;
235 }
236 return flags;
237 }
238
239 static int forward_query(int udpfd, union mysockaddr *udpaddr,
240 struct all_addr *dst_addr, unsigned int dst_iface,
241 struct dns_header *header, size_t plen, time_t now,
242 struct frec *forward, int ad_reqd, int do_bit)
243 {
244 char *domain = NULL;
245 int type = 0, norebind = 0;
246 struct all_addr *addrp = NULL;
247 unsigned int flags = 0;
248 struct server *start = NULL;
249 #ifdef HAVE_DNSSEC
250 void *hash = hash_questions(header, plen, daemon->namebuff);
251 #else
252 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
253 void *hash = &crc;
254 #endif
255 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
256
257 (void)do_bit;
258
259 /* may be no servers available. */
260 if (!daemon->servers)
261 forward = NULL;
262 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
263 {
264 #ifdef HAVE_DNSSEC
265 /* If we've already got an answer to this query, but we're awaiting keys for validation,
266 there's no point retrying the query, retry the key query instead...... */
267 if (forward->blocking_query)
268 {
269 int fd;
270
271 while (forward->blocking_query)
272 forward = forward->blocking_query;
273
274 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
275 plen = forward->stash_len;
276
277 if (forward->sentto->addr.sa.sa_family == AF_INET)
278 log_query(F_NOEXTRA | F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
279 #ifdef HAVE_IPV6
280 else
281 log_query(F_NOEXTRA | F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
282 #endif
283
284 if (forward->sentto->sfd)
285 fd = forward->sentto->sfd->fd;
286 else
287 {
288 #ifdef HAVE_IPV6
289 if (forward->sentto->addr.sa.sa_family == AF_INET6)
290 fd = forward->rfd6->fd;
291 else
292 #endif
293 fd = forward->rfd4->fd;
294 }
295
296 while (retry_send( sendto(fd, (char *)header, plen, 0,
297 &forward->sentto->addr.sa,
298 sa_len(&forward->sentto->addr))));
299
300 return 1;
301 }
302 #endif
303
304 /* retry on existing query, send to all available servers */
305 domain = forward->sentto->domain;
306 forward->sentto->failed_queries++;
307 if (!option_bool(OPT_ORDER))
308 {
309 forward->forwardall = 1;
310 daemon->last_server = NULL;
311 }
312 type = forward->sentto->flags & SERV_TYPE;
313 if (!(start = forward->sentto->next))
314 start = daemon->servers; /* at end of list, recycle */
315 header->id = htons(forward->new_id);
316 }
317 else
318 {
319 if (gotname)
320 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
321
322 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
323 /* table full - server failure. */
324 flags = F_NEG;
325
326 if (forward)
327 {
328 forward->source = *udpaddr;
329 forward->dest = *dst_addr;
330 forward->iface = dst_iface;
331 forward->orig_id = ntohs(header->id);
332 forward->new_id = get_id();
333 forward->fd = udpfd;
334 memcpy(forward->hash, hash, HASH_SIZE);
335 forward->forwardall = 0;
336 forward->flags = 0;
337 if (norebind)
338 forward->flags |= FREC_NOREBIND;
339 if (header->hb4 & HB4_CD)
340 forward->flags |= FREC_CHECKING_DISABLED;
341 if (ad_reqd)
342 forward->flags |= FREC_AD_QUESTION;
343 #ifdef HAVE_DNSSEC
344 forward->work_counter = DNSSEC_WORK;
345 if (do_bit)
346 forward->flags |= FREC_DO_QUESTION;
347 #endif
348
349 header->id = htons(forward->new_id);
350
351 /* In strict_order mode, always try servers in the order
352 specified in resolv.conf, if a domain is given
353 always try all the available servers,
354 otherwise, use the one last known to work. */
355
356 if (type == 0)
357 {
358 if (option_bool(OPT_ORDER))
359 start = daemon->servers;
360 else if (!(start = daemon->last_server) ||
361 daemon->forwardcount++ > FORWARD_TEST ||
362 difftime(now, daemon->forwardtime) > FORWARD_TIME)
363 {
364 start = daemon->servers;
365 forward->forwardall = 1;
366 daemon->forwardcount = 0;
367 daemon->forwardtime = now;
368 }
369 }
370 else
371 {
372 start = daemon->servers;
373 if (!option_bool(OPT_ORDER))
374 forward->forwardall = 1;
375 }
376 }
377 }
378
379 /* check for send errors here (no route to host)
380 if we fail to send to all nameservers, send back an error
381 packet straight away (helps modem users when offline) */
382
383 if (!flags && forward)
384 {
385 struct server *firstsentto = start;
386 int forwarded = 0;
387
388 /* If a query is retried, use the log_id for the retry when logging the answer. */
389 forward->log_id = daemon->log_id;
390
391 if (option_bool(OPT_ADD_MAC))
392 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
393
394 if (option_bool(OPT_CLIENT_SUBNET))
395 {
396 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
397 if (new != plen)
398 {
399 plen = new;
400 forward->flags |= FREC_HAS_SUBNET;
401 }
402 }
403
404 #ifdef HAVE_DNSSEC
405 if (option_bool(OPT_DNSSEC_VALID))
406 {
407 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
408
409 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
410 this allows it to select auth servers when one is returning bad data. */
411 if (option_bool(OPT_DNSSEC_DEBUG))
412 header->hb4 |= HB4_CD;
413
414 if (new_plen != plen)
415 forward->flags |= FREC_ADDED_PHEADER;
416
417 plen = new_plen;
418 }
419 #endif
420
421 while (1)
422 {
423 /* only send to servers dealing with our domain.
424 domain may be NULL, in which case server->domain
425 must be NULL also. */
426
427 if (type == (start->flags & SERV_TYPE) &&
428 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
429 !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
430 {
431 int fd;
432
433 /* find server socket to use, may need to get random one. */
434 if (start->sfd)
435 fd = start->sfd->fd;
436 else
437 {
438 #ifdef HAVE_IPV6
439 if (start->addr.sa.sa_family == AF_INET6)
440 {
441 if (!forward->rfd6 &&
442 !(forward->rfd6 = allocate_rfd(AF_INET6)))
443 break;
444 daemon->rfd_save = forward->rfd6;
445 fd = forward->rfd6->fd;
446 }
447 else
448 #endif
449 {
450 if (!forward->rfd4 &&
451 !(forward->rfd4 = allocate_rfd(AF_INET)))
452 break;
453 daemon->rfd_save = forward->rfd4;
454 fd = forward->rfd4->fd;
455 }
456
457 #ifdef HAVE_CONNTRACK
458 /* Copy connection mark of incoming query to outgoing connection. */
459 if (option_bool(OPT_CONNTRACK))
460 {
461 unsigned int mark;
462 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
463 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
464 }
465 #endif
466 }
467
468 if (retry_send(sendto(fd, (char *)header, plen, 0,
469 &start->addr.sa,
470 sa_len(&start->addr))))
471 continue;
472
473 if (errno == 0)
474 {
475 /* Keep info in case we want to re-send this packet */
476 daemon->srv_save = start;
477 daemon->packet_len = plen;
478
479 if (!gotname)
480 strcpy(daemon->namebuff, "query");
481 if (start->addr.sa.sa_family == AF_INET)
482 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
483 (struct all_addr *)&start->addr.in.sin_addr, NULL);
484 #ifdef HAVE_IPV6
485 else
486 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
487 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
488 #endif
489 start->queries++;
490 forwarded = 1;
491 forward->sentto = start;
492 if (!forward->forwardall)
493 break;
494 forward->forwardall++;
495 }
496 }
497
498 if (!(start = start->next))
499 start = daemon->servers;
500
501 if (start == firstsentto)
502 break;
503 }
504
505 if (forwarded)
506 return 1;
507
508 /* could not send on, prepare to return */
509 header->id = htons(forward->orig_id);
510 free_frec(forward); /* cancel */
511 }
512
513 /* could not send on, return empty answer or address if known for whole domain */
514 if (udpfd != -1)
515 {
516 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
517 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
518 }
519
520 return 0;
521 }
522
523 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
524 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
525 {
526 unsigned char *pheader, *sizep;
527 char **sets = 0;
528 int munged = 0, is_sign;
529 size_t plen;
530
531 (void)ad_reqd;
532 (void) do_bit;
533
534 #ifdef HAVE_IPSET
535 if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL))
536 {
537 /* Similar algorithm to search_servers. */
538 struct ipsets *ipset_pos;
539 unsigned int namelen = strlen(daemon->namebuff);
540 unsigned int matchlen = 0;
541 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
542 {
543 unsigned int domainlen = strlen(ipset_pos->domain);
544 char *matchstart = daemon->namebuff + namelen - domainlen;
545 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
546 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
547 domainlen >= matchlen)
548 {
549 matchlen = domainlen;
550 sets = ipset_pos->sets;
551 }
552 }
553 }
554 #endif
555
556 /* If upstream is advertising a larger UDP packet size
557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
559
560 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
561 {
562 unsigned short udpsz;
563 unsigned char *psave = sizep;
564
565 GETSHORT(udpsz, sizep);
566
567 if (!is_sign && udpsz > daemon->edns_pktsz)
568 PUTSHORT(daemon->edns_pktsz, psave);
569
570 if (check_subnet && !check_source(header, plen, pheader, query_source))
571 {
572 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
573 return 0;
574 }
575
576 if (added_pheader)
577 {
578 pheader = 0;
579 header->arcount = htons(0);
580 }
581 }
582
583 /* RFC 4035 sect 4.6 para 3 */
584 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
585 header->hb4 &= ~HB4_AD;
586
587 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
588 return resize_packet(header, n, pheader, plen);
589
590 /* Complain loudly if the upstream server is non-recursive. */
591 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
592 server && !(server->flags & SERV_WARNED_RECURSIVE))
593 {
594 prettyprint_addr(&server->addr, daemon->namebuff);
595 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
596 if (!option_bool(OPT_LOG))
597 server->flags |= SERV_WARNED_RECURSIVE;
598 }
599
600 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
601 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
602 {
603 munged = 1;
604 SET_RCODE(header, NXDOMAIN);
605 header->hb3 &= ~HB3_AA;
606 cache_secure = 0;
607 }
608 else
609 {
610 int doctored = 0;
611
612 if (RCODE(header) == NXDOMAIN &&
613 extract_request(header, n, daemon->namebuff, NULL) &&
614 check_for_local_domain(daemon->namebuff, now))
615 {
616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
619 munged = 1;
620 header->hb3 |= HB3_AA;
621 SET_RCODE(header, NOERROR);
622 cache_secure = 0;
623 }
624
625 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
626 {
627 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
628 munged = 1;
629 cache_secure = 0;
630 }
631
632 if (doctored)
633 cache_secure = 0;
634 }
635
636 #ifdef HAVE_DNSSEC
637 if (no_cache && !(header->hb4 & HB4_CD))
638 {
639 if (!option_bool(OPT_DNSSEC_DEBUG))
640 {
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header, SERVFAIL);
643 munged = 1;
644 }
645 }
646
647 if (option_bool(OPT_DNSSEC_VALID))
648 header->hb4 &= ~HB4_AD;
649
650 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
651 header->hb4 |= HB4_AD;
652
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
654 if (!do_bit)
655 n = filter_rrsigs(header, n);
656 #endif
657
658 /* do this after extract_addresses. Ensure NODATA reply and remove
659 nameserver info. */
660
661 if (munged)
662 {
663 header->ancount = htons(0);
664 header->nscount = htons(0);
665 header->arcount = htons(0);
666 header->hb3 &= ~HB3_TC;
667 }
668
669 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
670 sections of the packet. Find the new length here and put back pseudoheader
671 if it was removed. */
672 return resize_packet(header, n, pheader, plen);
673 }
674
675 /* sets new last_server */
676 void reply_query(int fd, int family, time_t now)
677 {
678 /* packet from peer server, extract data for cache, and send to
679 original requester */
680 struct dns_header *header;
681 union mysockaddr serveraddr;
682 struct frec *forward;
683 socklen_t addrlen = sizeof(serveraddr);
684 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
685 size_t nn;
686 struct server *server;
687 void *hash;
688 #ifndef HAVE_DNSSEC
689 unsigned int crc;
690 #endif
691
692 /* packet buffer overwritten */
693 daemon->srv_save = NULL;
694
695 /* Determine the address of the server replying so that we can mark that as good */
696 serveraddr.sa.sa_family = family;
697 #ifdef HAVE_IPV6
698 if (serveraddr.sa.sa_family == AF_INET6)
699 serveraddr.in6.sin6_flowinfo = 0;
700 #endif
701
702 header = (struct dns_header *)daemon->packet;
703
704 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
705 return;
706
707 /* spoof check: answer must come from known server, */
708 for (server = daemon->servers; server; server = server->next)
709 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
710 sockaddr_isequal(&server->addr, &serveraddr))
711 break;
712
713 if (!server)
714 return;
715
716 #ifdef HAVE_DNSSEC
717 hash = hash_questions(header, n, daemon->namebuff);
718 #else
719 hash = &crc;
720 crc = questions_crc(header, n, daemon->namebuff);
721 #endif
722
723 if (!(forward = lookup_frec(ntohs(header->id), hash)))
724 return;
725
726 /* log_query gets called indirectly all over the place, so
727 pass these in global variables - sorry. */
728 daemon->log_display_id = forward->log_id;
729 daemon->log_source_addr = &forward->source;
730
731 if (daemon->ignore_addr && RCODE(header) == NOERROR &&
732 check_for_ignored_address(header, n, daemon->ignore_addr))
733 return;
734
735 if (RCODE(header) == REFUSED &&
736 !option_bool(OPT_ORDER) &&
737 forward->forwardall == 0)
738 /* for broken servers, attempt to send to another one. */
739 {
740 unsigned char *pheader;
741 size_t plen;
742 int is_sign;
743
744 /* recreate query from reply */
745 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
746 if (!is_sign)
747 {
748 header->ancount = htons(0);
749 header->nscount = htons(0);
750 header->arcount = htons(0);
751 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
752 {
753 header->hb3 &= ~(HB3_QR | HB3_TC);
754 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
755 return;
756 }
757 }
758 }
759
760 server = forward->sentto;
761
762 if ((forward->sentto->flags & SERV_TYPE) == 0)
763 {
764 if (RCODE(header) == REFUSED)
765 server = NULL;
766 else
767 {
768 struct server *last_server;
769
770 /* find good server by address if possible, otherwise assume the last one we sent to */
771 for (last_server = daemon->servers; last_server; last_server = last_server->next)
772 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
773 sockaddr_isequal(&last_server->addr, &serveraddr))
774 {
775 server = last_server;
776 break;
777 }
778 }
779 if (!option_bool(OPT_ALL_SERVERS))
780 daemon->last_server = server;
781 }
782
783 /* If the answer is an error, keep the forward record in place in case
784 we get a good reply from another server. Kill it when we've
785 had replies from all to avoid filling the forwarding table when
786 everything is broken */
787 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
788 {
789 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
790
791 if (option_bool(OPT_NO_REBIND))
792 check_rebind = !(forward->flags & FREC_NOREBIND);
793
794 /* Don't cache replies where DNSSEC validation was turned off, either
795 the upstream server told us so, or the original query specified it. */
796 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
797 no_cache_dnssec = 1;
798
799 #ifdef HAVE_DNSSEC
800 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
801 {
802 int status;
803
804 /* We've had a reply already, which we're validating. Ignore this duplicate */
805 if (forward->blocking_query)
806 return;
807
808 if (header->hb3 & HB3_TC)
809 {
810 /* Truncated answer can't be validated.
811 If this is an answer to a DNSSEC-generated query, we still
812 need to get the client to retry over TCP, so return
813 an answer with the TC bit set, even if the actual answer fits.
814 */
815 status = STAT_TRUNCATED;
816 }
817 else if (forward->flags & FREC_DNSKEY_QUERY)
818 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
819 else if (forward->flags & FREC_DS_QUERY)
820 {
821 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
822 if (status == STAT_NO_DS || status == STAT_NO_NS)
823 status = STAT_BOGUS;
824 }
825 else if (forward->flags & FREC_CHECK_NOSIGN)
826 {
827 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
828 if (status != STAT_NEED_KEY)
829 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
830 }
831 else
832 {
833 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
834 if (status == STAT_NO_SIG)
835 {
836 if (option_bool(OPT_DNSSEC_NO_SIGN))
837 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
838 else
839 status = STAT_INSECURE;
840 }
841 }
842 /* Can't validate, as we're missing key data. Put this
843 answer aside, whilst we get that. */
844 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
845 {
846 struct frec *new, *orig;
847
848 /* Free any saved query */
849 if (forward->stash)
850 blockdata_free(forward->stash);
851
852 /* Now save reply pending receipt of key data */
853 if (!(forward->stash = blockdata_alloc((char *)header, n)))
854 return;
855 forward->stash_len = n;
856
857 anotherkey:
858 /* Find the original query that started it all.... */
859 for (orig = forward; orig->dependent; orig = orig->dependent);
860
861 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
862 status = STAT_INSECURE;
863 else
864 {
865 int fd;
866 struct frec *next = new->next;
867 *new = *forward; /* copy everything, then overwrite */
868 new->next = next;
869 new->blocking_query = NULL;
870 new->sentto = server;
871 new->rfd4 = NULL;
872 new->orig_domain = NULL;
873 #ifdef HAVE_IPV6
874 new->rfd6 = NULL;
875 #endif
876 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
877
878 new->dependent = forward; /* to find query awaiting new one. */
879 forward->blocking_query = new; /* for garbage cleaning */
880 /* validate routines leave name of required record in daemon->keyname */
881 if (status == STAT_NEED_KEY)
882 {
883 new->flags |= FREC_DNSKEY_QUERY;
884 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
885 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
886 }
887 else
888 {
889 if (status == STAT_NEED_DS_NEG)
890 new->flags |= FREC_CHECK_NOSIGN;
891 else
892 new->flags |= FREC_DS_QUERY;
893 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
894 daemon->keyname, forward->class, T_DS, &server->addr);
895 }
896 if ((hash = hash_questions(header, nn, daemon->namebuff)))
897 memcpy(new->hash, hash, HASH_SIZE);
898 new->new_id = get_id();
899 header->id = htons(new->new_id);
900 /* Save query for retransmission */
901 if (!(new->stash = blockdata_alloc((char *)header, nn)))
902 return;
903
904 new->stash_len = nn;
905
906 /* Don't resend this. */
907 daemon->srv_save = NULL;
908
909 if (server->sfd)
910 fd = server->sfd->fd;
911 else
912 {
913 fd = -1;
914 #ifdef HAVE_IPV6
915 if (server->addr.sa.sa_family == AF_INET6)
916 {
917 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
918 fd = new->rfd6->fd;
919 }
920 else
921 #endif
922 {
923 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
924 fd = new->rfd4->fd;
925 }
926 }
927
928 if (fd != -1)
929 {
930 while (retry_send(sendto(fd, (char *)header, nn, 0,
931 &server->addr.sa,
932 sa_len(&server->addr))));
933 server->queries++;
934 }
935
936 return;
937 }
938 }
939
940 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
941 Now wind back down, pulling back answers which wouldn't previously validate
942 and validate them with the new data. Note that if an answer needs multiple
943 keys to validate, we may find another key is needed, in which case we set off
944 down another branch of the tree. Once we get to the original answer
945 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
946 while (forward->dependent)
947 {
948 struct frec *prev = forward->dependent;
949 free_frec(forward);
950 forward = prev;
951 forward->blocking_query = NULL; /* already gone */
952 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
953 n = forward->stash_len;
954
955 if (status == STAT_SECURE)
956 {
957 if (forward->flags & FREC_DNSKEY_QUERY)
958 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
959 else if (forward->flags & FREC_DS_QUERY)
960 {
961 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
962 if (status == STAT_NO_DS || status == STAT_NO_NS)
963 status = STAT_BOGUS;
964 }
965 else if (forward->flags & FREC_CHECK_NOSIGN)
966 {
967 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
968 if (status != STAT_NEED_KEY)
969 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
970 }
971 else
972 {
973 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
974 if (status == STAT_NO_SIG)
975 {
976 if (option_bool(OPT_DNSSEC_NO_SIGN))
977 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
978 else
979 status = STAT_INSECURE;
980 }
981 }
982
983 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
984 goto anotherkey;
985 }
986 }
987
988 if (status == STAT_TRUNCATED)
989 header->hb3 |= HB3_TC;
990 else
991 {
992 char *result;
993
994 if (forward->work_counter == 0)
995 {
996 result = "ABANDONED";
997 status = STAT_BOGUS;
998 }
999 else
1000 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1001
1002 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1003 }
1004
1005 no_cache_dnssec = 0;
1006
1007 if (status == STAT_SECURE)
1008 cache_secure = 1;
1009 else if (status == STAT_BOGUS)
1010 no_cache_dnssec = 1;
1011 }
1012 #endif
1013
1014 /* restore CD bit to the value in the query */
1015 if (forward->flags & FREC_CHECKING_DISABLED)
1016 header->hb4 |= HB4_CD;
1017 else
1018 header->hb4 &= ~HB4_CD;
1019
1020 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
1021 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
1022 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
1023 {
1024 header->id = htons(forward->orig_id);
1025 header->hb4 |= HB4_RA; /* recursion if available */
1026 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
1027 &forward->source, &forward->dest, forward->iface);
1028 }
1029 free_frec(forward); /* cancel */
1030 }
1031 }
1032
1033
1034 void receive_query(struct listener *listen, time_t now)
1035 {
1036 struct dns_header *header = (struct dns_header *)daemon->packet;
1037 union mysockaddr source_addr;
1038 unsigned short type;
1039 struct all_addr dst_addr;
1040 struct in_addr netmask, dst_addr_4;
1041 size_t m;
1042 ssize_t n;
1043 int if_index = 0, auth_dns = 0;
1044 #ifdef HAVE_AUTH
1045 int local_auth = 0;
1046 #endif
1047 struct iovec iov[1];
1048 struct msghdr msg;
1049 struct cmsghdr *cmptr;
1050 union {
1051 struct cmsghdr align; /* this ensures alignment */
1052 #ifdef HAVE_IPV6
1053 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1054 #endif
1055 #if defined(HAVE_LINUX_NETWORK)
1056 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1057 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1058 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1059 CMSG_SPACE(sizeof(unsigned int))];
1060 #elif defined(IP_RECVDSTADDR)
1061 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1062 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1063 #endif
1064 } control_u;
1065 #ifdef HAVE_IPV6
1066 /* Can always get recvd interface for IPv6 */
1067 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1068 #else
1069 int check_dst = !option_bool(OPT_NOWILD);
1070 #endif
1071
1072 /* packet buffer overwritten */
1073 daemon->srv_save = NULL;
1074
1075 dst_addr_4.s_addr = dst_addr.addr.addr4.s_addr = 0;
1076 netmask.s_addr = 0;
1077
1078 if (option_bool(OPT_NOWILD) && listen->iface)
1079 {
1080 auth_dns = listen->iface->dns_auth;
1081
1082 if (listen->family == AF_INET)
1083 {
1084 dst_addr_4 = dst_addr.addr.addr4 = listen->iface->addr.in.sin_addr;
1085 netmask = listen->iface->netmask;
1086 }
1087 }
1088
1089 iov[0].iov_base = daemon->packet;
1090 iov[0].iov_len = daemon->edns_pktsz;
1091
1092 msg.msg_control = control_u.control;
1093 msg.msg_controllen = sizeof(control_u);
1094 msg.msg_flags = 0;
1095 msg.msg_name = &source_addr;
1096 msg.msg_namelen = sizeof(source_addr);
1097 msg.msg_iov = iov;
1098 msg.msg_iovlen = 1;
1099
1100 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1101 return;
1102
1103 if (n < (int)sizeof(struct dns_header) ||
1104 (msg.msg_flags & MSG_TRUNC) ||
1105 (header->hb3 & HB3_QR))
1106 return;
1107
1108 source_addr.sa.sa_family = listen->family;
1109
1110 if (listen->family == AF_INET)
1111 {
1112 /* Source-port == 0 is an error, we can't send back to that.
1113 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1114 if (source_addr.in.sin_port == 0)
1115 return;
1116 }
1117 #ifdef HAVE_IPV6
1118 else
1119 {
1120 /* Source-port == 0 is an error, we can't send back to that. */
1121 if (source_addr.in6.sin6_port == 0)
1122 return;
1123 source_addr.in6.sin6_flowinfo = 0;
1124 }
1125 #endif
1126
1127 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1128 if (option_bool(OPT_LOCAL_SERVICE))
1129 {
1130 struct addrlist *addr;
1131 #ifdef HAVE_IPV6
1132 if (listen->family == AF_INET6)
1133 {
1134 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1135 if ((addr->flags & ADDRLIST_IPV6) &&
1136 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1137 break;
1138 }
1139 else
1140 #endif
1141 {
1142 struct in_addr netmask;
1143 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1144 {
1145 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1146 if (!(addr->flags & ADDRLIST_IPV6) &&
1147 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1148 break;
1149 }
1150 }
1151 if (!addr)
1152 {
1153 static int warned = 0;
1154 if (!warned)
1155 {
1156 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1157 warned = 1;
1158 }
1159 return;
1160 }
1161 }
1162
1163 if (check_dst)
1164 {
1165 struct ifreq ifr;
1166
1167 if (msg.msg_controllen < sizeof(struct cmsghdr))
1168 return;
1169
1170 #if defined(HAVE_LINUX_NETWORK)
1171 if (listen->family == AF_INET)
1172 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1173 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1174 {
1175 union {
1176 unsigned char *c;
1177 struct in_pktinfo *p;
1178 } p;
1179 p.c = CMSG_DATA(cmptr);
1180 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1181 if_index = p.p->ipi_ifindex;
1182 }
1183 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1184 if (listen->family == AF_INET)
1185 {
1186 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1187 {
1188 union {
1189 unsigned char *c;
1190 unsigned int *i;
1191 struct in_addr *a;
1192 #ifndef HAVE_SOLARIS_NETWORK
1193 struct sockaddr_dl *s;
1194 #endif
1195 } p;
1196 p.c = CMSG_DATA(cmptr);
1197 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1198 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1199 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1200 #ifdef HAVE_SOLARIS_NETWORK
1201 if_index = *(p.i);
1202 #else
1203 if_index = p.s->sdl_index;
1204 #endif
1205 }
1206 }
1207 #endif
1208
1209 #ifdef HAVE_IPV6
1210 if (listen->family == AF_INET6)
1211 {
1212 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1213 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1214 {
1215 union {
1216 unsigned char *c;
1217 struct in6_pktinfo *p;
1218 } p;
1219 p.c = CMSG_DATA(cmptr);
1220
1221 dst_addr.addr.addr6 = p.p->ipi6_addr;
1222 if_index = p.p->ipi6_ifindex;
1223 }
1224 }
1225 #endif
1226
1227 /* enforce available interface configuration */
1228
1229 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1230 return;
1231
1232 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1233 {
1234 if (!option_bool(OPT_CLEVERBIND))
1235 enumerate_interfaces(0);
1236 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1237 !label_exception(if_index, listen->family, &dst_addr))
1238 return;
1239 }
1240
1241 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1242 {
1243 struct irec *iface;
1244
1245 /* get the netmask of the interface whch has the address we were sent to.
1246 This is no neccessarily the interface we arrived on. */
1247
1248 for (iface = daemon->interfaces; iface; iface = iface->next)
1249 if (iface->addr.sa.sa_family == AF_INET &&
1250 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1251 break;
1252
1253 /* interface may be new */
1254 if (!iface && !option_bool(OPT_CLEVERBIND))
1255 enumerate_interfaces(0);
1256
1257 for (iface = daemon->interfaces; iface; iface = iface->next)
1258 if (iface->addr.sa.sa_family == AF_INET &&
1259 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1260 break;
1261
1262 /* If we failed, abandon localisation */
1263 if (iface)
1264 netmask = iface->netmask;
1265 else
1266 dst_addr_4.s_addr = 0;
1267 }
1268 }
1269
1270 /* log_query gets called indirectly all over the place, so
1271 pass these in global variables - sorry. */
1272 daemon->log_display_id = ++daemon->log_id;
1273 daemon->log_source_addr = &source_addr;
1274
1275 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1276 {
1277 #ifdef HAVE_AUTH
1278 struct auth_zone *zone;
1279 #endif
1280 char *types = querystr(auth_dns ? "auth" : "query", type);
1281
1282 if (listen->family == AF_INET)
1283 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1284 (struct all_addr *)&source_addr.in.sin_addr, types);
1285 #ifdef HAVE_IPV6
1286 else
1287 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1288 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1289 #endif
1290
1291 #ifdef HAVE_AUTH
1292 /* find queries for zones we're authoritative for, and answer them directly */
1293 if (!auth_dns)
1294 for (zone = daemon->auth_zones; zone; zone = zone->next)
1295 if (in_zone(zone, daemon->namebuff, NULL))
1296 {
1297 auth_dns = 1;
1298 local_auth = 1;
1299 break;
1300 }
1301 #endif
1302
1303 #ifdef HAVE_LOOP
1304 /* Check for forwarding loop */
1305 if (detect_loop(daemon->namebuff, type))
1306 return;
1307 #endif
1308 }
1309
1310 #ifdef HAVE_AUTH
1311 if (auth_dns)
1312 {
1313 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1314 if (m >= 1)
1315 {
1316 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1317 (char *)header, m, &source_addr, &dst_addr, if_index);
1318 daemon->auth_answer++;
1319 }
1320 }
1321 else
1322 #endif
1323 {
1324 int ad_reqd, do_bit;
1325 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1326 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1327
1328 if (m >= 1)
1329 {
1330 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1331 (char *)header, m, &source_addr, &dst_addr, if_index);
1332 daemon->local_answer++;
1333 }
1334 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1335 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1336 daemon->queries_forwarded++;
1337 else
1338 daemon->local_answer++;
1339 }
1340 }
1341
1342 #ifdef HAVE_DNSSEC
1343
1344 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1345 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1346 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1347 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
1348 char *name, char *keyname)
1349 {
1350 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1351
1352 if (status != STAT_INSECURE)
1353 return status;
1354
1355 /* Store the domain we're trying to check. */
1356 forward->name_start = strlen(name);
1357 forward->name_len = forward->name_start + 1;
1358 if (!(forward->orig_domain = blockdata_alloc(name, forward->name_len)))
1359 return STAT_BOGUS;
1360
1361 return do_check_sign(forward, 0, now, name, keyname);
1362 }
1363
1364 /* We either have a a reply (header non-NULL, or we need to start by looking in the cache */
1365 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname)
1366 {
1367 /* get domain we're checking back from blockdata store, it's stored on the original query. */
1368 while (forward->dependent)
1369 forward = forward->dependent;
1370
1371 blockdata_retrieve(forward->orig_domain, forward->name_len, name);
1372
1373 while (1)
1374 {
1375 char *p;
1376
1377 if (status == 0)
1378 {
1379 struct crec *crecp;
1380
1381 /* Haven't received answer, see if in cache */
1382 if (!(crecp = cache_find_by_name(NULL, &name[forward->name_start], now, F_DS)))
1383 {
1384 /* put name of DS record we're missing into keyname */
1385 strcpy(keyname, &name[forward->name_start]);
1386 /* and wait for reply to arrive */
1387 return STAT_NEED_DS_NEG;
1388 }
1389
1390 /* F_DNSSECOK misused in DS cache records to non-existance of NS record */
1391 if (!(crecp->flags & F_NEG))
1392 status = STAT_SECURE;
1393 else if (crecp->flags & F_DNSSECOK)
1394 status = STAT_NO_DS;
1395 else
1396 status = STAT_NO_NS;
1397 }
1398
1399 /* Have entered non-signed part of DNS tree. */
1400 if (status == STAT_NO_DS)
1401 return STAT_INSECURE;
1402
1403 if (status == STAT_BOGUS)
1404 return STAT_BOGUS;
1405
1406 /* There's a proven DS record, or we're within a zone, where there doesn't need
1407 to be a DS record. Add a name and try again.
1408 If we've already tried the whole name, then fail */
1409
1410 if (forward->name_start == 0)
1411 return STAT_BOGUS;
1412
1413 for (p = &name[forward->name_start-2]; (*p != '.') && (p != name); p--);
1414
1415 if (p != name)
1416 p++;
1417
1418 forward->name_start = p - name;
1419 status = 0; /* force to cache when we iterate. */
1420 }
1421 }
1422
1423 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1424 an unsigned answer is OK, or we find a signed DS, in which case there should be
1425 a signature, and the answer is BOGUS */
1426 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1427 char *keyname, struct server *server, int *keycount)
1428 {
1429 size_t m;
1430 unsigned char *packet, *payload;
1431 u16 *length;
1432 int status, name_len;
1433 struct blockdata *block;
1434
1435 char *name_start;
1436
1437 /* Get first insecure entry in CNAME chain */
1438 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1439 if (status == STAT_BOGUS)
1440 return STAT_BOGUS;
1441
1442 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1443 return STAT_BOGUS;
1444
1445 payload = &packet[2];
1446 header = (struct dns_header *)payload;
1447 length = (u16 *)packet;
1448
1449 /* Stash the name away, since the buffer will be trashed when we recurse */
1450 name_len = strlen(name) + 1;
1451 name_start = name + name_len - 1;
1452
1453 if (!(block = blockdata_alloc(name, name_len)))
1454 {
1455 free(packet);
1456 return STAT_BOGUS;
1457 }
1458
1459 while (1)
1460 {
1461 unsigned char c1, c2;
1462 struct crec *crecp;
1463
1464 if (--(*keycount) == 0)
1465 {
1466 free(packet);
1467 blockdata_free(block);
1468 return STAT_BOGUS;
1469 }
1470
1471 while ((crecp = cache_find_by_name(NULL, name_start, now, F_DS)))
1472 {
1473 if ((crecp->flags & F_NEG) && (crecp->flags & F_DNSSECOK))
1474 {
1475 /* Found a secure denial of DS - delegation is indeed insecure */
1476 free(packet);
1477 blockdata_free(block);
1478 return STAT_INSECURE;
1479 }
1480
1481 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1482 Add another label and continue. */
1483
1484 if (name_start == name)
1485 {
1486 free(packet);
1487 blockdata_free(block);
1488 return STAT_BOGUS; /* run out of labels */
1489 }
1490
1491 name_start -= 2;
1492 while (*name_start != '.' && name_start != name)
1493 name_start--;
1494 if (name_start != name)
1495 name_start++;
1496 }
1497
1498 /* Can't find it in the cache, have to send a query */
1499
1500 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1501
1502 *length = htons(m);
1503
1504 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1505 read_write(server->tcpfd, &c1, 1, 1) &&
1506 read_write(server->tcpfd, &c2, 1, 1) &&
1507 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1508 {
1509 m = (c1 << 8) | c2;
1510
1511 /* Note this trashes all three name workspaces */
1512 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1513
1514 if (status == STAT_NO_DS)
1515 {
1516 /* Found a secure denial of DS - delegation is indeed insecure */
1517 free(packet);
1518 blockdata_free(block);
1519 return STAT_INSECURE;
1520 }
1521
1522 if (status == STAT_BOGUS)
1523 {
1524 free(packet);
1525 blockdata_free(block);
1526 return STAT_BOGUS;
1527 }
1528
1529 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1530 Add another label and continue. */
1531
1532 /* Get name we're checking back. */
1533 blockdata_retrieve(block, name_len, name);
1534
1535 if (name_start == name)
1536 {
1537 free(packet);
1538 blockdata_free(block);
1539 return STAT_BOGUS; /* run out of labels */
1540 }
1541
1542 name_start -= 2;
1543 while (*name_start != '.' && name_start != name)
1544 name_start--;
1545 if (name_start != name)
1546 name_start++;
1547 }
1548 else
1549 {
1550 /* IO failure */
1551 free(packet);
1552 blockdata_free(block);
1553 return STAT_BOGUS; /* run out of labels */
1554 }
1555 }
1556 }
1557
1558 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1559 int class, char *name, char *keyname, struct server *server, int *keycount)
1560 {
1561 /* Recurse up the key heirarchy */
1562 int new_status;
1563
1564 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1565 if (--(*keycount) == 0)
1566 return STAT_INSECURE;
1567
1568 if (status == STAT_NEED_KEY)
1569 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1570 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1571 {
1572 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1573 if (status == STAT_NEED_DS && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
1574 new_status = STAT_BOGUS;
1575 }
1576 else if (status == STAT_CHASE_CNAME)
1577 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1578 else
1579 {
1580 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1581
1582 if (new_status == STAT_NO_SIG)
1583 {
1584 if (option_bool(OPT_DNSSEC_NO_SIGN))
1585 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1586 else
1587 new_status = STAT_INSECURE;
1588 }
1589 }
1590
1591 /* Can't validate because we need a key/DS whose name now in keyname.
1592 Make query for same, and recurse to validate */
1593 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1594 {
1595 size_t m;
1596 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1597 unsigned char *payload = &packet[2];
1598 struct dns_header *new_header = (struct dns_header *)payload;
1599 u16 *length = (u16 *)packet;
1600 unsigned char c1, c2;
1601
1602 if (!packet)
1603 return STAT_INSECURE;
1604
1605 another_tcp_key:
1606 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1607 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1608
1609 *length = htons(m);
1610
1611 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1612 !read_write(server->tcpfd, &c1, 1, 1) ||
1613 !read_write(server->tcpfd, &c2, 1, 1) ||
1614 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1615 new_status = STAT_INSECURE;
1616 else
1617 {
1618 m = (c1 << 8) | c2;
1619
1620 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1621
1622 if (new_status == STAT_SECURE)
1623 {
1624 /* Reached a validated record, now try again at this level.
1625 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1626 If so, go round again. */
1627
1628 if (status == STAT_NEED_KEY)
1629 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1630 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1631 {
1632 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1633 if (status == STAT_NEED_DS && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
1634 new_status = STAT_BOGUS; /* Validated no DS */
1635 }
1636 else if (status == STAT_CHASE_CNAME)
1637 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1638 else
1639 {
1640 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1641
1642 if (new_status == STAT_NO_SIG)
1643 {
1644 if (option_bool(OPT_DNSSEC_NO_SIGN))
1645 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1646 else
1647 new_status = STAT_INSECURE;
1648 }
1649 }
1650
1651 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1652 goto another_tcp_key;
1653 }
1654 }
1655
1656 free(packet);
1657 }
1658 return new_status;
1659 }
1660 #endif
1661
1662
1663 /* The daemon forks before calling this: it should deal with one connection,
1664 blocking as neccessary, and then return. Note, need to be a bit careful
1665 about resources for debug mode, when the fork is suppressed: that's
1666 done by the caller. */
1667 unsigned char *tcp_request(int confd, time_t now,
1668 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1669 {
1670 size_t size = 0;
1671 int norebind = 0;
1672 #ifdef HAVE_AUTH
1673 int local_auth = 0;
1674 #endif
1675 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1676 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
1677 size_t m;
1678 unsigned short qtype;
1679 unsigned int gotname;
1680 unsigned char c1, c2;
1681 /* Max TCP packet + slop + size */
1682 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1683 unsigned char *payload = &packet[2];
1684 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1685 struct dns_header *header = (struct dns_header *)payload;
1686 u16 *length = (u16 *)packet;
1687 struct server *last_server;
1688 struct in_addr dst_addr_4;
1689 union mysockaddr peer_addr;
1690 socklen_t peer_len = sizeof(union mysockaddr);
1691 int query_count = 0;
1692
1693 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1694 return packet;
1695
1696 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1697 if (option_bool(OPT_LOCAL_SERVICE))
1698 {
1699 struct addrlist *addr;
1700 #ifdef HAVE_IPV6
1701 if (peer_addr.sa.sa_family == AF_INET6)
1702 {
1703 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1704 if ((addr->flags & ADDRLIST_IPV6) &&
1705 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1706 break;
1707 }
1708 else
1709 #endif
1710 {
1711 struct in_addr netmask;
1712 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1713 {
1714 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1715 if (!(addr->flags & ADDRLIST_IPV6) &&
1716 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1717 break;
1718 }
1719 }
1720 if (!addr)
1721 {
1722 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1723 return packet;
1724 }
1725 }
1726
1727 while (1)
1728 {
1729 if (query_count == TCP_MAX_QUERIES ||
1730 !packet ||
1731 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1732 !(size = c1 << 8 | c2) ||
1733 !read_write(confd, payload, size, 1))
1734 return packet;
1735
1736 if (size < (int)sizeof(struct dns_header))
1737 continue;
1738
1739 query_count++;
1740
1741 /* log_query gets called indirectly all over the place, so
1742 pass these in global variables - sorry. */
1743 daemon->log_display_id = ++daemon->log_id;
1744 daemon->log_source_addr = &peer_addr;
1745
1746 check_subnet = 0;
1747
1748 /* save state of "cd" flag in query */
1749 if ((checking_disabled = header->hb4 & HB4_CD))
1750 no_cache_dnssec = 1;
1751
1752 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1753 {
1754 #ifdef HAVE_AUTH
1755 struct auth_zone *zone;
1756 #endif
1757 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1758
1759 if (peer_addr.sa.sa_family == AF_INET)
1760 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1761 (struct all_addr *)&peer_addr.in.sin_addr, types);
1762 #ifdef HAVE_IPV6
1763 else
1764 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1765 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1766 #endif
1767
1768 #ifdef HAVE_AUTH
1769 /* find queries for zones we're authoritative for, and answer them directly */
1770 if (!auth_dns)
1771 for (zone = daemon->auth_zones; zone; zone = zone->next)
1772 if (in_zone(zone, daemon->namebuff, NULL))
1773 {
1774 auth_dns = 1;
1775 local_auth = 1;
1776 break;
1777 }
1778 #endif
1779 }
1780
1781 if (local_addr->sa.sa_family == AF_INET)
1782 dst_addr_4 = local_addr->in.sin_addr;
1783 else
1784 dst_addr_4.s_addr = 0;
1785
1786 #ifdef HAVE_AUTH
1787 if (auth_dns)
1788 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1789 else
1790 #endif
1791 {
1792 /* m > 0 if answered from cache */
1793 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1794 dst_addr_4, netmask, now, &ad_question, &do_bit);
1795
1796 /* Do this by steam now we're not in the select() loop */
1797 check_log_writer(NULL);
1798
1799 if (m == 0)
1800 {
1801 unsigned int flags = 0;
1802 struct all_addr *addrp = NULL;
1803 int type = 0;
1804 char *domain = NULL;
1805
1806 if (option_bool(OPT_ADD_MAC))
1807 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1808
1809 if (option_bool(OPT_CLIENT_SUBNET))
1810 {
1811 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1812 if (size != new)
1813 {
1814 size = new;
1815 check_subnet = 1;
1816 }
1817 }
1818
1819 if (gotname)
1820 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1821
1822 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1823 last_server = daemon->servers;
1824 else
1825 last_server = daemon->last_server;
1826
1827 if (!flags && last_server)
1828 {
1829 struct server *firstsendto = NULL;
1830 #ifdef HAVE_DNSSEC
1831 unsigned char *newhash, hash[HASH_SIZE];
1832 if ((newhash = hash_questions(header, (unsigned int)size, daemon->namebuff)))
1833 memcpy(hash, newhash, HASH_SIZE);
1834 else
1835 memset(hash, 0, HASH_SIZE);
1836 #else
1837 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1838 #endif
1839 /* Loop round available servers until we succeed in connecting to one.
1840 Note that this code subtley ensures that consecutive queries on this connection
1841 which can go to the same server, do so. */
1842 while (1)
1843 {
1844 if (!firstsendto)
1845 firstsendto = last_server;
1846 else
1847 {
1848 if (!(last_server = last_server->next))
1849 last_server = daemon->servers;
1850
1851 if (last_server == firstsendto)
1852 break;
1853 }
1854
1855 /* server for wrong domain */
1856 if (type != (last_server->flags & SERV_TYPE) ||
1857 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)) ||
1858 (last_server->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
1859 continue;
1860
1861 if (last_server->tcpfd == -1)
1862 {
1863 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1864 continue;
1865
1866 #ifdef HAVE_CONNTRACK
1867 /* Copy connection mark of incoming query to outgoing connection. */
1868 if (option_bool(OPT_CONNTRACK))
1869 {
1870 unsigned int mark;
1871 struct all_addr local;
1872 #ifdef HAVE_IPV6
1873 if (local_addr->sa.sa_family == AF_INET6)
1874 local.addr.addr6 = local_addr->in6.sin6_addr;
1875 else
1876 #endif
1877 local.addr.addr4 = local_addr->in.sin_addr;
1878
1879 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1880 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1881 }
1882 #endif
1883
1884 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1885 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1886 {
1887 close(last_server->tcpfd);
1888 last_server->tcpfd = -1;
1889 continue;
1890 }
1891
1892 #ifdef HAVE_DNSSEC
1893 if (option_bool(OPT_DNSSEC_VALID))
1894 {
1895 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1896
1897 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1898 this allows it to select auth servers when one is returning bad data. */
1899 if (option_bool(OPT_DNSSEC_DEBUG))
1900 header->hb4 |= HB4_CD;
1901
1902 if (size != new_size)
1903 added_pheader = 1;
1904
1905 size = new_size;
1906 }
1907 #endif
1908 }
1909
1910 *length = htons(size);
1911
1912 /* get query name again for logging - may have been overwritten */
1913 if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1914 strcpy(daemon->namebuff, "query");
1915
1916 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1917 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1918 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1919 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1920 {
1921 close(last_server->tcpfd);
1922 last_server->tcpfd = -1;
1923 continue;
1924 }
1925
1926 m = (c1 << 8) | c2;
1927
1928 if (last_server->addr.sa.sa_family == AF_INET)
1929 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1930 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1931 #ifdef HAVE_IPV6
1932 else
1933 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1934 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1935 #endif
1936
1937 #ifdef HAVE_DNSSEC
1938 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1939 {
1940 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1941 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1942 char *result;
1943
1944 if (keycount == 0)
1945 {
1946 result = "ABANDONED";
1947 status = STAT_BOGUS;
1948 }
1949 else
1950 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1951
1952 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1953
1954 if (status == STAT_BOGUS)
1955 no_cache_dnssec = 1;
1956
1957 if (status == STAT_SECURE)
1958 cache_secure = 1;
1959 }
1960 #endif
1961
1962 /* restore CD bit to the value in the query */
1963 if (checking_disabled)
1964 header->hb4 |= HB4_CD;
1965 else
1966 header->hb4 &= ~HB4_CD;
1967
1968 /* There's no point in updating the cache, since this process will exit and
1969 lose the information after a few queries. We make this call for the alias and
1970 bogus-nxdomain side-effects. */
1971 /* If the crc of the question section doesn't match the crc we sent, then
1972 someone might be attempting to insert bogus values into the cache by
1973 sending replies containing questions and bogus answers. */
1974 #ifdef HAVE_DNSSEC
1975 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1976 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
1977 {
1978 m = 0;
1979 break;
1980 }
1981 #else
1982 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
1983 {
1984 m = 0;
1985 break;
1986 }
1987 #endif
1988
1989 m = process_reply(header, now, last_server, (unsigned int)m,
1990 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
1991 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
1992
1993 break;
1994 }
1995 }
1996
1997 /* In case of local answer or no connections made. */
1998 if (m == 0)
1999 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
2000 }
2001 }
2002
2003 check_log_writer(NULL);
2004
2005 *length = htons(m);
2006
2007 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
2008 return packet;
2009 }
2010 }
2011
2012 static struct frec *allocate_frec(time_t now)
2013 {
2014 struct frec *f;
2015
2016 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
2017 {
2018 f->next = daemon->frec_list;
2019 f->time = now;
2020 f->sentto = NULL;
2021 f->rfd4 = NULL;
2022 f->flags = 0;
2023 #ifdef HAVE_IPV6
2024 f->rfd6 = NULL;
2025 #endif
2026 #ifdef HAVE_DNSSEC
2027 f->dependent = NULL;
2028 f->blocking_query = NULL;
2029 f->stash = NULL;
2030 f->orig_domain = NULL;
2031 #endif
2032 daemon->frec_list = f;
2033 }
2034
2035 return f;
2036 }
2037
2038 struct randfd *allocate_rfd(int family)
2039 {
2040 static int finger = 0;
2041 int i;
2042
2043 /* limit the number of sockets we have open to avoid starvation of
2044 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
2045
2046 for (i = 0; i < RANDOM_SOCKS; i++)
2047 if (daemon->randomsocks[i].refcount == 0)
2048 {
2049 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
2050 break;
2051
2052 daemon->randomsocks[i].refcount = 1;
2053 daemon->randomsocks[i].family = family;
2054 return &daemon->randomsocks[i];
2055 }
2056
2057 /* No free ones or cannot get new socket, grab an existing one */
2058 for (i = 0; i < RANDOM_SOCKS; i++)
2059 {
2060 int j = (i+finger) % RANDOM_SOCKS;
2061 if (daemon->randomsocks[j].refcount != 0 &&
2062 daemon->randomsocks[j].family == family &&
2063 daemon->randomsocks[j].refcount != 0xffff)
2064 {
2065 finger = j;
2066 daemon->randomsocks[j].refcount++;
2067 return &daemon->randomsocks[j];
2068 }
2069 }
2070
2071 return NULL; /* doom */
2072 }
2073
2074 void free_rfd(struct randfd *rfd)
2075 {
2076 if (rfd && --(rfd->refcount) == 0)
2077 close(rfd->fd);
2078 }
2079
2080 static void free_frec(struct frec *f)
2081 {
2082 free_rfd(f->rfd4);
2083 f->rfd4 = NULL;
2084 f->sentto = NULL;
2085 f->flags = 0;
2086
2087 #ifdef HAVE_IPV6
2088 free_rfd(f->rfd6);
2089 f->rfd6 = NULL;
2090 #endif
2091
2092 #ifdef HAVE_DNSSEC
2093 if (f->stash)
2094 {
2095 blockdata_free(f->stash);
2096 f->stash = NULL;
2097 }
2098
2099 if (f->orig_domain)
2100 {
2101 blockdata_free(f->orig_domain);
2102 f->orig_domain = NULL;
2103 }
2104
2105 /* Anything we're waiting on is pointless now, too */
2106 if (f->blocking_query)
2107 free_frec(f->blocking_query);
2108 f->blocking_query = NULL;
2109 f->dependent = NULL;
2110 #endif
2111 }
2112
2113 /* if wait==NULL return a free or older than TIMEOUT record.
2114 else return *wait zero if one available, or *wait is delay to
2115 when the oldest in-use record will expire. Impose an absolute
2116 limit of 4*TIMEOUT before we wipe things (for random sockets).
2117 If force is set, always return a result, even if we have
2118 to allocate above the limit. */
2119 struct frec *get_new_frec(time_t now, int *wait, int force)
2120 {
2121 struct frec *f, *oldest, *target;
2122 int count;
2123
2124 if (wait)
2125 *wait = 0;
2126
2127 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
2128 if (!f->sentto)
2129 target = f;
2130 else
2131 {
2132 if (difftime(now, f->time) >= 4*TIMEOUT)
2133 {
2134 free_frec(f);
2135 target = f;
2136 }
2137
2138 if (!oldest || difftime(f->time, oldest->time) <= 0)
2139 oldest = f;
2140 }
2141
2142 if (target)
2143 {
2144 target->time = now;
2145 return target;
2146 }
2147
2148 /* can't find empty one, use oldest if there is one
2149 and it's older than timeout */
2150 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2151 {
2152 /* keep stuff for twice timeout if we can by allocating a new
2153 record instead */
2154 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2155 count <= daemon->ftabsize &&
2156 (f = allocate_frec(now)))
2157 return f;
2158
2159 if (!wait)
2160 {
2161 free_frec(oldest);
2162 oldest->time = now;
2163 }
2164 return oldest;
2165 }
2166
2167 /* none available, calculate time 'till oldest record expires */
2168 if (!force && count > daemon->ftabsize)
2169 {
2170 static time_t last_log = 0;
2171
2172 if (oldest && wait)
2173 *wait = oldest->time + (time_t)TIMEOUT - now;
2174
2175 if ((int)difftime(now, last_log) > 5)
2176 {
2177 last_log = now;
2178 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2179 }
2180
2181 return NULL;
2182 }
2183
2184 if (!(f = allocate_frec(now)) && wait)
2185 /* wait one second on malloc failure */
2186 *wait = 1;
2187
2188 return f; /* OK if malloc fails and this is NULL */
2189 }
2190
2191 /* crc is all-ones if not known. */
2192 static struct frec *lookup_frec(unsigned short id, void *hash)
2193 {
2194 struct frec *f;
2195
2196 for(f = daemon->frec_list; f; f = f->next)
2197 if (f->sentto && f->new_id == id &&
2198 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2199 return f;
2200
2201 return NULL;
2202 }
2203
2204 static struct frec *lookup_frec_by_sender(unsigned short id,
2205 union mysockaddr *addr,
2206 void *hash)
2207 {
2208 struct frec *f;
2209
2210 for(f = daemon->frec_list; f; f = f->next)
2211 if (f->sentto &&
2212 f->orig_id == id &&
2213 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2214 sockaddr_isequal(&f->source, addr))
2215 return f;
2216
2217 return NULL;
2218 }
2219
2220 /* Send query packet again, if we can. */
2221 void resend_query()
2222 {
2223 if (daemon->srv_save)
2224 {
2225 int fd;
2226
2227 if (daemon->srv_save->sfd)
2228 fd = daemon->srv_save->sfd->fd;
2229 else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
2230 fd = daemon->rfd_save->fd;
2231 else
2232 return;
2233
2234 while(retry_send(sendto(fd, daemon->packet, daemon->packet_len, 0,
2235 &daemon->srv_save->addr.sa,
2236 sa_len(&daemon->srv_save->addr))));
2237 }
2238 }
2239
2240 /* A server record is going away, remove references to it */
2241 void server_gone(struct server *server)
2242 {
2243 struct frec *f;
2244
2245 for (f = daemon->frec_list; f; f = f->next)
2246 if (f->sentto && f->sentto == server)
2247 free_frec(f);
2248
2249 if (daemon->last_server == server)
2250 daemon->last_server = NULL;
2251
2252 if (daemon->srv_save == server)
2253 daemon->srv_save = NULL;
2254 }
2255
2256 /* return unique random ids. */
2257 static unsigned short get_id(void)
2258 {
2259 unsigned short ret = 0;
2260
2261 do
2262 ret = rand16();
2263 while (lookup_frec(ret, NULL));
2264
2265 return ret;
2266 }
2267
2268
2269
2270
2271
Michael's tree of dnsmasq.