]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2013 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(unsigned int crc
);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
27 /* Send a UDP packet with its source address set as "source"
28 unless nowild is true, when we just send it with the kernel default */
29 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
30 union mysockaddr
*to
, struct all_addr
*source
,
36 struct cmsghdr align
; /* this ensures alignment */
37 #if defined(HAVE_LINUX_NETWORK)
38 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
39 #elif defined(IP_SENDSRCADDR)
40 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
43 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
47 iov
[0].iov_base
= packet
;
50 msg
.msg_control
= NULL
;
51 msg
.msg_controllen
= 0;
54 msg
.msg_namelen
= sa_len(to
);
60 struct cmsghdr
*cmptr
;
61 msg
.msg_control
= &control_u
;
62 msg
.msg_controllen
= sizeof(control_u
);
63 cmptr
= CMSG_FIRSTHDR(&msg
);
65 if (to
->sa
.sa_family
== AF_INET
)
67 #if defined(HAVE_LINUX_NETWORK)
70 p
.ipi_spec_dst
= source
->addr
.addr4
;
71 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
72 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
73 cmptr
->cmsg_level
= IPPROTO_IP
;
74 cmptr
->cmsg_type
= IP_PKTINFO
;
75 #elif defined(IP_SENDSRCADDR)
76 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
77 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
78 cmptr
->cmsg_level
= IPPROTO_IP
;
79 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
86 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
87 p
.ipi6_addr
= source
->addr
.addr6
;
88 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
89 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
90 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
91 cmptr
->cmsg_level
= IPPROTO_IPV6
;
94 (void)iface
; /* eliminate warning */
98 while (sendmsg(fd
, &msg
, 0) == -1)
103 /* If interface is still in DAD, EINVAL results - ignore that. */
107 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
114 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
115 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
118 /* If the query ends in the domain in one of our servers, set
119 domain to point to that name. We find the largest match to allow both
120 domain.org and sub.domain.org to exist. */
122 unsigned int namelen
= strlen(qdomain
);
123 unsigned int matchlen
= 0;
125 unsigned int flags
= 0;
127 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
128 /* domain matches take priority over NODOTS matches */
129 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
131 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
132 *type
= SERV_FOR_NODOTS
;
133 if (serv
->flags
& SERV_NO_ADDR
)
135 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
140 if (serv
->addr
.sa
.sa_family
== AF_INET
)
141 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
144 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
147 else if (!flags
|| (flags
& F_NXDOMAIN
))
151 else if (serv
->flags
& SERV_HAS_DOMAIN
)
153 unsigned int domainlen
= strlen(serv
->domain
);
154 char *matchstart
= qdomain
+ namelen
- domainlen
;
155 if (namelen
>= domainlen
&&
156 hostname_isequal(matchstart
, serv
->domain
) &&
157 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
159 if (serv
->flags
& SERV_NO_REBIND
)
163 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
164 /* implement priority rules for --address and --server for same domain.
165 --address wins if the address is for the correct AF
166 --server wins otherwise. */
167 if (domainlen
!= 0 && domainlen
== matchlen
)
169 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
171 if (!(sflag
& qtype
) && flags
== 0)
176 if (flags
& (F_IPV4
| F_IPV6
))
181 if (domainlen
>= matchlen
)
183 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
184 *domain
= serv
->domain
;
185 matchlen
= domainlen
;
186 if (serv
->flags
& SERV_NO_ADDR
)
188 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
193 if (serv
->addr
.sa
.sa_family
== AF_INET
)
194 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
197 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
200 else if (!flags
|| (flags
& F_NXDOMAIN
))
210 if (flags
== 0 && !(qtype
& F_QUERY
) &&
211 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
212 /* don't forward A or AAAA queries for simple names, except the empty name */
215 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
222 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
223 logflags
= F_NEG
| qtype
;
225 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
227 else if ((*type
) & SERV_USE_RESOLV
)
229 *type
= 0; /* use normal servers for this domain */
235 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
236 struct all_addr
*dst_addr
, unsigned int dst_iface
,
237 struct dns_header
*header
, size_t plen
, time_t now
, struct frec
*forward
)
240 int type
= 0, norebind
= 0;
241 struct all_addr
*addrp
= NULL
;
242 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
243 unsigned int flags
= 0;
244 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
245 struct server
*start
= NULL
;
247 /* RFC 4035: sect 4.6 para 2 */
248 header
->hb4
&= ~HB4_AD
;
250 /* may be no servers available. */
251 if (!daemon
->servers
)
253 else if (forward
|| (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, crc
)))
255 /* retry on existing query, send to all available servers */
256 domain
= forward
->sentto
->domain
;
257 forward
->sentto
->failed_queries
++;
258 if (!option_bool(OPT_ORDER
))
260 forward
->forwardall
= 1;
261 daemon
->last_server
= NULL
;
263 type
= forward
->sentto
->flags
& SERV_TYPE
;
264 if (!(start
= forward
->sentto
->next
))
265 start
= daemon
->servers
; /* at end of list, recycle */
266 header
->id
= htons(forward
->new_id
);
271 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
273 if (!flags
&& !(forward
= get_new_frec(now
, NULL
)))
274 /* table full - server failure. */
279 forward
->source
= *udpaddr
;
280 forward
->dest
= *dst_addr
;
281 forward
->iface
= dst_iface
;
282 forward
->orig_id
= ntohs(header
->id
);
283 forward
->new_id
= get_id(crc
);
286 forward
->forwardall
= 0;
289 forward
->flags
|= FREC_NOREBIND
;
290 if (header
->hb4
& HB4_CD
)
291 forward
->flags
|= FREC_CHECKING_DISABLED
;
293 header
->id
= htons(forward
->new_id
);
295 /* In strict_order mode, always try servers in the order
296 specified in resolv.conf, if a domain is given
297 always try all the available servers,
298 otherwise, use the one last known to work. */
302 if (option_bool(OPT_ORDER
))
303 start
= daemon
->servers
;
304 else if (!(start
= daemon
->last_server
) ||
305 daemon
->forwardcount
++ > FORWARD_TEST
||
306 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
308 start
= daemon
->servers
;
309 forward
->forwardall
= 1;
310 daemon
->forwardcount
= 0;
311 daemon
->forwardtime
= now
;
316 start
= daemon
->servers
;
317 if (!option_bool(OPT_ORDER
))
318 forward
->forwardall
= 1;
323 /* check for send errors here (no route to host)
324 if we fail to send to all nameservers, send back an error
325 packet straight away (helps modem users when offline) */
327 if (!flags
&& forward
)
329 struct server
*firstsentto
= start
;
332 if (option_bool(OPT_ADD_MAC
))
333 plen
= add_mac(header
, plen
, ((char *) header
) + PACKETSZ
, &forward
->source
);
335 if (option_bool(OPT_CLIENT_SUBNET
))
337 size_t new = add_source_addr(header
, plen
, ((char *) header
) + PACKETSZ
, &forward
->source
);
341 forward
->flags
|= FREC_HAS_SUBNET
;
347 /* only send to servers dealing with our domain.
348 domain may be NULL, in which case server->domain
349 must be NULL also. */
351 if (type
== (start
->flags
& SERV_TYPE
) &&
352 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
353 !(start
->flags
& SERV_LITERAL_ADDRESS
))
357 /* find server socket to use, may need to get random one. */
363 if (start
->addr
.sa
.sa_family
== AF_INET6
)
365 if (!forward
->rfd6
&&
366 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
368 daemon
->rfd_save
= forward
->rfd6
;
369 fd
= forward
->rfd6
->fd
;
374 if (!forward
->rfd4
&&
375 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
377 daemon
->rfd_save
= forward
->rfd4
;
378 fd
= forward
->rfd4
->fd
;
381 #ifdef HAVE_CONNTRACK
382 /* Copy connection mark of incoming query to outgoing connection. */
383 if (option_bool(OPT_CONNTRACK
))
386 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
387 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
392 if (sendto(fd
, (char *)header
, plen
, 0,
394 sa_len(&start
->addr
)) == -1)
401 /* Keep info in case we want to re-send this packet */
402 daemon
->srv_save
= start
;
403 daemon
->packet_len
= plen
;
406 strcpy(daemon
->namebuff
, "query");
407 if (start
->addr
.sa
.sa_family
== AF_INET
)
408 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
409 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
412 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
413 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
417 forward
->sentto
= start
;
418 if (!forward
->forwardall
)
420 forward
->forwardall
++;
424 if (!(start
= start
->next
))
425 start
= daemon
->servers
;
427 if (start
== firstsentto
)
434 /* could not send on, prepare to return */
435 header
->id
= htons(forward
->orig_id
);
436 free_frec(forward
); /* cancel */
439 /* could not send on, return empty answer or address if known for whole domain */
442 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
443 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
449 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
450 int checking_disabled
, int check_subnet
, union mysockaddr
*query_source
)
452 unsigned char *pheader
, *sizep
;
454 int munged
= 0, is_sign
;
458 /* Similar algorithm to search_servers. */
459 struct ipsets
*ipset_pos
;
460 unsigned int namelen
= strlen(daemon
->namebuff
);
461 unsigned int matchlen
= 0;
462 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
464 unsigned int domainlen
= strlen(ipset_pos
->domain
);
465 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
466 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
467 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
468 domainlen
>= matchlen
) {
469 matchlen
= domainlen
;
470 sets
= ipset_pos
->sets
;
475 /* If upstream is advertising a larger UDP packet size
476 than we allow, trim it so that we don't get overlarge
477 requests for the client. We can't do this for signed packets. */
479 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
483 unsigned short udpsz
;
484 unsigned char *psave
= sizep
;
486 GETSHORT(udpsz
, sizep
);
487 if (udpsz
> daemon
->edns_pktsz
)
488 PUTSHORT(daemon
->edns_pktsz
, psave
);
491 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
493 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
499 /* RFC 4035 sect 4.6 para 3 */
500 if (!is_sign
&& !option_bool(OPT_DNSSEC
))
501 header
->hb4
&= ~HB4_AD
;
503 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
506 /* Complain loudly if the upstream server is non-recursive. */
507 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
508 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
510 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
511 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
512 if (!option_bool(OPT_LOG
))
513 server
->flags
|= SERV_WARNED_RECURSIVE
;
516 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
517 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
520 SET_RCODE(header
, NXDOMAIN
);
521 header
->hb3
&= ~HB3_AA
;
525 if (RCODE(header
) == NXDOMAIN
&&
526 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
527 check_for_local_domain(daemon
->namebuff
, now
))
529 /* if we forwarded a query for a locally known name (because it was for
530 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
531 since we know that the domain exists, even if upstream doesn't */
533 header
->hb3
|= HB3_AA
;
534 SET_RCODE(header
, NOERROR
);
537 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, checking_disabled
))
539 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
544 /* do this after extract_addresses. Ensure NODATA reply and remove
549 header
->ancount
= htons(0);
550 header
->nscount
= htons(0);
551 header
->arcount
= htons(0);
554 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
555 sections of the packet. Find the new length here and put back pseudoheader
556 if it was removed. */
557 return resize_packet(header
, n
, pheader
, plen
);
560 /* sets new last_server */
561 void reply_query(int fd
, int family
, time_t now
)
563 /* packet from peer server, extract data for cache, and send to
564 original requester */
565 struct dns_header
*header
;
566 union mysockaddr serveraddr
;
567 struct frec
*forward
;
568 socklen_t addrlen
= sizeof(serveraddr
);
569 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->edns_pktsz
, 0, &serveraddr
.sa
, &addrlen
);
571 struct server
*server
;
573 /* packet buffer overwritten */
574 daemon
->srv_save
= NULL
;
576 /* Determine the address of the server replying so that we can mark that as good */
577 serveraddr
.sa
.sa_family
= family
;
579 if (serveraddr
.sa
.sa_family
== AF_INET6
)
580 serveraddr
.in6
.sin6_flowinfo
= 0;
583 /* spoof check: answer must come from known server, */
584 for (server
= daemon
->servers
; server
; server
= server
->next
)
585 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
586 sockaddr_isequal(&server
->addr
, &serveraddr
))
589 header
= (struct dns_header
*)daemon
->packet
;
592 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
593 !(forward
= lookup_frec(ntohs(header
->id
), questions_crc(header
, n
, daemon
->namebuff
))))
596 server
= forward
->sentto
;
598 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
599 !option_bool(OPT_ORDER
) &&
600 forward
->forwardall
== 0)
601 /* for broken servers, attempt to send to another one. */
603 unsigned char *pheader
;
607 /* recreate query from reply */
608 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
611 header
->ancount
= htons(0);
612 header
->nscount
= htons(0);
613 header
->arcount
= htons(0);
614 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
616 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
617 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
);
623 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
625 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
629 struct server
*last_server
;
631 /* find good server by address if possible, otherwise assume the last one we sent to */
632 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
633 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
634 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
636 server
= last_server
;
640 if (!option_bool(OPT_ALL_SERVERS
))
641 daemon
->last_server
= server
;
644 /* If the answer is an error, keep the forward record in place in case
645 we get a good reply from another server. Kill it when we've
646 had replies from all to avoid filling the forwarding table when
647 everything is broken */
648 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
649 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
651 int check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
653 if (!option_bool(OPT_NO_REBIND
))
656 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, forward
->flags
& FREC_CHECKING_DISABLED
,
657 forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
659 header
->id
= htons(forward
->orig_id
);
660 header
->hb4
|= HB4_RA
; /* recursion if available */
661 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
662 &forward
->source
, &forward
->dest
, forward
->iface
);
664 free_frec(forward
); /* cancel */
669 void receive_query(struct listener
*listen
, time_t now
)
671 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
672 union mysockaddr source_addr
;
674 struct all_addr dst_addr
;
675 struct in_addr netmask
, dst_addr_4
;
678 int if_index
= 0, auth_dns
= 0;
684 struct cmsghdr
*cmptr
;
686 struct cmsghdr align
; /* this ensures alignment */
688 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
690 #if defined(HAVE_LINUX_NETWORK)
691 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
692 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
693 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
694 CMSG_SPACE(sizeof(unsigned int))];
695 #elif defined(IP_RECVDSTADDR)
696 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
697 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
701 /* Can always get recvd interface for IPv6 */
702 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
704 int check_dst
= !option_bool(OPT_NOWILD
);
707 /* packet buffer overwritten */
708 daemon
->srv_save
= NULL
;
710 dst_addr_4
.s_addr
= 0;
713 if (option_bool(OPT_NOWILD
) && listen
->iface
)
715 auth_dns
= listen
->iface
->dns_auth
;
717 if (listen
->family
== AF_INET
)
719 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
720 netmask
= listen
->iface
->netmask
;
724 iov
[0].iov_base
= daemon
->packet
;
725 iov
[0].iov_len
= daemon
->edns_pktsz
;
727 msg
.msg_control
= control_u
.control
;
728 msg
.msg_controllen
= sizeof(control_u
);
730 msg
.msg_name
= &source_addr
;
731 msg
.msg_namelen
= sizeof(source_addr
);
735 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
738 if (n
< (int)sizeof(struct dns_header
) ||
739 (msg
.msg_flags
& MSG_TRUNC
) ||
740 (header
->hb3
& HB3_QR
))
743 source_addr
.sa
.sa_family
= listen
->family
;
745 if (listen
->family
== AF_INET6
)
746 source_addr
.in6
.sin6_flowinfo
= 0;
753 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
756 #if defined(HAVE_LINUX_NETWORK)
757 if (listen
->family
== AF_INET
)
758 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
759 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
763 struct in_pktinfo
*p
;
765 p
.c
= CMSG_DATA(cmptr
);
766 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
767 if_index
= p
.p
->ipi_ifindex
;
769 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
770 if (listen
->family
== AF_INET
)
772 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
778 #ifndef HAVE_SOLARIS_NETWORK
779 struct sockaddr_dl
*s
;
782 p
.c
= CMSG_DATA(cmptr
);
783 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
784 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
785 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
786 #ifdef HAVE_SOLARIS_NETWORK
789 if_index
= p
.s
->sdl_index
;
796 if (listen
->family
== AF_INET6
)
798 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
799 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
803 struct in6_pktinfo
*p
;
805 p
.c
= CMSG_DATA(cmptr
);
807 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
808 if_index
= p
.p
->ipi6_ifindex
;
813 /* enforce available interface configuration */
815 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
818 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
820 if (!option_bool(OPT_CLEVERBIND
))
821 enumerate_interfaces(0);
822 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
823 !label_exception(if_index
, listen
->family
, &dst_addr
))
827 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
831 /* get the netmask of the interface whch has the address we were sent to.
832 This is no neccessarily the interface we arrived on. */
834 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
835 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
836 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
839 /* interface may be new */
840 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
841 enumerate_interfaces(0);
843 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
844 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
845 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
848 /* If we failed, abandon localisation */
850 netmask
= iface
->netmask
;
852 dst_addr_4
.s_addr
= 0;
856 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
860 struct auth_zone
*zone
;
863 querystr(auth_dns
? "auth" : "query", types
, type
);
865 if (listen
->family
== AF_INET
)
866 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
867 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
870 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
871 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
875 /* find queries for zones we're authoritative for, and answer them directly */
877 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
878 if (in_zone(zone
, daemon
->namebuff
, NULL
))
890 m
= answer_auth(header
, ((char *) header
) + PACKETSZ
, (size_t)n
, now
, &source_addr
, local_auth
);
893 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
894 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
895 daemon
->auth_answer
++;
901 m
= answer_request(header
, ((char *) header
) + PACKETSZ
, (size_t)n
,
902 dst_addr_4
, netmask
, now
);
906 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
907 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
908 daemon
->local_answer
++;
910 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
911 header
, (size_t)n
, now
, NULL
))
912 daemon
->queries_forwarded
++;
914 daemon
->local_answer
++;
918 /* The daemon forks before calling this: it should deal with one connection,
919 blocking as neccessary, and then return. Note, need to be a bit careful
920 about resources for debug mode, when the fork is suppressed: that's
921 done by the caller. */
922 unsigned char *tcp_request(int confd
, time_t now
,
923 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
930 int checking_disabled
, check_subnet
;
932 unsigned short qtype
;
933 unsigned int gotname
;
934 unsigned char c1
, c2
;
935 /* Max TCP packet + slop + size */
936 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
937 unsigned char *payload
= &packet
[2];
938 /* largest field in header is 16-bits, so this is still sufficiently aligned */
939 struct dns_header
*header
= (struct dns_header
*)payload
;
940 u16
*length
= (u16
*)packet
;
941 struct server
*last_server
;
942 struct in_addr dst_addr_4
;
943 union mysockaddr peer_addr
;
944 socklen_t peer_len
= sizeof(union mysockaddr
);
946 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
952 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
953 !(size
= c1
<< 8 | c2
) ||
954 !read_write(confd
, payload
, size
, 1))
957 if (size
< (int)sizeof(struct dns_header
))
962 /* save state of "cd" flag in query */
963 checking_disabled
= header
->hb4
& HB4_CD
;
965 /* RFC 4035: sect 4.6 para 2 */
966 header
->hb4
&= ~HB4_AD
;
968 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
972 struct auth_zone
*zone
;
974 querystr(auth_dns
? "auth" : "query", types
, qtype
);
976 if (peer_addr
.sa
.sa_family
== AF_INET
)
977 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
978 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
981 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
982 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
986 /* find queries for zones we're authoritative for, and answer them directly */
988 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
989 if (in_zone(zone
, daemon
->namebuff
, NULL
))
998 if (local_addr
->sa
.sa_family
== AF_INET
)
999 dst_addr_4
= local_addr
->in
.sin_addr
;
1001 dst_addr_4
.s_addr
= 0;
1005 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1009 /* m > 0 if answered from cache */
1010 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1011 dst_addr_4
, netmask
, now
);
1013 /* Do this by steam now we're not in the select() loop */
1014 check_log_writer(NULL
);
1018 unsigned int flags
= 0;
1019 struct all_addr
*addrp
= NULL
;
1021 char *domain
= NULL
;
1023 if (option_bool(OPT_ADD_MAC
))
1024 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1026 if (option_bool(OPT_CLIENT_SUBNET
))
1028 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1037 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1039 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1040 last_server
= daemon
->servers
;
1042 last_server
= daemon
->last_server
;
1044 if (!flags
&& last_server
)
1046 struct server
*firstsendto
= NULL
;
1047 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1049 /* Loop round available servers until we succeed in connecting to one.
1050 Note that this code subtley ensures that consecutive queries on this connection
1051 which can go to the same server, do so. */
1055 firstsendto
= last_server
;
1058 if (!(last_server
= last_server
->next
))
1059 last_server
= daemon
->servers
;
1061 if (last_server
== firstsendto
)
1065 /* server for wrong domain */
1066 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1067 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1070 if (last_server
->tcpfd
== -1)
1072 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1075 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1076 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1078 close(last_server
->tcpfd
);
1079 last_server
->tcpfd
= -1;
1083 #ifdef HAVE_CONNTRACK
1084 /* Copy connection mark of incoming query to outgoing connection. */
1085 if (option_bool(OPT_CONNTRACK
))
1088 struct all_addr local
;
1090 if (local_addr
->sa
.sa_family
== AF_INET6
)
1091 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1094 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1096 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1097 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1102 *length
= htons(size
);
1104 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1105 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1106 !read_write(last_server
->tcpfd
, &c2
, 1, 1))
1108 close(last_server
->tcpfd
);
1109 last_server
->tcpfd
= -1;
1114 if (!read_write(last_server
->tcpfd
, payload
, m
, 1))
1118 strcpy(daemon
->namebuff
, "query");
1119 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1120 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1121 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1124 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1125 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1128 /* There's no point in updating the cache, since this process will exit and
1129 lose the information after a few queries. We make this call for the alias and
1130 bogus-nxdomain side-effects. */
1131 /* If the crc of the question section doesn't match the crc we sent, then
1132 someone might be attempting to insert bogus values into the cache by
1133 sending replies containing questions and bogus answers. */
1134 if (crc
== questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1135 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1136 option_bool(OPT_NO_REBIND
) && !norebind
, checking_disabled
,
1137 check_subnet
, &peer_addr
);
1143 /* In case of local answer or no connections made. */
1145 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1149 check_log_writer(NULL
);
1153 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1158 static struct frec
*allocate_frec(time_t now
)
1162 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1164 f
->next
= daemon
->frec_list
;
1172 daemon
->frec_list
= f
;
1178 static struct randfd
*allocate_rfd(int family
)
1180 static int finger
= 0;
1183 /* limit the number of sockets we have open to avoid starvation of
1184 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1186 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1187 if (daemon
->randomsocks
[i
].refcount
== 0)
1189 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1192 daemon
->randomsocks
[i
].refcount
= 1;
1193 daemon
->randomsocks
[i
].family
= family
;
1194 return &daemon
->randomsocks
[i
];
1197 /* No free ones or cannot get new socket, grab an existing one */
1198 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1200 int j
= (i
+finger
) % RANDOM_SOCKS
;
1201 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1202 daemon
->randomsocks
[j
].family
== family
&&
1203 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1206 daemon
->randomsocks
[j
].refcount
++;
1207 return &daemon
->randomsocks
[j
];
1211 return NULL
; /* doom */
1214 static void free_frec(struct frec
*f
)
1216 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1224 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1231 /* if wait==NULL return a free or older than TIMEOUT record.
1232 else return *wait zero if one available, or *wait is delay to
1233 when the oldest in-use record will expire. Impose an absolute
1234 limit of 4*TIMEOUT before we wipe things (for random sockets) */
1235 struct frec
*get_new_frec(time_t now
, int *wait
)
1237 struct frec
*f
, *oldest
, *target
;
1243 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1248 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1254 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1264 /* can't find empty one, use oldest if there is one
1265 and it's older than timeout */
1266 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1268 /* keep stuff for twice timeout if we can by allocating a new
1270 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1271 count
<= daemon
->ftabsize
&&
1272 (f
= allocate_frec(now
)))
1283 /* none available, calculate time 'till oldest record expires */
1284 if (count
> daemon
->ftabsize
)
1286 static time_t last_log
= 0;
1289 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1291 if ((int)difftime(now
, last_log
) > 5)
1294 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1300 if (!(f
= allocate_frec(now
)) && wait
)
1301 /* wait one second on malloc failure */
1304 return f
; /* OK if malloc fails and this is NULL */
1307 /* crc is all-ones if not known. */
1308 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
)
1312 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1313 if (f
->sentto
&& f
->new_id
== id
&&
1314 (f
->crc
== crc
|| crc
== 0xffffffff))
1320 static struct frec
*lookup_frec_by_sender(unsigned short id
,
1321 union mysockaddr
*addr
,
1326 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1330 sockaddr_isequal(&f
->source
, addr
))
1336 /* A server record is going away, remove references to it */
1337 void server_gone(struct server
*server
)
1341 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
1342 if (f
->sentto
&& f
->sentto
== server
)
1345 if (daemon
->last_server
== server
)
1346 daemon
->last_server
= NULL
;
1348 if (daemon
->srv_save
== server
)
1349 daemon
->srv_save
= NULL
;
1352 /* return unique random ids. */
1353 static unsigned short get_id(unsigned int crc
)
1355 unsigned short ret
= 0;
1359 while (lookup_frec(ret
, crc
));