]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix DNSSEC crash retrying to IPv6 server.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25 static struct randfd *allocate_rfd(int family);
26
27 #ifdef HAVE_DNSSEC
28 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
29 int class, char *name, char *keyname, struct server *server, int *keycount);
30 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
31 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
32 #endif
33
34
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
39 unsigned int iface)
40 {
41 struct msghdr msg;
42 struct iovec iov[1];
43 union {
44 struct cmsghdr align; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47 #elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49 #endif
50 #ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52 #endif
53 } control_u;
54
55 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
58 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
60 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
65
66 if (!nowild)
67 {
68 struct cmsghdr *cmptr;
69 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
71 cmptr = CMSG_FIRSTHDR(&msg);
72
73 if (to->sa.sa_family == AF_INET)
74 {
75 #if defined(HAVE_LINUX_NETWORK)
76 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
80 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
81 cmptr->cmsg_level = IPPROTO_IP;
82 cmptr->cmsg_type = IP_PKTINFO;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
85 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
88 #endif
89 }
90 else
91 #ifdef HAVE_IPV6
92 {
93 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
97 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
98 cmptr->cmsg_type = daemon->v6pktinfo;
99 cmptr->cmsg_level = IPPROTO_IPV6;
100 }
101 #else
102 (void)iface; /* eliminate warning */
103 #endif
104 }
105
106 while (sendmsg(fd, &msg, 0) == -1)
107 {
108 if (retry_send())
109 continue;
110
111 /* If interface is still in DAD, EINVAL results - ignore that. */
112 if (errno == EINVAL)
113 break;
114
115 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
116 return 0;
117 }
118
119 return 1;
120 }
121
122 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
123 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
124
125 {
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
129
130 unsigned int namelen = strlen(qdomain);
131 unsigned int matchlen = 0;
132 struct server *serv;
133 unsigned int flags = 0;
134
135 for (serv = daemon->servers; serv; serv=serv->next)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
138 {
139 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
140 *type = SERV_FOR_NODOTS;
141 if (serv->flags & SERV_NO_ADDR)
142 flags = F_NXDOMAIN;
143 else if (serv->flags & SERV_LITERAL_ADDRESS)
144 {
145 if (sflag & qtype)
146 {
147 flags = sflag;
148 if (serv->addr.sa.sa_family == AF_INET)
149 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
150 #ifdef HAVE_IPV6
151 else
152 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
153 #endif
154 }
155 else if (!flags || (flags & F_NXDOMAIN))
156 flags = F_NOERR;
157 }
158 }
159 else if (serv->flags & SERV_HAS_DOMAIN)
160 {
161 unsigned int domainlen = strlen(serv->domain);
162 char *matchstart = qdomain + namelen - domainlen;
163 if (namelen >= domainlen &&
164 hostname_isequal(matchstart, serv->domain) &&
165 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
166 {
167 if (serv->flags & SERV_NO_REBIND)
168 *norebind = 1;
169 else
170 {
171 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen != 0 && domainlen == matchlen)
176 {
177 if ((serv->flags & SERV_LITERAL_ADDRESS))
178 {
179 if (!(sflag & qtype) && flags == 0)
180 continue;
181 }
182 else
183 {
184 if (flags & (F_IPV4 | F_IPV6))
185 continue;
186 }
187 }
188
189 if (domainlen >= matchlen)
190 {
191 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
192 *domain = serv->domain;
193 matchlen = domainlen;
194 if (serv->flags & SERV_NO_ADDR)
195 flags = F_NXDOMAIN;
196 else if (serv->flags & SERV_LITERAL_ADDRESS)
197 {
198 if (sflag & qtype)
199 {
200 flags = sflag;
201 if (serv->addr.sa.sa_family == AF_INET)
202 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
203 #ifdef HAVE_IPV6
204 else
205 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
206 #endif
207 }
208 else if (!flags || (flags & F_NXDOMAIN))
209 flags = F_NOERR;
210 }
211 else
212 flags = 0;
213 }
214 }
215 }
216 }
217
218 if (flags == 0 && !(qtype & F_QUERY) &&
219 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
221 flags = F_NOERR;
222
223 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
224 flags = F_NOERR;
225
226 if (flags)
227 {
228 int logflags = 0;
229
230 if (flags == F_NXDOMAIN || flags == F_NOERR)
231 logflags = F_NEG | qtype;
232
233 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
234 }
235 else if ((*type) & SERV_USE_RESOLV)
236 {
237 *type = 0; /* use normal servers for this domain */
238 *domain = NULL;
239 }
240 return flags;
241 }
242
243 static int forward_query(int udpfd, union mysockaddr *udpaddr,
244 struct all_addr *dst_addr, unsigned int dst_iface,
245 struct dns_header *header, size_t plen, time_t now,
246 struct frec *forward, int ad_reqd, int do_bit)
247 {
248 char *domain = NULL;
249 int type = 0, norebind = 0;
250 struct all_addr *addrp = NULL;
251 unsigned int flags = 0;
252 struct server *start = NULL;
253 #ifdef HAVE_DNSSEC
254 void *hash = hash_questions(header, plen, daemon->namebuff);
255 #else
256 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
257 void *hash = &crc;
258 #endif
259 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
260
261 (void)do_bit;
262
263 /* may be no servers available. */
264 if (!daemon->servers)
265 forward = NULL;
266 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
267 {
268 #ifdef HAVE_DNSSEC
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward->blocking_query)
272 {
273 int fd;
274
275 while (forward->blocking_query)
276 forward = forward->blocking_query;
277
278 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
279 plen = forward->stash_len;
280
281 if (forward->sentto->addr.sa.sa_family == AF_INET)
282 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
283 #ifdef HAVE_IPV6
284 else
285 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
286 #endif
287
288 if (forward->sentto->sfd)
289 fd = forward->sentto->sfd->fd;
290 else
291 {
292 #ifdef HAVE_IPV6
293 if (forward->sentto->addr.sa.sa_family == AF_INET6)
294 fd = forward->rfd6->fd;
295 else
296 #endif
297 fd = forward->rfd4->fd;
298 }
299
300 while (sendto(fd, (char *)header, plen, 0,
301 &forward->sentto->addr.sa,
302 sa_len(&forward->sentto->addr)) == -1 && retry_send());
303
304 return 1;
305 }
306 #endif
307
308 /* retry on existing query, send to all available servers */
309 domain = forward->sentto->domain;
310 forward->sentto->failed_queries++;
311 if (!option_bool(OPT_ORDER))
312 {
313 forward->forwardall = 1;
314 daemon->last_server = NULL;
315 }
316 type = forward->sentto->flags & SERV_TYPE;
317 if (!(start = forward->sentto->next))
318 start = daemon->servers; /* at end of list, recycle */
319 header->id = htons(forward->new_id);
320 }
321 else
322 {
323 if (gotname)
324 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
325
326 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
327 /* table full - server failure. */
328 flags = F_NEG;
329
330 if (forward)
331 {
332 forward->source = *udpaddr;
333 forward->dest = *dst_addr;
334 forward->iface = dst_iface;
335 forward->orig_id = ntohs(header->id);
336 forward->new_id = get_id();
337 forward->fd = udpfd;
338 memcpy(forward->hash, hash, HASH_SIZE);
339 forward->forwardall = 0;
340 forward->flags = 0;
341 if (norebind)
342 forward->flags |= FREC_NOREBIND;
343 if (header->hb4 & HB4_CD)
344 forward->flags |= FREC_CHECKING_DISABLED;
345 if (ad_reqd)
346 forward->flags |= FREC_AD_QUESTION;
347 #ifdef HAVE_DNSSEC
348 forward->work_counter = DNSSEC_WORK;
349 if (do_bit)
350 forward->flags |= FREC_DO_QUESTION;
351 #endif
352
353 header->id = htons(forward->new_id);
354
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
359
360 if (type == 0)
361 {
362 if (option_bool(OPT_ORDER))
363 start = daemon->servers;
364 else if (!(start = daemon->last_server) ||
365 daemon->forwardcount++ > FORWARD_TEST ||
366 difftime(now, daemon->forwardtime) > FORWARD_TIME)
367 {
368 start = daemon->servers;
369 forward->forwardall = 1;
370 daemon->forwardcount = 0;
371 daemon->forwardtime = now;
372 }
373 }
374 else
375 {
376 start = daemon->servers;
377 if (!option_bool(OPT_ORDER))
378 forward->forwardall = 1;
379 }
380 }
381 }
382
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
386
387 if (!flags && forward)
388 {
389 struct server *firstsentto = start;
390 int forwarded = 0;
391
392 if (option_bool(OPT_ADD_MAC))
393 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
394
395 if (option_bool(OPT_CLIENT_SUBNET))
396 {
397 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
398 if (new != plen)
399 {
400 plen = new;
401 forward->flags |= FREC_HAS_SUBNET;
402 }
403 }
404
405 #ifdef HAVE_DNSSEC
406 if (option_bool(OPT_DNSSEC_VALID))
407 {
408 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
409
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG))
413 header->hb4 |= HB4_CD;
414
415 if (new_plen != plen)
416 forward->flags |= FREC_ADDED_PHEADER;
417
418 plen = new_plen;
419 }
420 #endif
421
422 while (1)
423 {
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
427
428 if (type == (start->flags & SERV_TYPE) &&
429 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
430 !(start->flags & SERV_LITERAL_ADDRESS))
431 {
432 int fd;
433
434 /* find server socket to use, may need to get random one. */
435 if (start->sfd)
436 fd = start->sfd->fd;
437 else
438 {
439 #ifdef HAVE_IPV6
440 if (start->addr.sa.sa_family == AF_INET6)
441 {
442 if (!forward->rfd6 &&
443 !(forward->rfd6 = allocate_rfd(AF_INET6)))
444 break;
445 daemon->rfd_save = forward->rfd6;
446 fd = forward->rfd6->fd;
447 }
448 else
449 #endif
450 {
451 if (!forward->rfd4 &&
452 !(forward->rfd4 = allocate_rfd(AF_INET)))
453 break;
454 daemon->rfd_save = forward->rfd4;
455 fd = forward->rfd4->fd;
456 }
457
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK))
461 {
462 unsigned int mark;
463 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
464 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
465 }
466 #endif
467 }
468
469 if (sendto(fd, (char *)header, plen, 0,
470 &start->addr.sa,
471 sa_len(&start->addr)) == -1)
472 {
473 if (retry_send())
474 continue;
475 }
476 else
477 {
478 /* Keep info in case we want to re-send this packet */
479 daemon->srv_save = start;
480 daemon->packet_len = plen;
481
482 if (!gotname)
483 strcpy(daemon->namebuff, "query");
484 if (start->addr.sa.sa_family == AF_INET)
485 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
486 (struct all_addr *)&start->addr.in.sin_addr, NULL);
487 #ifdef HAVE_IPV6
488 else
489 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
490 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
491 #endif
492 start->queries++;
493 forwarded = 1;
494 forward->sentto = start;
495 if (!forward->forwardall)
496 break;
497 forward->forwardall++;
498 }
499 }
500
501 if (!(start = start->next))
502 start = daemon->servers;
503
504 if (start == firstsentto)
505 break;
506 }
507
508 if (forwarded)
509 return 1;
510
511 /* could not send on, prepare to return */
512 header->id = htons(forward->orig_id);
513 free_frec(forward); /* cancel */
514 }
515
516 /* could not send on, return empty answer or address if known for whole domain */
517 if (udpfd != -1)
518 {
519 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
520 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
521 }
522
523 return 0;
524 }
525
526 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
527 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
528 {
529 unsigned char *pheader, *sizep;
530 char **sets = 0;
531 int munged = 0, is_sign;
532 size_t plen;
533
534 (void)ad_reqd;
535 (void) do_bit;
536
537 #ifdef HAVE_IPSET
538 /* Similar algorithm to search_servers. */
539 struct ipsets *ipset_pos;
540 unsigned int namelen = strlen(daemon->namebuff);
541 unsigned int matchlen = 0;
542 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
543 {
544 unsigned int domainlen = strlen(ipset_pos->domain);
545 char *matchstart = daemon->namebuff + namelen - domainlen;
546 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
547 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
548 domainlen >= matchlen)
549 {
550 matchlen = domainlen;
551 sets = ipset_pos->sets;
552 }
553 }
554 #endif
555
556 /* If upstream is advertising a larger UDP packet size
557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
559
560 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
561 {
562 unsigned short udpsz;
563 unsigned char *psave = sizep;
564
565 GETSHORT(udpsz, sizep);
566
567 if (!is_sign && udpsz > daemon->edns_pktsz)
568 PUTSHORT(daemon->edns_pktsz, psave);
569
570 if (check_subnet && !check_source(header, plen, pheader, query_source))
571 {
572 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
573 return 0;
574 }
575
576 if (added_pheader)
577 {
578 pheader = 0;
579 header->arcount = htons(0);
580 }
581 }
582
583 /* RFC 4035 sect 4.6 para 3 */
584 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
585 header->hb4 &= ~HB4_AD;
586
587 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
588 return n;
589
590 /* Complain loudly if the upstream server is non-recursive. */
591 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
592 server && !(server->flags & SERV_WARNED_RECURSIVE))
593 {
594 prettyprint_addr(&server->addr, daemon->namebuff);
595 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
596 if (!option_bool(OPT_LOG))
597 server->flags |= SERV_WARNED_RECURSIVE;
598 }
599
600 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
601 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
602 {
603 munged = 1;
604 SET_RCODE(header, NXDOMAIN);
605 header->hb3 &= ~HB3_AA;
606 cache_secure = 0;
607 }
608 else
609 {
610 int doctored = 0;
611
612 if (RCODE(header) == NXDOMAIN &&
613 extract_request(header, n, daemon->namebuff, NULL) &&
614 check_for_local_domain(daemon->namebuff, now))
615 {
616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
619 munged = 1;
620 header->hb3 |= HB3_AA;
621 SET_RCODE(header, NOERROR);
622 cache_secure = 0;
623 }
624
625 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
626 {
627 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
628 munged = 1;
629 cache_secure = 0;
630 }
631
632 if (doctored)
633 cache_secure = 0;
634 }
635
636 #ifdef HAVE_DNSSEC
637 if (no_cache && !(header->hb4 & HB4_CD))
638 {
639 if (!option_bool(OPT_DNSSEC_DEBUG))
640 {
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header, SERVFAIL);
643 munged = 1;
644 }
645 }
646
647 if (option_bool(OPT_DNSSEC_VALID))
648 header->hb4 &= ~HB4_AD;
649
650 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
651 header->hb4 |= HB4_AD;
652
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
654 if (!do_bit)
655 n = filter_rrsigs(header, n);
656 #endif
657
658 /* do this after extract_addresses. Ensure NODATA reply and remove
659 nameserver info. */
660
661 if (munged)
662 {
663 header->ancount = htons(0);
664 header->nscount = htons(0);
665 header->arcount = htons(0);
666 }
667
668 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
669 sections of the packet. Find the new length here and put back pseudoheader
670 if it was removed. */
671 return resize_packet(header, n, pheader, plen);
672 }
673
674 /* sets new last_server */
675 void reply_query(int fd, int family, time_t now)
676 {
677 /* packet from peer server, extract data for cache, and send to
678 original requester */
679 struct dns_header *header;
680 union mysockaddr serveraddr;
681 struct frec *forward;
682 socklen_t addrlen = sizeof(serveraddr);
683 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
684 size_t nn;
685 struct server *server;
686 void *hash;
687 #ifndef HAVE_DNSSEC
688 unsigned int crc;
689 #endif
690
691 /* packet buffer overwritten */
692 daemon->srv_save = NULL;
693
694 /* Determine the address of the server replying so that we can mark that as good */
695 serveraddr.sa.sa_family = family;
696 #ifdef HAVE_IPV6
697 if (serveraddr.sa.sa_family == AF_INET6)
698 serveraddr.in6.sin6_flowinfo = 0;
699 #endif
700
701 /* spoof check: answer must come from known server, */
702 for (server = daemon->servers; server; server = server->next)
703 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
704 sockaddr_isequal(&server->addr, &serveraddr))
705 break;
706
707 header = (struct dns_header *)daemon->packet;
708
709 #ifdef HAVE_DNSSEC
710 hash = hash_questions(header, n, daemon->namebuff);
711 #else
712 hash = &crc;
713 crc = questions_crc(header, n, daemon->namebuff);
714 #endif
715
716 if (!server ||
717 n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR) ||
718 !(forward = lookup_frec(ntohs(header->id), hash)))
719 return;
720
721 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
722 !option_bool(OPT_ORDER) &&
723 forward->forwardall == 0)
724 /* for broken servers, attempt to send to another one. */
725 {
726 unsigned char *pheader;
727 size_t plen;
728 int is_sign;
729
730 /* recreate query from reply */
731 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
732 if (!is_sign)
733 {
734 header->ancount = htons(0);
735 header->nscount = htons(0);
736 header->arcount = htons(0);
737 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
738 {
739 header->hb3 &= ~(HB3_QR | HB3_TC);
740 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
741 return;
742 }
743 }
744 }
745
746 server = forward->sentto;
747
748 if ((forward->sentto->flags & SERV_TYPE) == 0)
749 {
750 if (RCODE(header) == SERVFAIL || RCODE(header) == REFUSED)
751 server = NULL;
752 else
753 {
754 struct server *last_server;
755
756 /* find good server by address if possible, otherwise assume the last one we sent to */
757 for (last_server = daemon->servers; last_server; last_server = last_server->next)
758 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
759 sockaddr_isequal(&last_server->addr, &serveraddr))
760 {
761 server = last_server;
762 break;
763 }
764 }
765 if (!option_bool(OPT_ALL_SERVERS))
766 daemon->last_server = server;
767 }
768
769 /* If the answer is an error, keep the forward record in place in case
770 we get a good reply from another server. Kill it when we've
771 had replies from all to avoid filling the forwarding table when
772 everything is broken */
773 if (forward->forwardall == 0 || --forward->forwardall == 1 ||
774 (RCODE(header) != REFUSED && RCODE(header) != SERVFAIL))
775 {
776 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
777
778 if (option_bool(OPT_NO_REBIND))
779 check_rebind = !(forward->flags & FREC_NOREBIND);
780
781 /* Don't cache replies where DNSSEC validation was turned off, either
782 the upstream server told us so, or the original query specified it. */
783 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
784 no_cache_dnssec = 1;
785
786 #ifdef HAVE_DNSSEC
787 if (option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
788 {
789 int status;
790
791 /* We've had a reply already, which we're validating. Ignore this duplicate */
792 if (forward->blocking_query)
793 return;
794
795 if (header->hb3 & HB3_TC)
796 {
797 /* Truncated answer can't be validated.
798 If this is an answer to a DNSSEC-generated query, we still
799 need to get the client to retry over TCP, so return
800 an answer with the TC bit set, even if the actual answer fits.
801 */
802 status = STAT_TRUNCATED;
803 }
804 else if (forward->flags & FREC_DNSKEY_QUERY)
805 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
806 else if (forward->flags & FREC_DS_QUERY)
807 {
808 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
809 if (status == STAT_NO_DS)
810 status = STAT_INSECURE;
811 }
812 else if (forward->flags & FREC_CHECK_NOSIGN)
813 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
814 else
815 {
816 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
817 if (status == STAT_NO_SIG)
818 {
819 if (option_bool(OPT_DNSSEC_NO_SIGN))
820 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
821 else
822 status = STAT_INSECURE;
823 }
824 }
825 /* Can't validate, as we're missing key data. Put this
826 answer aside, whilst we get that. */
827 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
828 {
829 struct frec *new, *orig;
830
831 /* Free any saved query */
832 if (forward->stash)
833 blockdata_free(forward->stash);
834
835 /* Now save reply pending receipt of key data */
836 if (!(forward->stash = blockdata_alloc((char *)header, n)))
837 return;
838 forward->stash_len = n;
839
840 anotherkey:
841 /* Find the original query that started it all.... */
842 for (orig = forward; orig->dependent; orig = orig->dependent);
843
844 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
845 status = STAT_INSECURE;
846 else
847 {
848 int fd;
849 struct frec *next = new->next;
850 *new = *forward; /* copy everything, then overwrite */
851 new->next = next;
852 new->blocking_query = NULL;
853 new->rfd4 = NULL;
854 #ifdef HAVE_IPV6
855 new->rfd6 = NULL;
856 #endif
857 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
858
859 new->dependent = forward; /* to find query awaiting new one. */
860 forward->blocking_query = new; /* for garbage cleaning */
861 /* validate routines leave name of required record in daemon->keyname */
862 if (status == STAT_NEED_KEY)
863 {
864 new->flags |= FREC_DNSKEY_QUERY;
865 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
866 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
867 }
868 else
869 {
870 if (status == STAT_NEED_DS_NEG)
871 new->flags |= FREC_CHECK_NOSIGN;
872 else
873 new->flags |= FREC_DS_QUERY;
874 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
875 daemon->keyname, forward->class, T_DS, &server->addr);
876 }
877 if ((hash = hash_questions(header, nn, daemon->namebuff)))
878 memcpy(new->hash, hash, HASH_SIZE);
879 new->new_id = get_id();
880 header->id = htons(new->new_id);
881 /* Save query for retransmission */
882 new->stash = blockdata_alloc((char *)header, nn);
883 new->stash_len = nn;
884
885 /* Don't resend this. */
886 daemon->srv_save = NULL;
887
888 if (server->sfd)
889 fd = server->sfd->fd;
890 else
891 {
892 fd = -1;
893 #ifdef HAVE_IPV6
894 if (server->addr.sa.sa_family == AF_INET6)
895 {
896 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
897 fd = new->rfd6->fd;
898 }
899 else
900 #endif
901 {
902 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
903 fd = new->rfd4->fd;
904 }
905 }
906
907 if (fd != -1)
908 {
909 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
910 server->queries++;
911 }
912
913 return;
914 }
915 }
916
917 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
918 Now wind back down, pulling back answers which wouldn't previously validate
919 and validate them with the new data. Note that if an answer needs multiple
920 keys to validate, we may find another key is needed, in which case we set off
921 down another branch of the tree. Once we get to the original answer
922 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
923 while (forward->dependent)
924 {
925 struct frec *prev = forward->dependent;
926 free_frec(forward);
927 forward = prev;
928 forward->blocking_query = NULL; /* already gone */
929 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
930 n = forward->stash_len;
931
932 if (status == STAT_SECURE)
933 {
934 if (forward->flags & FREC_DNSKEY_QUERY)
935 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
936 else if (forward->flags & FREC_DS_QUERY)
937 {
938 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
939 if (status == STAT_NO_DS)
940 status = STAT_INSECURE;
941 }
942 else if (forward->flags & FREC_CHECK_NOSIGN)
943 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
944 else
945 {
946 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
947 if (status == STAT_NO_SIG)
948 {
949 if (option_bool(OPT_DNSSEC_NO_SIGN))
950 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
951 else
952 status = STAT_INSECURE;
953 }
954 }
955
956 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
957 goto anotherkey;
958 }
959 }
960
961 if (status == STAT_TRUNCATED)
962 header->hb3 |= HB3_TC;
963 else
964 {
965 char *result;
966
967 if (forward->work_counter == 0)
968 result = "ABANDONED";
969 else
970 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
971
972 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
973 }
974
975 no_cache_dnssec = 0;
976
977 if (status == STAT_SECURE)
978 cache_secure = 1;
979 else if (status == STAT_BOGUS)
980 no_cache_dnssec = 1;
981 }
982 #endif
983
984 /* restore CD bit to the value in the query */
985 if (forward->flags & FREC_CHECKING_DISABLED)
986 header->hb4 |= HB4_CD;
987 else
988 header->hb4 &= ~HB4_CD;
989
990 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
991 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
992 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
993 {
994 header->id = htons(forward->orig_id);
995 header->hb4 |= HB4_RA; /* recursion if available */
996 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
997 &forward->source, &forward->dest, forward->iface);
998 }
999 free_frec(forward); /* cancel */
1000 }
1001 }
1002
1003
1004 void receive_query(struct listener *listen, time_t now)
1005 {
1006 struct dns_header *header = (struct dns_header *)daemon->packet;
1007 union mysockaddr source_addr;
1008 unsigned short type;
1009 struct all_addr dst_addr;
1010 struct in_addr netmask, dst_addr_4;
1011 size_t m;
1012 ssize_t n;
1013 int if_index = 0, auth_dns = 0;
1014 #ifdef HAVE_AUTH
1015 int local_auth = 0;
1016 #endif
1017 struct iovec iov[1];
1018 struct msghdr msg;
1019 struct cmsghdr *cmptr;
1020 union {
1021 struct cmsghdr align; /* this ensures alignment */
1022 #ifdef HAVE_IPV6
1023 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1024 #endif
1025 #if defined(HAVE_LINUX_NETWORK)
1026 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1027 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1028 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1029 CMSG_SPACE(sizeof(unsigned int))];
1030 #elif defined(IP_RECVDSTADDR)
1031 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1032 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1033 #endif
1034 } control_u;
1035 #ifdef HAVE_IPV6
1036 /* Can always get recvd interface for IPv6 */
1037 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1038 #else
1039 int check_dst = !option_bool(OPT_NOWILD);
1040 #endif
1041
1042 /* packet buffer overwritten */
1043 daemon->srv_save = NULL;
1044
1045 dst_addr_4.s_addr = 0;
1046 netmask.s_addr = 0;
1047
1048 if (option_bool(OPT_NOWILD) && listen->iface)
1049 {
1050 auth_dns = listen->iface->dns_auth;
1051
1052 if (listen->family == AF_INET)
1053 {
1054 dst_addr_4 = listen->iface->addr.in.sin_addr;
1055 netmask = listen->iface->netmask;
1056 }
1057 }
1058
1059 iov[0].iov_base = daemon->packet;
1060 iov[0].iov_len = daemon->edns_pktsz;
1061
1062 msg.msg_control = control_u.control;
1063 msg.msg_controllen = sizeof(control_u);
1064 msg.msg_flags = 0;
1065 msg.msg_name = &source_addr;
1066 msg.msg_namelen = sizeof(source_addr);
1067 msg.msg_iov = iov;
1068 msg.msg_iovlen = 1;
1069
1070 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1071 return;
1072
1073 if (n < (int)sizeof(struct dns_header) ||
1074 (msg.msg_flags & MSG_TRUNC) ||
1075 (header->hb3 & HB3_QR))
1076 return;
1077
1078 source_addr.sa.sa_family = listen->family;
1079 #ifdef HAVE_IPV6
1080 if (listen->family == AF_INET6)
1081 source_addr.in6.sin6_flowinfo = 0;
1082 #endif
1083
1084 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1085 if (option_bool(OPT_LOCAL_SERVICE))
1086 {
1087 struct addrlist *addr;
1088 #ifdef HAVE_IPV6
1089 if (listen->family == AF_INET6)
1090 {
1091 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1092 if ((addr->flags & ADDRLIST_IPV6) &&
1093 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1094 break;
1095 }
1096 else
1097 #endif
1098 {
1099 struct in_addr netmask;
1100 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1101 {
1102 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1103 if (!(addr->flags & ADDRLIST_IPV6) &&
1104 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1105 break;
1106 }
1107 }
1108 if (!addr)
1109 {
1110 static int warned = 0;
1111 if (!warned)
1112 {
1113 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1114 warned = 1;
1115 }
1116 return;
1117 }
1118 }
1119
1120 if (check_dst)
1121 {
1122 struct ifreq ifr;
1123
1124 if (msg.msg_controllen < sizeof(struct cmsghdr))
1125 return;
1126
1127 #if defined(HAVE_LINUX_NETWORK)
1128 if (listen->family == AF_INET)
1129 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1130 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1131 {
1132 union {
1133 unsigned char *c;
1134 struct in_pktinfo *p;
1135 } p;
1136 p.c = CMSG_DATA(cmptr);
1137 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1138 if_index = p.p->ipi_ifindex;
1139 }
1140 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1141 if (listen->family == AF_INET)
1142 {
1143 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1144 {
1145 union {
1146 unsigned char *c;
1147 unsigned int *i;
1148 struct in_addr *a;
1149 #ifndef HAVE_SOLARIS_NETWORK
1150 struct sockaddr_dl *s;
1151 #endif
1152 } p;
1153 p.c = CMSG_DATA(cmptr);
1154 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1155 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1156 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1157 #ifdef HAVE_SOLARIS_NETWORK
1158 if_index = *(p.i);
1159 #else
1160 if_index = p.s->sdl_index;
1161 #endif
1162 }
1163 }
1164 #endif
1165
1166 #ifdef HAVE_IPV6
1167 if (listen->family == AF_INET6)
1168 {
1169 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1170 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1171 {
1172 union {
1173 unsigned char *c;
1174 struct in6_pktinfo *p;
1175 } p;
1176 p.c = CMSG_DATA(cmptr);
1177
1178 dst_addr.addr.addr6 = p.p->ipi6_addr;
1179 if_index = p.p->ipi6_ifindex;
1180 }
1181 }
1182 #endif
1183
1184 /* enforce available interface configuration */
1185
1186 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1187 return;
1188
1189 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1190 {
1191 if (!option_bool(OPT_CLEVERBIND))
1192 enumerate_interfaces(0);
1193 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1194 !label_exception(if_index, listen->family, &dst_addr))
1195 return;
1196 }
1197
1198 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1199 {
1200 struct irec *iface;
1201
1202 /* get the netmask of the interface whch has the address we were sent to.
1203 This is no neccessarily the interface we arrived on. */
1204
1205 for (iface = daemon->interfaces; iface; iface = iface->next)
1206 if (iface->addr.sa.sa_family == AF_INET &&
1207 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1208 break;
1209
1210 /* interface may be new */
1211 if (!iface && !option_bool(OPT_CLEVERBIND))
1212 enumerate_interfaces(0);
1213
1214 for (iface = daemon->interfaces; iface; iface = iface->next)
1215 if (iface->addr.sa.sa_family == AF_INET &&
1216 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1217 break;
1218
1219 /* If we failed, abandon localisation */
1220 if (iface)
1221 netmask = iface->netmask;
1222 else
1223 dst_addr_4.s_addr = 0;
1224 }
1225 }
1226
1227 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1228 {
1229 #ifdef HAVE_AUTH
1230 struct auth_zone *zone;
1231 #endif
1232 char *types = querystr(auth_dns ? "auth" : "query", type);
1233
1234 if (listen->family == AF_INET)
1235 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1236 (struct all_addr *)&source_addr.in.sin_addr, types);
1237 #ifdef HAVE_IPV6
1238 else
1239 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1240 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1241 #endif
1242
1243 #ifdef HAVE_AUTH
1244 /* find queries for zones we're authoritative for, and answer them directly */
1245 if (!auth_dns)
1246 for (zone = daemon->auth_zones; zone; zone = zone->next)
1247 if (in_zone(zone, daemon->namebuff, NULL))
1248 {
1249 auth_dns = 1;
1250 local_auth = 1;
1251 break;
1252 }
1253 #endif
1254 }
1255
1256 #ifdef HAVE_AUTH
1257 if (auth_dns)
1258 {
1259 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1260 if (m >= 1)
1261 {
1262 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1263 (char *)header, m, &source_addr, &dst_addr, if_index);
1264 daemon->auth_answer++;
1265 }
1266 }
1267 else
1268 #endif
1269 {
1270 int ad_reqd, do_bit;
1271 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1272 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1273
1274 if (m >= 1)
1275 {
1276 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1277 (char *)header, m, &source_addr, &dst_addr, if_index);
1278 daemon->local_answer++;
1279 }
1280 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1281 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1282 daemon->queries_forwarded++;
1283 else
1284 daemon->local_answer++;
1285 }
1286 }
1287
1288 #ifdef HAVE_DNSSEC
1289
1290 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1291 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1292 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1293 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
1294 {
1295 struct crec *crecp;
1296 char *name_start = name;
1297 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1298
1299 if (status != STAT_INSECURE)
1300 return status;
1301
1302 while (1)
1303 {
1304 crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1305
1306 if (crecp && (crecp->flags & F_DNSSECOK))
1307 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1308
1309 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1310 {
1311 name_start++; /* chop a label off and try again */
1312 continue;
1313 }
1314
1315 strcpy(keyname, name_start);
1316 return STAT_NEED_DS_NEG;
1317 }
1318 }
1319
1320 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1321 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
1322
1323 {
1324 char *name_start;
1325 unsigned char *p;
1326 int status = dnssec_validate_ds(now, header, plen, name, keyname, class);
1327
1328 if (status != STAT_INSECURE)
1329 {
1330 if (status == STAT_NO_DS)
1331 status = STAT_INSECURE;
1332 return status;
1333 }
1334
1335 p = (unsigned char *)(header+1);
1336
1337 if (extract_name(header, plen, &p, name, 1, 4) &&
1338 (name_start = strchr(name, '.')))
1339 {
1340 name_start++; /* chop a label off and try again */
1341 strcpy(keyname, name_start);
1342 return STAT_NEED_DS_NEG;
1343 }
1344
1345 return STAT_BOGUS;
1346 }
1347
1348 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1349 an unsigned answer is OK, or we find a signed DS, in which case there should be
1350 a signature, and the answer is BOGUS */
1351 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1352 char *keyname, struct server *server, int *keycount)
1353 {
1354 size_t m;
1355 unsigned char *packet, *payload;
1356 u16 *length;
1357 unsigned char *p = (unsigned char *)(header+1);
1358 int status;
1359 char *name_start = name;
1360
1361 /* Get first insecure entry in CNAME chain */
1362 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1363 if (status == STAT_BOGUS)
1364 return STAT_BOGUS;
1365
1366 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1367 return STAT_BOGUS;
1368
1369 payload = &packet[2];
1370 header = (struct dns_header *)payload;
1371 length = (u16 *)packet;
1372
1373 while (1)
1374 {
1375 unsigned char *newhash, hash[HASH_SIZE];
1376 unsigned char c1, c2;
1377 struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1378
1379 if (--(*keycount) == 0)
1380 return STAT_BOGUS;
1381
1382 if (crecp && (crecp->flags & F_DNSSECOK))
1383 {
1384 free(packet);
1385 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1386 }
1387
1388 /* If we have cached insecurely that a DS doesn't exist,
1389 ise that is a hit for where to start looking for the secure one */
1390 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1391 {
1392 name_start++; /* chop a label off and try again */
1393 continue;
1394 }
1395
1396 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1397
1398 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1399 if ((newhash = hash_questions(header, (unsigned int)m, name)))
1400 memcpy(hash, newhash, HASH_SIZE);
1401
1402 *length = htons(m);
1403
1404 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1405 read_write(server->tcpfd, &c1, 1, 1) &&
1406 read_write(server->tcpfd, &c2, 1, 1) &&
1407 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1408 {
1409 m = (c1 << 8) | c2;
1410
1411 newhash = hash_questions(header, (unsigned int)m, name);
1412 if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
1413 {
1414 /* Note this trashes all three name workspaces */
1415 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1416
1417 /* We've found a DS which proves the bit of the DNS where the
1418 original query is, is unsigned, so the answer is OK,
1419 if unvalidated. */
1420 if (status == STAT_NO_DS)
1421 {
1422 free(packet);
1423 return STAT_INSECURE;
1424 }
1425
1426 /* No DS, not got to DNSSEC-land yet, go up. */
1427 if (status == STAT_INSECURE)
1428 {
1429 p = (unsigned char *)(header+1);
1430
1431 if (extract_name(header, plen, &p, name, 1, 4) &&
1432 (name_start = strchr(name, '.')))
1433 {
1434 name_start++; /* chop a label off and try again */
1435 continue;
1436 }
1437 }
1438 }
1439 }
1440
1441 free(packet);
1442
1443 return STAT_BOGUS;
1444 }
1445 }
1446
1447 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1448 int class, char *name, char *keyname, struct server *server, int *keycount)
1449 {
1450 /* Recurse up the key heirarchy */
1451 int new_status;
1452
1453 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1454 if (--(*keycount) == 0)
1455 return STAT_INSECURE;
1456
1457 if (status == STAT_NEED_KEY)
1458 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1459 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1460 {
1461 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1462 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1463 new_status = STAT_INSECURE;
1464 }
1465 else if (status == STAT_CHASE_CNAME)
1466 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1467 else
1468 {
1469 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1470
1471 if (new_status == STAT_NO_SIG)
1472 {
1473 if (option_bool(OPT_DNSSEC_NO_SIGN))
1474 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1475 else
1476 new_status = STAT_INSECURE;
1477 }
1478 }
1479
1480 /* Can't validate because we need a key/DS whose name now in keyname.
1481 Make query for same, and recurse to validate */
1482 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1483 {
1484 size_t m;
1485 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1486 unsigned char *payload = &packet[2];
1487 struct dns_header *new_header = (struct dns_header *)payload;
1488 u16 *length = (u16 *)packet;
1489 unsigned char c1, c2;
1490
1491 if (!packet)
1492 return STAT_INSECURE;
1493
1494 another_tcp_key:
1495 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1496 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1497
1498 *length = htons(m);
1499
1500 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1501 !read_write(server->tcpfd, &c1, 1, 1) ||
1502 !read_write(server->tcpfd, &c2, 1, 1) ||
1503 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1504 new_status = STAT_INSECURE;
1505 else
1506 {
1507 m = (c1 << 8) | c2;
1508
1509 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1510
1511 if (new_status == STAT_SECURE)
1512 {
1513 /* Reached a validated record, now try again at this level.
1514 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1515 If so, go round again. */
1516
1517 if (status == STAT_NEED_KEY)
1518 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1519 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1520 {
1521 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1522 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1523 new_status = STAT_INSECURE; /* Validated no DS */
1524 }
1525 else if (status == STAT_CHASE_CNAME)
1526 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1527 else
1528 {
1529 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1530
1531 if (new_status == STAT_NO_SIG)
1532 {
1533 if (option_bool(OPT_DNSSEC_NO_SIGN))
1534 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1535 else
1536 new_status = STAT_INSECURE;
1537 }
1538 }
1539
1540 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1541 goto another_tcp_key;
1542 }
1543 }
1544
1545 free(packet);
1546 }
1547 return new_status;
1548 }
1549 #endif
1550
1551
1552 /* The daemon forks before calling this: it should deal with one connection,
1553 blocking as neccessary, and then return. Note, need to be a bit careful
1554 about resources for debug mode, when the fork is suppressed: that's
1555 done by the caller. */
1556 unsigned char *tcp_request(int confd, time_t now,
1557 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1558 {
1559 size_t size = 0;
1560 int norebind = 0;
1561 #ifdef HAVE_AUTH
1562 int local_auth = 0;
1563 #endif
1564 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1565 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
1566 size_t m;
1567 unsigned short qtype;
1568 unsigned int gotname;
1569 unsigned char c1, c2;
1570 /* Max TCP packet + slop + size */
1571 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1572 unsigned char *payload = &packet[2];
1573 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1574 struct dns_header *header = (struct dns_header *)payload;
1575 u16 *length = (u16 *)packet;
1576 struct server *last_server;
1577 struct in_addr dst_addr_4;
1578 union mysockaddr peer_addr;
1579 socklen_t peer_len = sizeof(union mysockaddr);
1580
1581 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1582 return packet;
1583
1584 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1585 if (option_bool(OPT_LOCAL_SERVICE))
1586 {
1587 struct addrlist *addr;
1588 #ifdef HAVE_IPV6
1589 if (peer_addr.sa.sa_family == AF_INET6)
1590 {
1591 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1592 if ((addr->flags & ADDRLIST_IPV6) &&
1593 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1594 break;
1595 }
1596 else
1597 #endif
1598 {
1599 struct in_addr netmask;
1600 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1601 {
1602 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1603 if (!(addr->flags & ADDRLIST_IPV6) &&
1604 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1605 break;
1606 }
1607 }
1608 if (!addr)
1609 {
1610 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1611 return packet;
1612 }
1613 }
1614
1615 while (1)
1616 {
1617 if (!packet ||
1618 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1619 !(size = c1 << 8 | c2) ||
1620 !read_write(confd, payload, size, 1))
1621 return packet;
1622
1623 if (size < (int)sizeof(struct dns_header))
1624 continue;
1625
1626 check_subnet = 0;
1627
1628 /* save state of "cd" flag in query */
1629 if ((checking_disabled = header->hb4 & HB4_CD))
1630 no_cache_dnssec = 1;
1631
1632 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1633 {
1634 #ifdef HAVE_AUTH
1635 struct auth_zone *zone;
1636 #endif
1637 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1638
1639 if (peer_addr.sa.sa_family == AF_INET)
1640 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1641 (struct all_addr *)&peer_addr.in.sin_addr, types);
1642 #ifdef HAVE_IPV6
1643 else
1644 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1645 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1646 #endif
1647
1648 #ifdef HAVE_AUTH
1649 /* find queries for zones we're authoritative for, and answer them directly */
1650 if (!auth_dns)
1651 for (zone = daemon->auth_zones; zone; zone = zone->next)
1652 if (in_zone(zone, daemon->namebuff, NULL))
1653 {
1654 auth_dns = 1;
1655 local_auth = 1;
1656 break;
1657 }
1658 #endif
1659 }
1660
1661 if (local_addr->sa.sa_family == AF_INET)
1662 dst_addr_4 = local_addr->in.sin_addr;
1663 else
1664 dst_addr_4.s_addr = 0;
1665
1666 #ifdef HAVE_AUTH
1667 if (auth_dns)
1668 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1669 else
1670 #endif
1671 {
1672 /* m > 0 if answered from cache */
1673 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1674 dst_addr_4, netmask, now, &ad_question, &do_bit);
1675
1676 /* Do this by steam now we're not in the select() loop */
1677 check_log_writer(NULL);
1678
1679 if (m == 0)
1680 {
1681 unsigned int flags = 0;
1682 struct all_addr *addrp = NULL;
1683 int type = 0;
1684 char *domain = NULL;
1685
1686 if (option_bool(OPT_ADD_MAC))
1687 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1688
1689 if (option_bool(OPT_CLIENT_SUBNET))
1690 {
1691 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1692 if (size != new)
1693 {
1694 size = new;
1695 check_subnet = 1;
1696 }
1697 }
1698
1699 if (gotname)
1700 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1701
1702 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1703 last_server = daemon->servers;
1704 else
1705 last_server = daemon->last_server;
1706
1707 if (!flags && last_server)
1708 {
1709 struct server *firstsendto = NULL;
1710 #ifdef HAVE_DNSSEC
1711 unsigned char *newhash, hash[HASH_SIZE];
1712 if ((newhash = hash_questions(header, (unsigned int)size, daemon->keyname)))
1713 memcpy(hash, newhash, HASH_SIZE);
1714 #else
1715 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1716 #endif
1717 /* Loop round available servers until we succeed in connecting to one.
1718 Note that this code subtley ensures that consecutive queries on this connection
1719 which can go to the same server, do so. */
1720 while (1)
1721 {
1722 if (!firstsendto)
1723 firstsendto = last_server;
1724 else
1725 {
1726 if (!(last_server = last_server->next))
1727 last_server = daemon->servers;
1728
1729 if (last_server == firstsendto)
1730 break;
1731 }
1732
1733 /* server for wrong domain */
1734 if (type != (last_server->flags & SERV_TYPE) ||
1735 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)))
1736 continue;
1737
1738 if (last_server->tcpfd == -1)
1739 {
1740 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1741 continue;
1742
1743 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1744 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1745 {
1746 close(last_server->tcpfd);
1747 last_server->tcpfd = -1;
1748 continue;
1749 }
1750
1751 #ifdef HAVE_DNSSEC
1752 if (option_bool(OPT_DNSSEC_VALID))
1753 {
1754 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1755
1756 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1757 this allows it to select auth servers when one is returning bad data. */
1758 if (option_bool(OPT_DNSSEC_DEBUG))
1759 header->hb4 |= HB4_CD;
1760
1761 if (size != new_size)
1762 added_pheader = 1;
1763
1764 size = new_size;
1765 }
1766 #endif
1767
1768 #ifdef HAVE_CONNTRACK
1769 /* Copy connection mark of incoming query to outgoing connection. */
1770 if (option_bool(OPT_CONNTRACK))
1771 {
1772 unsigned int mark;
1773 struct all_addr local;
1774 #ifdef HAVE_IPV6
1775 if (local_addr->sa.sa_family == AF_INET6)
1776 local.addr.addr6 = local_addr->in6.sin6_addr;
1777 else
1778 #endif
1779 local.addr.addr4 = local_addr->in.sin_addr;
1780
1781 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1782 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1783 }
1784 #endif
1785 }
1786
1787 *length = htons(size);
1788
1789 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1790 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1791 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1792 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1793 {
1794 close(last_server->tcpfd);
1795 last_server->tcpfd = -1;
1796 continue;
1797 }
1798
1799 m = (c1 << 8) | c2;
1800
1801 if (!gotname)
1802 strcpy(daemon->namebuff, "query");
1803 if (last_server->addr.sa.sa_family == AF_INET)
1804 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1805 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1806 #ifdef HAVE_IPV6
1807 else
1808 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1809 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1810 #endif
1811
1812 #ifdef HAVE_DNSSEC
1813 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1814 {
1815 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1816 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1817 char *result;
1818
1819 if (keycount == 0)
1820 result = "ABANDONED";
1821 else
1822 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1823
1824 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1825
1826 if (status == STAT_BOGUS)
1827 no_cache_dnssec = 1;
1828
1829 if (status == STAT_SECURE)
1830 cache_secure = 1;
1831 }
1832 #endif
1833
1834 /* restore CD bit to the value in the query */
1835 if (checking_disabled)
1836 header->hb4 |= HB4_CD;
1837 else
1838 header->hb4 &= ~HB4_CD;
1839
1840 /* There's no point in updating the cache, since this process will exit and
1841 lose the information after a few queries. We make this call for the alias and
1842 bogus-nxdomain side-effects. */
1843 /* If the crc of the question section doesn't match the crc we sent, then
1844 someone might be attempting to insert bogus values into the cache by
1845 sending replies containing questions and bogus answers. */
1846 #ifdef HAVE_DNSSEC
1847 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1848 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
1849 {
1850 m = 0;
1851 break;
1852 }
1853 #else
1854 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
1855 {
1856 m = 0;
1857 break;
1858 }
1859 #endif
1860
1861 m = process_reply(header, now, last_server, (unsigned int)m,
1862 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
1863 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
1864
1865 break;
1866 }
1867 }
1868
1869 /* In case of local answer or no connections made. */
1870 if (m == 0)
1871 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
1872 }
1873 }
1874
1875 check_log_writer(NULL);
1876
1877 *length = htons(m);
1878
1879 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
1880 return packet;
1881 }
1882 }
1883
1884 static struct frec *allocate_frec(time_t now)
1885 {
1886 struct frec *f;
1887
1888 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
1889 {
1890 f->next = daemon->frec_list;
1891 f->time = now;
1892 f->sentto = NULL;
1893 f->rfd4 = NULL;
1894 f->flags = 0;
1895 #ifdef HAVE_IPV6
1896 f->rfd6 = NULL;
1897 #endif
1898 #ifdef HAVE_DNSSEC
1899 f->dependent = NULL;
1900 f->blocking_query = NULL;
1901 f->stash = NULL;
1902 #endif
1903 daemon->frec_list = f;
1904 }
1905
1906 return f;
1907 }
1908
1909 static struct randfd *allocate_rfd(int family)
1910 {
1911 static int finger = 0;
1912 int i;
1913
1914 /* limit the number of sockets we have open to avoid starvation of
1915 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1916
1917 for (i = 0; i < RANDOM_SOCKS; i++)
1918 if (daemon->randomsocks[i].refcount == 0)
1919 {
1920 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
1921 break;
1922
1923 daemon->randomsocks[i].refcount = 1;
1924 daemon->randomsocks[i].family = family;
1925 return &daemon->randomsocks[i];
1926 }
1927
1928 /* No free ones or cannot get new socket, grab an existing one */
1929 for (i = 0; i < RANDOM_SOCKS; i++)
1930 {
1931 int j = (i+finger) % RANDOM_SOCKS;
1932 if (daemon->randomsocks[j].refcount != 0 &&
1933 daemon->randomsocks[j].family == family &&
1934 daemon->randomsocks[j].refcount != 0xffff)
1935 {
1936 finger = j;
1937 daemon->randomsocks[j].refcount++;
1938 return &daemon->randomsocks[j];
1939 }
1940 }
1941
1942 return NULL; /* doom */
1943 }
1944 static void free_frec(struct frec *f)
1945 {
1946 if (f->rfd4 && --(f->rfd4->refcount) == 0)
1947 close(f->rfd4->fd);
1948
1949 f->rfd4 = NULL;
1950 f->sentto = NULL;
1951 f->flags = 0;
1952
1953 #ifdef HAVE_IPV6
1954 if (f->rfd6 && --(f->rfd6->refcount) == 0)
1955 close(f->rfd6->fd);
1956
1957 f->rfd6 = NULL;
1958 #endif
1959
1960 #ifdef HAVE_DNSSEC
1961 if (f->stash)
1962 {
1963 blockdata_free(f->stash);
1964 f->stash = NULL;
1965 }
1966
1967 /* Anything we're waiting on is pointless now, too */
1968 if (f->blocking_query)
1969 free_frec(f->blocking_query);
1970 f->blocking_query = NULL;
1971 f->dependent = NULL;
1972 #endif
1973 }
1974
1975 /* if wait==NULL return a free or older than TIMEOUT record.
1976 else return *wait zero if one available, or *wait is delay to
1977 when the oldest in-use record will expire. Impose an absolute
1978 limit of 4*TIMEOUT before we wipe things (for random sockets).
1979 If force is set, always return a result, even if we have
1980 to allocate above the limit. */
1981 struct frec *get_new_frec(time_t now, int *wait, int force)
1982 {
1983 struct frec *f, *oldest, *target;
1984 int count;
1985
1986 if (wait)
1987 *wait = 0;
1988
1989 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
1990 if (!f->sentto)
1991 target = f;
1992 else
1993 {
1994 if (difftime(now, f->time) >= 4*TIMEOUT)
1995 {
1996 free_frec(f);
1997 target = f;
1998 }
1999
2000 if (!oldest || difftime(f->time, oldest->time) <= 0)
2001 oldest = f;
2002 }
2003
2004 if (target)
2005 {
2006 target->time = now;
2007 return target;
2008 }
2009
2010 /* can't find empty one, use oldest if there is one
2011 and it's older than timeout */
2012 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2013 {
2014 /* keep stuff for twice timeout if we can by allocating a new
2015 record instead */
2016 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2017 count <= daemon->ftabsize &&
2018 (f = allocate_frec(now)))
2019 return f;
2020
2021 if (!wait)
2022 {
2023 free_frec(oldest);
2024 oldest->time = now;
2025 }
2026 return oldest;
2027 }
2028
2029 /* none available, calculate time 'till oldest record expires */
2030 if (!force && count > daemon->ftabsize)
2031 {
2032 static time_t last_log = 0;
2033
2034 if (oldest && wait)
2035 *wait = oldest->time + (time_t)TIMEOUT - now;
2036
2037 if ((int)difftime(now, last_log) > 5)
2038 {
2039 last_log = now;
2040 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2041 }
2042
2043 return NULL;
2044 }
2045
2046 if (!(f = allocate_frec(now)) && wait)
2047 /* wait one second on malloc failure */
2048 *wait = 1;
2049
2050 return f; /* OK if malloc fails and this is NULL */
2051 }
2052
2053 /* crc is all-ones if not known. */
2054 static struct frec *lookup_frec(unsigned short id, void *hash)
2055 {
2056 struct frec *f;
2057
2058 for(f = daemon->frec_list; f; f = f->next)
2059 if (f->sentto && f->new_id == id &&
2060 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2061 return f;
2062
2063 return NULL;
2064 }
2065
2066 static struct frec *lookup_frec_by_sender(unsigned short id,
2067 union mysockaddr *addr,
2068 void *hash)
2069 {
2070 struct frec *f;
2071
2072 for(f = daemon->frec_list; f; f = f->next)
2073 if (f->sentto &&
2074 f->orig_id == id &&
2075 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2076 sockaddr_isequal(&f->source, addr))
2077 return f;
2078
2079 return NULL;
2080 }
2081
2082 /* A server record is going away, remove references to it */
2083 void server_gone(struct server *server)
2084 {
2085 struct frec *f;
2086
2087 for (f = daemon->frec_list; f; f = f->next)
2088 if (f->sentto && f->sentto == server)
2089 free_frec(f);
2090
2091 if (daemon->last_server == server)
2092 daemon->last_server = NULL;
2093
2094 if (daemon->srv_save == server)
2095 daemon->srv_save = NULL;
2096 }
2097
2098 /* return unique random ids. */
2099 static unsigned short get_id(void)
2100 {
2101 unsigned short ret = 0;
2102
2103 do
2104 ret = rand16();
2105 while (lookup_frec(ret, NULL));
2106
2107 return ret;
2108 }
2109
2110
2111
2112
2113
Michael's tree of dnsmasq.