]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
27 /* Send a UDP packet with its source address set as "source"
28 unless nowild is true, when we just send it with the kernel default */
29 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
30 union mysockaddr
*to
, struct all_addr
*source
,
36 struct cmsghdr align
; /* this ensures alignment */
37 #if defined(HAVE_LINUX_NETWORK)
38 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
39 #elif defined(IP_SENDSRCADDR)
40 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
43 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
47 iov
[0].iov_base
= packet
;
50 msg
.msg_control
= NULL
;
51 msg
.msg_controllen
= 0;
54 msg
.msg_namelen
= sa_len(to
);
60 struct cmsghdr
*cmptr
;
61 msg
.msg_control
= &control_u
;
62 msg
.msg_controllen
= sizeof(control_u
);
63 cmptr
= CMSG_FIRSTHDR(&msg
);
65 if (to
->sa
.sa_family
== AF_INET
)
67 #if defined(HAVE_LINUX_NETWORK)
70 p
.ipi_spec_dst
= source
->addr
.addr4
;
71 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
72 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
73 cmptr
->cmsg_level
= IPPROTO_IP
;
74 cmptr
->cmsg_type
= IP_PKTINFO
;
75 #elif defined(IP_SENDSRCADDR)
76 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
77 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
78 cmptr
->cmsg_level
= IPPROTO_IP
;
79 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
86 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
87 p
.ipi6_addr
= source
->addr
.addr6
;
88 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
89 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
90 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
91 cmptr
->cmsg_level
= IPPROTO_IPV6
;
94 (void)iface
; /* eliminate warning */
98 while (sendmsg(fd
, &msg
, 0) == -1)
103 /* If interface is still in DAD, EINVAL results - ignore that. */
107 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
114 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
115 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
118 /* If the query ends in the domain in one of our servers, set
119 domain to point to that name. We find the largest match to allow both
120 domain.org and sub.domain.org to exist. */
122 unsigned int namelen
= strlen(qdomain
);
123 unsigned int matchlen
= 0;
125 unsigned int flags
= 0;
127 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
128 /* domain matches take priority over NODOTS matches */
129 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
131 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
132 *type
= SERV_FOR_NODOTS
;
133 if (serv
->flags
& SERV_NO_ADDR
)
135 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
140 if (serv
->addr
.sa
.sa_family
== AF_INET
)
141 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
144 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
147 else if (!flags
|| (flags
& F_NXDOMAIN
))
151 else if (serv
->flags
& SERV_HAS_DOMAIN
)
153 unsigned int domainlen
= strlen(serv
->domain
);
154 char *matchstart
= qdomain
+ namelen
- domainlen
;
155 if (namelen
>= domainlen
&&
156 hostname_isequal(matchstart
, serv
->domain
) &&
157 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
159 if (serv
->flags
& SERV_NO_REBIND
)
163 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
164 /* implement priority rules for --address and --server for same domain.
165 --address wins if the address is for the correct AF
166 --server wins otherwise. */
167 if (domainlen
!= 0 && domainlen
== matchlen
)
169 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
171 if (!(sflag
& qtype
) && flags
== 0)
176 if (flags
& (F_IPV4
| F_IPV6
))
181 if (domainlen
>= matchlen
)
183 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
184 *domain
= serv
->domain
;
185 matchlen
= domainlen
;
186 if (serv
->flags
& SERV_NO_ADDR
)
188 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
193 if (serv
->addr
.sa
.sa_family
== AF_INET
)
194 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
197 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
200 else if (!flags
|| (flags
& F_NXDOMAIN
))
210 if (flags
== 0 && !(qtype
& F_QUERY
) &&
211 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
212 /* don't forward A or AAAA queries for simple names, except the empty name */
215 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
222 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
223 logflags
= F_NEG
| qtype
;
225 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
227 else if ((*type
) & SERV_USE_RESOLV
)
229 *type
= 0; /* use normal servers for this domain */
235 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
236 struct all_addr
*dst_addr
, unsigned int dst_iface
,
237 struct dns_header
*header
, size_t plen
, time_t now
,
238 struct frec
*forward
, int ad_reqd
)
241 int type
= 0, norebind
= 0;
242 struct all_addr
*addrp
= NULL
;
243 unsigned int flags
= 0;
244 struct server
*start
= NULL
;
246 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
248 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
251 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
253 /* may be no servers available. */
254 if (!daemon
->servers
)
256 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
259 /* If we've already got an answer to this query, but we're awaiting keys for vaildation,
260 there's no point retrying the query, retry the key query instead...... */
261 if (forward
->blocking_query
)
265 while (forward
->blocking_query
)
266 forward
= forward
->blocking_query
;
268 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
269 plen
= forward
->stash_len
;
271 if (forward
->sentto
->addr
.sa
.sa_family
)
272 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
275 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
278 if (forward
->sentto
->sfd
)
279 fd
= forward
->sentto
->sfd
->fd
;
283 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
284 fd
= forward
->rfd6
->fd
;
287 fd
= forward
->rfd4
->fd
;
290 while (sendto(fd
, (char *)header
, plen
, 0,
291 &forward
->sentto
->addr
.sa
,
292 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
298 /* retry on existing query, send to all available servers */
299 domain
= forward
->sentto
->domain
;
300 forward
->sentto
->failed_queries
++;
301 if (!option_bool(OPT_ORDER
))
303 forward
->forwardall
= 1;
304 daemon
->last_server
= NULL
;
306 type
= forward
->sentto
->flags
& SERV_TYPE
;
307 if (!(start
= forward
->sentto
->next
))
308 start
= daemon
->servers
; /* at end of list, recycle */
309 header
->id
= htons(forward
->new_id
);
314 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
316 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
317 /* table full - server failure. */
322 forward
->source
= *udpaddr
;
323 forward
->dest
= *dst_addr
;
324 forward
->iface
= dst_iface
;
325 forward
->orig_id
= ntohs(header
->id
);
326 forward
->new_id
= get_id();
328 memcpy(forward
->hash
, hash
, HASH_SIZE
);
329 forward
->forwardall
= 0;
332 forward
->flags
|= FREC_NOREBIND
;
333 if (header
->hb4
& HB4_CD
)
334 forward
->flags
|= FREC_CHECKING_DISABLED
;
336 forward
->flags
|= FREC_AD_QUESTION
;
338 forward
->work_counter
= DNSSEC_WORK
;
341 header
->id
= htons(forward
->new_id
);
343 /* In strict_order mode, always try servers in the order
344 specified in resolv.conf, if a domain is given
345 always try all the available servers,
346 otherwise, use the one last known to work. */
350 if (option_bool(OPT_ORDER
))
351 start
= daemon
->servers
;
352 else if (!(start
= daemon
->last_server
) ||
353 daemon
->forwardcount
++ > FORWARD_TEST
||
354 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
356 start
= daemon
->servers
;
357 forward
->forwardall
= 1;
358 daemon
->forwardcount
= 0;
359 daemon
->forwardtime
= now
;
364 start
= daemon
->servers
;
365 if (!option_bool(OPT_ORDER
))
366 forward
->forwardall
= 1;
371 /* check for send errors here (no route to host)
372 if we fail to send to all nameservers, send back an error
373 packet straight away (helps modem users when offline) */
375 if (!flags
&& forward
)
377 struct server
*firstsentto
= start
;
380 if (option_bool(OPT_ADD_MAC
))
381 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
383 if (option_bool(OPT_CLIENT_SUBNET
))
385 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
389 forward
->flags
|= FREC_HAS_SUBNET
;
394 if (option_bool(OPT_DNSSEC_VALID
))
396 plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
397 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
398 this allows it to select auth servers when one is returning bad data. */
399 if (option_bool(OPT_DNSSEC_DEBUG
))
400 header
->hb4
|= HB4_CD
;
406 /* only send to servers dealing with our domain.
407 domain may be NULL, in which case server->domain
408 must be NULL also. */
410 if (type
== (start
->flags
& SERV_TYPE
) &&
411 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
412 !(start
->flags
& SERV_LITERAL_ADDRESS
))
416 /* find server socket to use, may need to get random one. */
422 if (start
->addr
.sa
.sa_family
== AF_INET6
)
424 if (!forward
->rfd6
&&
425 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
427 daemon
->rfd_save
= forward
->rfd6
;
428 fd
= forward
->rfd6
->fd
;
433 if (!forward
->rfd4
&&
434 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
436 daemon
->rfd_save
= forward
->rfd4
;
437 fd
= forward
->rfd4
->fd
;
440 #ifdef HAVE_CONNTRACK
441 /* Copy connection mark of incoming query to outgoing connection. */
442 if (option_bool(OPT_CONNTRACK
))
445 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
446 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
451 if (sendto(fd
, (char *)header
, plen
, 0,
453 sa_len(&start
->addr
)) == -1)
460 /* Keep info in case we want to re-send this packet */
461 daemon
->srv_save
= start
;
462 daemon
->packet_len
= plen
;
465 strcpy(daemon
->namebuff
, "query");
466 if (start
->addr
.sa
.sa_family
== AF_INET
)
467 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
468 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
471 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
472 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
476 forward
->sentto
= start
;
477 if (!forward
->forwardall
)
479 forward
->forwardall
++;
483 if (!(start
= start
->next
))
484 start
= daemon
->servers
;
486 if (start
== firstsentto
)
493 /* could not send on, prepare to return */
494 header
->id
= htons(forward
->orig_id
);
495 free_frec(forward
); /* cancel */
498 /* could not send on, return empty answer or address if known for whole domain */
501 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
502 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
508 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
509 int no_cache
, int cache_secure
, int ad_reqd
, int check_subnet
, union mysockaddr
*query_source
)
511 unsigned char *pheader
, *sizep
;
513 int munged
= 0, is_sign
;
519 /* Similar algorithm to search_servers. */
520 struct ipsets
*ipset_pos
;
521 unsigned int namelen
= strlen(daemon
->namebuff
);
522 unsigned int matchlen
= 0;
523 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
525 unsigned int domainlen
= strlen(ipset_pos
->domain
);
526 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
527 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
528 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
529 domainlen
>= matchlen
)
531 matchlen
= domainlen
;
532 sets
= ipset_pos
->sets
;
537 /* If upstream is advertising a larger UDP packet size
538 than we allow, trim it so that we don't get overlarge
539 requests for the client. We can't do this for signed packets. */
541 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
543 unsigned short udpsz
;
544 unsigned char *psave
= sizep
;
546 GETSHORT(udpsz
, sizep
);
548 if (!is_sign
&& udpsz
> daemon
->edns_pktsz
)
549 PUTSHORT(daemon
->edns_pktsz
, psave
);
551 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
553 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
558 /* RFC 4035 sect 4.6 para 3 */
559 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
560 header
->hb4
&= ~HB4_AD
;
562 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
565 /* Complain loudly if the upstream server is non-recursive. */
566 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
567 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
569 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
570 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
571 if (!option_bool(OPT_LOG
))
572 server
->flags
|= SERV_WARNED_RECURSIVE
;
575 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
576 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
579 SET_RCODE(header
, NXDOMAIN
);
580 header
->hb3
&= ~HB3_AA
;
587 if (RCODE(header
) == NXDOMAIN
&&
588 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
589 check_for_local_domain(daemon
->namebuff
, now
))
591 /* if we forwarded a query for a locally known name (because it was for
592 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
593 since we know that the domain exists, even if upstream doesn't */
595 header
->hb3
|= HB3_AA
;
596 SET_RCODE(header
, NOERROR
);
600 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
602 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
612 if (no_cache
&& !(header
->hb4
& HB4_CD
))
614 if (!option_bool(OPT_DNSSEC_DEBUG
))
616 /* Bogus reply, turn into SERVFAIL */
617 SET_RCODE(header
, SERVFAIL
);
622 if (option_bool(OPT_DNSSEC_VALID
))
623 header
->hb4
&= ~HB4_AD
;
625 if (!(header
->hb4
& HB4_CD
) && ad_reqd
&& cache_secure
)
626 header
->hb4
|= HB4_AD
;
629 /* do this after extract_addresses. Ensure NODATA reply and remove
634 header
->ancount
= htons(0);
635 header
->nscount
= htons(0);
636 header
->arcount
= htons(0);
639 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
640 sections of the packet. Find the new length here and put back pseudoheader
641 if it was removed. */
642 return resize_packet(header
, n
, pheader
, plen
);
645 /* sets new last_server */
646 void reply_query(int fd
, int family
, time_t now
)
648 /* packet from peer server, extract data for cache, and send to
649 original requester */
650 struct dns_header
*header
;
651 union mysockaddr serveraddr
;
652 struct frec
*forward
;
653 socklen_t addrlen
= sizeof(serveraddr
);
654 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
656 struct server
*server
;
662 /* packet buffer overwritten */
663 daemon
->srv_save
= NULL
;
665 /* Determine the address of the server replying so that we can mark that as good */
666 serveraddr
.sa
.sa_family
= family
;
668 if (serveraddr
.sa
.sa_family
== AF_INET6
)
669 serveraddr
.in6
.sin6_flowinfo
= 0;
672 /* spoof check: answer must come from known server, */
673 for (server
= daemon
->servers
; server
; server
= server
->next
)
674 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
675 sockaddr_isequal(&server
->addr
, &serveraddr
))
678 header
= (struct dns_header
*)daemon
->packet
;
681 hash
= hash_questions(header
, n
, daemon
->namebuff
);
684 crc
= questions_crc(header
, n
, daemon
->namebuff
);
688 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
689 !(forward
= lookup_frec(ntohs(header
->id
), hash
)))
692 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
693 !option_bool(OPT_ORDER
) &&
694 forward
->forwardall
== 0)
695 /* for broken servers, attempt to send to another one. */
697 unsigned char *pheader
;
701 /* recreate query from reply */
702 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
705 header
->ancount
= htons(0);
706 header
->nscount
= htons(0);
707 header
->arcount
= htons(0);
708 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
710 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
711 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
, 0);
717 server
= forward
->sentto
;
719 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
721 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
725 struct server
*last_server
;
727 /* find good server by address if possible, otherwise assume the last one we sent to */
728 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
729 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
730 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
732 server
= last_server
;
736 if (!option_bool(OPT_ALL_SERVERS
))
737 daemon
->last_server
= server
;
740 /* If the answer is an error, keep the forward record in place in case
741 we get a good reply from another server. Kill it when we've
742 had replies from all to avoid filling the forwarding table when
743 everything is broken */
744 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
745 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
747 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
749 if (option_bool(OPT_NO_REBIND
))
750 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
752 /* Don't cache replies where DNSSEC validation was turned off, either
753 the upstream server told us so, or the original query specified it. */
754 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
758 if (option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
762 /* We've had a reply already, which we're validating. Ignore this duplicate */
763 if (forward
->blocking_query
)
766 if (header
->hb3
& HB3_TC
)
768 /* Truncated answer can't be validated.
769 If this is an answer to a DNSSEC-generated query, we still
770 need to get the client to retry over TCP, so return
771 an answer with the TC bit set, even if the actual answer fits.
773 status
= STAT_TRUNCATED
;
775 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
776 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
777 else if (forward
->flags
& FREC_DS_QUERY
)
778 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
780 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
782 /* Can't validate, as we're missing key data. Put this
783 answer aside, whilst we get that. */
784 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
786 struct frec
*new, *orig
;
788 /* Free any saved query */
790 blockdata_free(forward
->stash
);
792 /* Now save reply pending receipt of key data */
793 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
795 forward
->stash_len
= n
;
798 /* Find the original query that started it all.... */
799 for (orig
= forward
; orig
->dependent
; orig
= orig
->dependent
);
801 if (--orig
->work_counter
== 0 || !(new = get_new_frec(now
, NULL
, 1)))
802 status
= STAT_INSECURE
;
806 struct frec
*next
= new->next
;
807 *new = *forward
; /* copy everything, then overwrite */
809 new->blocking_query
= NULL
;
814 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
);
816 new->dependent
= forward
; /* to find query awaiting new one. */
817 forward
->blocking_query
= new; /* for garbage cleaning */
818 /* validate routines leave name of required record in daemon->keyname */
819 if (status
== STAT_NEED_KEY
)
821 new->flags
|= FREC_DNSKEY_QUERY
;
822 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
823 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
827 new->flags
|= FREC_DS_QUERY
;
828 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
829 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
831 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
832 memcpy(new->hash
, hash
, HASH_SIZE
);
833 new->new_id
= get_id();
834 header
->id
= htons(new->new_id
);
835 /* Save query for retransmission */
836 new->stash
= blockdata_alloc((char *)header
, nn
);
839 /* Don't resend this. */
840 daemon
->srv_save
= NULL
;
843 fd
= server
->sfd
->fd
;
848 if (server
->addr
.sa
.sa_family
== AF_INET6
)
850 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
856 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
863 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
871 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
872 Now wind back down, pulling back answers which wouldn't previously validate
873 and validate them with the new data. Note that if an answer needs multiple
874 keys to validate, we may find another key is needed, in which case we set off
875 down another branch of the tree. Once we get to the original answer
876 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
877 while (forward
->dependent
)
879 struct frec
*prev
= forward
->dependent
;
882 forward
->blocking_query
= NULL
; /* already gone */
883 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
884 n
= forward
->stash_len
;
886 if (status
== STAT_SECURE
)
888 if (forward
->flags
& FREC_DNSKEY_QUERY
)
889 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
890 else if (forward
->flags
& FREC_DS_QUERY
)
891 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
893 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
895 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
900 if (status
== STAT_TRUNCATED
)
901 header
->hb3
|= HB3_TC
;
906 if (forward
->work_counter
== 0)
907 result
= "ABANDONED";
909 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
911 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
916 if (status
== STAT_SECURE
)
918 else if (status
== STAT_BOGUS
)
923 /* restore CD bit to the value in the query */
924 if (forward
->flags
& FREC_CHECKING_DISABLED
)
925 header
->hb4
|= HB4_CD
;
927 header
->hb4
&= ~HB4_CD
;
929 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
930 forward
->flags
& FREC_AD_QUESTION
, forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
932 header
->id
= htons(forward
->orig_id
);
933 header
->hb4
|= HB4_RA
; /* recursion if available */
934 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
935 &forward
->source
, &forward
->dest
, forward
->iface
);
937 free_frec(forward
); /* cancel */
942 void receive_query(struct listener
*listen
, time_t now
)
944 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
945 union mysockaddr source_addr
;
947 struct all_addr dst_addr
;
948 struct in_addr netmask
, dst_addr_4
;
951 int if_index
= 0, auth_dns
= 0;
957 struct cmsghdr
*cmptr
;
959 struct cmsghdr align
; /* this ensures alignment */
961 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
963 #if defined(HAVE_LINUX_NETWORK)
964 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
965 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
966 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
967 CMSG_SPACE(sizeof(unsigned int))];
968 #elif defined(IP_RECVDSTADDR)
969 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
970 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
974 /* Can always get recvd interface for IPv6 */
975 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
977 int check_dst
= !option_bool(OPT_NOWILD
);
980 /* packet buffer overwritten */
981 daemon
->srv_save
= NULL
;
983 dst_addr_4
.s_addr
= 0;
986 if (option_bool(OPT_NOWILD
) && listen
->iface
)
988 auth_dns
= listen
->iface
->dns_auth
;
990 if (listen
->family
== AF_INET
)
992 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
993 netmask
= listen
->iface
->netmask
;
997 iov
[0].iov_base
= daemon
->packet
;
998 iov
[0].iov_len
= daemon
->edns_pktsz
;
1000 msg
.msg_control
= control_u
.control
;
1001 msg
.msg_controllen
= sizeof(control_u
);
1003 msg
.msg_name
= &source_addr
;
1004 msg
.msg_namelen
= sizeof(source_addr
);
1008 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1011 if (n
< (int)sizeof(struct dns_header
) ||
1012 (msg
.msg_flags
& MSG_TRUNC
) ||
1013 (header
->hb3
& HB3_QR
))
1016 source_addr
.sa
.sa_family
= listen
->family
;
1018 if (listen
->family
== AF_INET6
)
1019 source_addr
.in6
.sin6_flowinfo
= 0;
1026 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1029 #if defined(HAVE_LINUX_NETWORK)
1030 if (listen
->family
== AF_INET
)
1031 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1032 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1036 struct in_pktinfo
*p
;
1038 p
.c
= CMSG_DATA(cmptr
);
1039 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1040 if_index
= p
.p
->ipi_ifindex
;
1042 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1043 if (listen
->family
== AF_INET
)
1045 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1051 #ifndef HAVE_SOLARIS_NETWORK
1052 struct sockaddr_dl
*s
;
1055 p
.c
= CMSG_DATA(cmptr
);
1056 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1057 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1058 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1059 #ifdef HAVE_SOLARIS_NETWORK
1062 if_index
= p
.s
->sdl_index
;
1069 if (listen
->family
== AF_INET6
)
1071 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1072 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1076 struct in6_pktinfo
*p
;
1078 p
.c
= CMSG_DATA(cmptr
);
1080 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1081 if_index
= p
.p
->ipi6_ifindex
;
1086 /* enforce available interface configuration */
1088 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1091 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1093 if (!option_bool(OPT_CLEVERBIND
))
1094 enumerate_interfaces(0);
1095 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1096 !label_exception(if_index
, listen
->family
, &dst_addr
))
1100 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1104 /* get the netmask of the interface whch has the address we were sent to.
1105 This is no neccessarily the interface we arrived on. */
1107 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1108 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1109 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1112 /* interface may be new */
1113 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1114 enumerate_interfaces(0);
1116 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1117 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1118 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1121 /* If we failed, abandon localisation */
1123 netmask
= iface
->netmask
;
1125 dst_addr_4
.s_addr
= 0;
1129 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1132 struct auth_zone
*zone
;
1134 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1136 if (listen
->family
== AF_INET
)
1137 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1138 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1141 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1142 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1146 /* find queries for zones we're authoritative for, and answer them directly */
1148 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1149 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1161 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1164 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1165 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1166 daemon
->auth_answer
++;
1173 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1174 dst_addr_4
, netmask
, now
, &ad_reqd
);
1178 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1179 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1180 daemon
->local_answer
++;
1182 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1183 header
, (size_t)n
, now
, NULL
, ad_reqd
))
1184 daemon
->queries_forwarded
++;
1186 daemon
->local_answer
++;
1191 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
1192 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
)
1194 /* Recurse up the key heirarchy */
1197 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1198 if (--(*keycount
) == 0)
1199 return STAT_INSECURE
;
1201 if (status
== STAT_NEED_KEY
)
1202 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1203 else if (status
== STAT_NEED_DS
)
1204 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1206 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class);
1208 /* Can't validate because we need a key/DS whose name now in keyname.
1209 Make query for same, and recurse to validate */
1210 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1213 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1214 unsigned char *payload
= &packet
[2];
1215 struct dns_header
*new_header
= (struct dns_header
*)payload
;
1216 u16
*length
= (u16
*)packet
;
1217 unsigned char c1
, c2
;
1220 return STAT_INSECURE
;
1223 m
= dnssec_generate_query(new_header
, ((char *) new_header
) + 65536, keyname
, class,
1224 new_status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1228 if (!read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) ||
1229 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1230 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1231 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1232 new_status
= STAT_INSECURE
;
1237 if (tcp_key_recurse(now
, new_status
, new_header
, m
, class, name
, keyname
, server
, keycount
) == STAT_SECURE
)
1239 /* Reached a validated record, now try again at this level.
1240 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1241 If so, go round again. */
1243 if (status
== STAT_NEED_KEY
)
1244 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1245 else if (status
== STAT_NEED_DS
)
1246 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1248 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class);
1250 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1251 goto another_tcp_key
;
1263 /* The daemon forks before calling this: it should deal with one connection,
1264 blocking as neccessary, and then return. Note, need to be a bit careful
1265 about resources for debug mode, when the fork is suppressed: that's
1266 done by the caller. */
1267 unsigned char *tcp_request(int confd
, time_t now
,
1268 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1275 int checking_disabled
, ad_question
, check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1277 unsigned short qtype
;
1278 unsigned int gotname
;
1279 unsigned char c1
, c2
;
1280 /* Max TCP packet + slop + size */
1281 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1282 unsigned char *payload
= &packet
[2];
1283 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1284 struct dns_header
*header
= (struct dns_header
*)payload
;
1285 u16
*length
= (u16
*)packet
;
1286 struct server
*last_server
;
1287 struct in_addr dst_addr_4
;
1288 union mysockaddr peer_addr
;
1289 socklen_t peer_len
= sizeof(union mysockaddr
);
1291 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1297 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1298 !(size
= c1
<< 8 | c2
) ||
1299 !read_write(confd
, payload
, size
, 1))
1302 if (size
< (int)sizeof(struct dns_header
))
1307 /* save state of "cd" flag in query */
1308 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1309 no_cache_dnssec
= 1;
1311 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1314 struct auth_zone
*zone
;
1316 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1318 if (peer_addr
.sa
.sa_family
== AF_INET
)
1319 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1320 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1323 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1324 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1328 /* find queries for zones we're authoritative for, and answer them directly */
1330 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1331 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1340 if (local_addr
->sa
.sa_family
== AF_INET
)
1341 dst_addr_4
= local_addr
->in
.sin_addr
;
1343 dst_addr_4
.s_addr
= 0;
1347 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1351 /* m > 0 if answered from cache */
1352 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1353 dst_addr_4
, netmask
, now
, &ad_question
);
1355 /* Do this by steam now we're not in the select() loop */
1356 check_log_writer(NULL
);
1360 unsigned int flags
= 0;
1361 struct all_addr
*addrp
= NULL
;
1363 char *domain
= NULL
;
1365 if (option_bool(OPT_ADD_MAC
))
1366 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1368 if (option_bool(OPT_CLIENT_SUBNET
))
1370 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1379 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1381 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1382 last_server
= daemon
->servers
;
1384 last_server
= daemon
->last_server
;
1386 if (!flags
&& last_server
)
1388 struct server
*firstsendto
= NULL
;
1390 unsigned char *newhash
, hash
[HASH_SIZE
];
1391 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->keyname
)))
1392 memcpy(hash
, newhash
, HASH_SIZE
);
1394 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1396 /* Loop round available servers until we succeed in connecting to one.
1397 Note that this code subtley ensures that consecutive queries on this connection
1398 which can go to the same server, do so. */
1402 firstsendto
= last_server
;
1405 if (!(last_server
= last_server
->next
))
1406 last_server
= daemon
->servers
;
1408 if (last_server
== firstsendto
)
1412 /* server for wrong domain */
1413 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1414 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1417 if (last_server
->tcpfd
== -1)
1419 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1422 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1423 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1425 close(last_server
->tcpfd
);
1426 last_server
->tcpfd
= -1;
1431 if (option_bool(OPT_DNSSEC_VALID
))
1433 size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1434 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1435 this allows it to select auth servers when one is returning bad data. */
1436 if (option_bool(OPT_DNSSEC_DEBUG
))
1437 header
->hb4
|= HB4_CD
;
1441 #ifdef HAVE_CONNTRACK
1442 /* Copy connection mark of incoming query to outgoing connection. */
1443 if (option_bool(OPT_CONNTRACK
))
1446 struct all_addr local
;
1448 if (local_addr
->sa
.sa_family
== AF_INET6
)
1449 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1452 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1454 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1455 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1460 *length
= htons(size
);
1462 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1463 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1464 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1465 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1467 close(last_server
->tcpfd
);
1468 last_server
->tcpfd
= -1;
1475 strcpy(daemon
->namebuff
, "query");
1476 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1477 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1478 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1481 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1482 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1486 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1488 int keycount
= DNSSEC_WORK
; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1489 int status
= tcp_key_recurse(now
, STAT_TRUNCATED
, header
, m
, 0, daemon
->namebuff
, daemon
->keyname
, last_server
, &keycount
);
1493 result
= "ABANDONED";
1495 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1497 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
1499 if (status
== STAT_BOGUS
)
1500 no_cache_dnssec
= 1;
1502 if (status
== STAT_SECURE
)
1507 /* restore CD bit to the value in the query */
1508 if (checking_disabled
)
1509 header
->hb4
|= HB4_CD
;
1511 header
->hb4
&= ~HB4_CD
;
1513 /* There's no point in updating the cache, since this process will exit and
1514 lose the information after a few queries. We make this call for the alias and
1515 bogus-nxdomain side-effects. */
1516 /* If the crc of the question section doesn't match the crc we sent, then
1517 someone might be attempting to insert bogus values into the cache by
1518 sending replies containing questions and bogus answers. */
1520 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
1521 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
1527 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1534 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1535 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1536 cache_secure
, ad_question
, check_subnet
, &peer_addr
);
1542 /* In case of local answer or no connections made. */
1544 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1548 check_log_writer(NULL
);
1552 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1557 static struct frec
*allocate_frec(time_t now
)
1561 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1563 f
->next
= daemon
->frec_list
;
1572 f
->dependent
= NULL
;
1573 f
->blocking_query
= NULL
;
1576 daemon
->frec_list
= f
;
1582 static struct randfd
*allocate_rfd(int family
)
1584 static int finger
= 0;
1587 /* limit the number of sockets we have open to avoid starvation of
1588 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1590 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1591 if (daemon
->randomsocks
[i
].refcount
== 0)
1593 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1596 daemon
->randomsocks
[i
].refcount
= 1;
1597 daemon
->randomsocks
[i
].family
= family
;
1598 return &daemon
->randomsocks
[i
];
1601 /* No free ones or cannot get new socket, grab an existing one */
1602 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1604 int j
= (i
+finger
) % RANDOM_SOCKS
;
1605 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1606 daemon
->randomsocks
[j
].family
== family
&&
1607 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1610 daemon
->randomsocks
[j
].refcount
++;
1611 return &daemon
->randomsocks
[j
];
1615 return NULL
; /* doom */
1617 static void free_frec(struct frec
*f
)
1619 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1627 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1636 blockdata_free(f
->stash
);
1640 /* Anything we're waiting on is pointless now, too */
1641 if (f
->blocking_query
)
1642 free_frec(f
->blocking_query
);
1643 f
->blocking_query
= NULL
;
1644 f
->dependent
= NULL
;
1648 /* if wait==NULL return a free or older than TIMEOUT record.
1649 else return *wait zero if one available, or *wait is delay to
1650 when the oldest in-use record will expire. Impose an absolute
1651 limit of 4*TIMEOUT before we wipe things (for random sockets).
1652 If force is set, always return a result, even if we have
1653 to allocate above the limit. */
1654 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
1656 struct frec
*f
, *oldest
, *target
;
1662 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1667 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1673 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1683 /* can't find empty one, use oldest if there is one
1684 and it's older than timeout */
1685 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1687 /* keep stuff for twice timeout if we can by allocating a new
1689 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1690 count
<= daemon
->ftabsize
&&
1691 (f
= allocate_frec(now
)))
1702 /* none available, calculate time 'till oldest record expires */
1703 if (!force
&& count
> daemon
->ftabsize
)
1705 static time_t last_log
= 0;
1708 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1710 if ((int)difftime(now
, last_log
) > 5)
1713 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1719 if (!(f
= allocate_frec(now
)) && wait
)
1720 /* wait one second on malloc failure */
1723 return f
; /* OK if malloc fails and this is NULL */
1726 /* crc is all-ones if not known. */
1727 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
1731 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1732 if (f
->sentto
&& f
->new_id
== id
&&
1733 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
1739 static struct frec
*lookup_frec_by_sender(unsigned short id
,
1740 union mysockaddr
*addr
,
1745 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1748 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
1749 sockaddr_isequal(&f
->source
, addr
))
1755 /* A server record is going away, remove references to it */
1756 void server_gone(struct server
*server
)
1760 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
1761 if (f
->sentto
&& f
->sentto
== server
)
1764 if (daemon
->last_server
== server
)
1765 daemon
->last_server
= NULL
;
1767 if (daemon
->srv_save
== server
)
1768 daemon
->srv_save
= NULL
;
1771 /* return unique random ids. */
1772 static unsigned short get_id(void)
1774 unsigned short ret
= 0;
1778 while (lookup_frec(ret
, NULL
));