]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Add --ignore-address option.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25
26 #ifdef HAVE_DNSSEC
27 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
28 int class, char *name, char *keyname, struct server *server, int *keycount);
29 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
30 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
31 #endif
32
33
34 /* Send a UDP packet with its source address set as "source"
35 unless nowild is true, when we just send it with the kernel default */
36 int send_from(int fd, int nowild, char *packet, size_t len,
37 union mysockaddr *to, struct all_addr *source,
38 unsigned int iface)
39 {
40 struct msghdr msg;
41 struct iovec iov[1];
42 union {
43 struct cmsghdr align; /* this ensures alignment */
44 #if defined(HAVE_LINUX_NETWORK)
45 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
46 #elif defined(IP_SENDSRCADDR)
47 char control[CMSG_SPACE(sizeof(struct in_addr))];
48 #endif
49 #ifdef HAVE_IPV6
50 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
51 #endif
52 } control_u;
53
54 iov[0].iov_base = packet;
55 iov[0].iov_len = len;
56
57 msg.msg_control = NULL;
58 msg.msg_controllen = 0;
59 msg.msg_flags = 0;
60 msg.msg_name = to;
61 msg.msg_namelen = sa_len(to);
62 msg.msg_iov = iov;
63 msg.msg_iovlen = 1;
64
65 if (!nowild)
66 {
67 struct cmsghdr *cmptr;
68 msg.msg_control = &control_u;
69 msg.msg_controllen = sizeof(control_u);
70 cmptr = CMSG_FIRSTHDR(&msg);
71
72 if (to->sa.sa_family == AF_INET)
73 {
74 #if defined(HAVE_LINUX_NETWORK)
75 struct in_pktinfo p;
76 p.ipi_ifindex = 0;
77 p.ipi_spec_dst = source->addr.addr4;
78 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
79 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
80 cmptr->cmsg_level = IPPROTO_IP;
81 cmptr->cmsg_type = IP_PKTINFO;
82 #elif defined(IP_SENDSRCADDR)
83 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
84 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
85 cmptr->cmsg_level = IPPROTO_IP;
86 cmptr->cmsg_type = IP_SENDSRCADDR;
87 #endif
88 }
89 else
90 #ifdef HAVE_IPV6
91 {
92 struct in6_pktinfo p;
93 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
94 p.ipi6_addr = source->addr.addr6;
95 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
96 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
97 cmptr->cmsg_type = daemon->v6pktinfo;
98 cmptr->cmsg_level = IPPROTO_IPV6;
99 }
100 #else
101 (void)iface; /* eliminate warning */
102 #endif
103 }
104
105 while (sendmsg(fd, &msg, 0) == -1)
106 {
107 if (retry_send())
108 continue;
109
110 /* If interface is still in DAD, EINVAL results - ignore that. */
111 if (errno == EINVAL)
112 break;
113
114 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
115 return 0;
116 }
117
118 return 1;
119 }
120
121 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
122 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
123
124 {
125 /* If the query ends in the domain in one of our servers, set
126 domain to point to that name. We find the largest match to allow both
127 domain.org and sub.domain.org to exist. */
128
129 unsigned int namelen = strlen(qdomain);
130 unsigned int matchlen = 0;
131 struct server *serv;
132 unsigned int flags = 0;
133
134 for (serv = daemon->servers; serv; serv=serv->next)
135 /* domain matches take priority over NODOTS matches */
136 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
137 {
138 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
139 *type = SERV_FOR_NODOTS;
140 if (serv->flags & SERV_NO_ADDR)
141 flags = F_NXDOMAIN;
142 else if (serv->flags & SERV_LITERAL_ADDRESS)
143 {
144 if (sflag & qtype)
145 {
146 flags = sflag;
147 if (serv->addr.sa.sa_family == AF_INET)
148 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
149 #ifdef HAVE_IPV6
150 else
151 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
152 #endif
153 }
154 else if (!flags || (flags & F_NXDOMAIN))
155 flags = F_NOERR;
156 }
157 }
158 else if (serv->flags & SERV_HAS_DOMAIN)
159 {
160 unsigned int domainlen = strlen(serv->domain);
161 char *matchstart = qdomain + namelen - domainlen;
162 if (namelen >= domainlen &&
163 hostname_isequal(matchstart, serv->domain) &&
164 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
165 {
166 if (serv->flags & SERV_NO_REBIND)
167 *norebind = 1;
168 else
169 {
170 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
171 /* implement priority rules for --address and --server for same domain.
172 --address wins if the address is for the correct AF
173 --server wins otherwise. */
174 if (domainlen != 0 && domainlen == matchlen)
175 {
176 if ((serv->flags & SERV_LITERAL_ADDRESS))
177 {
178 if (!(sflag & qtype) && flags == 0)
179 continue;
180 }
181 else
182 {
183 if (flags & (F_IPV4 | F_IPV6))
184 continue;
185 }
186 }
187
188 if (domainlen >= matchlen)
189 {
190 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
191 *domain = serv->domain;
192 matchlen = domainlen;
193 if (serv->flags & SERV_NO_ADDR)
194 flags = F_NXDOMAIN;
195 else if (serv->flags & SERV_LITERAL_ADDRESS)
196 {
197 if (sflag & qtype)
198 {
199 flags = sflag;
200 if (serv->addr.sa.sa_family == AF_INET)
201 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
202 #ifdef HAVE_IPV6
203 else
204 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
205 #endif
206 }
207 else if (!flags || (flags & F_NXDOMAIN))
208 flags = F_NOERR;
209 }
210 else
211 flags = 0;
212 }
213 }
214 }
215 }
216
217 if (flags == 0 && !(qtype & F_QUERY) &&
218 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
219 /* don't forward A or AAAA queries for simple names, except the empty name */
220 flags = F_NOERR;
221
222 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
223 flags = F_NOERR;
224
225 if (flags)
226 {
227 int logflags = 0;
228
229 if (flags == F_NXDOMAIN || flags == F_NOERR)
230 logflags = F_NEG | qtype;
231
232 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
233 }
234 else if ((*type) & SERV_USE_RESOLV)
235 {
236 *type = 0; /* use normal servers for this domain */
237 *domain = NULL;
238 }
239 return flags;
240 }
241
242 static int forward_query(int udpfd, union mysockaddr *udpaddr,
243 struct all_addr *dst_addr, unsigned int dst_iface,
244 struct dns_header *header, size_t plen, time_t now,
245 struct frec *forward, int ad_reqd, int do_bit)
246 {
247 char *domain = NULL;
248 int type = 0, norebind = 0;
249 struct all_addr *addrp = NULL;
250 unsigned int flags = 0;
251 struct server *start = NULL;
252 #ifdef HAVE_DNSSEC
253 void *hash = hash_questions(header, plen, daemon->namebuff);
254 #else
255 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
256 void *hash = &crc;
257 #endif
258 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
259
260 (void)do_bit;
261
262 /* may be no servers available. */
263 if (!daemon->servers)
264 forward = NULL;
265 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
266 {
267 #ifdef HAVE_DNSSEC
268 /* If we've already got an answer to this query, but we're awaiting keys for validation,
269 there's no point retrying the query, retry the key query instead...... */
270 if (forward->blocking_query)
271 {
272 int fd;
273
274 while (forward->blocking_query)
275 forward = forward->blocking_query;
276
277 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
278 plen = forward->stash_len;
279
280 if (forward->sentto->addr.sa.sa_family == AF_INET)
281 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
282 #ifdef HAVE_IPV6
283 else
284 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
285 #endif
286
287 if (forward->sentto->sfd)
288 fd = forward->sentto->sfd->fd;
289 else
290 {
291 #ifdef HAVE_IPV6
292 if (forward->sentto->addr.sa.sa_family == AF_INET6)
293 fd = forward->rfd6->fd;
294 else
295 #endif
296 fd = forward->rfd4->fd;
297 }
298
299 while (sendto(fd, (char *)header, plen, 0,
300 &forward->sentto->addr.sa,
301 sa_len(&forward->sentto->addr)) == -1 && retry_send());
302
303 return 1;
304 }
305 #endif
306
307 /* retry on existing query, send to all available servers */
308 domain = forward->sentto->domain;
309 forward->sentto->failed_queries++;
310 if (!option_bool(OPT_ORDER))
311 {
312 forward->forwardall = 1;
313 daemon->last_server = NULL;
314 }
315 type = forward->sentto->flags & SERV_TYPE;
316 if (!(start = forward->sentto->next))
317 start = daemon->servers; /* at end of list, recycle */
318 header->id = htons(forward->new_id);
319 }
320 else
321 {
322 if (gotname)
323 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
324
325 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
326 /* table full - server failure. */
327 flags = F_NEG;
328
329 if (forward)
330 {
331 forward->source = *udpaddr;
332 forward->dest = *dst_addr;
333 forward->iface = dst_iface;
334 forward->orig_id = ntohs(header->id);
335 forward->new_id = get_id();
336 forward->fd = udpfd;
337 memcpy(forward->hash, hash, HASH_SIZE);
338 forward->forwardall = 0;
339 forward->flags = 0;
340 if (norebind)
341 forward->flags |= FREC_NOREBIND;
342 if (header->hb4 & HB4_CD)
343 forward->flags |= FREC_CHECKING_DISABLED;
344 if (ad_reqd)
345 forward->flags |= FREC_AD_QUESTION;
346 #ifdef HAVE_DNSSEC
347 forward->work_counter = DNSSEC_WORK;
348 if (do_bit)
349 forward->flags |= FREC_DO_QUESTION;
350 #endif
351
352 header->id = htons(forward->new_id);
353
354 /* In strict_order mode, always try servers in the order
355 specified in resolv.conf, if a domain is given
356 always try all the available servers,
357 otherwise, use the one last known to work. */
358
359 if (type == 0)
360 {
361 if (option_bool(OPT_ORDER))
362 start = daemon->servers;
363 else if (!(start = daemon->last_server) ||
364 daemon->forwardcount++ > FORWARD_TEST ||
365 difftime(now, daemon->forwardtime) > FORWARD_TIME)
366 {
367 start = daemon->servers;
368 forward->forwardall = 1;
369 daemon->forwardcount = 0;
370 daemon->forwardtime = now;
371 }
372 }
373 else
374 {
375 start = daemon->servers;
376 if (!option_bool(OPT_ORDER))
377 forward->forwardall = 1;
378 }
379 }
380 }
381
382 /* check for send errors here (no route to host)
383 if we fail to send to all nameservers, send back an error
384 packet straight away (helps modem users when offline) */
385
386 if (!flags && forward)
387 {
388 struct server *firstsentto = start;
389 int forwarded = 0;
390
391 if (option_bool(OPT_ADD_MAC))
392 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
393
394 if (option_bool(OPT_CLIENT_SUBNET))
395 {
396 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
397 if (new != plen)
398 {
399 plen = new;
400 forward->flags |= FREC_HAS_SUBNET;
401 }
402 }
403
404 #ifdef HAVE_DNSSEC
405 if (option_bool(OPT_DNSSEC_VALID))
406 {
407 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
408
409 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
410 this allows it to select auth servers when one is returning bad data. */
411 if (option_bool(OPT_DNSSEC_DEBUG))
412 header->hb4 |= HB4_CD;
413
414 if (new_plen != plen)
415 forward->flags |= FREC_ADDED_PHEADER;
416
417 plen = new_plen;
418 }
419 #endif
420
421 while (1)
422 {
423 /* only send to servers dealing with our domain.
424 domain may be NULL, in which case server->domain
425 must be NULL also. */
426
427 if (type == (start->flags & SERV_TYPE) &&
428 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
429 !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
430 {
431 int fd;
432
433 /* find server socket to use, may need to get random one. */
434 if (start->sfd)
435 fd = start->sfd->fd;
436 else
437 {
438 #ifdef HAVE_IPV6
439 if (start->addr.sa.sa_family == AF_INET6)
440 {
441 if (!forward->rfd6 &&
442 !(forward->rfd6 = allocate_rfd(AF_INET6)))
443 break;
444 daemon->rfd_save = forward->rfd6;
445 fd = forward->rfd6->fd;
446 }
447 else
448 #endif
449 {
450 if (!forward->rfd4 &&
451 !(forward->rfd4 = allocate_rfd(AF_INET)))
452 break;
453 daemon->rfd_save = forward->rfd4;
454 fd = forward->rfd4->fd;
455 }
456
457 #ifdef HAVE_CONNTRACK
458 /* Copy connection mark of incoming query to outgoing connection. */
459 if (option_bool(OPT_CONNTRACK))
460 {
461 unsigned int mark;
462 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
463 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
464 }
465 #endif
466 }
467
468 if (sendto(fd, (char *)header, plen, 0,
469 &start->addr.sa,
470 sa_len(&start->addr)) == -1)
471 {
472 if (retry_send())
473 continue;
474 }
475 else
476 {
477 /* Keep info in case we want to re-send this packet */
478 daemon->srv_save = start;
479 daemon->packet_len = plen;
480
481 if (!gotname)
482 strcpy(daemon->namebuff, "query");
483 if (start->addr.sa.sa_family == AF_INET)
484 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
485 (struct all_addr *)&start->addr.in.sin_addr, NULL);
486 #ifdef HAVE_IPV6
487 else
488 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
489 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
490 #endif
491 start->queries++;
492 forwarded = 1;
493 forward->sentto = start;
494 if (!forward->forwardall)
495 break;
496 forward->forwardall++;
497 }
498 }
499
500 if (!(start = start->next))
501 start = daemon->servers;
502
503 if (start == firstsentto)
504 break;
505 }
506
507 if (forwarded)
508 return 1;
509
510 /* could not send on, prepare to return */
511 header->id = htons(forward->orig_id);
512 free_frec(forward); /* cancel */
513 }
514
515 /* could not send on, return empty answer or address if known for whole domain */
516 if (udpfd != -1)
517 {
518 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
519 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
520 }
521
522 return 0;
523 }
524
525 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
526 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
527 {
528 unsigned char *pheader, *sizep;
529 char **sets = 0;
530 int munged = 0, is_sign;
531 size_t plen;
532
533 (void)ad_reqd;
534 (void) do_bit;
535
536 #ifdef HAVE_IPSET
537 if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL))
538 {
539 /* Similar algorithm to search_servers. */
540 struct ipsets *ipset_pos;
541 unsigned int namelen = strlen(daemon->namebuff);
542 unsigned int matchlen = 0;
543 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
544 {
545 unsigned int domainlen = strlen(ipset_pos->domain);
546 char *matchstart = daemon->namebuff + namelen - domainlen;
547 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
548 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
549 domainlen >= matchlen)
550 {
551 matchlen = domainlen;
552 sets = ipset_pos->sets;
553 }
554 }
555 }
556 #endif
557
558 /* If upstream is advertising a larger UDP packet size
559 than we allow, trim it so that we don't get overlarge
560 requests for the client. We can't do this for signed packets. */
561
562 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
563 {
564 unsigned short udpsz;
565 unsigned char *psave = sizep;
566
567 GETSHORT(udpsz, sizep);
568
569 if (!is_sign && udpsz > daemon->edns_pktsz)
570 PUTSHORT(daemon->edns_pktsz, psave);
571
572 if (check_subnet && !check_source(header, plen, pheader, query_source))
573 {
574 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
575 return 0;
576 }
577
578 if (added_pheader)
579 {
580 pheader = 0;
581 header->arcount = htons(0);
582 }
583 }
584
585 /* RFC 4035 sect 4.6 para 3 */
586 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
587 header->hb4 &= ~HB4_AD;
588
589 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
590 return resize_packet(header, n, pheader, plen);
591
592 /* Complain loudly if the upstream server is non-recursive. */
593 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
594 server && !(server->flags & SERV_WARNED_RECURSIVE))
595 {
596 prettyprint_addr(&server->addr, daemon->namebuff);
597 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
598 if (!option_bool(OPT_LOG))
599 server->flags |= SERV_WARNED_RECURSIVE;
600 }
601
602 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
603 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
604 {
605 munged = 1;
606 SET_RCODE(header, NXDOMAIN);
607 header->hb3 &= ~HB3_AA;
608 cache_secure = 0;
609 }
610 else
611 {
612 int doctored = 0;
613
614 if (RCODE(header) == NXDOMAIN &&
615 extract_request(header, n, daemon->namebuff, NULL) &&
616 check_for_local_domain(daemon->namebuff, now))
617 {
618 /* if we forwarded a query for a locally known name (because it was for
619 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
620 since we know that the domain exists, even if upstream doesn't */
621 munged = 1;
622 header->hb3 |= HB3_AA;
623 SET_RCODE(header, NOERROR);
624 cache_secure = 0;
625 }
626
627 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
628 {
629 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
630 munged = 1;
631 cache_secure = 0;
632 }
633
634 if (doctored)
635 cache_secure = 0;
636 }
637
638 #ifdef HAVE_DNSSEC
639 if (no_cache && !(header->hb4 & HB4_CD))
640 {
641 if (!option_bool(OPT_DNSSEC_DEBUG))
642 {
643 /* Bogus reply, turn into SERVFAIL */
644 SET_RCODE(header, SERVFAIL);
645 munged = 1;
646 }
647 }
648
649 if (option_bool(OPT_DNSSEC_VALID))
650 header->hb4 &= ~HB4_AD;
651
652 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
653 header->hb4 |= HB4_AD;
654
655 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
656 if (!do_bit)
657 n = filter_rrsigs(header, n);
658 #endif
659
660 /* do this after extract_addresses. Ensure NODATA reply and remove
661 nameserver info. */
662
663 if (munged)
664 {
665 header->ancount = htons(0);
666 header->nscount = htons(0);
667 header->arcount = htons(0);
668 }
669
670 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
671 sections of the packet. Find the new length here and put back pseudoheader
672 if it was removed. */
673 return resize_packet(header, n, pheader, plen);
674 }
675
676 /* sets new last_server */
677 void reply_query(int fd, int family, time_t now)
678 {
679 /* packet from peer server, extract data for cache, and send to
680 original requester */
681 struct dns_header *header;
682 union mysockaddr serveraddr;
683 struct frec *forward;
684 socklen_t addrlen = sizeof(serveraddr);
685 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
686 size_t nn;
687 struct server *server;
688 void *hash;
689 #ifndef HAVE_DNSSEC
690 unsigned int crc;
691 #endif
692
693 /* packet buffer overwritten */
694 daemon->srv_save = NULL;
695
696 /* Determine the address of the server replying so that we can mark that as good */
697 serveraddr.sa.sa_family = family;
698 #ifdef HAVE_IPV6
699 if (serveraddr.sa.sa_family == AF_INET6)
700 serveraddr.in6.sin6_flowinfo = 0;
701 #endif
702
703 header = (struct dns_header *)daemon->packet;
704
705 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
706 return;
707
708 /* spoof check: answer must come from known server, */
709 for (server = daemon->servers; server; server = server->next)
710 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
711 sockaddr_isequal(&server->addr, &serveraddr))
712 break;
713
714 if (!server)
715 return;
716
717 #ifdef HAVE_DNSSEC
718 hash = hash_questions(header, n, daemon->namebuff);
719 #else
720 hash = &crc;
721 crc = questions_crc(header, n, daemon->namebuff);
722 #endif
723
724 if (!(forward = lookup_frec(ntohs(header->id), hash)))
725 return;
726
727 if (daemon->ignore_addr && RCODE(header) == NOERROR &&
728 check_for_ignored_address(header, n, daemon->ignore_addr))
729 return;
730
731 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
732 !option_bool(OPT_ORDER) &&
733 forward->forwardall == 0)
734 /* for broken servers, attempt to send to another one. */
735 {
736 unsigned char *pheader;
737 size_t plen;
738 int is_sign;
739
740 /* recreate query from reply */
741 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
742 if (!is_sign)
743 {
744 header->ancount = htons(0);
745 header->nscount = htons(0);
746 header->arcount = htons(0);
747 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
748 {
749 header->hb3 &= ~(HB3_QR | HB3_TC);
750 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
751 return;
752 }
753 }
754 }
755
756 server = forward->sentto;
757
758 if ((forward->sentto->flags & SERV_TYPE) == 0)
759 {
760 if (RCODE(header) == REFUSED)
761 server = NULL;
762 else
763 {
764 struct server *last_server;
765
766 /* find good server by address if possible, otherwise assume the last one we sent to */
767 for (last_server = daemon->servers; last_server; last_server = last_server->next)
768 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
769 sockaddr_isequal(&last_server->addr, &serveraddr))
770 {
771 server = last_server;
772 break;
773 }
774 }
775 if (!option_bool(OPT_ALL_SERVERS))
776 daemon->last_server = server;
777 }
778
779 /* If the answer is an error, keep the forward record in place in case
780 we get a good reply from another server. Kill it when we've
781 had replies from all to avoid filling the forwarding table when
782 everything is broken */
783 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
784 {
785 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
786
787 if (option_bool(OPT_NO_REBIND))
788 check_rebind = !(forward->flags & FREC_NOREBIND);
789
790 /* Don't cache replies where DNSSEC validation was turned off, either
791 the upstream server told us so, or the original query specified it. */
792 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
793 no_cache_dnssec = 1;
794
795 #ifdef HAVE_DNSSEC
796 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
797 {
798 int status;
799
800 /* We've had a reply already, which we're validating. Ignore this duplicate */
801 if (forward->blocking_query)
802 return;
803
804 if (header->hb3 & HB3_TC)
805 {
806 /* Truncated answer can't be validated.
807 If this is an answer to a DNSSEC-generated query, we still
808 need to get the client to retry over TCP, so return
809 an answer with the TC bit set, even if the actual answer fits.
810 */
811 status = STAT_TRUNCATED;
812 }
813 else if (forward->flags & FREC_DNSKEY_QUERY)
814 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
815 else if (forward->flags & FREC_DS_QUERY)
816 {
817 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
818 if (status == STAT_NO_DS)
819 status = STAT_INSECURE;
820 }
821 else if (forward->flags & FREC_CHECK_NOSIGN)
822 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
823 else
824 {
825 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
826 if (status == STAT_NO_SIG)
827 {
828 if (option_bool(OPT_DNSSEC_NO_SIGN))
829 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
830 else
831 status = STAT_INSECURE;
832 }
833 }
834 /* Can't validate, as we're missing key data. Put this
835 answer aside, whilst we get that. */
836 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
837 {
838 struct frec *new, *orig;
839
840 /* Free any saved query */
841 if (forward->stash)
842 blockdata_free(forward->stash);
843
844 /* Now save reply pending receipt of key data */
845 if (!(forward->stash = blockdata_alloc((char *)header, n)))
846 return;
847 forward->stash_len = n;
848
849 anotherkey:
850 /* Find the original query that started it all.... */
851 for (orig = forward; orig->dependent; orig = orig->dependent);
852
853 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
854 status = STAT_INSECURE;
855 else
856 {
857 int fd;
858 struct frec *next = new->next;
859 *new = *forward; /* copy everything, then overwrite */
860 new->next = next;
861 new->blocking_query = NULL;
862 new->sentto = server;
863 new->rfd4 = NULL;
864 #ifdef HAVE_IPV6
865 new->rfd6 = NULL;
866 #endif
867 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
868
869 new->dependent = forward; /* to find query awaiting new one. */
870 forward->blocking_query = new; /* for garbage cleaning */
871 /* validate routines leave name of required record in daemon->keyname */
872 if (status == STAT_NEED_KEY)
873 {
874 new->flags |= FREC_DNSKEY_QUERY;
875 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
876 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
877 }
878 else
879 {
880 if (status == STAT_NEED_DS_NEG)
881 new->flags |= FREC_CHECK_NOSIGN;
882 else
883 new->flags |= FREC_DS_QUERY;
884 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
885 daemon->keyname, forward->class, T_DS, &server->addr);
886 }
887 if ((hash = hash_questions(header, nn, daemon->namebuff)))
888 memcpy(new->hash, hash, HASH_SIZE);
889 new->new_id = get_id();
890 header->id = htons(new->new_id);
891 /* Save query for retransmission */
892 new->stash = blockdata_alloc((char *)header, nn);
893 new->stash_len = nn;
894
895 /* Don't resend this. */
896 daemon->srv_save = NULL;
897
898 if (server->sfd)
899 fd = server->sfd->fd;
900 else
901 {
902 fd = -1;
903 #ifdef HAVE_IPV6
904 if (server->addr.sa.sa_family == AF_INET6)
905 {
906 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
907 fd = new->rfd6->fd;
908 }
909 else
910 #endif
911 {
912 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
913 fd = new->rfd4->fd;
914 }
915 }
916
917 if (fd != -1)
918 {
919 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
920 server->queries++;
921 }
922
923 return;
924 }
925 }
926
927 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
928 Now wind back down, pulling back answers which wouldn't previously validate
929 and validate them with the new data. Note that if an answer needs multiple
930 keys to validate, we may find another key is needed, in which case we set off
931 down another branch of the tree. Once we get to the original answer
932 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
933 while (forward->dependent)
934 {
935 struct frec *prev = forward->dependent;
936 free_frec(forward);
937 forward = prev;
938 forward->blocking_query = NULL; /* already gone */
939 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
940 n = forward->stash_len;
941
942 if (status == STAT_SECURE)
943 {
944 if (forward->flags & FREC_DNSKEY_QUERY)
945 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
946 else if (forward->flags & FREC_DS_QUERY)
947 {
948 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
949 if (status == STAT_NO_DS)
950 status = STAT_INSECURE;
951 }
952 else if (forward->flags & FREC_CHECK_NOSIGN)
953 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
954 else
955 {
956 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
957 if (status == STAT_NO_SIG)
958 {
959 if (option_bool(OPT_DNSSEC_NO_SIGN))
960 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
961 else
962 status = STAT_INSECURE;
963 }
964 }
965
966 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
967 goto anotherkey;
968 }
969 }
970
971 if (status == STAT_TRUNCATED)
972 header->hb3 |= HB3_TC;
973 else
974 {
975 char *result;
976
977 if (forward->work_counter == 0)
978 result = "ABANDONED";
979 else
980 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
981
982 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
983 }
984
985 no_cache_dnssec = 0;
986
987 if (status == STAT_SECURE)
988 cache_secure = 1;
989 else if (status == STAT_BOGUS)
990 no_cache_dnssec = 1;
991 }
992 #endif
993
994 /* restore CD bit to the value in the query */
995 if (forward->flags & FREC_CHECKING_DISABLED)
996 header->hb4 |= HB4_CD;
997 else
998 header->hb4 &= ~HB4_CD;
999
1000 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
1001 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
1002 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
1003 {
1004 header->id = htons(forward->orig_id);
1005 header->hb4 |= HB4_RA; /* recursion if available */
1006 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
1007 &forward->source, &forward->dest, forward->iface);
1008 }
1009 free_frec(forward); /* cancel */
1010 }
1011 }
1012
1013
1014 void receive_query(struct listener *listen, time_t now)
1015 {
1016 struct dns_header *header = (struct dns_header *)daemon->packet;
1017 union mysockaddr source_addr;
1018 unsigned short type;
1019 struct all_addr dst_addr;
1020 struct in_addr netmask, dst_addr_4;
1021 size_t m;
1022 ssize_t n;
1023 int if_index = 0, auth_dns = 0;
1024 #ifdef HAVE_AUTH
1025 int local_auth = 0;
1026 #endif
1027 struct iovec iov[1];
1028 struct msghdr msg;
1029 struct cmsghdr *cmptr;
1030 union {
1031 struct cmsghdr align; /* this ensures alignment */
1032 #ifdef HAVE_IPV6
1033 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1034 #endif
1035 #if defined(HAVE_LINUX_NETWORK)
1036 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1037 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1038 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1039 CMSG_SPACE(sizeof(unsigned int))];
1040 #elif defined(IP_RECVDSTADDR)
1041 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1042 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1043 #endif
1044 } control_u;
1045 #ifdef HAVE_IPV6
1046 /* Can always get recvd interface for IPv6 */
1047 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1048 #else
1049 int check_dst = !option_bool(OPT_NOWILD);
1050 #endif
1051
1052 /* packet buffer overwritten */
1053 daemon->srv_save = NULL;
1054
1055 dst_addr_4.s_addr = dst_addr.addr.addr4.s_addr = 0;
1056 netmask.s_addr = 0;
1057
1058 if (option_bool(OPT_NOWILD) && listen->iface)
1059 {
1060 auth_dns = listen->iface->dns_auth;
1061
1062 if (listen->family == AF_INET)
1063 {
1064 dst_addr_4 = dst_addr.addr.addr4 = listen->iface->addr.in.sin_addr;
1065 netmask = listen->iface->netmask;
1066 }
1067 }
1068
1069 iov[0].iov_base = daemon->packet;
1070 iov[0].iov_len = daemon->edns_pktsz;
1071
1072 msg.msg_control = control_u.control;
1073 msg.msg_controllen = sizeof(control_u);
1074 msg.msg_flags = 0;
1075 msg.msg_name = &source_addr;
1076 msg.msg_namelen = sizeof(source_addr);
1077 msg.msg_iov = iov;
1078 msg.msg_iovlen = 1;
1079
1080 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1081 return;
1082
1083 if (n < (int)sizeof(struct dns_header) ||
1084 (msg.msg_flags & MSG_TRUNC) ||
1085 (header->hb3 & HB3_QR))
1086 return;
1087
1088 source_addr.sa.sa_family = listen->family;
1089
1090 if (listen->family == AF_INET)
1091 {
1092 /* Source-port == 0 is an error, we can't send back to that.
1093 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1094 if (source_addr.in.sin_port == 0)
1095 return;
1096 }
1097 #ifdef HAVE_IPV6
1098 else
1099 {
1100 /* Source-port == 0 is an error, we can't send back to that. */
1101 if (source_addr.in6.sin6_port == 0)
1102 return;
1103 source_addr.in6.sin6_flowinfo = 0;
1104 }
1105 #endif
1106
1107 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1108 if (option_bool(OPT_LOCAL_SERVICE))
1109 {
1110 struct addrlist *addr;
1111 #ifdef HAVE_IPV6
1112 if (listen->family == AF_INET6)
1113 {
1114 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1115 if ((addr->flags & ADDRLIST_IPV6) &&
1116 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1117 break;
1118 }
1119 else
1120 #endif
1121 {
1122 struct in_addr netmask;
1123 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1124 {
1125 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1126 if (!(addr->flags & ADDRLIST_IPV6) &&
1127 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1128 break;
1129 }
1130 }
1131 if (!addr)
1132 {
1133 static int warned = 0;
1134 if (!warned)
1135 {
1136 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1137 warned = 1;
1138 }
1139 return;
1140 }
1141 }
1142
1143 if (check_dst)
1144 {
1145 struct ifreq ifr;
1146
1147 if (msg.msg_controllen < sizeof(struct cmsghdr))
1148 return;
1149
1150 #if defined(HAVE_LINUX_NETWORK)
1151 if (listen->family == AF_INET)
1152 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1153 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1154 {
1155 union {
1156 unsigned char *c;
1157 struct in_pktinfo *p;
1158 } p;
1159 p.c = CMSG_DATA(cmptr);
1160 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1161 if_index = p.p->ipi_ifindex;
1162 }
1163 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1164 if (listen->family == AF_INET)
1165 {
1166 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1167 {
1168 union {
1169 unsigned char *c;
1170 unsigned int *i;
1171 struct in_addr *a;
1172 #ifndef HAVE_SOLARIS_NETWORK
1173 struct sockaddr_dl *s;
1174 #endif
1175 } p;
1176 p.c = CMSG_DATA(cmptr);
1177 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1178 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1179 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1180 #ifdef HAVE_SOLARIS_NETWORK
1181 if_index = *(p.i);
1182 #else
1183 if_index = p.s->sdl_index;
1184 #endif
1185 }
1186 }
1187 #endif
1188
1189 #ifdef HAVE_IPV6
1190 if (listen->family == AF_INET6)
1191 {
1192 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1193 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1194 {
1195 union {
1196 unsigned char *c;
1197 struct in6_pktinfo *p;
1198 } p;
1199 p.c = CMSG_DATA(cmptr);
1200
1201 dst_addr.addr.addr6 = p.p->ipi6_addr;
1202 if_index = p.p->ipi6_ifindex;
1203 }
1204 }
1205 #endif
1206
1207 /* enforce available interface configuration */
1208
1209 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1210 return;
1211
1212 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1213 {
1214 if (!option_bool(OPT_CLEVERBIND))
1215 enumerate_interfaces(0);
1216 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1217 !label_exception(if_index, listen->family, &dst_addr))
1218 return;
1219 }
1220
1221 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1222 {
1223 struct irec *iface;
1224
1225 /* get the netmask of the interface whch has the address we were sent to.
1226 This is no neccessarily the interface we arrived on. */
1227
1228 for (iface = daemon->interfaces; iface; iface = iface->next)
1229 if (iface->addr.sa.sa_family == AF_INET &&
1230 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1231 break;
1232
1233 /* interface may be new */
1234 if (!iface && !option_bool(OPT_CLEVERBIND))
1235 enumerate_interfaces(0);
1236
1237 for (iface = daemon->interfaces; iface; iface = iface->next)
1238 if (iface->addr.sa.sa_family == AF_INET &&
1239 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1240 break;
1241
1242 /* If we failed, abandon localisation */
1243 if (iface)
1244 netmask = iface->netmask;
1245 else
1246 dst_addr_4.s_addr = 0;
1247 }
1248 }
1249
1250 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1251 {
1252 #ifdef HAVE_AUTH
1253 struct auth_zone *zone;
1254 #endif
1255 char *types = querystr(auth_dns ? "auth" : "query", type);
1256
1257 if (listen->family == AF_INET)
1258 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1259 (struct all_addr *)&source_addr.in.sin_addr, types);
1260 #ifdef HAVE_IPV6
1261 else
1262 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1263 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1264 #endif
1265
1266 #ifdef HAVE_AUTH
1267 /* find queries for zones we're authoritative for, and answer them directly */
1268 if (!auth_dns)
1269 for (zone = daemon->auth_zones; zone; zone = zone->next)
1270 if (in_zone(zone, daemon->namebuff, NULL))
1271 {
1272 auth_dns = 1;
1273 local_auth = 1;
1274 break;
1275 }
1276 #endif
1277
1278 #ifdef HAVE_LOOP
1279 /* Check for forwarding loop */
1280 if (detect_loop(daemon->namebuff, type))
1281 return;
1282 #endif
1283 }
1284
1285 #ifdef HAVE_AUTH
1286 if (auth_dns)
1287 {
1288 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1289 if (m >= 1)
1290 {
1291 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1292 (char *)header, m, &source_addr, &dst_addr, if_index);
1293 daemon->auth_answer++;
1294 }
1295 }
1296 else
1297 #endif
1298 {
1299 int ad_reqd, do_bit;
1300 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1301 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1302
1303 if (m >= 1)
1304 {
1305 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1306 (char *)header, m, &source_addr, &dst_addr, if_index);
1307 daemon->local_answer++;
1308 }
1309 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1310 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1311 daemon->queries_forwarded++;
1312 else
1313 daemon->local_answer++;
1314 }
1315 }
1316
1317 #ifdef HAVE_DNSSEC
1318
1319 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1320 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1321 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1322 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
1323 {
1324 struct crec *crecp;
1325 char *name_start = name;
1326 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1327
1328 if (status != STAT_INSECURE)
1329 return status;
1330
1331 while (1)
1332 {
1333 crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1334
1335 if (crecp && (crecp->flags & F_DNSSECOK))
1336 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1337
1338 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1339 {
1340 name_start++; /* chop a label off and try again */
1341 continue;
1342 }
1343
1344 /* Reached the root */
1345 if (!name_start)
1346 return STAT_BOGUS;
1347
1348 strcpy(keyname, name_start);
1349 return STAT_NEED_DS_NEG;
1350 }
1351 }
1352
1353 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1354 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
1355
1356 {
1357 char *name_start;
1358 unsigned char *p;
1359 int status;
1360
1361 /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a
1362 suitable NSEC reply to DS queries. */
1363 if (RCODE(header) != SERVFAIL)
1364 {
1365 status = dnssec_validate_ds(now, header, plen, name, keyname, class);
1366
1367 if (status != STAT_INSECURE)
1368 {
1369 if (status == STAT_NO_DS)
1370 status = STAT_INSECURE;
1371 return status;
1372 }
1373 }
1374
1375 p = (unsigned char *)(header+1);
1376
1377 if (extract_name(header, plen, &p, name, 1, 4) &&
1378 (name_start = strchr(name, '.')))
1379 {
1380 name_start++; /* chop a label off and try again */
1381 strcpy(keyname, name_start);
1382 return STAT_NEED_DS_NEG;
1383 }
1384
1385 return STAT_BOGUS;
1386 }
1387
1388 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1389 an unsigned answer is OK, or we find a signed DS, in which case there should be
1390 a signature, and the answer is BOGUS */
1391 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1392 char *keyname, struct server *server, int *keycount)
1393 {
1394 size_t m;
1395 unsigned char *packet, *payload;
1396 u16 *length;
1397 unsigned char *p = (unsigned char *)(header+1);
1398 int status;
1399 char *name_start = name;
1400
1401 /* Get first insecure entry in CNAME chain */
1402 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1403 if (status == STAT_BOGUS)
1404 return STAT_BOGUS;
1405
1406 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1407 return STAT_BOGUS;
1408
1409 payload = &packet[2];
1410 header = (struct dns_header *)payload;
1411 length = (u16 *)packet;
1412
1413 while (1)
1414 {
1415 unsigned char *newhash, hash[HASH_SIZE];
1416 unsigned char c1, c2;
1417 struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1418
1419 if (--(*keycount) == 0)
1420 {
1421 free(packet);
1422 return STAT_BOGUS;
1423 }
1424
1425 if (crecp && (crecp->flags & F_DNSSECOK))
1426 {
1427 free(packet);
1428 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1429 }
1430
1431 /* If we have cached insecurely that a DS doesn't exist,
1432 ise that is a hit for where to start looking for the secure one */
1433 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1434 {
1435 name_start++; /* chop a label off and try again */
1436 continue;
1437 }
1438
1439 /* reached the root */
1440 if (!name_start)
1441 {
1442 free(packet);
1443 return STAT_BOGUS;
1444 }
1445
1446 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1447
1448 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1449 if ((newhash = hash_questions(header, (unsigned int)m, name)))
1450 {
1451 memcpy(hash, newhash, HASH_SIZE);
1452
1453 *length = htons(m);
1454
1455 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1456 read_write(server->tcpfd, &c1, 1, 1) &&
1457 read_write(server->tcpfd, &c2, 1, 1) &&
1458 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1459 {
1460 m = (c1 << 8) | c2;
1461
1462 newhash = hash_questions(header, (unsigned int)m, name);
1463 if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
1464 {
1465 /* In this case only, a SERVFAIL reply allows us to continue up the tree, looking for a
1466 suitable NSEC reply to DS queries. */
1467 if (RCODE(header) == SERVFAIL)
1468 status = STAT_INSECURE;
1469 else
1470 /* Note this trashes all three name workspaces */
1471 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1472
1473 /* We've found a DS which proves the bit of the DNS where the
1474 original query is, is unsigned, so the answer is OK,
1475 if unvalidated. */
1476 if (status == STAT_NO_DS)
1477 {
1478 free(packet);
1479 return STAT_INSECURE;
1480 }
1481
1482 /* No DS, not got to DNSSEC-land yet, go up. */
1483 if (status == STAT_INSECURE)
1484 {
1485 p = (unsigned char *)(header+1);
1486
1487 if (extract_name(header, plen, &p, name, 1, 4) &&
1488 (name_start = strchr(name, '.')))
1489 {
1490 name_start++; /* chop a label off and try again */
1491 continue;
1492 }
1493 }
1494 }
1495 }
1496 }
1497
1498 free(packet);
1499
1500 return STAT_BOGUS;
1501 }
1502 }
1503
1504 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1505 int class, char *name, char *keyname, struct server *server, int *keycount)
1506 {
1507 /* Recurse up the key heirarchy */
1508 int new_status;
1509
1510 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1511 if (--(*keycount) == 0)
1512 return STAT_INSECURE;
1513
1514 if (status == STAT_NEED_KEY)
1515 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1516 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1517 {
1518 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1519 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1520 new_status = STAT_INSECURE;
1521 }
1522 else if (status == STAT_CHASE_CNAME)
1523 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1524 else
1525 {
1526 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1527
1528 if (new_status == STAT_NO_SIG)
1529 {
1530 if (option_bool(OPT_DNSSEC_NO_SIGN))
1531 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1532 else
1533 new_status = STAT_INSECURE;
1534 }
1535 }
1536
1537 /* Can't validate because we need a key/DS whose name now in keyname.
1538 Make query for same, and recurse to validate */
1539 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1540 {
1541 size_t m;
1542 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1543 unsigned char *payload = &packet[2];
1544 struct dns_header *new_header = (struct dns_header *)payload;
1545 u16 *length = (u16 *)packet;
1546 unsigned char c1, c2;
1547
1548 if (!packet)
1549 return STAT_INSECURE;
1550
1551 another_tcp_key:
1552 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1553 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1554
1555 *length = htons(m);
1556
1557 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1558 !read_write(server->tcpfd, &c1, 1, 1) ||
1559 !read_write(server->tcpfd, &c2, 1, 1) ||
1560 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1561 new_status = STAT_INSECURE;
1562 else
1563 {
1564 m = (c1 << 8) | c2;
1565
1566 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1567
1568 if (new_status == STAT_SECURE)
1569 {
1570 /* Reached a validated record, now try again at this level.
1571 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1572 If so, go round again. */
1573
1574 if (status == STAT_NEED_KEY)
1575 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1576 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1577 {
1578 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1579 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1580 new_status = STAT_INSECURE; /* Validated no DS */
1581 }
1582 else if (status == STAT_CHASE_CNAME)
1583 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1584 else
1585 {
1586 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1587
1588 if (new_status == STAT_NO_SIG)
1589 {
1590 if (option_bool(OPT_DNSSEC_NO_SIGN))
1591 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1592 else
1593 new_status = STAT_INSECURE;
1594 }
1595 }
1596
1597 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1598 goto another_tcp_key;
1599 }
1600 }
1601
1602 free(packet);
1603 }
1604 return new_status;
1605 }
1606 #endif
1607
1608
1609 /* The daemon forks before calling this: it should deal with one connection,
1610 blocking as neccessary, and then return. Note, need to be a bit careful
1611 about resources for debug mode, when the fork is suppressed: that's
1612 done by the caller. */
1613 unsigned char *tcp_request(int confd, time_t now,
1614 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1615 {
1616 size_t size = 0;
1617 int norebind = 0;
1618 #ifdef HAVE_AUTH
1619 int local_auth = 0;
1620 #endif
1621 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1622 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
1623 size_t m;
1624 unsigned short qtype;
1625 unsigned int gotname;
1626 unsigned char c1, c2;
1627 /* Max TCP packet + slop + size */
1628 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1629 unsigned char *payload = &packet[2];
1630 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1631 struct dns_header *header = (struct dns_header *)payload;
1632 u16 *length = (u16 *)packet;
1633 struct server *last_server;
1634 struct in_addr dst_addr_4;
1635 union mysockaddr peer_addr;
1636 socklen_t peer_len = sizeof(union mysockaddr);
1637
1638 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1639 return packet;
1640
1641 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1642 if (option_bool(OPT_LOCAL_SERVICE))
1643 {
1644 struct addrlist *addr;
1645 #ifdef HAVE_IPV6
1646 if (peer_addr.sa.sa_family == AF_INET6)
1647 {
1648 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1649 if ((addr->flags & ADDRLIST_IPV6) &&
1650 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1651 break;
1652 }
1653 else
1654 #endif
1655 {
1656 struct in_addr netmask;
1657 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1658 {
1659 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1660 if (!(addr->flags & ADDRLIST_IPV6) &&
1661 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1662 break;
1663 }
1664 }
1665 if (!addr)
1666 {
1667 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1668 return packet;
1669 }
1670 }
1671
1672 while (1)
1673 {
1674 if (!packet ||
1675 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1676 !(size = c1 << 8 | c2) ||
1677 !read_write(confd, payload, size, 1))
1678 return packet;
1679
1680 if (size < (int)sizeof(struct dns_header))
1681 continue;
1682
1683 check_subnet = 0;
1684
1685 /* save state of "cd" flag in query */
1686 if ((checking_disabled = header->hb4 & HB4_CD))
1687 no_cache_dnssec = 1;
1688
1689 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1690 {
1691 #ifdef HAVE_AUTH
1692 struct auth_zone *zone;
1693 #endif
1694 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1695
1696 if (peer_addr.sa.sa_family == AF_INET)
1697 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1698 (struct all_addr *)&peer_addr.in.sin_addr, types);
1699 #ifdef HAVE_IPV6
1700 else
1701 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1702 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1703 #endif
1704
1705 #ifdef HAVE_AUTH
1706 /* find queries for zones we're authoritative for, and answer them directly */
1707 if (!auth_dns)
1708 for (zone = daemon->auth_zones; zone; zone = zone->next)
1709 if (in_zone(zone, daemon->namebuff, NULL))
1710 {
1711 auth_dns = 1;
1712 local_auth = 1;
1713 break;
1714 }
1715 #endif
1716 }
1717
1718 if (local_addr->sa.sa_family == AF_INET)
1719 dst_addr_4 = local_addr->in.sin_addr;
1720 else
1721 dst_addr_4.s_addr = 0;
1722
1723 #ifdef HAVE_AUTH
1724 if (auth_dns)
1725 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1726 else
1727 #endif
1728 {
1729 /* m > 0 if answered from cache */
1730 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1731 dst_addr_4, netmask, now, &ad_question, &do_bit);
1732
1733 /* Do this by steam now we're not in the select() loop */
1734 check_log_writer(NULL);
1735
1736 if (m == 0)
1737 {
1738 unsigned int flags = 0;
1739 struct all_addr *addrp = NULL;
1740 int type = 0;
1741 char *domain = NULL;
1742
1743 if (option_bool(OPT_ADD_MAC))
1744 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1745
1746 if (option_bool(OPT_CLIENT_SUBNET))
1747 {
1748 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1749 if (size != new)
1750 {
1751 size = new;
1752 check_subnet = 1;
1753 }
1754 }
1755
1756 if (gotname)
1757 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1758
1759 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1760 last_server = daemon->servers;
1761 else
1762 last_server = daemon->last_server;
1763
1764 if (!flags && last_server)
1765 {
1766 struct server *firstsendto = NULL;
1767 #ifdef HAVE_DNSSEC
1768 unsigned char *newhash, hash[HASH_SIZE];
1769 if ((newhash = hash_questions(header, (unsigned int)size, daemon->namebuff)))
1770 memcpy(hash, newhash, HASH_SIZE);
1771 else
1772 memset(hash, 0, HASH_SIZE);
1773 #else
1774 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1775 #endif
1776 /* Loop round available servers until we succeed in connecting to one.
1777 Note that this code subtley ensures that consecutive queries on this connection
1778 which can go to the same server, do so. */
1779 while (1)
1780 {
1781 if (!firstsendto)
1782 firstsendto = last_server;
1783 else
1784 {
1785 if (!(last_server = last_server->next))
1786 last_server = daemon->servers;
1787
1788 if (last_server == firstsendto)
1789 break;
1790 }
1791
1792 /* server for wrong domain */
1793 if (type != (last_server->flags & SERV_TYPE) ||
1794 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)) ||
1795 (last_server->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
1796 continue;
1797
1798 if (last_server->tcpfd == -1)
1799 {
1800 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1801 continue;
1802
1803 #ifdef HAVE_CONNTRACK
1804 /* Copy connection mark of incoming query to outgoing connection. */
1805 if (option_bool(OPT_CONNTRACK))
1806 {
1807 unsigned int mark;
1808 struct all_addr local;
1809 #ifdef HAVE_IPV6
1810 if (local_addr->sa.sa_family == AF_INET6)
1811 local.addr.addr6 = local_addr->in6.sin6_addr;
1812 else
1813 #endif
1814 local.addr.addr4 = local_addr->in.sin_addr;
1815
1816 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1817 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1818 }
1819 #endif
1820
1821 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1822 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1823 {
1824 close(last_server->tcpfd);
1825 last_server->tcpfd = -1;
1826 continue;
1827 }
1828
1829 #ifdef HAVE_DNSSEC
1830 if (option_bool(OPT_DNSSEC_VALID))
1831 {
1832 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1833
1834 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1835 this allows it to select auth servers when one is returning bad data. */
1836 if (option_bool(OPT_DNSSEC_DEBUG))
1837 header->hb4 |= HB4_CD;
1838
1839 if (size != new_size)
1840 added_pheader = 1;
1841
1842 size = new_size;
1843 }
1844 #endif
1845 }
1846
1847 *length = htons(size);
1848
1849 /* get query name again for logging - may have been overwritten */
1850 if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1851 strcpy(daemon->namebuff, "query");
1852
1853 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1854 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1855 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1856 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1857 {
1858 close(last_server->tcpfd);
1859 last_server->tcpfd = -1;
1860 continue;
1861 }
1862
1863 m = (c1 << 8) | c2;
1864
1865 if (last_server->addr.sa.sa_family == AF_INET)
1866 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1867 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1868 #ifdef HAVE_IPV6
1869 else
1870 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1871 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1872 #endif
1873
1874 #ifdef HAVE_DNSSEC
1875 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1876 {
1877 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1878 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1879 char *result;
1880
1881 if (keycount == 0)
1882 result = "ABANDONED";
1883 else
1884 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1885
1886 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1887
1888 if (status == STAT_BOGUS)
1889 no_cache_dnssec = 1;
1890
1891 if (status == STAT_SECURE)
1892 cache_secure = 1;
1893 }
1894 #endif
1895
1896 /* restore CD bit to the value in the query */
1897 if (checking_disabled)
1898 header->hb4 |= HB4_CD;
1899 else
1900 header->hb4 &= ~HB4_CD;
1901
1902 /* There's no point in updating the cache, since this process will exit and
1903 lose the information after a few queries. We make this call for the alias and
1904 bogus-nxdomain side-effects. */
1905 /* If the crc of the question section doesn't match the crc we sent, then
1906 someone might be attempting to insert bogus values into the cache by
1907 sending replies containing questions and bogus answers. */
1908 #ifdef HAVE_DNSSEC
1909 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1910 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
1911 {
1912 m = 0;
1913 break;
1914 }
1915 #else
1916 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
1917 {
1918 m = 0;
1919 break;
1920 }
1921 #endif
1922
1923 m = process_reply(header, now, last_server, (unsigned int)m,
1924 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
1925 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
1926
1927 break;
1928 }
1929 }
1930
1931 /* In case of local answer or no connections made. */
1932 if (m == 0)
1933 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
1934 }
1935 }
1936
1937 check_log_writer(NULL);
1938
1939 *length = htons(m);
1940
1941 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
1942 return packet;
1943 }
1944 }
1945
1946 static struct frec *allocate_frec(time_t now)
1947 {
1948 struct frec *f;
1949
1950 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
1951 {
1952 f->next = daemon->frec_list;
1953 f->time = now;
1954 f->sentto = NULL;
1955 f->rfd4 = NULL;
1956 f->flags = 0;
1957 #ifdef HAVE_IPV6
1958 f->rfd6 = NULL;
1959 #endif
1960 #ifdef HAVE_DNSSEC
1961 f->dependent = NULL;
1962 f->blocking_query = NULL;
1963 f->stash = NULL;
1964 #endif
1965 daemon->frec_list = f;
1966 }
1967
1968 return f;
1969 }
1970
1971 struct randfd *allocate_rfd(int family)
1972 {
1973 static int finger = 0;
1974 int i;
1975
1976 /* limit the number of sockets we have open to avoid starvation of
1977 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1978
1979 for (i = 0; i < RANDOM_SOCKS; i++)
1980 if (daemon->randomsocks[i].refcount == 0)
1981 {
1982 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
1983 break;
1984
1985 daemon->randomsocks[i].refcount = 1;
1986 daemon->randomsocks[i].family = family;
1987 return &daemon->randomsocks[i];
1988 }
1989
1990 /* No free ones or cannot get new socket, grab an existing one */
1991 for (i = 0; i < RANDOM_SOCKS; i++)
1992 {
1993 int j = (i+finger) % RANDOM_SOCKS;
1994 if (daemon->randomsocks[j].refcount != 0 &&
1995 daemon->randomsocks[j].family == family &&
1996 daemon->randomsocks[j].refcount != 0xffff)
1997 {
1998 finger = j;
1999 daemon->randomsocks[j].refcount++;
2000 return &daemon->randomsocks[j];
2001 }
2002 }
2003
2004 return NULL; /* doom */
2005 }
2006
2007 void free_rfd(struct randfd *rfd)
2008 {
2009 if (rfd && --(rfd->refcount) == 0)
2010 close(rfd->fd);
2011 }
2012
2013 static void free_frec(struct frec *f)
2014 {
2015 free_rfd(f->rfd4);
2016 f->rfd4 = NULL;
2017 f->sentto = NULL;
2018 f->flags = 0;
2019
2020 #ifdef HAVE_IPV6
2021 free_rfd(f->rfd6);
2022 f->rfd6 = NULL;
2023 #endif
2024
2025 #ifdef HAVE_DNSSEC
2026 if (f->stash)
2027 {
2028 blockdata_free(f->stash);
2029 f->stash = NULL;
2030 }
2031
2032 /* Anything we're waiting on is pointless now, too */
2033 if (f->blocking_query)
2034 free_frec(f->blocking_query);
2035 f->blocking_query = NULL;
2036 f->dependent = NULL;
2037 #endif
2038 }
2039
2040 /* if wait==NULL return a free or older than TIMEOUT record.
2041 else return *wait zero if one available, or *wait is delay to
2042 when the oldest in-use record will expire. Impose an absolute
2043 limit of 4*TIMEOUT before we wipe things (for random sockets).
2044 If force is set, always return a result, even if we have
2045 to allocate above the limit. */
2046 struct frec *get_new_frec(time_t now, int *wait, int force)
2047 {
2048 struct frec *f, *oldest, *target;
2049 int count;
2050
2051 if (wait)
2052 *wait = 0;
2053
2054 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
2055 if (!f->sentto)
2056 target = f;
2057 else
2058 {
2059 if (difftime(now, f->time) >= 4*TIMEOUT)
2060 {
2061 free_frec(f);
2062 target = f;
2063 }
2064
2065 if (!oldest || difftime(f->time, oldest->time) <= 0)
2066 oldest = f;
2067 }
2068
2069 if (target)
2070 {
2071 target->time = now;
2072 return target;
2073 }
2074
2075 /* can't find empty one, use oldest if there is one
2076 and it's older than timeout */
2077 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2078 {
2079 /* keep stuff for twice timeout if we can by allocating a new
2080 record instead */
2081 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2082 count <= daemon->ftabsize &&
2083 (f = allocate_frec(now)))
2084 return f;
2085
2086 if (!wait)
2087 {
2088 free_frec(oldest);
2089 oldest->time = now;
2090 }
2091 return oldest;
2092 }
2093
2094 /* none available, calculate time 'till oldest record expires */
2095 if (!force && count > daemon->ftabsize)
2096 {
2097 static time_t last_log = 0;
2098
2099 if (oldest && wait)
2100 *wait = oldest->time + (time_t)TIMEOUT - now;
2101
2102 if ((int)difftime(now, last_log) > 5)
2103 {
2104 last_log = now;
2105 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2106 }
2107
2108 return NULL;
2109 }
2110
2111 if (!(f = allocate_frec(now)) && wait)
2112 /* wait one second on malloc failure */
2113 *wait = 1;
2114
2115 return f; /* OK if malloc fails and this is NULL */
2116 }
2117
2118 /* crc is all-ones if not known. */
2119 static struct frec *lookup_frec(unsigned short id, void *hash)
2120 {
2121 struct frec *f;
2122
2123 for(f = daemon->frec_list; f; f = f->next)
2124 if (f->sentto && f->new_id == id &&
2125 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2126 return f;
2127
2128 return NULL;
2129 }
2130
2131 static struct frec *lookup_frec_by_sender(unsigned short id,
2132 union mysockaddr *addr,
2133 void *hash)
2134 {
2135 struct frec *f;
2136
2137 for(f = daemon->frec_list; f; f = f->next)
2138 if (f->sentto &&
2139 f->orig_id == id &&
2140 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2141 sockaddr_isequal(&f->source, addr))
2142 return f;
2143
2144 return NULL;
2145 }
2146
2147 /* Send query packet again, if we can. */
2148 void resend_query()
2149 {
2150 if (daemon->srv_save)
2151 {
2152 int fd;
2153
2154 if (daemon->srv_save->sfd)
2155 fd = daemon->srv_save->sfd->fd;
2156 else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
2157 fd = daemon->rfd_save->fd;
2158 else
2159 return;
2160
2161 while(sendto(fd, daemon->packet, daemon->packet_len, 0,
2162 &daemon->srv_save->addr.sa, sa_len(&daemon->srv_save->addr)) == -1 && retry_send());
2163 }
2164 }
2165
2166 /* A server record is going away, remove references to it */
2167 void server_gone(struct server *server)
2168 {
2169 struct frec *f;
2170
2171 for (f = daemon->frec_list; f; f = f->next)
2172 if (f->sentto && f->sentto == server)
2173 free_frec(f);
2174
2175 if (daemon->last_server == server)
2176 daemon->last_server = NULL;
2177
2178 if (daemon->srv_save == server)
2179 daemon->srv_save = NULL;
2180 }
2181
2182 /* return unique random ids. */
2183 static unsigned short get_id(void)
2184 {
2185 unsigned short ret = 0;
2186
2187 do
2188 ret = rand16();
2189 while (lookup_frec(ret, NULL));
2190
2191 return ret;
2192 }
2193
2194
2195
2196
2197
Michael's tree of dnsmasq.