]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
28 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
29 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
);
30 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class);
31 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
);
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
38 union mysockaddr
*to
, struct all_addr
*source
,
44 struct cmsghdr align
; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
47 #elif defined(IP_SENDSRCADDR)
48 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
51 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
55 iov
[0].iov_base
= packet
;
58 msg
.msg_control
= NULL
;
59 msg
.msg_controllen
= 0;
62 msg
.msg_namelen
= sa_len(to
);
68 struct cmsghdr
*cmptr
;
69 msg
.msg_control
= &control_u
;
70 msg
.msg_controllen
= sizeof(control_u
);
71 cmptr
= CMSG_FIRSTHDR(&msg
);
73 if (to
->sa
.sa_family
== AF_INET
)
75 #if defined(HAVE_LINUX_NETWORK)
78 p
.ipi_spec_dst
= source
->addr
.addr4
;
79 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
80 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
81 cmptr
->cmsg_level
= IPPROTO_IP
;
82 cmptr
->cmsg_type
= IP_PKTINFO
;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
85 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
86 cmptr
->cmsg_level
= IPPROTO_IP
;
87 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
94 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
95 p
.ipi6_addr
= source
->addr
.addr6
;
96 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
97 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
98 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
99 cmptr
->cmsg_level
= IPPROTO_IPV6
;
102 (void)iface
; /* eliminate warning */
106 while (sendmsg(fd
, &msg
, 0) == -1)
111 /* If interface is still in DAD, EINVAL results - ignore that. */
115 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
122 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
123 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
130 unsigned int namelen
= strlen(qdomain
);
131 unsigned int matchlen
= 0;
133 unsigned int flags
= 0;
135 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
139 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
140 *type
= SERV_FOR_NODOTS
;
141 if (serv
->flags
& SERV_NO_ADDR
)
143 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
148 if (serv
->addr
.sa
.sa_family
== AF_INET
)
149 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
152 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
155 else if (!flags
|| (flags
& F_NXDOMAIN
))
159 else if (serv
->flags
& SERV_HAS_DOMAIN
)
161 unsigned int domainlen
= strlen(serv
->domain
);
162 char *matchstart
= qdomain
+ namelen
- domainlen
;
163 if (namelen
>= domainlen
&&
164 hostname_isequal(matchstart
, serv
->domain
) &&
165 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
167 if (serv
->flags
& SERV_NO_REBIND
)
171 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen
!= 0 && domainlen
== matchlen
)
177 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
179 if (!(sflag
& qtype
) && flags
== 0)
184 if (flags
& (F_IPV4
| F_IPV6
))
189 if (domainlen
>= matchlen
)
191 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
192 *domain
= serv
->domain
;
193 matchlen
= domainlen
;
194 if (serv
->flags
& SERV_NO_ADDR
)
196 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
201 if (serv
->addr
.sa
.sa_family
== AF_INET
)
202 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
205 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
208 else if (!flags
|| (flags
& F_NXDOMAIN
))
218 if (flags
== 0 && !(qtype
& F_QUERY
) &&
219 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
223 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
230 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
231 logflags
= F_NEG
| qtype
;
233 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
235 else if ((*type
) & SERV_USE_RESOLV
)
237 *type
= 0; /* use normal servers for this domain */
243 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
244 struct all_addr
*dst_addr
, unsigned int dst_iface
,
245 struct dns_header
*header
, size_t plen
, time_t now
,
246 struct frec
*forward
, int ad_reqd
, int do_bit
)
249 int type
= 0, norebind
= 0;
250 struct all_addr
*addrp
= NULL
;
251 unsigned int flags
= 0;
252 struct server
*start
= NULL
;
254 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
256 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
259 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
263 /* may be no servers available. */
264 if (!daemon
->servers
)
266 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward
->blocking_query
)
275 while (forward
->blocking_query
)
276 forward
= forward
->blocking_query
;
278 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
279 plen
= forward
->stash_len
;
281 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET
)
282 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
285 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
288 if (forward
->sentto
->sfd
)
289 fd
= forward
->sentto
->sfd
->fd
;
293 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
294 fd
= forward
->rfd6
->fd
;
297 fd
= forward
->rfd4
->fd
;
300 while (sendto(fd
, (char *)header
, plen
, 0,
301 &forward
->sentto
->addr
.sa
,
302 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
308 /* retry on existing query, send to all available servers */
309 domain
= forward
->sentto
->domain
;
310 forward
->sentto
->failed_queries
++;
311 if (!option_bool(OPT_ORDER
))
313 forward
->forwardall
= 1;
314 daemon
->last_server
= NULL
;
316 type
= forward
->sentto
->flags
& SERV_TYPE
;
317 if (!(start
= forward
->sentto
->next
))
318 start
= daemon
->servers
; /* at end of list, recycle */
319 header
->id
= htons(forward
->new_id
);
324 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
326 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
327 /* table full - server failure. */
332 forward
->source
= *udpaddr
;
333 forward
->dest
= *dst_addr
;
334 forward
->iface
= dst_iface
;
335 forward
->orig_id
= ntohs(header
->id
);
336 forward
->new_id
= get_id();
338 memcpy(forward
->hash
, hash
, HASH_SIZE
);
339 forward
->forwardall
= 0;
342 forward
->flags
|= FREC_NOREBIND
;
343 if (header
->hb4
& HB4_CD
)
344 forward
->flags
|= FREC_CHECKING_DISABLED
;
346 forward
->flags
|= FREC_AD_QUESTION
;
348 forward
->work_counter
= DNSSEC_WORK
;
350 forward
->flags
|= FREC_DO_QUESTION
;
353 header
->id
= htons(forward
->new_id
);
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
362 if (option_bool(OPT_ORDER
))
363 start
= daemon
->servers
;
364 else if (!(start
= daemon
->last_server
) ||
365 daemon
->forwardcount
++ > FORWARD_TEST
||
366 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
368 start
= daemon
->servers
;
369 forward
->forwardall
= 1;
370 daemon
->forwardcount
= 0;
371 daemon
->forwardtime
= now
;
376 start
= daemon
->servers
;
377 if (!option_bool(OPT_ORDER
))
378 forward
->forwardall
= 1;
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
387 if (!flags
&& forward
)
389 struct server
*firstsentto
= start
;
392 if (option_bool(OPT_ADD_MAC
))
393 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
395 if (option_bool(OPT_CLIENT_SUBNET
))
397 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
401 forward
->flags
|= FREC_HAS_SUBNET
;
406 if (option_bool(OPT_DNSSEC_VALID
))
408 size_t new_plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG
))
413 header
->hb4
|= HB4_CD
;
415 if (new_plen
!= plen
)
416 forward
->flags
|= FREC_ADDED_PHEADER
;
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
428 if (type
== (start
->flags
& SERV_TYPE
) &&
429 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
430 !(start
->flags
& SERV_LITERAL_ADDRESS
))
434 /* find server socket to use, may need to get random one. */
440 if (start
->addr
.sa
.sa_family
== AF_INET6
)
442 if (!forward
->rfd6
&&
443 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
445 daemon
->rfd_save
= forward
->rfd6
;
446 fd
= forward
->rfd6
->fd
;
451 if (!forward
->rfd4
&&
452 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
454 daemon
->rfd_save
= forward
->rfd4
;
455 fd
= forward
->rfd4
->fd
;
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK
))
463 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
464 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
469 if (sendto(fd
, (char *)header
, plen
, 0,
471 sa_len(&start
->addr
)) == -1)
478 /* Keep info in case we want to re-send this packet */
479 daemon
->srv_save
= start
;
480 daemon
->packet_len
= plen
;
483 strcpy(daemon
->namebuff
, "query");
484 if (start
->addr
.sa
.sa_family
== AF_INET
)
485 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
486 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
489 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
490 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
494 forward
->sentto
= start
;
495 if (!forward
->forwardall
)
497 forward
->forwardall
++;
501 if (!(start
= start
->next
))
502 start
= daemon
->servers
;
504 if (start
== firstsentto
)
511 /* could not send on, prepare to return */
512 header
->id
= htons(forward
->orig_id
);
513 free_frec(forward
); /* cancel */
516 /* could not send on, return empty answer or address if known for whole domain */
519 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
520 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
526 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
527 int no_cache
, int cache_secure
, int ad_reqd
, int do_bit
, int added_pheader
, int check_subnet
, union mysockaddr
*query_source
)
529 unsigned char *pheader
, *sizep
;
531 int munged
= 0, is_sign
;
538 /* Similar algorithm to search_servers. */
539 struct ipsets
*ipset_pos
;
540 unsigned int namelen
= strlen(daemon
->namebuff
);
541 unsigned int matchlen
= 0;
542 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
544 unsigned int domainlen
= strlen(ipset_pos
->domain
);
545 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
546 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
547 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
548 domainlen
>= matchlen
)
550 matchlen
= domainlen
;
551 sets
= ipset_pos
->sets
;
556 /* If upstream is advertising a larger UDP packet size
557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
560 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
562 unsigned short udpsz
;
563 unsigned char *psave
= sizep
;
565 GETSHORT(udpsz
, sizep
);
567 if (!is_sign
&& udpsz
> daemon
->edns_pktsz
)
568 PUTSHORT(daemon
->edns_pktsz
, psave
);
570 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
572 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
579 header
->arcount
= htons(0);
583 /* RFC 4035 sect 4.6 para 3 */
584 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
585 header
->hb4
&= ~HB4_AD
;
587 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
590 /* Complain loudly if the upstream server is non-recursive. */
591 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
592 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
594 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
595 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
596 if (!option_bool(OPT_LOG
))
597 server
->flags
|= SERV_WARNED_RECURSIVE
;
600 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
601 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
604 SET_RCODE(header
, NXDOMAIN
);
605 header
->hb3
&= ~HB3_AA
;
612 if (RCODE(header
) == NXDOMAIN
&&
613 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
614 check_for_local_domain(daemon
->namebuff
, now
))
616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
620 header
->hb3
|= HB3_AA
;
621 SET_RCODE(header
, NOERROR
);
625 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
627 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
637 if (no_cache
&& !(header
->hb4
& HB4_CD
))
639 if (!option_bool(OPT_DNSSEC_DEBUG
))
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header
, SERVFAIL
);
647 if (option_bool(OPT_DNSSEC_VALID
))
648 header
->hb4
&= ~HB4_AD
;
650 if (!(header
->hb4
& HB4_CD
) && ad_reqd
&& cache_secure
)
651 header
->hb4
|= HB4_AD
;
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
655 n
= filter_rrsigs(header
, n
);
658 /* do this after extract_addresses. Ensure NODATA reply and remove
663 header
->ancount
= htons(0);
664 header
->nscount
= htons(0);
665 header
->arcount
= htons(0);
668 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
669 sections of the packet. Find the new length here and put back pseudoheader
670 if it was removed. */
671 return resize_packet(header
, n
, pheader
, plen
);
674 /* sets new last_server */
675 void reply_query(int fd
, int family
, time_t now
)
677 /* packet from peer server, extract data for cache, and send to
678 original requester */
679 struct dns_header
*header
;
680 union mysockaddr serveraddr
;
681 struct frec
*forward
;
682 socklen_t addrlen
= sizeof(serveraddr
);
683 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
685 struct server
*server
;
691 /* packet buffer overwritten */
692 daemon
->srv_save
= NULL
;
694 /* Determine the address of the server replying so that we can mark that as good */
695 serveraddr
.sa
.sa_family
= family
;
697 if (serveraddr
.sa
.sa_family
== AF_INET6
)
698 serveraddr
.in6
.sin6_flowinfo
= 0;
701 header
= (struct dns_header
*)daemon
->packet
;
703 if (n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
))
706 /* spoof check: answer must come from known server, */
707 for (server
= daemon
->servers
; server
; server
= server
->next
)
708 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
709 sockaddr_isequal(&server
->addr
, &serveraddr
))
716 hash
= hash_questions(header
, n
, daemon
->namebuff
);
719 crc
= questions_crc(header
, n
, daemon
->namebuff
);
722 if (!(forward
= lookup_frec(ntohs(header
->id
), hash
)))
725 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
726 !option_bool(OPT_ORDER
) &&
727 forward
->forwardall
== 0)
728 /* for broken servers, attempt to send to another one. */
730 unsigned char *pheader
;
734 /* recreate query from reply */
735 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
738 header
->ancount
= htons(0);
739 header
->nscount
= htons(0);
740 header
->arcount
= htons(0);
741 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
743 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
744 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
, 0, 0);
750 server
= forward
->sentto
;
752 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
754 if (RCODE(header
) == REFUSED
)
758 struct server
*last_server
;
760 /* find good server by address if possible, otherwise assume the last one we sent to */
761 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
762 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
763 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
765 server
= last_server
;
769 if (!option_bool(OPT_ALL_SERVERS
))
770 daemon
->last_server
= server
;
773 /* If the answer is an error, keep the forward record in place in case
774 we get a good reply from another server. Kill it when we've
775 had replies from all to avoid filling the forwarding table when
776 everything is broken */
777 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 || RCODE(header
) != SERVFAIL
)
779 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
781 if (option_bool(OPT_NO_REBIND
))
782 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
784 /* Don't cache replies where DNSSEC validation was turned off, either
785 the upstream server told us so, or the original query specified it. */
786 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
790 if (server
&& option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
794 /* We've had a reply already, which we're validating. Ignore this duplicate */
795 if (forward
->blocking_query
)
798 if (header
->hb3
& HB3_TC
)
800 /* Truncated answer can't be validated.
801 If this is an answer to a DNSSEC-generated query, we still
802 need to get the client to retry over TCP, so return
803 an answer with the TC bit set, even if the actual answer fits.
805 status
= STAT_TRUNCATED
;
807 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
808 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
809 else if (forward
->flags
& FREC_DS_QUERY
)
811 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
812 if (status
== STAT_NO_DS
)
813 status
= STAT_INSECURE
;
815 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
816 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
819 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
820 if (status
== STAT_NO_SIG
)
822 if (option_bool(OPT_DNSSEC_NO_SIGN
))
823 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
825 status
= STAT_INSECURE
;
828 /* Can't validate, as we're missing key data. Put this
829 answer aside, whilst we get that. */
830 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
832 struct frec
*new, *orig
;
834 /* Free any saved query */
836 blockdata_free(forward
->stash
);
838 /* Now save reply pending receipt of key data */
839 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
841 forward
->stash_len
= n
;
844 /* Find the original query that started it all.... */
845 for (orig
= forward
; orig
->dependent
; orig
= orig
->dependent
);
847 if (--orig
->work_counter
== 0 || !(new = get_new_frec(now
, NULL
, 1)))
848 status
= STAT_INSECURE
;
852 struct frec
*next
= new->next
;
853 *new = *forward
; /* copy everything, then overwrite */
855 new->blocking_query
= NULL
;
860 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
| FREC_CHECK_NOSIGN
);
862 new->dependent
= forward
; /* to find query awaiting new one. */
863 forward
->blocking_query
= new; /* for garbage cleaning */
864 /* validate routines leave name of required record in daemon->keyname */
865 if (status
== STAT_NEED_KEY
)
867 new->flags
|= FREC_DNSKEY_QUERY
;
868 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
869 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
873 if (status
== STAT_NEED_DS_NEG
)
874 new->flags
|= FREC_CHECK_NOSIGN
;
876 new->flags
|= FREC_DS_QUERY
;
877 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
878 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
880 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
881 memcpy(new->hash
, hash
, HASH_SIZE
);
882 new->new_id
= get_id();
883 header
->id
= htons(new->new_id
);
884 /* Save query for retransmission */
885 new->stash
= blockdata_alloc((char *)header
, nn
);
888 /* Don't resend this. */
889 daemon
->srv_save
= NULL
;
892 fd
= server
->sfd
->fd
;
897 if (server
->addr
.sa
.sa_family
== AF_INET6
)
899 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
905 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
912 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
920 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
921 Now wind back down, pulling back answers which wouldn't previously validate
922 and validate them with the new data. Note that if an answer needs multiple
923 keys to validate, we may find another key is needed, in which case we set off
924 down another branch of the tree. Once we get to the original answer
925 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
926 while (forward
->dependent
)
928 struct frec
*prev
= forward
->dependent
;
931 forward
->blocking_query
= NULL
; /* already gone */
932 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
933 n
= forward
->stash_len
;
935 if (status
== STAT_SECURE
)
937 if (forward
->flags
& FREC_DNSKEY_QUERY
)
938 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
939 else if (forward
->flags
& FREC_DS_QUERY
)
941 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
942 if (status
== STAT_NO_DS
)
943 status
= STAT_INSECURE
;
945 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
946 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
949 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
950 if (status
== STAT_NO_SIG
)
952 if (option_bool(OPT_DNSSEC_NO_SIGN
))
953 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
955 status
= STAT_INSECURE
;
959 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
964 if (status
== STAT_TRUNCATED
)
965 header
->hb3
|= HB3_TC
;
970 if (forward
->work_counter
== 0)
971 result
= "ABANDONED";
973 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
975 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
980 if (status
== STAT_SECURE
)
982 else if (status
== STAT_BOGUS
)
987 /* restore CD bit to the value in the query */
988 if (forward
->flags
& FREC_CHECKING_DISABLED
)
989 header
->hb4
|= HB4_CD
;
991 header
->hb4
&= ~HB4_CD
;
993 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
994 forward
->flags
& FREC_AD_QUESTION
, forward
->flags
& FREC_DO_QUESTION
,
995 forward
->flags
& FREC_ADDED_PHEADER
, forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
997 header
->id
= htons(forward
->orig_id
);
998 header
->hb4
|= HB4_RA
; /* recursion if available */
999 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
1000 &forward
->source
, &forward
->dest
, forward
->iface
);
1002 free_frec(forward
); /* cancel */
1007 void receive_query(struct listener
*listen
, time_t now
)
1009 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
1010 union mysockaddr source_addr
;
1011 unsigned short type
;
1012 struct all_addr dst_addr
;
1013 struct in_addr netmask
, dst_addr_4
;
1016 int if_index
= 0, auth_dns
= 0;
1020 struct iovec iov
[1];
1022 struct cmsghdr
*cmptr
;
1024 struct cmsghdr align
; /* this ensures alignment */
1026 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
1028 #if defined(HAVE_LINUX_NETWORK)
1029 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
1030 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1031 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1032 CMSG_SPACE(sizeof(unsigned int))];
1033 #elif defined(IP_RECVDSTADDR)
1034 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1035 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
1039 /* Can always get recvd interface for IPv6 */
1040 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
1042 int check_dst
= !option_bool(OPT_NOWILD
);
1045 /* packet buffer overwritten */
1046 daemon
->srv_save
= NULL
;
1048 dst_addr_4
.s_addr
= 0;
1051 if (option_bool(OPT_NOWILD
) && listen
->iface
)
1053 auth_dns
= listen
->iface
->dns_auth
;
1055 if (listen
->family
== AF_INET
)
1057 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
1058 netmask
= listen
->iface
->netmask
;
1062 iov
[0].iov_base
= daemon
->packet
;
1063 iov
[0].iov_len
= daemon
->edns_pktsz
;
1065 msg
.msg_control
= control_u
.control
;
1066 msg
.msg_controllen
= sizeof(control_u
);
1068 msg
.msg_name
= &source_addr
;
1069 msg
.msg_namelen
= sizeof(source_addr
);
1073 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1076 if (n
< (int)sizeof(struct dns_header
) ||
1077 (msg
.msg_flags
& MSG_TRUNC
) ||
1078 (header
->hb3
& HB3_QR
))
1081 source_addr
.sa
.sa_family
= listen
->family
;
1083 if (listen
->family
== AF_INET
)
1085 /* Source-port == 0 is an error, we can't send back to that.
1086 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1087 if (source_addr
.in
.sin_port
== 0)
1093 /* Source-port == 0 is an error, we can't send back to that. */
1094 if (source_addr
.in6
.sin6_port
== 0)
1096 source_addr
.in6
.sin6_flowinfo
= 0;
1100 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1101 if (option_bool(OPT_LOCAL_SERVICE
))
1103 struct addrlist
*addr
;
1105 if (listen
->family
== AF_INET6
)
1107 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1108 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1109 is_same_net6(&addr
->addr
.addr
.addr6
, &source_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1115 struct in_addr netmask
;
1116 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1118 netmask
.s_addr
= 0xffffffff << (32 - addr
->prefixlen
);
1119 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1120 is_same_net(addr
->addr
.addr
.addr4
, source_addr
.in
.sin_addr
, netmask
))
1126 static int warned
= 0;
1129 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1140 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1143 #if defined(HAVE_LINUX_NETWORK)
1144 if (listen
->family
== AF_INET
)
1145 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1146 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1150 struct in_pktinfo
*p
;
1152 p
.c
= CMSG_DATA(cmptr
);
1153 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1154 if_index
= p
.p
->ipi_ifindex
;
1156 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1157 if (listen
->family
== AF_INET
)
1159 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1165 #ifndef HAVE_SOLARIS_NETWORK
1166 struct sockaddr_dl
*s
;
1169 p
.c
= CMSG_DATA(cmptr
);
1170 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1171 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1172 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1173 #ifdef HAVE_SOLARIS_NETWORK
1176 if_index
= p
.s
->sdl_index
;
1183 if (listen
->family
== AF_INET6
)
1185 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1186 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1190 struct in6_pktinfo
*p
;
1192 p
.c
= CMSG_DATA(cmptr
);
1194 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1195 if_index
= p
.p
->ipi6_ifindex
;
1200 /* enforce available interface configuration */
1202 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1205 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1207 if (!option_bool(OPT_CLEVERBIND
))
1208 enumerate_interfaces(0);
1209 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1210 !label_exception(if_index
, listen
->family
, &dst_addr
))
1214 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1218 /* get the netmask of the interface whch has the address we were sent to.
1219 This is no neccessarily the interface we arrived on. */
1221 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1222 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1223 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1226 /* interface may be new */
1227 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1228 enumerate_interfaces(0);
1230 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1231 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1232 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1235 /* If we failed, abandon localisation */
1237 netmask
= iface
->netmask
;
1239 dst_addr_4
.s_addr
= 0;
1243 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1246 struct auth_zone
*zone
;
1248 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1250 if (listen
->family
== AF_INET
)
1251 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1252 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1255 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1256 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1260 /* find queries for zones we're authoritative for, and answer them directly */
1262 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1263 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1275 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1278 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1279 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1280 daemon
->auth_answer
++;
1286 int ad_reqd
, do_bit
;
1287 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1288 dst_addr_4
, netmask
, now
, &ad_reqd
, &do_bit
);
1292 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1293 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1294 daemon
->local_answer
++;
1296 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1297 header
, (size_t)n
, now
, NULL
, ad_reqd
, do_bit
))
1298 daemon
->queries_forwarded
++;
1300 daemon
->local_answer
++;
1306 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1307 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1308 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1309 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
)
1312 char *name_start
= name
;
1313 int status
= dnssec_chase_cname(now
, header
, plen
, name
, keyname
);
1315 if (status
!= STAT_INSECURE
)
1320 crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1322 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1323 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1325 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1327 name_start
++; /* chop a label off and try again */
1331 /* Reached the root */
1335 strcpy(keyname
, name_start
);
1336 return STAT_NEED_DS_NEG
;
1340 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1341 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class)
1346 int status
= dnssec_validate_ds(now
, header
, plen
, name
, keyname
, class);
1348 if (status
!= STAT_INSECURE
)
1350 if (status
== STAT_NO_DS
)
1351 status
= STAT_INSECURE
;
1355 p
= (unsigned char *)(header
+1);
1357 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1358 (name_start
= strchr(name
, '.')))
1360 name_start
++; /* chop a label off and try again */
1361 strcpy(keyname
, name_start
);
1362 return STAT_NEED_DS_NEG
;
1368 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1369 an unsigned answer is OK, or we find a signed DS, in which case there should be
1370 a signature, and the answer is BOGUS */
1371 static int tcp_check_for_unsigned_zone(time_t now
, struct dns_header
*header
, size_t plen
, int class, char *name
,
1372 char *keyname
, struct server
*server
, int *keycount
)
1375 unsigned char *packet
, *payload
;
1377 unsigned char *p
= (unsigned char *)(header
+1);
1379 char *name_start
= name
;
1381 /* Get first insecure entry in CNAME chain */
1382 status
= tcp_key_recurse(now
, STAT_CHASE_CNAME
, header
, plen
, class, name
, keyname
, server
, keycount
);
1383 if (status
== STAT_BOGUS
)
1386 if (!(packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
))))
1389 payload
= &packet
[2];
1390 header
= (struct dns_header
*)payload
;
1391 length
= (u16
*)packet
;
1395 unsigned char *newhash
, hash
[HASH_SIZE
];
1396 unsigned char c1
, c2
;
1397 struct crec
*crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1399 if (--(*keycount
) == 0)
1405 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1408 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1411 /* If we have cached insecurely that a DS doesn't exist,
1412 ise that is a hit for where to start looking for the secure one */
1413 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1415 name_start
++; /* chop a label off and try again */
1419 /* reached the root */
1426 m
= dnssec_generate_query(header
, ((char *) header
) + 65536, name_start
, class, T_DS
, &server
->addr
);
1428 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1429 if ((newhash
= hash_questions(header
, (unsigned int)m
, name
)))
1431 memcpy(hash
, newhash
, HASH_SIZE
);
1435 if (read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) &&
1436 read_write(server
->tcpfd
, &c1
, 1, 1) &&
1437 read_write(server
->tcpfd
, &c2
, 1, 1) &&
1438 read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1442 newhash
= hash_questions(header
, (unsigned int)m
, name
);
1443 if (newhash
&& memcmp(hash
, newhash
, HASH_SIZE
) == 0)
1445 /* Note this trashes all three name workspaces */
1446 status
= tcp_key_recurse(now
, STAT_NEED_DS_NEG
, header
, m
, class, name
, keyname
, server
, keycount
);
1448 /* We've found a DS which proves the bit of the DNS where the
1449 original query is, is unsigned, so the answer is OK,
1451 if (status
== STAT_NO_DS
)
1454 return STAT_INSECURE
;
1457 /* No DS, not got to DNSSEC-land yet, go up. */
1458 if (status
== STAT_INSECURE
)
1460 p
= (unsigned char *)(header
+1);
1462 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1463 (name_start
= strchr(name
, '.')))
1465 name_start
++; /* chop a label off and try again */
1479 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
1480 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
)
1482 /* Recurse up the key heirarchy */
1485 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1486 if (--(*keycount
) == 0)
1487 return STAT_INSECURE
;
1489 if (status
== STAT_NEED_KEY
)
1490 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1491 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1493 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1494 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1495 new_status
= STAT_INSECURE
;
1497 else if (status
== STAT_CHASE_CNAME
)
1498 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1501 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1503 if (new_status
== STAT_NO_SIG
)
1505 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1506 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1508 new_status
= STAT_INSECURE
;
1512 /* Can't validate because we need a key/DS whose name now in keyname.
1513 Make query for same, and recurse to validate */
1514 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1517 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1518 unsigned char *payload
= &packet
[2];
1519 struct dns_header
*new_header
= (struct dns_header
*)payload
;
1520 u16
*length
= (u16
*)packet
;
1521 unsigned char c1
, c2
;
1524 return STAT_INSECURE
;
1527 m
= dnssec_generate_query(new_header
, ((char *) new_header
) + 65536, keyname
, class,
1528 new_status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1532 if (!read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) ||
1533 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1534 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1535 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1536 new_status
= STAT_INSECURE
;
1541 new_status
= tcp_key_recurse(now
, new_status
, new_header
, m
, class, name
, keyname
, server
, keycount
);
1543 if (new_status
== STAT_SECURE
)
1545 /* Reached a validated record, now try again at this level.
1546 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1547 If so, go round again. */
1549 if (status
== STAT_NEED_KEY
)
1550 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1551 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1553 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1554 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1555 new_status
= STAT_INSECURE
; /* Validated no DS */
1557 else if (status
== STAT_CHASE_CNAME
)
1558 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1561 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1563 if (new_status
== STAT_NO_SIG
)
1565 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1566 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1568 new_status
= STAT_INSECURE
;
1572 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1573 goto another_tcp_key
;
1584 /* The daemon forks before calling this: it should deal with one connection,
1585 blocking as neccessary, and then return. Note, need to be a bit careful
1586 about resources for debug mode, when the fork is suppressed: that's
1587 done by the caller. */
1588 unsigned char *tcp_request(int confd
, time_t now
,
1589 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1596 int checking_disabled
, ad_question
, do_bit
, added_pheader
= 0;
1597 int check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1599 unsigned short qtype
;
1600 unsigned int gotname
;
1601 unsigned char c1
, c2
;
1602 /* Max TCP packet + slop + size */
1603 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1604 unsigned char *payload
= &packet
[2];
1605 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1606 struct dns_header
*header
= (struct dns_header
*)payload
;
1607 u16
*length
= (u16
*)packet
;
1608 struct server
*last_server
;
1609 struct in_addr dst_addr_4
;
1610 union mysockaddr peer_addr
;
1611 socklen_t peer_len
= sizeof(union mysockaddr
);
1613 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1616 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1617 if (option_bool(OPT_LOCAL_SERVICE
))
1619 struct addrlist
*addr
;
1621 if (peer_addr
.sa
.sa_family
== AF_INET6
)
1623 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1624 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1625 is_same_net6(&addr
->addr
.addr
.addr6
, &peer_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1631 struct in_addr netmask
;
1632 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1634 netmask
.s_addr
= 0xffffffff << (32 - addr
->prefixlen
);
1635 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1636 is_same_net(addr
->addr
.addr
.addr4
, peer_addr
.in
.sin_addr
, netmask
))
1642 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1650 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1651 !(size
= c1
<< 8 | c2
) ||
1652 !read_write(confd
, payload
, size
, 1))
1655 if (size
< (int)sizeof(struct dns_header
))
1660 /* save state of "cd" flag in query */
1661 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1662 no_cache_dnssec
= 1;
1664 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1667 struct auth_zone
*zone
;
1669 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1671 if (peer_addr
.sa
.sa_family
== AF_INET
)
1672 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1673 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1676 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1677 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1681 /* find queries for zones we're authoritative for, and answer them directly */
1683 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1684 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1693 if (local_addr
->sa
.sa_family
== AF_INET
)
1694 dst_addr_4
= local_addr
->in
.sin_addr
;
1696 dst_addr_4
.s_addr
= 0;
1700 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1704 /* m > 0 if answered from cache */
1705 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1706 dst_addr_4
, netmask
, now
, &ad_question
, &do_bit
);
1708 /* Do this by steam now we're not in the select() loop */
1709 check_log_writer(NULL
);
1713 unsigned int flags
= 0;
1714 struct all_addr
*addrp
= NULL
;
1716 char *domain
= NULL
;
1718 if (option_bool(OPT_ADD_MAC
))
1719 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1721 if (option_bool(OPT_CLIENT_SUBNET
))
1723 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1732 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1734 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1735 last_server
= daemon
->servers
;
1737 last_server
= daemon
->last_server
;
1739 if (!flags
&& last_server
)
1741 struct server
*firstsendto
= NULL
;
1743 unsigned char *newhash
, hash
[HASH_SIZE
];
1744 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->keyname
)))
1745 memcpy(hash
, newhash
, HASH_SIZE
);
1747 memset(hash
, 0, HASH_SIZE
);
1749 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1751 /* Loop round available servers until we succeed in connecting to one.
1752 Note that this code subtley ensures that consecutive queries on this connection
1753 which can go to the same server, do so. */
1757 firstsendto
= last_server
;
1760 if (!(last_server
= last_server
->next
))
1761 last_server
= daemon
->servers
;
1763 if (last_server
== firstsendto
)
1767 /* server for wrong domain */
1768 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1769 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1772 if (last_server
->tcpfd
== -1)
1774 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1777 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1778 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1780 close(last_server
->tcpfd
);
1781 last_server
->tcpfd
= -1;
1786 if (option_bool(OPT_DNSSEC_VALID
))
1788 size_t new_size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1790 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1791 this allows it to select auth servers when one is returning bad data. */
1792 if (option_bool(OPT_DNSSEC_DEBUG
))
1793 header
->hb4
|= HB4_CD
;
1795 if (size
!= new_size
)
1802 #ifdef HAVE_CONNTRACK
1803 /* Copy connection mark of incoming query to outgoing connection. */
1804 if (option_bool(OPT_CONNTRACK
))
1807 struct all_addr local
;
1809 if (local_addr
->sa
.sa_family
== AF_INET6
)
1810 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1813 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1815 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1816 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1821 *length
= htons(size
);
1823 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1824 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1825 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1826 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1828 close(last_server
->tcpfd
);
1829 last_server
->tcpfd
= -1;
1836 strcpy(daemon
->namebuff
, "query");
1837 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1838 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1839 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1842 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1843 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1847 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1849 int keycount
= DNSSEC_WORK
; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1850 int status
= tcp_key_recurse(now
, STAT_TRUNCATED
, header
, m
, 0, daemon
->namebuff
, daemon
->keyname
, last_server
, &keycount
);
1854 result
= "ABANDONED";
1856 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1858 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
1860 if (status
== STAT_BOGUS
)
1861 no_cache_dnssec
= 1;
1863 if (status
== STAT_SECURE
)
1868 /* restore CD bit to the value in the query */
1869 if (checking_disabled
)
1870 header
->hb4
|= HB4_CD
;
1872 header
->hb4
&= ~HB4_CD
;
1874 /* There's no point in updating the cache, since this process will exit and
1875 lose the information after a few queries. We make this call for the alias and
1876 bogus-nxdomain side-effects. */
1877 /* If the crc of the question section doesn't match the crc we sent, then
1878 someone might be attempting to insert bogus values into the cache by
1879 sending replies containing questions and bogus answers. */
1881 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
1882 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
1888 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1895 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1896 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1897 cache_secure
, ad_question
, do_bit
, added_pheader
, check_subnet
, &peer_addr
);
1903 /* In case of local answer or no connections made. */
1905 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1909 check_log_writer(NULL
);
1913 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1918 static struct frec
*allocate_frec(time_t now
)
1922 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1924 f
->next
= daemon
->frec_list
;
1933 f
->dependent
= NULL
;
1934 f
->blocking_query
= NULL
;
1937 daemon
->frec_list
= f
;
1943 static struct randfd
*allocate_rfd(int family
)
1945 static int finger
= 0;
1948 /* limit the number of sockets we have open to avoid starvation of
1949 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1951 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1952 if (daemon
->randomsocks
[i
].refcount
== 0)
1954 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1957 daemon
->randomsocks
[i
].refcount
= 1;
1958 daemon
->randomsocks
[i
].family
= family
;
1959 return &daemon
->randomsocks
[i
];
1962 /* No free ones or cannot get new socket, grab an existing one */
1963 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1965 int j
= (i
+finger
) % RANDOM_SOCKS
;
1966 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1967 daemon
->randomsocks
[j
].family
== family
&&
1968 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1971 daemon
->randomsocks
[j
].refcount
++;
1972 return &daemon
->randomsocks
[j
];
1976 return NULL
; /* doom */
1978 static void free_frec(struct frec
*f
)
1980 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1988 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1997 blockdata_free(f
->stash
);
2001 /* Anything we're waiting on is pointless now, too */
2002 if (f
->blocking_query
)
2003 free_frec(f
->blocking_query
);
2004 f
->blocking_query
= NULL
;
2005 f
->dependent
= NULL
;
2009 /* if wait==NULL return a free or older than TIMEOUT record.
2010 else return *wait zero if one available, or *wait is delay to
2011 when the oldest in-use record will expire. Impose an absolute
2012 limit of 4*TIMEOUT before we wipe things (for random sockets).
2013 If force is set, always return a result, even if we have
2014 to allocate above the limit. */
2015 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
2017 struct frec
*f
, *oldest
, *target
;
2023 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
2028 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
2034 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
2044 /* can't find empty one, use oldest if there is one
2045 and it's older than timeout */
2046 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
2048 /* keep stuff for twice timeout if we can by allocating a new
2050 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
2051 count
<= daemon
->ftabsize
&&
2052 (f
= allocate_frec(now
)))
2063 /* none available, calculate time 'till oldest record expires */
2064 if (!force
&& count
> daemon
->ftabsize
)
2066 static time_t last_log
= 0;
2069 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
2071 if ((int)difftime(now
, last_log
) > 5)
2074 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
2080 if (!(f
= allocate_frec(now
)) && wait
)
2081 /* wait one second on malloc failure */
2084 return f
; /* OK if malloc fails and this is NULL */
2087 /* crc is all-ones if not known. */
2088 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
2092 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2093 if (f
->sentto
&& f
->new_id
== id
&&
2094 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
2100 static struct frec
*lookup_frec_by_sender(unsigned short id
,
2101 union mysockaddr
*addr
,
2106 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2109 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
2110 sockaddr_isequal(&f
->source
, addr
))
2116 /* A server record is going away, remove references to it */
2117 void server_gone(struct server
*server
)
2121 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
2122 if (f
->sentto
&& f
->sentto
== server
)
2125 if (daemon
->last_server
== server
)
2126 daemon
->last_server
= NULL
;
2128 if (daemon
->srv_save
== server
)
2129 daemon
->srv_save
= NULL
;
2132 /* return unique random ids. */
2133 static unsigned short get_id(void)
2135 unsigned short ret
= 0;
2139 while (lookup_frec(ret
, NULL
));