]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(unsigned int crc
);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
27 /* Send a UDP packet with its source address set as "source"
28 unless nowild is true, when we just send it with the kernel default */
29 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
30 union mysockaddr
*to
, struct all_addr
*source
,
36 struct cmsghdr align
; /* this ensures alignment */
37 #if defined(HAVE_LINUX_NETWORK)
38 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
39 #elif defined(IP_SENDSRCADDR)
40 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
43 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
47 iov
[0].iov_base
= packet
;
50 msg
.msg_control
= NULL
;
51 msg
.msg_controllen
= 0;
54 msg
.msg_namelen
= sa_len(to
);
60 struct cmsghdr
*cmptr
;
61 msg
.msg_control
= &control_u
;
62 msg
.msg_controllen
= sizeof(control_u
);
63 cmptr
= CMSG_FIRSTHDR(&msg
);
65 if (to
->sa
.sa_family
== AF_INET
)
67 #if defined(HAVE_LINUX_NETWORK)
70 p
.ipi_spec_dst
= source
->addr
.addr4
;
71 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
72 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
73 cmptr
->cmsg_level
= IPPROTO_IP
;
74 cmptr
->cmsg_type
= IP_PKTINFO
;
75 #elif defined(IP_SENDSRCADDR)
76 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
77 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
78 cmptr
->cmsg_level
= IPPROTO_IP
;
79 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
86 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
87 p
.ipi6_addr
= source
->addr
.addr6
;
88 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
89 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
90 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
91 cmptr
->cmsg_level
= IPPROTO_IPV6
;
94 (void)iface
; /* eliminate warning */
98 while (sendmsg(fd
, &msg
, 0) == -1)
103 /* If interface is still in DAD, EINVAL results - ignore that. */
107 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
114 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
115 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
118 /* If the query ends in the domain in one of our servers, set
119 domain to point to that name. We find the largest match to allow both
120 domain.org and sub.domain.org to exist. */
122 unsigned int namelen
= strlen(qdomain
);
123 unsigned int matchlen
= 0;
125 unsigned int flags
= 0;
127 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
128 /* domain matches take priority over NODOTS matches */
129 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
131 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
132 *type
= SERV_FOR_NODOTS
;
133 if (serv
->flags
& SERV_NO_ADDR
)
135 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
140 if (serv
->addr
.sa
.sa_family
== AF_INET
)
141 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
144 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
147 else if (!flags
|| (flags
& F_NXDOMAIN
))
151 else if (serv
->flags
& SERV_HAS_DOMAIN
)
153 unsigned int domainlen
= strlen(serv
->domain
);
154 char *matchstart
= qdomain
+ namelen
- domainlen
;
155 if (namelen
>= domainlen
&&
156 hostname_isequal(matchstart
, serv
->domain
) &&
157 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
159 if (serv
->flags
& SERV_NO_REBIND
)
163 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
164 /* implement priority rules for --address and --server for same domain.
165 --address wins if the address is for the correct AF
166 --server wins otherwise. */
167 if (domainlen
!= 0 && domainlen
== matchlen
)
169 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
171 if (!(sflag
& qtype
) && flags
== 0)
176 if (flags
& (F_IPV4
| F_IPV6
))
181 if (domainlen
>= matchlen
)
183 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
184 *domain
= serv
->domain
;
185 matchlen
= domainlen
;
186 if (serv
->flags
& SERV_NO_ADDR
)
188 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
193 if (serv
->addr
.sa
.sa_family
== AF_INET
)
194 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
197 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
200 else if (!flags
|| (flags
& F_NXDOMAIN
))
210 if (flags
== 0 && !(qtype
& F_QUERY
) &&
211 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
212 /* don't forward A or AAAA queries for simple names, except the empty name */
215 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
222 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
223 logflags
= F_NEG
| qtype
;
225 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
227 else if ((*type
) & SERV_USE_RESOLV
)
229 *type
= 0; /* use normal servers for this domain */
235 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
236 struct all_addr
*dst_addr
, unsigned int dst_iface
,
237 struct dns_header
*header
, size_t plen
, time_t now
, struct frec
*forward
)
240 int type
= 0, norebind
= 0;
241 struct all_addr
*addrp
= NULL
;
242 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
243 unsigned int flags
= 0;
244 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
245 struct server
*start
= NULL
;
247 /* RFC 4035: sect 4.6 para 2 */
248 header
->hb4
&= ~HB4_AD
;
250 /* may be no servers available. */
251 if (!daemon
->servers
)
253 else if (forward
|| (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, crc
)))
256 /* If we've already got an answer to this query, but we're awaiting keys for vaildation,
257 there's no point retrying the query, retry the key query instead...... */
258 if (forward
->blocking_query
)
262 while (forward
->blocking_query
)
263 forward
= forward
->blocking_query
;
265 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
266 plen
= forward
->stash_len
;
268 if (forward
->sentto
->addr
.sa
.sa_family
)
269 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
272 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
275 if (forward
->sentto
->sfd
)
276 fd
= forward
->sentto
->sfd
->fd
;
280 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
281 fd
= forward
->rfd6
->fd
;
284 fd
= forward
->rfd4
->fd
;
287 while (sendto(fd
, (char *)header
, plen
, 0,
288 &forward
->sentto
->addr
.sa
,
289 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
295 /* retry on existing query, send to all available servers */
296 domain
= forward
->sentto
->domain
;
297 forward
->sentto
->failed_queries
++;
298 if (!option_bool(OPT_ORDER
))
300 forward
->forwardall
= 1;
301 daemon
->last_server
= NULL
;
303 type
= forward
->sentto
->flags
& SERV_TYPE
;
304 if (!(start
= forward
->sentto
->next
))
305 start
= daemon
->servers
; /* at end of list, recycle */
306 header
->id
= htons(forward
->new_id
);
311 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
313 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
314 /* table full - server failure. */
319 forward
->source
= *udpaddr
;
320 forward
->dest
= *dst_addr
;
321 forward
->iface
= dst_iface
;
322 forward
->orig_id
= ntohs(header
->id
);
323 forward
->new_id
= get_id(crc
);
326 forward
->forwardall
= 0;
329 forward
->flags
|= FREC_NOREBIND
;
330 if (header
->hb4
& HB4_CD
)
331 forward
->flags
|= FREC_CHECKING_DISABLED
;
333 header
->id
= htons(forward
->new_id
);
335 /* In strict_order mode, always try servers in the order
336 specified in resolv.conf, if a domain is given
337 always try all the available servers,
338 otherwise, use the one last known to work. */
342 if (option_bool(OPT_ORDER
))
343 start
= daemon
->servers
;
344 else if (!(start
= daemon
->last_server
) ||
345 daemon
->forwardcount
++ > FORWARD_TEST
||
346 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
348 start
= daemon
->servers
;
349 forward
->forwardall
= 1;
350 daemon
->forwardcount
= 0;
351 daemon
->forwardtime
= now
;
356 start
= daemon
->servers
;
357 if (!option_bool(OPT_ORDER
))
358 forward
->forwardall
= 1;
363 /* check for send errors here (no route to host)
364 if we fail to send to all nameservers, send back an error
365 packet straight away (helps modem users when offline) */
367 if (!flags
&& forward
)
369 struct server
*firstsentto
= start
;
372 if (option_bool(OPT_ADD_MAC
))
373 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
375 if (option_bool(OPT_CLIENT_SUBNET
))
377 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
381 forward
->flags
|= FREC_HAS_SUBNET
;
386 if (option_bool(OPT_DNSSEC_VALID
))
388 plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
389 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
390 this allows it to select auth servers when one is returning bad data. */
391 if (option_bool(OPT_DNSSEC_DEBUG
))
392 header
->hb4
|= HB4_CD
;
398 /* only send to servers dealing with our domain.
399 domain may be NULL, in which case server->domain
400 must be NULL also. */
402 if (type
== (start
->flags
& SERV_TYPE
) &&
403 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
404 !(start
->flags
& SERV_LITERAL_ADDRESS
))
408 /* find server socket to use, may need to get random one. */
414 if (start
->addr
.sa
.sa_family
== AF_INET6
)
416 if (!forward
->rfd6
&&
417 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
419 daemon
->rfd_save
= forward
->rfd6
;
420 fd
= forward
->rfd6
->fd
;
425 if (!forward
->rfd4
&&
426 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
428 daemon
->rfd_save
= forward
->rfd4
;
429 fd
= forward
->rfd4
->fd
;
432 #ifdef HAVE_CONNTRACK
433 /* Copy connection mark of incoming query to outgoing connection. */
434 if (option_bool(OPT_CONNTRACK
))
437 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
438 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
443 if (sendto(fd
, (char *)header
, plen
, 0,
445 sa_len(&start
->addr
)) == -1)
452 /* Keep info in case we want to re-send this packet */
453 daemon
->srv_save
= start
;
454 daemon
->packet_len
= plen
;
457 strcpy(daemon
->namebuff
, "query");
458 if (start
->addr
.sa
.sa_family
== AF_INET
)
459 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
460 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
463 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
464 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
468 forward
->sentto
= start
;
469 if (!forward
->forwardall
)
471 forward
->forwardall
++;
475 if (!(start
= start
->next
))
476 start
= daemon
->servers
;
478 if (start
== firstsentto
)
485 /* could not send on, prepare to return */
486 header
->id
= htons(forward
->orig_id
);
487 free_frec(forward
); /* cancel */
490 /* could not send on, return empty answer or address if known for whole domain */
493 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
494 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
500 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
501 int no_cache
, int cache_secure
, int check_subnet
, union mysockaddr
*query_source
)
503 unsigned char *pheader
, *sizep
;
505 int munged
= 0, is_sign
;
509 /* Similar algorithm to search_servers. */
510 struct ipsets
*ipset_pos
;
511 unsigned int namelen
= strlen(daemon
->namebuff
);
512 unsigned int matchlen
= 0;
513 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
515 unsigned int domainlen
= strlen(ipset_pos
->domain
);
516 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
517 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
518 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
519 domainlen
>= matchlen
)
521 matchlen
= domainlen
;
522 sets
= ipset_pos
->sets
;
527 /* If upstream is advertising a larger UDP packet size
528 than we allow, trim it so that we don't get overlarge
529 requests for the client. We can't do this for signed packets. */
531 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
535 unsigned short udpsz
;
536 unsigned char *psave
= sizep
;
538 GETSHORT(udpsz
, sizep
);
539 if (udpsz
> daemon
->edns_pktsz
)
540 PUTSHORT(daemon
->edns_pktsz
, psave
);
543 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
545 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
550 /* RFC 4035 sect 4.6 para 3 */
551 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
552 header
->hb4
&= ~HB4_AD
;
555 if (option_bool(OPT_DNSSEC_VALID
))
556 header
->hb4
&= ~HB4_AD
;
558 if (!(header
->hb4
& HB4_CD
) && cache_secure
)
559 header
->hb4
|= HB4_AD
;
562 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
565 /* Complain loudly if the upstream server is non-recursive. */
566 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
567 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
569 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
570 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
571 if (!option_bool(OPT_LOG
))
572 server
->flags
|= SERV_WARNED_RECURSIVE
;
575 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
576 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
579 SET_RCODE(header
, NXDOMAIN
);
580 header
->hb3
&= ~HB3_AA
;
584 if (RCODE(header
) == NXDOMAIN
&&
585 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
586 check_for_local_domain(daemon
->namebuff
, now
))
588 /* if we forwarded a query for a locally known name (because it was for
589 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
590 since we know that the domain exists, even if upstream doesn't */
592 header
->hb3
|= HB3_AA
;
593 SET_RCODE(header
, NOERROR
);
596 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
))
598 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
604 if (no_cache
&& !(header
->hb4
& HB4_CD
))
606 if (option_bool(OPT_DNSSEC_PERMISS
))
611 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
613 querystr("", types
, type
);
614 my_syslog(LOG_WARNING
, _("DNSSEC validation failed: query %s%s"), daemon
->namebuff
, types
);
617 my_syslog(LOG_WARNING
, _("DNSSEC validation failed for unknown query"));
621 /* Bogus reply, turn into SERVFAIL */
622 SET_RCODE(header
, SERVFAIL
);
628 /* do this after extract_addresses. Ensure NODATA reply and remove
633 header
->ancount
= htons(0);
634 header
->nscount
= htons(0);
635 header
->arcount
= htons(0);
638 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
639 sections of the packet. Find the new length here and put back pseudoheader
640 if it was removed. */
641 return resize_packet(header
, n
, pheader
, plen
);
644 /* sets new last_server */
645 void reply_query(int fd
, int family
, time_t now
)
647 /* packet from peer server, extract data for cache, and send to
648 original requester */
649 struct dns_header
*header
;
650 union mysockaddr serveraddr
;
651 struct frec
*forward
;
652 socklen_t addrlen
= sizeof(serveraddr
);
653 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
655 struct server
*server
;
657 /* packet buffer overwritten */
658 daemon
->srv_save
= NULL
;
660 /* Determine the address of the server replying so that we can mark that as good */
661 serveraddr
.sa
.sa_family
= family
;
663 if (serveraddr
.sa
.sa_family
== AF_INET6
)
664 serveraddr
.in6
.sin6_flowinfo
= 0;
667 /* spoof check: answer must come from known server, */
668 for (server
= daemon
->servers
; server
; server
= server
->next
)
669 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
670 sockaddr_isequal(&server
->addr
, &serveraddr
))
673 header
= (struct dns_header
*)daemon
->packet
;
676 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
677 !(forward
= lookup_frec(ntohs(header
->id
), questions_crc(header
, n
, daemon
->namebuff
))))
680 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
681 !option_bool(OPT_ORDER
) &&
682 forward
->forwardall
== 0)
683 /* for broken servers, attempt to send to another one. */
685 unsigned char *pheader
;
689 /* recreate query from reply */
690 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
693 header
->ancount
= htons(0);
694 header
->nscount
= htons(0);
695 header
->arcount
= htons(0);
696 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
698 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
699 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
);
705 server
= forward
->sentto
;
707 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
709 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
713 struct server
*last_server
;
715 /* find good server by address if possible, otherwise assume the last one we sent to */
716 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
717 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
718 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
720 server
= last_server
;
724 if (!option_bool(OPT_ALL_SERVERS
))
725 daemon
->last_server
= server
;
728 /* If the answer is an error, keep the forward record in place in case
729 we get a good reply from another server. Kill it when we've
730 had replies from all to avoid filling the forwarding table when
731 everything is broken */
732 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
733 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
735 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
737 if (option_bool(OPT_NO_REBIND
))
738 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
740 /* Don't cache replies where DNSSEC validation was turned off, either
741 the upstream server told us so, or the original query specified it. */
742 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
746 if (option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
750 /* We've had a reply already, which we're validating. Ignore this duplicate */
751 if (forward
->blocking_query
)
754 if (header
->hb3
& HB3_TC
)
756 /* Truncated answer can't be validated.
757 If this is an answer to a DNSSEC-generated query, we still
758 need to get the client to retry over TCP, so return
759 an answer with the TC bit set, even if the actual answer fits.
761 status
= STAT_TRUNCATED
;
763 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
764 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
765 else if (forward
->flags
& FREC_DS_QUERY
)
766 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
768 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
770 /* Can't validate, as we're missing key data. Put this
771 answer aside, whilst we get that. */
772 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
776 if ((new = get_new_frec(now
, NULL
, 1)))
778 struct frec
*next
= new->next
;
779 *new = *forward
; /* copy everything, then overwrite */
781 new->blocking_query
= NULL
;
786 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
);
788 /* Free any saved query */
790 blockdata_free(forward
->stash
);
792 /* Now save reply pending receipt of key data */
793 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
794 free_frec(new); /* malloc failure, unwind */
799 forward
->stash_len
= n
;
801 new->dependent
= forward
; /* to find query awaiting new one. */
802 forward
->blocking_query
= new; /* for garbage cleaning */
803 /* validate routines leave name of required record in daemon->keyname */
804 if (status
== STAT_NEED_KEY
)
806 new->flags
|= FREC_DNSKEY_QUERY
;
807 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
808 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
812 new->flags
|= FREC_DS_QUERY
;
813 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
814 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
816 new->crc
= questions_crc(header
, nn
, daemon
->namebuff
);
817 new->new_id
= get_id(new->crc
);
818 header
->id
= htons(new->new_id
);
819 /* Save query for retransmission */
820 new->stash
= blockdata_alloc((char *)header
, nn
);
823 /* Don't resend this. */
824 daemon
->srv_save
= NULL
;
827 fd
= server
->sfd
->fd
;
832 if (server
->addr
.sa
.sa_family
== AF_INET6
)
834 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
840 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
847 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
856 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
857 Now wind back down, pulling back answers which wouldn't previously validate
858 and validate them with the new data. Failure to find needed data here is an internal error.
859 Once we get to the original answer (FREC_DNSSEC_QUERY not set) and it validates,
860 return it to the original requestor. */
861 while (forward
->dependent
)
863 struct frec
*prev
= forward
->dependent
;
866 forward
->blocking_query
= NULL
; /* already gone */
867 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
868 n
= forward
->stash_len
;
870 if (status
== STAT_SECURE
)
872 if (forward
->flags
& FREC_DNSKEY_QUERY
)
873 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
874 else if (forward
->flags
& FREC_DS_QUERY
)
875 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
877 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
879 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
881 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
882 status
= STAT_INSECURE
;
887 if (status
== STAT_TRUNCATED
)
888 header
->hb3
|= HB3_TC
;
890 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
891 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
895 if (status
== STAT_SECURE
)
897 else if (status
== STAT_BOGUS
)
900 /* restore CD bit to the value in the query */
901 if (forward
->flags
& FREC_CHECKING_DISABLED
)
902 header
->hb4
|= HB4_CD
;
904 header
->hb4
&= ~HB4_CD
;
908 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
909 forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
911 header
->id
= htons(forward
->orig_id
);
912 header
->hb4
|= HB4_RA
; /* recursion if available */
913 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
914 &forward
->source
, &forward
->dest
, forward
->iface
);
916 free_frec(forward
); /* cancel */
921 void receive_query(struct listener
*listen
, time_t now
)
923 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
924 union mysockaddr source_addr
;
926 struct all_addr dst_addr
;
927 struct in_addr netmask
, dst_addr_4
;
930 int if_index
= 0, auth_dns
= 0;
936 struct cmsghdr
*cmptr
;
938 struct cmsghdr align
; /* this ensures alignment */
940 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
942 #if defined(HAVE_LINUX_NETWORK)
943 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
944 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
945 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
946 CMSG_SPACE(sizeof(unsigned int))];
947 #elif defined(IP_RECVDSTADDR)
948 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
949 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
953 /* Can always get recvd interface for IPv6 */
954 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
956 int check_dst
= !option_bool(OPT_NOWILD
);
959 /* packet buffer overwritten */
960 daemon
->srv_save
= NULL
;
962 dst_addr_4
.s_addr
= 0;
965 if (option_bool(OPT_NOWILD
) && listen
->iface
)
967 auth_dns
= listen
->iface
->dns_auth
;
969 if (listen
->family
== AF_INET
)
971 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
972 netmask
= listen
->iface
->netmask
;
976 iov
[0].iov_base
= daemon
->packet
;
977 iov
[0].iov_len
= daemon
->edns_pktsz
;
979 msg
.msg_control
= control_u
.control
;
980 msg
.msg_controllen
= sizeof(control_u
);
982 msg
.msg_name
= &source_addr
;
983 msg
.msg_namelen
= sizeof(source_addr
);
987 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
990 if (n
< (int)sizeof(struct dns_header
) ||
991 (msg
.msg_flags
& MSG_TRUNC
) ||
992 (header
->hb3
& HB3_QR
))
995 source_addr
.sa
.sa_family
= listen
->family
;
997 if (listen
->family
== AF_INET6
)
998 source_addr
.in6
.sin6_flowinfo
= 0;
1005 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1008 #if defined(HAVE_LINUX_NETWORK)
1009 if (listen
->family
== AF_INET
)
1010 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1011 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1015 struct in_pktinfo
*p
;
1017 p
.c
= CMSG_DATA(cmptr
);
1018 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1019 if_index
= p
.p
->ipi_ifindex
;
1021 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1022 if (listen
->family
== AF_INET
)
1024 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1030 #ifndef HAVE_SOLARIS_NETWORK
1031 struct sockaddr_dl
*s
;
1034 p
.c
= CMSG_DATA(cmptr
);
1035 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1036 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1037 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1038 #ifdef HAVE_SOLARIS_NETWORK
1041 if_index
= p
.s
->sdl_index
;
1048 if (listen
->family
== AF_INET6
)
1050 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1051 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1055 struct in6_pktinfo
*p
;
1057 p
.c
= CMSG_DATA(cmptr
);
1059 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1060 if_index
= p
.p
->ipi6_ifindex
;
1065 /* enforce available interface configuration */
1067 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1070 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1072 if (!option_bool(OPT_CLEVERBIND
))
1073 enumerate_interfaces(0);
1074 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1075 !label_exception(if_index
, listen
->family
, &dst_addr
))
1079 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1083 /* get the netmask of the interface whch has the address we were sent to.
1084 This is no neccessarily the interface we arrived on. */
1086 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1087 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1088 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1091 /* interface may be new */
1092 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1093 enumerate_interfaces(0);
1095 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1096 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1097 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1100 /* If we failed, abandon localisation */
1102 netmask
= iface
->netmask
;
1104 dst_addr_4
.s_addr
= 0;
1108 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1112 struct auth_zone
*zone
;
1115 querystr(auth_dns
? "auth" : "query", types
, type
);
1117 if (listen
->family
== AF_INET
)
1118 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1119 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1122 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1123 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1127 /* find queries for zones we're authoritative for, and answer them directly */
1129 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1130 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1142 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1145 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1146 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1147 daemon
->auth_answer
++;
1153 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1154 dst_addr_4
, netmask
, now
);
1158 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1159 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1160 daemon
->local_answer
++;
1162 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1163 header
, (size_t)n
, now
, NULL
))
1164 daemon
->queries_forwarded
++;
1166 daemon
->local_answer
++;
1171 static int tcp_key_recurse(time_t now
, int status
, int class, char *keyname
, struct server
*server
)
1173 /* Recurse up the key heirarchy */
1175 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1176 unsigned char *payload
= &packet
[2];
1177 struct dns_header
*header
= (struct dns_header
*)payload
;
1178 u16
*length
= (u16
*)packet
;
1180 unsigned char c1
, c2
;
1182 n
= dnssec_generate_query(header
, ((char *) header
) + 65536, keyname
, class,
1183 status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1187 if (!read_write(server
->tcpfd
, packet
, n
+ sizeof(u16
), 0) ||
1188 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1189 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1190 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1192 close(server
->tcpfd
);
1194 new_status
= STAT_INSECURE
;
1200 if (status
== STAT_NEED_KEY
)
1201 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1203 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1205 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1207 if ((new_status
= tcp_key_recurse(now
, new_status
, class, daemon
->keyname
, server
) == STAT_SECURE
))
1209 if (status
== STAT_NEED_KEY
)
1210 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1212 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1214 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1216 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
1217 status
= STAT_INSECURE
;
1230 /* The daemon forks before calling this: it should deal with one connection,
1231 blocking as neccessary, and then return. Note, need to be a bit careful
1232 about resources for debug mode, when the fork is suppressed: that's
1233 done by the caller. */
1234 unsigned char *tcp_request(int confd
, time_t now
,
1235 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1242 int checking_disabled
, check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1244 unsigned short qtype
;
1245 unsigned int gotname
;
1246 unsigned char c1
, c2
;
1247 /* Max TCP packet + slop + size */
1248 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1249 unsigned char *payload
= &packet
[2];
1250 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1251 struct dns_header
*header
= (struct dns_header
*)payload
;
1252 u16
*length
= (u16
*)packet
;
1253 struct server
*last_server
;
1254 struct in_addr dst_addr_4
;
1255 union mysockaddr peer_addr
;
1256 socklen_t peer_len
= sizeof(union mysockaddr
);
1258 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1264 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1265 !(size
= c1
<< 8 | c2
) ||
1266 !read_write(confd
, payload
, size
, 1))
1269 if (size
< (int)sizeof(struct dns_header
))
1274 /* save state of "cd" flag in query */
1275 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1276 no_cache_dnssec
= 1;
1278 /* RFC 4035: sect 4.6 para 2 */
1279 header
->hb4
&= ~HB4_AD
;
1281 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1285 struct auth_zone
*zone
;
1287 querystr(auth_dns
? "auth" : "query", types
, qtype
);
1289 if (peer_addr
.sa
.sa_family
== AF_INET
)
1290 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1291 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1294 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1295 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1299 /* find queries for zones we're authoritative for, and answer them directly */
1301 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1302 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1311 if (local_addr
->sa
.sa_family
== AF_INET
)
1312 dst_addr_4
= local_addr
->in
.sin_addr
;
1314 dst_addr_4
.s_addr
= 0;
1318 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1322 /* m > 0 if answered from cache */
1323 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1324 dst_addr_4
, netmask
, now
);
1326 /* Do this by steam now we're not in the select() loop */
1327 check_log_writer(NULL
);
1331 unsigned int flags
= 0;
1332 struct all_addr
*addrp
= NULL
;
1334 char *domain
= NULL
;
1336 if (option_bool(OPT_ADD_MAC
))
1337 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1339 if (option_bool(OPT_CLIENT_SUBNET
))
1341 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1350 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1352 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1353 last_server
= daemon
->servers
;
1355 last_server
= daemon
->last_server
;
1357 if (!flags
&& last_server
)
1359 struct server
*firstsendto
= NULL
;
1360 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1362 /* Loop round available servers until we succeed in connecting to one.
1363 Note that this code subtley ensures that consecutive queries on this connection
1364 which can go to the same server, do so. */
1368 firstsendto
= last_server
;
1371 if (!(last_server
= last_server
->next
))
1372 last_server
= daemon
->servers
;
1374 if (last_server
== firstsendto
)
1378 /* server for wrong domain */
1379 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1380 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1383 if (last_server
->tcpfd
== -1)
1385 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1388 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1389 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1391 close(last_server
->tcpfd
);
1392 last_server
->tcpfd
= -1;
1397 if (option_bool(OPT_DNSSEC_VALID
))
1399 size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1400 header
->hb4
|= HB4_CD
;
1404 #ifdef HAVE_CONNTRACK
1405 /* Copy connection mark of incoming query to outgoing connection. */
1406 if (option_bool(OPT_CONNTRACK
))
1409 struct all_addr local
;
1411 if (local_addr
->sa
.sa_family
== AF_INET6
)
1412 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1415 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1417 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1418 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1423 *length
= htons(size
);
1425 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1426 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1427 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1428 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1430 close(last_server
->tcpfd
);
1431 last_server
->tcpfd
= -1;
1438 strcpy(daemon
->namebuff
, "query");
1439 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1440 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1441 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1444 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1445 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1449 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1453 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1455 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
1457 if ((status
= tcp_key_recurse(now
, status
, class, daemon
->keyname
, last_server
)) == STAT_SECURE
)
1458 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1461 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
1462 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1464 if (status
== STAT_BOGUS
)
1465 no_cache_dnssec
= 1;
1467 if (status
== STAT_SECURE
)
1472 /* restore CD bit to the value in the query */
1473 if (checking_disabled
)
1474 header
->hb4
|= HB4_CD
;
1476 header
->hb4
&= ~HB4_CD
;
1478 /* There's no point in updating the cache, since this process will exit and
1479 lose the information after a few queries. We make this call for the alias and
1480 bogus-nxdomain side-effects. */
1481 /* If the crc of the question section doesn't match the crc we sent, then
1482 someone might be attempting to insert bogus values into the cache by
1483 sending replies containing questions and bogus answers. */
1484 if (crc
== questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1485 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1486 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1487 cache_secure
, check_subnet
, &peer_addr
);
1493 /* In case of local answer or no connections made. */
1495 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1499 check_log_writer(NULL
);
1503 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1508 static struct frec
*allocate_frec(time_t now
)
1512 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1514 f
->next
= daemon
->frec_list
;
1523 f
->blocking_query
= NULL
;
1526 daemon
->frec_list
= f
;
1532 static struct randfd
*allocate_rfd(int family
)
1534 static int finger
= 0;
1537 /* limit the number of sockets we have open to avoid starvation of
1538 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1540 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1541 if (daemon
->randomsocks
[i
].refcount
== 0)
1543 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1546 daemon
->randomsocks
[i
].refcount
= 1;
1547 daemon
->randomsocks
[i
].family
= family
;
1548 return &daemon
->randomsocks
[i
];
1551 /* No free ones or cannot get new socket, grab an existing one */
1552 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1554 int j
= (i
+finger
) % RANDOM_SOCKS
;
1555 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1556 daemon
->randomsocks
[j
].family
== family
&&
1557 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1560 daemon
->randomsocks
[j
].refcount
++;
1561 return &daemon
->randomsocks
[j
];
1565 return NULL
; /* doom */
1567 static void free_frec(struct frec
*f
)
1569 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1577 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1586 blockdata_free(f
->stash
);
1590 /* Anything we're waiting on is pointless now, too */
1591 if (f
->blocking_query
)
1592 free_frec(f
->blocking_query
);
1593 f
->blocking_query
= NULL
;
1594 f
->dependent
= NULL
;
1598 /* if wait==NULL return a free or older than TIMEOUT record.
1599 else return *wait zero if one available, or *wait is delay to
1600 when the oldest in-use record will expire. Impose an absolute
1601 limit of 4*TIMEOUT before we wipe things (for random sockets).
1602 If force is set, always return a result, even if we have
1603 to allocate above the limit. */
1604 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
1606 struct frec
*f
, *oldest
, *target
;
1612 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1617 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1623 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1633 /* can't find empty one, use oldest if there is one
1634 and it's older than timeout */
1635 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1637 /* keep stuff for twice timeout if we can by allocating a new
1639 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1640 count
<= daemon
->ftabsize
&&
1641 (f
= allocate_frec(now
)))
1652 /* none available, calculate time 'till oldest record expires */
1653 if (!force
&& count
> daemon
->ftabsize
)
1655 static time_t last_log
= 0;
1658 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1660 if ((int)difftime(now
, last_log
) > 5)
1663 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1669 if (!(f
= allocate_frec(now
)) && wait
)
1670 /* wait one second on malloc failure */
1673 return f
; /* OK if malloc fails and this is NULL */
1676 /* crc is all-ones if not known. */
1677 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
)
1681 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1682 if (f
->sentto
&& f
->new_id
== id
&&
1683 (f
->crc
== crc
|| crc
== 0xffffffff))
1689 static struct frec
*lookup_frec_by_sender(unsigned short id
,
1690 union mysockaddr
*addr
,
1695 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1699 sockaddr_isequal(&f
->source
, addr
))
1705 /* A server record is going away, remove references to it */
1706 void server_gone(struct server
*server
)
1710 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
1711 if (f
->sentto
&& f
->sentto
== server
)
1714 if (daemon
->last_server
== server
)
1715 daemon
->last_server
= NULL
;
1717 if (daemon
->srv_save
== server
)
1718 daemon
->srv_save
= NULL
;
1721 /* return unique random ids. */
1722 static unsigned short get_id(unsigned int crc
)
1724 unsigned short ret
= 0;
1728 while (lookup_frec(ret
, crc
));