]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
27 /* Send a UDP packet with its source address set as "source"
28 unless nowild is true, when we just send it with the kernel default */
29 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
30 union mysockaddr
*to
, struct all_addr
*source
,
36 struct cmsghdr align
; /* this ensures alignment */
37 #if defined(HAVE_LINUX_NETWORK)
38 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
39 #elif defined(IP_SENDSRCADDR)
40 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
43 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
47 iov
[0].iov_base
= packet
;
50 msg
.msg_control
= NULL
;
51 msg
.msg_controllen
= 0;
54 msg
.msg_namelen
= sa_len(to
);
60 struct cmsghdr
*cmptr
;
61 msg
.msg_control
= &control_u
;
62 msg
.msg_controllen
= sizeof(control_u
);
63 cmptr
= CMSG_FIRSTHDR(&msg
);
65 if (to
->sa
.sa_family
== AF_INET
)
67 #if defined(HAVE_LINUX_NETWORK)
70 p
.ipi_spec_dst
= source
->addr
.addr4
;
71 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
72 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
73 cmptr
->cmsg_level
= IPPROTO_IP
;
74 cmptr
->cmsg_type
= IP_PKTINFO
;
75 #elif defined(IP_SENDSRCADDR)
76 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
77 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
78 cmptr
->cmsg_level
= IPPROTO_IP
;
79 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
86 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
87 p
.ipi6_addr
= source
->addr
.addr6
;
88 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
89 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
90 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
91 cmptr
->cmsg_level
= IPPROTO_IPV6
;
94 (void)iface
; /* eliminate warning */
98 while (sendmsg(fd
, &msg
, 0) == -1)
103 /* If interface is still in DAD, EINVAL results - ignore that. */
107 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
114 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
115 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
118 /* If the query ends in the domain in one of our servers, set
119 domain to point to that name. We find the largest match to allow both
120 domain.org and sub.domain.org to exist. */
122 unsigned int namelen
= strlen(qdomain
);
123 unsigned int matchlen
= 0;
125 unsigned int flags
= 0;
127 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
128 /* domain matches take priority over NODOTS matches */
129 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
131 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
132 *type
= SERV_FOR_NODOTS
;
133 if (serv
->flags
& SERV_NO_ADDR
)
135 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
140 if (serv
->addr
.sa
.sa_family
== AF_INET
)
141 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
144 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
147 else if (!flags
|| (flags
& F_NXDOMAIN
))
151 else if (serv
->flags
& SERV_HAS_DOMAIN
)
153 unsigned int domainlen
= strlen(serv
->domain
);
154 char *matchstart
= qdomain
+ namelen
- domainlen
;
155 if (namelen
>= domainlen
&&
156 hostname_isequal(matchstart
, serv
->domain
) &&
157 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
159 if (serv
->flags
& SERV_NO_REBIND
)
163 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
164 /* implement priority rules for --address and --server for same domain.
165 --address wins if the address is for the correct AF
166 --server wins otherwise. */
167 if (domainlen
!= 0 && domainlen
== matchlen
)
169 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
171 if (!(sflag
& qtype
) && flags
== 0)
176 if (flags
& (F_IPV4
| F_IPV6
))
181 if (domainlen
>= matchlen
)
183 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
184 *domain
= serv
->domain
;
185 matchlen
= domainlen
;
186 if (serv
->flags
& SERV_NO_ADDR
)
188 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
193 if (serv
->addr
.sa
.sa_family
== AF_INET
)
194 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
197 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
200 else if (!flags
|| (flags
& F_NXDOMAIN
))
210 if (flags
== 0 && !(qtype
& F_QUERY
) &&
211 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
212 /* don't forward A or AAAA queries for simple names, except the empty name */
215 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
222 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
223 logflags
= F_NEG
| qtype
;
225 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
227 else if ((*type
) & SERV_USE_RESOLV
)
229 *type
= 0; /* use normal servers for this domain */
235 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
236 struct all_addr
*dst_addr
, unsigned int dst_iface
,
237 struct dns_header
*header
, size_t plen
, time_t now
, struct frec
*forward
)
240 int type
= 0, norebind
= 0;
241 struct all_addr
*addrp
= NULL
;
242 unsigned int flags
= 0;
243 struct server
*start
= NULL
;
245 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
247 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
250 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
252 /* RFC 4035: sect 4.6 para 2 */
253 header
->hb4
&= ~HB4_AD
;
255 /* may be no servers available. */
256 if (!daemon
->servers
)
258 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
261 /* If we've already got an answer to this query, but we're awaiting keys for vaildation,
262 there's no point retrying the query, retry the key query instead...... */
263 if (forward
->blocking_query
)
267 while (forward
->blocking_query
)
268 forward
= forward
->blocking_query
;
270 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
271 plen
= forward
->stash_len
;
273 if (forward
->sentto
->addr
.sa
.sa_family
)
274 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
277 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
280 if (forward
->sentto
->sfd
)
281 fd
= forward
->sentto
->sfd
->fd
;
285 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
286 fd
= forward
->rfd6
->fd
;
289 fd
= forward
->rfd4
->fd
;
292 while (sendto(fd
, (char *)header
, plen
, 0,
293 &forward
->sentto
->addr
.sa
,
294 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
300 /* retry on existing query, send to all available servers */
301 domain
= forward
->sentto
->domain
;
302 forward
->sentto
->failed_queries
++;
303 if (!option_bool(OPT_ORDER
))
305 forward
->forwardall
= 1;
306 daemon
->last_server
= NULL
;
308 type
= forward
->sentto
->flags
& SERV_TYPE
;
309 if (!(start
= forward
->sentto
->next
))
310 start
= daemon
->servers
; /* at end of list, recycle */
311 header
->id
= htons(forward
->new_id
);
316 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
318 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
319 /* table full - server failure. */
324 forward
->source
= *udpaddr
;
325 forward
->dest
= *dst_addr
;
326 forward
->iface
= dst_iface
;
327 forward
->orig_id
= ntohs(header
->id
);
328 forward
->new_id
= get_id();
330 memcpy(forward
->hash
, hash
, HASH_SIZE
);
331 forward
->forwardall
= 0;
334 forward
->flags
|= FREC_NOREBIND
;
335 if (header
->hb4
& HB4_CD
)
336 forward
->flags
|= FREC_CHECKING_DISABLED
;
338 header
->id
= htons(forward
->new_id
);
340 /* In strict_order mode, always try servers in the order
341 specified in resolv.conf, if a domain is given
342 always try all the available servers,
343 otherwise, use the one last known to work. */
347 if (option_bool(OPT_ORDER
))
348 start
= daemon
->servers
;
349 else if (!(start
= daemon
->last_server
) ||
350 daemon
->forwardcount
++ > FORWARD_TEST
||
351 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
353 start
= daemon
->servers
;
354 forward
->forwardall
= 1;
355 daemon
->forwardcount
= 0;
356 daemon
->forwardtime
= now
;
361 start
= daemon
->servers
;
362 if (!option_bool(OPT_ORDER
))
363 forward
->forwardall
= 1;
368 /* check for send errors here (no route to host)
369 if we fail to send to all nameservers, send back an error
370 packet straight away (helps modem users when offline) */
372 if (!flags
&& forward
)
374 struct server
*firstsentto
= start
;
377 if (option_bool(OPT_ADD_MAC
))
378 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
380 if (option_bool(OPT_CLIENT_SUBNET
))
382 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
386 forward
->flags
|= FREC_HAS_SUBNET
;
391 if (option_bool(OPT_DNSSEC_VALID
))
393 plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
394 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
395 this allows it to select auth servers when one is returning bad data. */
396 if (option_bool(OPT_DNSSEC_DEBUG
))
397 header
->hb4
|= HB4_CD
;
403 /* only send to servers dealing with our domain.
404 domain may be NULL, in which case server->domain
405 must be NULL also. */
407 if (type
== (start
->flags
& SERV_TYPE
) &&
408 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
409 !(start
->flags
& SERV_LITERAL_ADDRESS
))
413 /* find server socket to use, may need to get random one. */
419 if (start
->addr
.sa
.sa_family
== AF_INET6
)
421 if (!forward
->rfd6
&&
422 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
424 daemon
->rfd_save
= forward
->rfd6
;
425 fd
= forward
->rfd6
->fd
;
430 if (!forward
->rfd4
&&
431 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
433 daemon
->rfd_save
= forward
->rfd4
;
434 fd
= forward
->rfd4
->fd
;
437 #ifdef HAVE_CONNTRACK
438 /* Copy connection mark of incoming query to outgoing connection. */
439 if (option_bool(OPT_CONNTRACK
))
442 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
443 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
448 if (sendto(fd
, (char *)header
, plen
, 0,
450 sa_len(&start
->addr
)) == -1)
457 /* Keep info in case we want to re-send this packet */
458 daemon
->srv_save
= start
;
459 daemon
->packet_len
= plen
;
462 strcpy(daemon
->namebuff
, "query");
463 if (start
->addr
.sa
.sa_family
== AF_INET
)
464 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
465 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
468 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
469 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
473 forward
->sentto
= start
;
474 if (!forward
->forwardall
)
476 forward
->forwardall
++;
480 if (!(start
= start
->next
))
481 start
= daemon
->servers
;
483 if (start
== firstsentto
)
490 /* could not send on, prepare to return */
491 header
->id
= htons(forward
->orig_id
);
492 free_frec(forward
); /* cancel */
495 /* could not send on, return empty answer or address if known for whole domain */
498 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
499 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
505 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
506 int no_cache
, int cache_secure
, int check_subnet
, union mysockaddr
*query_source
)
508 unsigned char *pheader
, *sizep
;
510 int munged
= 0, is_sign
;
514 /* Similar algorithm to search_servers. */
515 struct ipsets
*ipset_pos
;
516 unsigned int namelen
= strlen(daemon
->namebuff
);
517 unsigned int matchlen
= 0;
518 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
520 unsigned int domainlen
= strlen(ipset_pos
->domain
);
521 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
522 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
523 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
524 domainlen
>= matchlen
)
526 matchlen
= domainlen
;
527 sets
= ipset_pos
->sets
;
532 /* If upstream is advertising a larger UDP packet size
533 than we allow, trim it so that we don't get overlarge
534 requests for the client. We can't do this for signed packets. */
536 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
540 unsigned short udpsz
;
541 unsigned char *psave
= sizep
;
543 GETSHORT(udpsz
, sizep
);
544 if (udpsz
> daemon
->edns_pktsz
)
545 PUTSHORT(daemon
->edns_pktsz
, psave
);
548 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
550 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
555 /* RFC 4035 sect 4.6 para 3 */
556 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
557 header
->hb4
&= ~HB4_AD
;
559 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
562 /* Complain loudly if the upstream server is non-recursive. */
563 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
564 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
566 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
567 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
568 if (!option_bool(OPT_LOG
))
569 server
->flags
|= SERV_WARNED_RECURSIVE
;
572 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
573 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
576 SET_RCODE(header
, NXDOMAIN
);
577 header
->hb3
&= ~HB3_AA
;
584 if (RCODE(header
) == NXDOMAIN
&&
585 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
586 check_for_local_domain(daemon
->namebuff
, now
))
588 /* if we forwarded a query for a locally known name (because it was for
589 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
590 since we know that the domain exists, even if upstream doesn't */
592 header
->hb3
|= HB3_AA
;
593 SET_RCODE(header
, NOERROR
);
597 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
599 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
609 if (no_cache
&& !(header
->hb4
& HB4_CD
))
611 if (!option_bool(OPT_DNSSEC_DEBUG
))
613 /* Bogus reply, turn into SERVFAIL */
614 SET_RCODE(header
, SERVFAIL
);
619 if (option_bool(OPT_DNSSEC_VALID
))
620 header
->hb4
&= ~HB4_AD
;
622 if (!(header
->hb4
& HB4_CD
) && cache_secure
)
623 header
->hb4
|= HB4_AD
;
626 /* do this after extract_addresses. Ensure NODATA reply and remove
631 header
->ancount
= htons(0);
632 header
->nscount
= htons(0);
633 header
->arcount
= htons(0);
636 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
637 sections of the packet. Find the new length here and put back pseudoheader
638 if it was removed. */
639 return resize_packet(header
, n
, pheader
, plen
);
642 /* sets new last_server */
643 void reply_query(int fd
, int family
, time_t now
)
645 /* packet from peer server, extract data for cache, and send to
646 original requester */
647 struct dns_header
*header
;
648 union mysockaddr serveraddr
;
649 struct frec
*forward
;
650 socklen_t addrlen
= sizeof(serveraddr
);
651 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
653 struct server
*server
;
659 /* packet buffer overwritten */
660 daemon
->srv_save
= NULL
;
662 /* Determine the address of the server replying so that we can mark that as good */
663 serveraddr
.sa
.sa_family
= family
;
665 if (serveraddr
.sa
.sa_family
== AF_INET6
)
666 serveraddr
.in6
.sin6_flowinfo
= 0;
669 /* spoof check: answer must come from known server, */
670 for (server
= daemon
->servers
; server
; server
= server
->next
)
671 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
672 sockaddr_isequal(&server
->addr
, &serveraddr
))
675 header
= (struct dns_header
*)daemon
->packet
;
678 hash
= hash_questions(header
, n
, daemon
->namebuff
);
681 crc
= questions_crc(header
, n
, daemon
->namebuff
);
685 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
686 !(forward
= lookup_frec(ntohs(header
->id
), hash
)))
689 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
690 !option_bool(OPT_ORDER
) &&
691 forward
->forwardall
== 0)
692 /* for broken servers, attempt to send to another one. */
694 unsigned char *pheader
;
698 /* recreate query from reply */
699 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
702 header
->ancount
= htons(0);
703 header
->nscount
= htons(0);
704 header
->arcount
= htons(0);
705 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
707 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
708 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
);
714 server
= forward
->sentto
;
716 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
718 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
722 struct server
*last_server
;
724 /* find good server by address if possible, otherwise assume the last one we sent to */
725 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
726 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
727 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
729 server
= last_server
;
733 if (!option_bool(OPT_ALL_SERVERS
))
734 daemon
->last_server
= server
;
737 /* If the answer is an error, keep the forward record in place in case
738 we get a good reply from another server. Kill it when we've
739 had replies from all to avoid filling the forwarding table when
740 everything is broken */
741 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
742 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
744 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
746 if (option_bool(OPT_NO_REBIND
))
747 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
749 /* Don't cache replies where DNSSEC validation was turned off, either
750 the upstream server told us so, or the original query specified it. */
751 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
755 if (option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
759 /* We've had a reply already, which we're validating. Ignore this duplicate */
760 if (forward
->blocking_query
)
763 if (header
->hb3
& HB3_TC
)
765 /* Truncated answer can't be validated.
766 If this is an answer to a DNSSEC-generated query, we still
767 need to get the client to retry over TCP, so return
768 an answer with the TC bit set, even if the actual answer fits.
770 status
= STAT_TRUNCATED
;
772 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
773 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
774 else if (forward
->flags
& FREC_DS_QUERY
)
775 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
777 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
779 /* Can't validate, as we're missing key data. Put this
780 answer aside, whilst we get that. */
781 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
785 if ((new = get_new_frec(now
, NULL
, 1)))
787 struct frec
*next
= new->next
;
788 *new = *forward
; /* copy everything, then overwrite */
790 new->blocking_query
= NULL
;
795 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
);
797 /* Free any saved query */
799 blockdata_free(forward
->stash
);
801 /* Now save reply pending receipt of key data */
802 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
803 free_frec(new); /* malloc failure, unwind */
808 forward
->stash_len
= n
;
810 new->dependent
= forward
; /* to find query awaiting new one. */
811 forward
->blocking_query
= new; /* for garbage cleaning */
812 /* validate routines leave name of required record in daemon->keyname */
813 if (status
== STAT_NEED_KEY
)
815 new->flags
|= FREC_DNSKEY_QUERY
;
816 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
817 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
821 new->flags
|= FREC_DS_QUERY
;
822 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
823 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
825 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
826 memcpy(new->hash
, hash
, HASH_SIZE
);
827 new->new_id
= get_id();
828 header
->id
= htons(new->new_id
);
829 /* Save query for retransmission */
830 new->stash
= blockdata_alloc((char *)header
, nn
);
833 /* Don't resend this. */
834 daemon
->srv_save
= NULL
;
837 fd
= server
->sfd
->fd
;
842 if (server
->addr
.sa
.sa_family
== AF_INET6
)
844 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
850 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
857 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
866 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
867 Now wind back down, pulling back answers which wouldn't previously validate
868 and validate them with the new data. Failure to find needed data here is an internal error.
869 Once we get to the original answer (FREC_DNSSEC_QUERY not set) and it validates,
870 return it to the original requestor. */
871 while (forward
->dependent
)
873 struct frec
*prev
= forward
->dependent
;
876 forward
->blocking_query
= NULL
; /* already gone */
877 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
878 n
= forward
->stash_len
;
880 if (status
== STAT_SECURE
)
882 if (forward
->flags
& FREC_DNSKEY_QUERY
)
883 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
884 else if (forward
->flags
& FREC_DS_QUERY
)
885 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
887 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
889 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
891 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
892 status
= STAT_INSECURE
;
897 if (status
== STAT_TRUNCATED
)
898 header
->hb3
|= HB3_TC
;
900 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
901 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
905 if (status
== STAT_SECURE
)
907 else if (status
== STAT_BOGUS
)
910 /* restore CD bit to the value in the query */
911 if (forward
->flags
& FREC_CHECKING_DISABLED
)
912 header
->hb4
|= HB4_CD
;
914 header
->hb4
&= ~HB4_CD
;
918 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
919 forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
921 header
->id
= htons(forward
->orig_id
);
922 header
->hb4
|= HB4_RA
; /* recursion if available */
923 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
924 &forward
->source
, &forward
->dest
, forward
->iface
);
926 free_frec(forward
); /* cancel */
931 void receive_query(struct listener
*listen
, time_t now
)
933 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
934 union mysockaddr source_addr
;
936 struct all_addr dst_addr
;
937 struct in_addr netmask
, dst_addr_4
;
940 int if_index
= 0, auth_dns
= 0;
946 struct cmsghdr
*cmptr
;
948 struct cmsghdr align
; /* this ensures alignment */
950 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
952 #if defined(HAVE_LINUX_NETWORK)
953 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
954 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
955 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
956 CMSG_SPACE(sizeof(unsigned int))];
957 #elif defined(IP_RECVDSTADDR)
958 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
959 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
963 /* Can always get recvd interface for IPv6 */
964 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
966 int check_dst
= !option_bool(OPT_NOWILD
);
969 /* packet buffer overwritten */
970 daemon
->srv_save
= NULL
;
972 dst_addr_4
.s_addr
= 0;
975 if (option_bool(OPT_NOWILD
) && listen
->iface
)
977 auth_dns
= listen
->iface
->dns_auth
;
979 if (listen
->family
== AF_INET
)
981 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
982 netmask
= listen
->iface
->netmask
;
986 iov
[0].iov_base
= daemon
->packet
;
987 iov
[0].iov_len
= daemon
->edns_pktsz
;
989 msg
.msg_control
= control_u
.control
;
990 msg
.msg_controllen
= sizeof(control_u
);
992 msg
.msg_name
= &source_addr
;
993 msg
.msg_namelen
= sizeof(source_addr
);
997 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1000 if (n
< (int)sizeof(struct dns_header
) ||
1001 (msg
.msg_flags
& MSG_TRUNC
) ||
1002 (header
->hb3
& HB3_QR
))
1005 source_addr
.sa
.sa_family
= listen
->family
;
1007 if (listen
->family
== AF_INET6
)
1008 source_addr
.in6
.sin6_flowinfo
= 0;
1015 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1018 #if defined(HAVE_LINUX_NETWORK)
1019 if (listen
->family
== AF_INET
)
1020 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1021 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1025 struct in_pktinfo
*p
;
1027 p
.c
= CMSG_DATA(cmptr
);
1028 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1029 if_index
= p
.p
->ipi_ifindex
;
1031 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1032 if (listen
->family
== AF_INET
)
1034 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1040 #ifndef HAVE_SOLARIS_NETWORK
1041 struct sockaddr_dl
*s
;
1044 p
.c
= CMSG_DATA(cmptr
);
1045 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1046 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1047 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1048 #ifdef HAVE_SOLARIS_NETWORK
1051 if_index
= p
.s
->sdl_index
;
1058 if (listen
->family
== AF_INET6
)
1060 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1061 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1065 struct in6_pktinfo
*p
;
1067 p
.c
= CMSG_DATA(cmptr
);
1069 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1070 if_index
= p
.p
->ipi6_ifindex
;
1075 /* enforce available interface configuration */
1077 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1080 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1082 if (!option_bool(OPT_CLEVERBIND
))
1083 enumerate_interfaces(0);
1084 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1085 !label_exception(if_index
, listen
->family
, &dst_addr
))
1089 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1093 /* get the netmask of the interface whch has the address we were sent to.
1094 This is no neccessarily the interface we arrived on. */
1096 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1097 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1098 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1101 /* interface may be new */
1102 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1103 enumerate_interfaces(0);
1105 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1106 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1107 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1110 /* If we failed, abandon localisation */
1112 netmask
= iface
->netmask
;
1114 dst_addr_4
.s_addr
= 0;
1118 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1121 struct auth_zone
*zone
;
1123 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1125 if (listen
->family
== AF_INET
)
1126 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1127 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1130 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1131 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1135 /* find queries for zones we're authoritative for, and answer them directly */
1137 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1138 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1150 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1153 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1154 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1155 daemon
->auth_answer
++;
1161 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1162 dst_addr_4
, netmask
, now
);
1166 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1167 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1168 daemon
->local_answer
++;
1170 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1171 header
, (size_t)n
, now
, NULL
))
1172 daemon
->queries_forwarded
++;
1174 daemon
->local_answer
++;
1179 static int tcp_key_recurse(time_t now
, int status
, int class, char *keyname
, struct server
*server
)
1181 /* Recurse up the key heirarchy */
1183 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1184 unsigned char *payload
= &packet
[2];
1185 struct dns_header
*header
= (struct dns_header
*)payload
;
1186 u16
*length
= (u16
*)packet
;
1188 unsigned char c1
, c2
;
1190 n
= dnssec_generate_query(header
, ((char *) header
) + 65536, keyname
, class,
1191 status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1195 if (!read_write(server
->tcpfd
, packet
, n
+ sizeof(u16
), 0) ||
1196 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1197 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1198 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1200 close(server
->tcpfd
);
1202 new_status
= STAT_INSECURE
;
1208 if (status
== STAT_NEED_KEY
)
1209 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1211 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1213 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1215 if ((new_status
= tcp_key_recurse(now
, new_status
, class, daemon
->keyname
, server
) == STAT_SECURE
))
1217 if (status
== STAT_NEED_KEY
)
1218 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1220 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1222 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1224 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
1225 status
= STAT_INSECURE
;
1238 /* The daemon forks before calling this: it should deal with one connection,
1239 blocking as neccessary, and then return. Note, need to be a bit careful
1240 about resources for debug mode, when the fork is suppressed: that's
1241 done by the caller. */
1242 unsigned char *tcp_request(int confd
, time_t now
,
1243 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1250 int checking_disabled
, check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1252 unsigned short qtype
;
1253 unsigned int gotname
;
1254 unsigned char c1
, c2
;
1255 /* Max TCP packet + slop + size */
1256 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1257 unsigned char *payload
= &packet
[2];
1258 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1259 struct dns_header
*header
= (struct dns_header
*)payload
;
1260 u16
*length
= (u16
*)packet
;
1261 struct server
*last_server
;
1262 struct in_addr dst_addr_4
;
1263 union mysockaddr peer_addr
;
1264 socklen_t peer_len
= sizeof(union mysockaddr
);
1266 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1272 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1273 !(size
= c1
<< 8 | c2
) ||
1274 !read_write(confd
, payload
, size
, 1))
1277 if (size
< (int)sizeof(struct dns_header
))
1282 /* save state of "cd" flag in query */
1283 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1284 no_cache_dnssec
= 1;
1286 /* RFC 4035: sect 4.6 para 2 */
1287 header
->hb4
&= ~HB4_AD
;
1289 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1292 struct auth_zone
*zone
;
1294 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1296 if (peer_addr
.sa
.sa_family
== AF_INET
)
1297 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1298 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1301 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1302 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1306 /* find queries for zones we're authoritative for, and answer them directly */
1308 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1309 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1318 if (local_addr
->sa
.sa_family
== AF_INET
)
1319 dst_addr_4
= local_addr
->in
.sin_addr
;
1321 dst_addr_4
.s_addr
= 0;
1325 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1329 /* m > 0 if answered from cache */
1330 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1331 dst_addr_4
, netmask
, now
);
1333 /* Do this by steam now we're not in the select() loop */
1334 check_log_writer(NULL
);
1338 unsigned int flags
= 0;
1339 struct all_addr
*addrp
= NULL
;
1341 char *domain
= NULL
;
1343 if (option_bool(OPT_ADD_MAC
))
1344 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1346 if (option_bool(OPT_CLIENT_SUBNET
))
1348 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1357 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1359 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1360 last_server
= daemon
->servers
;
1362 last_server
= daemon
->last_server
;
1364 if (!flags
&& last_server
)
1366 struct server
*firstsendto
= NULL
;
1368 unsigned char *newhash
, hash
[HASH_SIZE
];
1369 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->keyname
)))
1370 memcpy(hash
, newhash
, HASH_SIZE
);
1372 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1374 /* Loop round available servers until we succeed in connecting to one.
1375 Note that this code subtley ensures that consecutive queries on this connection
1376 which can go to the same server, do so. */
1380 firstsendto
= last_server
;
1383 if (!(last_server
= last_server
->next
))
1384 last_server
= daemon
->servers
;
1386 if (last_server
== firstsendto
)
1390 /* server for wrong domain */
1391 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1392 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1395 if (last_server
->tcpfd
== -1)
1397 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1400 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1401 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1403 close(last_server
->tcpfd
);
1404 last_server
->tcpfd
= -1;
1409 if (option_bool(OPT_DNSSEC_VALID
))
1411 size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1412 header
->hb4
|= HB4_CD
;
1416 #ifdef HAVE_CONNTRACK
1417 /* Copy connection mark of incoming query to outgoing connection. */
1418 if (option_bool(OPT_CONNTRACK
))
1421 struct all_addr local
;
1423 if (local_addr
->sa
.sa_family
== AF_INET6
)
1424 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1427 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1429 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1430 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1435 *length
= htons(size
);
1437 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1438 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1439 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1440 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1442 close(last_server
->tcpfd
);
1443 last_server
->tcpfd
= -1;
1450 strcpy(daemon
->namebuff
, "query");
1451 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1452 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1453 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1456 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1457 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1461 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1465 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1467 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
1469 if ((status
= tcp_key_recurse(now
, status
, class, daemon
->keyname
, last_server
)) == STAT_SECURE
)
1470 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1473 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
1474 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1476 if (status
== STAT_BOGUS
)
1477 no_cache_dnssec
= 1;
1479 if (status
== STAT_SECURE
)
1484 /* restore CD bit to the value in the query */
1485 if (checking_disabled
)
1486 header
->hb4
|= HB4_CD
;
1488 header
->hb4
&= ~HB4_CD
;
1490 /* There's no point in updating the cache, since this process will exit and
1491 lose the information after a few queries. We make this call for the alias and
1492 bogus-nxdomain side-effects. */
1493 /* If the crc of the question section doesn't match the crc we sent, then
1494 someone might be attempting to insert bogus values into the cache by
1495 sending replies containing questions and bogus answers. */
1497 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
1498 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
1504 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1511 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1512 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1513 cache_secure
, check_subnet
, &peer_addr
);
1519 /* In case of local answer or no connections made. */
1521 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1525 check_log_writer(NULL
);
1529 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1534 static struct frec
*allocate_frec(time_t now
)
1538 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1540 f
->next
= daemon
->frec_list
;
1549 f
->dependent
= NULL
;
1550 f
->blocking_query
= NULL
;
1553 daemon
->frec_list
= f
;
1559 static struct randfd
*allocate_rfd(int family
)
1561 static int finger
= 0;
1564 /* limit the number of sockets we have open to avoid starvation of
1565 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1567 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1568 if (daemon
->randomsocks
[i
].refcount
== 0)
1570 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1573 daemon
->randomsocks
[i
].refcount
= 1;
1574 daemon
->randomsocks
[i
].family
= family
;
1575 return &daemon
->randomsocks
[i
];
1578 /* No free ones or cannot get new socket, grab an existing one */
1579 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1581 int j
= (i
+finger
) % RANDOM_SOCKS
;
1582 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1583 daemon
->randomsocks
[j
].family
== family
&&
1584 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1587 daemon
->randomsocks
[j
].refcount
++;
1588 return &daemon
->randomsocks
[j
];
1592 return NULL
; /* doom */
1594 static void free_frec(struct frec
*f
)
1596 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1604 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1613 blockdata_free(f
->stash
);
1617 /* Anything we're waiting on is pointless now, too */
1618 if (f
->blocking_query
)
1619 free_frec(f
->blocking_query
);
1620 f
->blocking_query
= NULL
;
1621 f
->dependent
= NULL
;
1625 /* if wait==NULL return a free or older than TIMEOUT record.
1626 else return *wait zero if one available, or *wait is delay to
1627 when the oldest in-use record will expire. Impose an absolute
1628 limit of 4*TIMEOUT before we wipe things (for random sockets).
1629 If force is set, always return a result, even if we have
1630 to allocate above the limit. */
1631 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
1633 struct frec
*f
, *oldest
, *target
;
1639 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1644 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1650 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1660 /* can't find empty one, use oldest if there is one
1661 and it's older than timeout */
1662 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1664 /* keep stuff for twice timeout if we can by allocating a new
1666 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1667 count
<= daemon
->ftabsize
&&
1668 (f
= allocate_frec(now
)))
1679 /* none available, calculate time 'till oldest record expires */
1680 if (!force
&& count
> daemon
->ftabsize
)
1682 static time_t last_log
= 0;
1685 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1687 if ((int)difftime(now
, last_log
) > 5)
1690 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1696 if (!(f
= allocate_frec(now
)) && wait
)
1697 /* wait one second on malloc failure */
1700 return f
; /* OK if malloc fails and this is NULL */
1703 /* crc is all-ones if not known. */
1704 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
1708 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1709 if (f
->sentto
&& f
->new_id
== id
&&
1710 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
1716 static struct frec
*lookup_frec_by_sender(unsigned short id
,
1717 union mysockaddr
*addr
,
1722 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1725 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
1726 sockaddr_isequal(&f
->source
, addr
))
1732 /* A server record is going away, remove references to it */
1733 void server_gone(struct server
*server
)
1737 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
1738 if (f
->sentto
&& f
->sentto
== server
)
1741 if (daemon
->last_server
== server
)
1742 daemon
->last_server
= NULL
;
1744 if (daemon
->srv_save
== server
)
1745 daemon
->srv_save
= NULL
;
1748 /* return unique random ids. */
1749 static unsigned short get_id(void)
1751 unsigned short ret
= 0;
1755 while (lookup_frec(ret
, NULL
));