]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, void *hash
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(void);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
28 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
29 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
);
30 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class);
31 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
);
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
38 union mysockaddr
*to
, struct all_addr
*source
,
44 struct cmsghdr align
; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
47 #elif defined(IP_SENDSRCADDR)
48 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
51 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
55 iov
[0].iov_base
= packet
;
58 msg
.msg_control
= NULL
;
59 msg
.msg_controllen
= 0;
62 msg
.msg_namelen
= sa_len(to
);
68 struct cmsghdr
*cmptr
;
69 msg
.msg_control
= &control_u
;
70 msg
.msg_controllen
= sizeof(control_u
);
71 cmptr
= CMSG_FIRSTHDR(&msg
);
73 if (to
->sa
.sa_family
== AF_INET
)
75 #if defined(HAVE_LINUX_NETWORK)
78 p
.ipi_spec_dst
= source
->addr
.addr4
;
79 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
80 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
81 cmptr
->cmsg_level
= IPPROTO_IP
;
82 cmptr
->cmsg_type
= IP_PKTINFO
;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
85 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
86 cmptr
->cmsg_level
= IPPROTO_IP
;
87 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
94 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
95 p
.ipi6_addr
= source
->addr
.addr6
;
96 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
97 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
98 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
99 cmptr
->cmsg_level
= IPPROTO_IPV6
;
102 (void)iface
; /* eliminate warning */
106 while (sendmsg(fd
, &msg
, 0) == -1)
111 /* If interface is still in DAD, EINVAL results - ignore that. */
115 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
122 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
123 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
130 unsigned int namelen
= strlen(qdomain
);
131 unsigned int matchlen
= 0;
133 unsigned int flags
= 0;
135 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
139 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
140 *type
= SERV_FOR_NODOTS
;
141 if (serv
->flags
& SERV_NO_ADDR
)
143 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
148 if (serv
->addr
.sa
.sa_family
== AF_INET
)
149 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
152 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
155 else if (!flags
|| (flags
& F_NXDOMAIN
))
159 else if (serv
->flags
& SERV_HAS_DOMAIN
)
161 unsigned int domainlen
= strlen(serv
->domain
);
162 char *matchstart
= qdomain
+ namelen
- domainlen
;
163 if (namelen
>= domainlen
&&
164 hostname_isequal(matchstart
, serv
->domain
) &&
165 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
167 if (serv
->flags
& SERV_NO_REBIND
)
171 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen
!= 0 && domainlen
== matchlen
)
177 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
179 if (!(sflag
& qtype
) && flags
== 0)
184 if (flags
& (F_IPV4
| F_IPV6
))
189 if (domainlen
>= matchlen
)
191 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
192 *domain
= serv
->domain
;
193 matchlen
= domainlen
;
194 if (serv
->flags
& SERV_NO_ADDR
)
196 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
201 if (serv
->addr
.sa
.sa_family
== AF_INET
)
202 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
205 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
208 else if (!flags
|| (flags
& F_NXDOMAIN
))
218 if (flags
== 0 && !(qtype
& F_QUERY
) &&
219 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
223 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
230 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
231 logflags
= F_NEG
| qtype
;
233 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
235 else if ((*type
) & SERV_USE_RESOLV
)
237 *type
= 0; /* use normal servers for this domain */
243 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
244 struct all_addr
*dst_addr
, unsigned int dst_iface
,
245 struct dns_header
*header
, size_t plen
, time_t now
,
246 struct frec
*forward
, int ad_reqd
, int do_bit
)
249 int type
= 0, norebind
= 0;
250 struct all_addr
*addrp
= NULL
;
251 unsigned int flags
= 0;
252 struct server
*start
= NULL
;
254 void *hash
= hash_questions(header
, plen
, daemon
->namebuff
);
256 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
259 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
263 /* may be no servers available. */
264 if (!daemon
->servers
)
266 else if (forward
|| (hash
&& (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, hash
))))
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward
->blocking_query
)
275 while (forward
->blocking_query
)
276 forward
= forward
->blocking_query
;
278 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
279 plen
= forward
->stash_len
;
281 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET
)
282 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
285 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
288 if (forward
->sentto
->sfd
)
289 fd
= forward
->sentto
->sfd
->fd
;
293 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
294 fd
= forward
->rfd6
->fd
;
297 fd
= forward
->rfd4
->fd
;
300 while (sendto(fd
, (char *)header
, plen
, 0,
301 &forward
->sentto
->addr
.sa
,
302 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
308 /* retry on existing query, send to all available servers */
309 domain
= forward
->sentto
->domain
;
310 forward
->sentto
->failed_queries
++;
311 if (!option_bool(OPT_ORDER
))
313 forward
->forwardall
= 1;
314 daemon
->last_server
= NULL
;
316 type
= forward
->sentto
->flags
& SERV_TYPE
;
317 if (!(start
= forward
->sentto
->next
))
318 start
= daemon
->servers
; /* at end of list, recycle */
319 header
->id
= htons(forward
->new_id
);
324 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
326 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
327 /* table full - server failure. */
332 forward
->source
= *udpaddr
;
333 forward
->dest
= *dst_addr
;
334 forward
->iface
= dst_iface
;
335 forward
->orig_id
= ntohs(header
->id
);
336 forward
->new_id
= get_id();
338 memcpy(forward
->hash
, hash
, HASH_SIZE
);
339 forward
->forwardall
= 0;
342 forward
->flags
|= FREC_NOREBIND
;
343 if (header
->hb4
& HB4_CD
)
344 forward
->flags
|= FREC_CHECKING_DISABLED
;
346 forward
->flags
|= FREC_AD_QUESTION
;
348 forward
->work_counter
= DNSSEC_WORK
;
350 forward
->flags
|= FREC_DO_QUESTION
;
353 header
->id
= htons(forward
->new_id
);
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
362 if (option_bool(OPT_ORDER
))
363 start
= daemon
->servers
;
364 else if (!(start
= daemon
->last_server
) ||
365 daemon
->forwardcount
++ > FORWARD_TEST
||
366 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
368 start
= daemon
->servers
;
369 forward
->forwardall
= 1;
370 daemon
->forwardcount
= 0;
371 daemon
->forwardtime
= now
;
376 start
= daemon
->servers
;
377 if (!option_bool(OPT_ORDER
))
378 forward
->forwardall
= 1;
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
387 if (!flags
&& forward
)
389 struct server
*firstsentto
= start
;
392 if (option_bool(OPT_ADD_MAC
))
393 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
395 if (option_bool(OPT_CLIENT_SUBNET
))
397 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
401 forward
->flags
|= FREC_HAS_SUBNET
;
406 if (option_bool(OPT_DNSSEC_VALID
))
408 size_t new_plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG
))
413 header
->hb4
|= HB4_CD
;
415 if (new_plen
!= plen
)
416 forward
->flags
|= FREC_ADDED_PHEADER
;
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
428 if (type
== (start
->flags
& SERV_TYPE
) &&
429 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
430 !(start
->flags
& SERV_LITERAL_ADDRESS
))
434 /* find server socket to use, may need to get random one. */
440 if (start
->addr
.sa
.sa_family
== AF_INET6
)
442 if (!forward
->rfd6
&&
443 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
445 daemon
->rfd_save
= forward
->rfd6
;
446 fd
= forward
->rfd6
->fd
;
451 if (!forward
->rfd4
&&
452 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
454 daemon
->rfd_save
= forward
->rfd4
;
455 fd
= forward
->rfd4
->fd
;
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK
))
463 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
464 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
469 if (sendto(fd
, (char *)header
, plen
, 0,
471 sa_len(&start
->addr
)) == -1)
478 /* Keep info in case we want to re-send this packet */
479 daemon
->srv_save
= start
;
480 daemon
->packet_len
= plen
;
483 strcpy(daemon
->namebuff
, "query");
484 if (start
->addr
.sa
.sa_family
== AF_INET
)
485 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
486 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
489 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
490 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
494 forward
->sentto
= start
;
495 if (!forward
->forwardall
)
497 forward
->forwardall
++;
501 if (!(start
= start
->next
))
502 start
= daemon
->servers
;
504 if (start
== firstsentto
)
511 /* could not send on, prepare to return */
512 header
->id
= htons(forward
->orig_id
);
513 free_frec(forward
); /* cancel */
516 /* could not send on, return empty answer or address if known for whole domain */
519 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
520 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
526 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
527 int no_cache
, int cache_secure
, int ad_reqd
, int do_bit
, int added_pheader
, int check_subnet
, union mysockaddr
*query_source
)
529 unsigned char *pheader
, *sizep
;
531 int munged
= 0, is_sign
;
538 if (daemon
->ipsets
&& extract_request(header
, n
, daemon
->namebuff
, NULL
))
540 /* Similar algorithm to search_servers. */
541 struct ipsets
*ipset_pos
;
542 unsigned int namelen
= strlen(daemon
->namebuff
);
543 unsigned int matchlen
= 0;
544 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
546 unsigned int domainlen
= strlen(ipset_pos
->domain
);
547 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
548 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
549 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
550 domainlen
>= matchlen
)
552 matchlen
= domainlen
;
553 sets
= ipset_pos
->sets
;
559 /* If upstream is advertising a larger UDP packet size
560 than we allow, trim it so that we don't get overlarge
561 requests for the client. We can't do this for signed packets. */
563 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
565 unsigned short udpsz
;
566 unsigned char *psave
= sizep
;
568 GETSHORT(udpsz
, sizep
);
570 if (!is_sign
&& udpsz
> daemon
->edns_pktsz
)
571 PUTSHORT(daemon
->edns_pktsz
, psave
);
573 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
575 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
582 header
->arcount
= htons(0);
586 /* RFC 4035 sect 4.6 para 3 */
587 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
588 header
->hb4
&= ~HB4_AD
;
590 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
593 /* Complain loudly if the upstream server is non-recursive. */
594 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
595 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
597 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
598 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
599 if (!option_bool(OPT_LOG
))
600 server
->flags
|= SERV_WARNED_RECURSIVE
;
603 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
604 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
607 SET_RCODE(header
, NXDOMAIN
);
608 header
->hb3
&= ~HB3_AA
;
615 if (RCODE(header
) == NXDOMAIN
&&
616 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
617 check_for_local_domain(daemon
->namebuff
, now
))
619 /* if we forwarded a query for a locally known name (because it was for
620 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
621 since we know that the domain exists, even if upstream doesn't */
623 header
->hb3
|= HB3_AA
;
624 SET_RCODE(header
, NOERROR
);
628 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
, &doctored
))
630 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
640 if (no_cache
&& !(header
->hb4
& HB4_CD
))
642 if (!option_bool(OPT_DNSSEC_DEBUG
))
644 /* Bogus reply, turn into SERVFAIL */
645 SET_RCODE(header
, SERVFAIL
);
650 if (option_bool(OPT_DNSSEC_VALID
))
651 header
->hb4
&= ~HB4_AD
;
653 if (!(header
->hb4
& HB4_CD
) && ad_reqd
&& cache_secure
)
654 header
->hb4
|= HB4_AD
;
656 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
658 n
= filter_rrsigs(header
, n
);
661 /* do this after extract_addresses. Ensure NODATA reply and remove
666 header
->ancount
= htons(0);
667 header
->nscount
= htons(0);
668 header
->arcount
= htons(0);
671 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
672 sections of the packet. Find the new length here and put back pseudoheader
673 if it was removed. */
674 return resize_packet(header
, n
, pheader
, plen
);
677 /* sets new last_server */
678 void reply_query(int fd
, int family
, time_t now
)
680 /* packet from peer server, extract data for cache, and send to
681 original requester */
682 struct dns_header
*header
;
683 union mysockaddr serveraddr
;
684 struct frec
*forward
;
685 socklen_t addrlen
= sizeof(serveraddr
);
686 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
688 struct server
*server
;
694 /* packet buffer overwritten */
695 daemon
->srv_save
= NULL
;
697 /* Determine the address of the server replying so that we can mark that as good */
698 serveraddr
.sa
.sa_family
= family
;
700 if (serveraddr
.sa
.sa_family
== AF_INET6
)
701 serveraddr
.in6
.sin6_flowinfo
= 0;
704 header
= (struct dns_header
*)daemon
->packet
;
706 if (n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
))
709 /* spoof check: answer must come from known server, */
710 for (server
= daemon
->servers
; server
; server
= server
->next
)
711 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
712 sockaddr_isequal(&server
->addr
, &serveraddr
))
719 hash
= hash_questions(header
, n
, daemon
->namebuff
);
722 crc
= questions_crc(header
, n
, daemon
->namebuff
);
725 if (!(forward
= lookup_frec(ntohs(header
->id
), hash
)))
728 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
729 !option_bool(OPT_ORDER
) &&
730 forward
->forwardall
== 0)
731 /* for broken servers, attempt to send to another one. */
733 unsigned char *pheader
;
737 /* recreate query from reply */
738 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
741 header
->ancount
= htons(0);
742 header
->nscount
= htons(0);
743 header
->arcount
= htons(0);
744 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
746 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
747 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
, 0, 0);
753 server
= forward
->sentto
;
755 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
757 if (RCODE(header
) == REFUSED
)
761 struct server
*last_server
;
763 /* find good server by address if possible, otherwise assume the last one we sent to */
764 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
765 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
766 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
768 server
= last_server
;
772 if (!option_bool(OPT_ALL_SERVERS
))
773 daemon
->last_server
= server
;
776 /* If the answer is an error, keep the forward record in place in case
777 we get a good reply from another server. Kill it when we've
778 had replies from all to avoid filling the forwarding table when
779 everything is broken */
780 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 || RCODE(header
) != SERVFAIL
)
782 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
784 if (option_bool(OPT_NO_REBIND
))
785 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
787 /* Don't cache replies where DNSSEC validation was turned off, either
788 the upstream server told us so, or the original query specified it. */
789 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
793 if (server
&& option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
797 /* We've had a reply already, which we're validating. Ignore this duplicate */
798 if (forward
->blocking_query
)
801 if (header
->hb3
& HB3_TC
)
803 /* Truncated answer can't be validated.
804 If this is an answer to a DNSSEC-generated query, we still
805 need to get the client to retry over TCP, so return
806 an answer with the TC bit set, even if the actual answer fits.
808 status
= STAT_TRUNCATED
;
810 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
811 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
812 else if (forward
->flags
& FREC_DS_QUERY
)
814 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
815 if (status
== STAT_NO_DS
)
816 status
= STAT_INSECURE
;
818 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
819 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
822 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
823 if (status
== STAT_NO_SIG
)
825 if (option_bool(OPT_DNSSEC_NO_SIGN
))
826 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
828 status
= STAT_INSECURE
;
831 /* Can't validate, as we're missing key data. Put this
832 answer aside, whilst we get that. */
833 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
835 struct frec
*new, *orig
;
837 /* Free any saved query */
839 blockdata_free(forward
->stash
);
841 /* Now save reply pending receipt of key data */
842 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
844 forward
->stash_len
= n
;
847 /* Find the original query that started it all.... */
848 for (orig
= forward
; orig
->dependent
; orig
= orig
->dependent
);
850 if (--orig
->work_counter
== 0 || !(new = get_new_frec(now
, NULL
, 1)))
851 status
= STAT_INSECURE
;
855 struct frec
*next
= new->next
;
856 *new = *forward
; /* copy everything, then overwrite */
858 new->blocking_query
= NULL
;
859 new->sentto
= server
;
864 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
| FREC_CHECK_NOSIGN
);
866 new->dependent
= forward
; /* to find query awaiting new one. */
867 forward
->blocking_query
= new; /* for garbage cleaning */
868 /* validate routines leave name of required record in daemon->keyname */
869 if (status
== STAT_NEED_KEY
)
871 new->flags
|= FREC_DNSKEY_QUERY
;
872 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
873 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
877 if (status
== STAT_NEED_DS_NEG
)
878 new->flags
|= FREC_CHECK_NOSIGN
;
880 new->flags
|= FREC_DS_QUERY
;
881 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
882 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
884 if ((hash
= hash_questions(header
, nn
, daemon
->namebuff
)))
885 memcpy(new->hash
, hash
, HASH_SIZE
);
886 new->new_id
= get_id();
887 header
->id
= htons(new->new_id
);
888 /* Save query for retransmission */
889 new->stash
= blockdata_alloc((char *)header
, nn
);
892 /* Don't resend this. */
893 daemon
->srv_save
= NULL
;
896 fd
= server
->sfd
->fd
;
901 if (server
->addr
.sa
.sa_family
== AF_INET6
)
903 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
909 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
916 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
924 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
925 Now wind back down, pulling back answers which wouldn't previously validate
926 and validate them with the new data. Note that if an answer needs multiple
927 keys to validate, we may find another key is needed, in which case we set off
928 down another branch of the tree. Once we get to the original answer
929 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
930 while (forward
->dependent
)
932 struct frec
*prev
= forward
->dependent
;
935 forward
->blocking_query
= NULL
; /* already gone */
936 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
937 n
= forward
->stash_len
;
939 if (status
== STAT_SECURE
)
941 if (forward
->flags
& FREC_DNSKEY_QUERY
)
942 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
943 else if (forward
->flags
& FREC_DS_QUERY
)
945 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
946 if (status
== STAT_NO_DS
)
947 status
= STAT_INSECURE
;
949 else if (forward
->flags
& FREC_CHECK_NOSIGN
)
950 status
= do_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
953 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class, NULL
);
954 if (status
== STAT_NO_SIG
)
956 if (option_bool(OPT_DNSSEC_NO_SIGN
))
957 status
= send_check_sign(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
);
959 status
= STAT_INSECURE
;
963 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
|| status
== STAT_NEED_KEY
)
968 if (status
== STAT_TRUNCATED
)
969 header
->hb3
|= HB3_TC
;
974 if (forward
->work_counter
== 0)
975 result
= "ABANDONED";
977 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
979 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
984 if (status
== STAT_SECURE
)
986 else if (status
== STAT_BOGUS
)
991 /* restore CD bit to the value in the query */
992 if (forward
->flags
& FREC_CHECKING_DISABLED
)
993 header
->hb4
|= HB4_CD
;
995 header
->hb4
&= ~HB4_CD
;
997 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
998 forward
->flags
& FREC_AD_QUESTION
, forward
->flags
& FREC_DO_QUESTION
,
999 forward
->flags
& FREC_ADDED_PHEADER
, forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
1001 header
->id
= htons(forward
->orig_id
);
1002 header
->hb4
|= HB4_RA
; /* recursion if available */
1003 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
1004 &forward
->source
, &forward
->dest
, forward
->iface
);
1006 free_frec(forward
); /* cancel */
1011 void receive_query(struct listener
*listen
, time_t now
)
1013 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
1014 union mysockaddr source_addr
;
1015 unsigned short type
;
1016 struct all_addr dst_addr
;
1017 struct in_addr netmask
, dst_addr_4
;
1020 int if_index
= 0, auth_dns
= 0;
1024 struct iovec iov
[1];
1026 struct cmsghdr
*cmptr
;
1028 struct cmsghdr align
; /* this ensures alignment */
1030 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
1032 #if defined(HAVE_LINUX_NETWORK)
1033 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
1034 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1035 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1036 CMSG_SPACE(sizeof(unsigned int))];
1037 #elif defined(IP_RECVDSTADDR)
1038 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
1039 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
1043 /* Can always get recvd interface for IPv6 */
1044 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
1046 int check_dst
= !option_bool(OPT_NOWILD
);
1049 /* packet buffer overwritten */
1050 daemon
->srv_save
= NULL
;
1052 dst_addr_4
.s_addr
= 0;
1055 if (option_bool(OPT_NOWILD
) && listen
->iface
)
1057 auth_dns
= listen
->iface
->dns_auth
;
1059 if (listen
->family
== AF_INET
)
1061 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
1062 netmask
= listen
->iface
->netmask
;
1066 iov
[0].iov_base
= daemon
->packet
;
1067 iov
[0].iov_len
= daemon
->edns_pktsz
;
1069 msg
.msg_control
= control_u
.control
;
1070 msg
.msg_controllen
= sizeof(control_u
);
1072 msg
.msg_name
= &source_addr
;
1073 msg
.msg_namelen
= sizeof(source_addr
);
1077 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
1080 if (n
< (int)sizeof(struct dns_header
) ||
1081 (msg
.msg_flags
& MSG_TRUNC
) ||
1082 (header
->hb3
& HB3_QR
))
1085 source_addr
.sa
.sa_family
= listen
->family
;
1087 if (listen
->family
== AF_INET
)
1089 /* Source-port == 0 is an error, we can't send back to that.
1090 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1091 if (source_addr
.in
.sin_port
== 0)
1097 /* Source-port == 0 is an error, we can't send back to that. */
1098 if (source_addr
.in6
.sin6_port
== 0)
1100 source_addr
.in6
.sin6_flowinfo
= 0;
1104 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1105 if (option_bool(OPT_LOCAL_SERVICE
))
1107 struct addrlist
*addr
;
1109 if (listen
->family
== AF_INET6
)
1111 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1112 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1113 is_same_net6(&addr
->addr
.addr
.addr6
, &source_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1119 struct in_addr netmask
;
1120 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1122 netmask
.s_addr
= 0xffffffff << (32 - addr
->prefixlen
);
1123 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1124 is_same_net(addr
->addr
.addr
.addr4
, source_addr
.in
.sin_addr
, netmask
))
1130 static int warned
= 0;
1133 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1144 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1147 #if defined(HAVE_LINUX_NETWORK)
1148 if (listen
->family
== AF_INET
)
1149 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1150 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1154 struct in_pktinfo
*p
;
1156 p
.c
= CMSG_DATA(cmptr
);
1157 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1158 if_index
= p
.p
->ipi_ifindex
;
1160 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1161 if (listen
->family
== AF_INET
)
1163 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1169 #ifndef HAVE_SOLARIS_NETWORK
1170 struct sockaddr_dl
*s
;
1173 p
.c
= CMSG_DATA(cmptr
);
1174 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1175 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1176 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1177 #ifdef HAVE_SOLARIS_NETWORK
1180 if_index
= p
.s
->sdl_index
;
1187 if (listen
->family
== AF_INET6
)
1189 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1190 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1194 struct in6_pktinfo
*p
;
1196 p
.c
= CMSG_DATA(cmptr
);
1198 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1199 if_index
= p
.p
->ipi6_ifindex
;
1204 /* enforce available interface configuration */
1206 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1209 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1211 if (!option_bool(OPT_CLEVERBIND
))
1212 enumerate_interfaces(0);
1213 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1214 !label_exception(if_index
, listen
->family
, &dst_addr
))
1218 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1222 /* get the netmask of the interface whch has the address we were sent to.
1223 This is no neccessarily the interface we arrived on. */
1225 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1226 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1227 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1230 /* interface may be new */
1231 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1232 enumerate_interfaces(0);
1234 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1235 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1236 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1239 /* If we failed, abandon localisation */
1241 netmask
= iface
->netmask
;
1243 dst_addr_4
.s_addr
= 0;
1247 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1250 struct auth_zone
*zone
;
1252 char *types
= querystr(auth_dns
? "auth" : "query", type
);
1254 if (listen
->family
== AF_INET
)
1255 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1256 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1259 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1260 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1264 /* find queries for zones we're authoritative for, and answer them directly */
1266 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1267 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1279 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1282 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1283 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1284 daemon
->auth_answer
++;
1290 int ad_reqd
, do_bit
;
1291 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1292 dst_addr_4
, netmask
, now
, &ad_reqd
, &do_bit
);
1296 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1297 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1298 daemon
->local_answer
++;
1300 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1301 header
, (size_t)n
, now
, NULL
, ad_reqd
, do_bit
))
1302 daemon
->queries_forwarded
++;
1304 daemon
->local_answer
++;
1310 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1311 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1312 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1313 static int send_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
)
1316 char *name_start
= name
;
1317 int status
= dnssec_chase_cname(now
, header
, plen
, name
, keyname
);
1319 if (status
!= STAT_INSECURE
)
1324 crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1326 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1327 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1329 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1331 name_start
++; /* chop a label off and try again */
1335 /* Reached the root */
1339 strcpy(keyname
, name_start
);
1340 return STAT_NEED_DS_NEG
;
1344 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1345 static int do_check_sign(time_t now
, struct dns_header
*header
, size_t plen
, char *name
, char *keyname
, int class)
1350 int status
= dnssec_validate_ds(now
, header
, plen
, name
, keyname
, class);
1352 if (status
!= STAT_INSECURE
)
1354 if (status
== STAT_NO_DS
)
1355 status
= STAT_INSECURE
;
1359 p
= (unsigned char *)(header
+1);
1361 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1362 (name_start
= strchr(name
, '.')))
1364 name_start
++; /* chop a label off and try again */
1365 strcpy(keyname
, name_start
);
1366 return STAT_NEED_DS_NEG
;
1372 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1373 an unsigned answer is OK, or we find a signed DS, in which case there should be
1374 a signature, and the answer is BOGUS */
1375 static int tcp_check_for_unsigned_zone(time_t now
, struct dns_header
*header
, size_t plen
, int class, char *name
,
1376 char *keyname
, struct server
*server
, int *keycount
)
1379 unsigned char *packet
, *payload
;
1381 unsigned char *p
= (unsigned char *)(header
+1);
1383 char *name_start
= name
;
1385 /* Get first insecure entry in CNAME chain */
1386 status
= tcp_key_recurse(now
, STAT_CHASE_CNAME
, header
, plen
, class, name
, keyname
, server
, keycount
);
1387 if (status
== STAT_BOGUS
)
1390 if (!(packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
))))
1393 payload
= &packet
[2];
1394 header
= (struct dns_header
*)payload
;
1395 length
= (u16
*)packet
;
1399 unsigned char *newhash
, hash
[HASH_SIZE
];
1400 unsigned char c1
, c2
;
1401 struct crec
*crecp
= cache_find_by_name(NULL
, name_start
, now
, F_DS
);
1403 if (--(*keycount
) == 0)
1409 if (crecp
&& (crecp
->flags
& F_DNSSECOK
))
1412 return (crecp
->flags
& F_NEG
) ? STAT_INSECURE
: STAT_BOGUS
;
1415 /* If we have cached insecurely that a DS doesn't exist,
1416 ise that is a hit for where to start looking for the secure one */
1417 if (crecp
&& (crecp
->flags
& F_NEG
) && (name_start
= strchr(name_start
, '.')))
1419 name_start
++; /* chop a label off and try again */
1423 /* reached the root */
1430 m
= dnssec_generate_query(header
, ((char *) header
) + 65536, name_start
, class, T_DS
, &server
->addr
);
1432 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1433 if ((newhash
= hash_questions(header
, (unsigned int)m
, name
)))
1435 memcpy(hash
, newhash
, HASH_SIZE
);
1439 if (read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) &&
1440 read_write(server
->tcpfd
, &c1
, 1, 1) &&
1441 read_write(server
->tcpfd
, &c2
, 1, 1) &&
1442 read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1446 newhash
= hash_questions(header
, (unsigned int)m
, name
);
1447 if (newhash
&& memcmp(hash
, newhash
, HASH_SIZE
) == 0)
1449 /* Note this trashes all three name workspaces */
1450 status
= tcp_key_recurse(now
, STAT_NEED_DS_NEG
, header
, m
, class, name
, keyname
, server
, keycount
);
1452 /* We've found a DS which proves the bit of the DNS where the
1453 original query is, is unsigned, so the answer is OK,
1455 if (status
== STAT_NO_DS
)
1458 return STAT_INSECURE
;
1461 /* No DS, not got to DNSSEC-land yet, go up. */
1462 if (status
== STAT_INSECURE
)
1464 p
= (unsigned char *)(header
+1);
1466 if (extract_name(header
, plen
, &p
, name
, 1, 4) &&
1467 (name_start
= strchr(name
, '.')))
1469 name_start
++; /* chop a label off and try again */
1483 static int tcp_key_recurse(time_t now
, int status
, struct dns_header
*header
, size_t n
,
1484 int class, char *name
, char *keyname
, struct server
*server
, int *keycount
)
1486 /* Recurse up the key heirarchy */
1489 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1490 if (--(*keycount
) == 0)
1491 return STAT_INSECURE
;
1493 if (status
== STAT_NEED_KEY
)
1494 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1495 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1497 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1498 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1499 new_status
= STAT_INSECURE
;
1501 else if (status
== STAT_CHASE_CNAME
)
1502 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1505 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1507 if (new_status
== STAT_NO_SIG
)
1509 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1510 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1512 new_status
= STAT_INSECURE
;
1516 /* Can't validate because we need a key/DS whose name now in keyname.
1517 Make query for same, and recurse to validate */
1518 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1521 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1522 unsigned char *payload
= &packet
[2];
1523 struct dns_header
*new_header
= (struct dns_header
*)payload
;
1524 u16
*length
= (u16
*)packet
;
1525 unsigned char c1
, c2
;
1528 return STAT_INSECURE
;
1531 m
= dnssec_generate_query(new_header
, ((char *) new_header
) + 65536, keyname
, class,
1532 new_status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1536 if (!read_write(server
->tcpfd
, packet
, m
+ sizeof(u16
), 0) ||
1537 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1538 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1539 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1540 new_status
= STAT_INSECURE
;
1545 new_status
= tcp_key_recurse(now
, new_status
, new_header
, m
, class, name
, keyname
, server
, keycount
);
1547 if (new_status
== STAT_SECURE
)
1549 /* Reached a validated record, now try again at this level.
1550 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1551 If so, go round again. */
1553 if (status
== STAT_NEED_KEY
)
1554 new_status
= dnssec_validate_by_ds(now
, header
, n
, name
, keyname
, class);
1555 else if (status
== STAT_NEED_DS
|| status
== STAT_NEED_DS_NEG
)
1557 new_status
= dnssec_validate_ds(now
, header
, n
, name
, keyname
, class);
1558 if (status
== STAT_NEED_DS
&& new_status
== STAT_NO_DS
)
1559 new_status
= STAT_INSECURE
; /* Validated no DS */
1561 else if (status
== STAT_CHASE_CNAME
)
1562 new_status
= dnssec_chase_cname(now
, header
, n
, name
, keyname
);
1565 new_status
= dnssec_validate_reply(now
, header
, n
, name
, keyname
, &class, NULL
);
1567 if (new_status
== STAT_NO_SIG
)
1569 if (option_bool(OPT_DNSSEC_NO_SIGN
))
1570 new_status
= tcp_check_for_unsigned_zone(now
, header
, n
, class, name
, keyname
, server
, keycount
);
1572 new_status
= STAT_INSECURE
;
1576 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1577 goto another_tcp_key
;
1588 /* The daemon forks before calling this: it should deal with one connection,
1589 blocking as neccessary, and then return. Note, need to be a bit careful
1590 about resources for debug mode, when the fork is suppressed: that's
1591 done by the caller. */
1592 unsigned char *tcp_request(int confd
, time_t now
,
1593 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1600 int checking_disabled
, ad_question
, do_bit
, added_pheader
= 0;
1601 int check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1603 unsigned short qtype
;
1604 unsigned int gotname
;
1605 unsigned char c1
, c2
;
1606 /* Max TCP packet + slop + size */
1607 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1608 unsigned char *payload
= &packet
[2];
1609 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1610 struct dns_header
*header
= (struct dns_header
*)payload
;
1611 u16
*length
= (u16
*)packet
;
1612 struct server
*last_server
;
1613 struct in_addr dst_addr_4
;
1614 union mysockaddr peer_addr
;
1615 socklen_t peer_len
= sizeof(union mysockaddr
);
1617 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1620 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1621 if (option_bool(OPT_LOCAL_SERVICE
))
1623 struct addrlist
*addr
;
1625 if (peer_addr
.sa
.sa_family
== AF_INET6
)
1627 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1628 if ((addr
->flags
& ADDRLIST_IPV6
) &&
1629 is_same_net6(&addr
->addr
.addr
.addr6
, &peer_addr
.in6
.sin6_addr
, addr
->prefixlen
))
1635 struct in_addr netmask
;
1636 for (addr
= daemon
->interface_addrs
; addr
; addr
= addr
->next
)
1638 netmask
.s_addr
= 0xffffffff << (32 - addr
->prefixlen
);
1639 if (!(addr
->flags
& ADDRLIST_IPV6
) &&
1640 is_same_net(addr
->addr
.addr
.addr4
, peer_addr
.in
.sin_addr
, netmask
))
1646 my_syslog(LOG_WARNING
, _("Ignoring query from non-local network"));
1654 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1655 !(size
= c1
<< 8 | c2
) ||
1656 !read_write(confd
, payload
, size
, 1))
1659 if (size
< (int)sizeof(struct dns_header
))
1664 /* save state of "cd" flag in query */
1665 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1666 no_cache_dnssec
= 1;
1668 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1671 struct auth_zone
*zone
;
1673 char *types
= querystr(auth_dns
? "auth" : "query", qtype
);
1675 if (peer_addr
.sa
.sa_family
== AF_INET
)
1676 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1677 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1680 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1681 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1685 /* find queries for zones we're authoritative for, and answer them directly */
1687 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1688 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1697 if (local_addr
->sa
.sa_family
== AF_INET
)
1698 dst_addr_4
= local_addr
->in
.sin_addr
;
1700 dst_addr_4
.s_addr
= 0;
1704 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1708 /* m > 0 if answered from cache */
1709 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1710 dst_addr_4
, netmask
, now
, &ad_question
, &do_bit
);
1712 /* Do this by steam now we're not in the select() loop */
1713 check_log_writer(NULL
);
1717 unsigned int flags
= 0;
1718 struct all_addr
*addrp
= NULL
;
1720 char *domain
= NULL
;
1722 if (option_bool(OPT_ADD_MAC
))
1723 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1725 if (option_bool(OPT_CLIENT_SUBNET
))
1727 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1736 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1738 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1739 last_server
= daemon
->servers
;
1741 last_server
= daemon
->last_server
;
1743 if (!flags
&& last_server
)
1745 struct server
*firstsendto
= NULL
;
1747 unsigned char *newhash
, hash
[HASH_SIZE
];
1748 if ((newhash
= hash_questions(header
, (unsigned int)size
, daemon
->keyname
)))
1749 memcpy(hash
, newhash
, HASH_SIZE
);
1751 memset(hash
, 0, HASH_SIZE
);
1753 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1755 /* Loop round available servers until we succeed in connecting to one.
1756 Note that this code subtley ensures that consecutive queries on this connection
1757 which can go to the same server, do so. */
1761 firstsendto
= last_server
;
1764 if (!(last_server
= last_server
->next
))
1765 last_server
= daemon
->servers
;
1767 if (last_server
== firstsendto
)
1771 /* server for wrong domain */
1772 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1773 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1776 if (last_server
->tcpfd
== -1)
1778 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1781 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1782 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1784 close(last_server
->tcpfd
);
1785 last_server
->tcpfd
= -1;
1790 if (option_bool(OPT_DNSSEC_VALID
))
1792 size_t new_size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1794 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1795 this allows it to select auth servers when one is returning bad data. */
1796 if (option_bool(OPT_DNSSEC_DEBUG
))
1797 header
->hb4
|= HB4_CD
;
1799 if (size
!= new_size
)
1806 #ifdef HAVE_CONNTRACK
1807 /* Copy connection mark of incoming query to outgoing connection. */
1808 if (option_bool(OPT_CONNTRACK
))
1811 struct all_addr local
;
1813 if (local_addr
->sa
.sa_family
== AF_INET6
)
1814 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1817 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1819 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1820 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1825 *length
= htons(size
);
1827 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1828 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1829 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1830 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1832 close(last_server
->tcpfd
);
1833 last_server
->tcpfd
= -1;
1840 strcpy(daemon
->namebuff
, "query");
1841 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1842 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1843 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1846 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1847 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1851 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1853 int keycount
= DNSSEC_WORK
; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1854 int status
= tcp_key_recurse(now
, STAT_TRUNCATED
, header
, m
, 0, daemon
->namebuff
, daemon
->keyname
, last_server
, &keycount
);
1858 result
= "ABANDONED";
1860 result
= (status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1862 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
, result
);
1864 if (status
== STAT_BOGUS
)
1865 no_cache_dnssec
= 1;
1867 if (status
== STAT_SECURE
)
1872 /* restore CD bit to the value in the query */
1873 if (checking_disabled
)
1874 header
->hb4
|= HB4_CD
;
1876 header
->hb4
&= ~HB4_CD
;
1878 /* There's no point in updating the cache, since this process will exit and
1879 lose the information after a few queries. We make this call for the alias and
1880 bogus-nxdomain side-effects. */
1881 /* If the crc of the question section doesn't match the crc we sent, then
1882 someone might be attempting to insert bogus values into the cache by
1883 sending replies containing questions and bogus answers. */
1885 newhash
= hash_questions(header
, (unsigned int)m
, daemon
->namebuff
);
1886 if (!newhash
|| memcmp(hash
, newhash
, HASH_SIZE
) != 0)
1892 if (crc
!= questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1899 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1900 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1901 cache_secure
, ad_question
, do_bit
, added_pheader
, check_subnet
, &peer_addr
);
1907 /* In case of local answer or no connections made. */
1909 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1913 check_log_writer(NULL
);
1917 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1922 static struct frec
*allocate_frec(time_t now
)
1926 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1928 f
->next
= daemon
->frec_list
;
1937 f
->dependent
= NULL
;
1938 f
->blocking_query
= NULL
;
1941 daemon
->frec_list
= f
;
1947 static struct randfd
*allocate_rfd(int family
)
1949 static int finger
= 0;
1952 /* limit the number of sockets we have open to avoid starvation of
1953 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1955 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1956 if (daemon
->randomsocks
[i
].refcount
== 0)
1958 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1961 daemon
->randomsocks
[i
].refcount
= 1;
1962 daemon
->randomsocks
[i
].family
= family
;
1963 return &daemon
->randomsocks
[i
];
1966 /* No free ones or cannot get new socket, grab an existing one */
1967 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1969 int j
= (i
+finger
) % RANDOM_SOCKS
;
1970 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1971 daemon
->randomsocks
[j
].family
== family
&&
1972 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1975 daemon
->randomsocks
[j
].refcount
++;
1976 return &daemon
->randomsocks
[j
];
1980 return NULL
; /* doom */
1982 static void free_frec(struct frec
*f
)
1984 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1992 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
2001 blockdata_free(f
->stash
);
2005 /* Anything we're waiting on is pointless now, too */
2006 if (f
->blocking_query
)
2007 free_frec(f
->blocking_query
);
2008 f
->blocking_query
= NULL
;
2009 f
->dependent
= NULL
;
2013 /* if wait==NULL return a free or older than TIMEOUT record.
2014 else return *wait zero if one available, or *wait is delay to
2015 when the oldest in-use record will expire. Impose an absolute
2016 limit of 4*TIMEOUT before we wipe things (for random sockets).
2017 If force is set, always return a result, even if we have
2018 to allocate above the limit. */
2019 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
2021 struct frec
*f
, *oldest
, *target
;
2027 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
2032 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
2038 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
2048 /* can't find empty one, use oldest if there is one
2049 and it's older than timeout */
2050 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
2052 /* keep stuff for twice timeout if we can by allocating a new
2054 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
2055 count
<= daemon
->ftabsize
&&
2056 (f
= allocate_frec(now
)))
2067 /* none available, calculate time 'till oldest record expires */
2068 if (!force
&& count
> daemon
->ftabsize
)
2070 static time_t last_log
= 0;
2073 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
2075 if ((int)difftime(now
, last_log
) > 5)
2078 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
2084 if (!(f
= allocate_frec(now
)) && wait
)
2085 /* wait one second on malloc failure */
2088 return f
; /* OK if malloc fails and this is NULL */
2091 /* crc is all-ones if not known. */
2092 static struct frec
*lookup_frec(unsigned short id
, void *hash
)
2096 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2097 if (f
->sentto
&& f
->new_id
== id
&&
2098 (!hash
|| memcmp(hash
, f
->hash
, HASH_SIZE
) == 0))
2104 static struct frec
*lookup_frec_by_sender(unsigned short id
,
2105 union mysockaddr
*addr
,
2110 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
2113 memcmp(hash
, f
->hash
, HASH_SIZE
) == 0 &&
2114 sockaddr_isequal(&f
->source
, addr
))
2120 /* A server record is going away, remove references to it */
2121 void server_gone(struct server
*server
)
2125 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
2126 if (f
->sentto
&& f
->sentto
== server
)
2129 if (daemon
->last_server
== server
)
2130 daemon
->last_server
= NULL
;
2132 if (daemon
->srv_save
== server
)
2133 daemon
->srv_save
= NULL
;
2136 /* return unique random ids. */
2137 static unsigned short get_id(void)
2139 unsigned short ret
= 0;
2143 while (lookup_frec(ret
, NULL
));