]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Ensure ->sentto is valid for DNSSEC forwards. Otherwise retries SEGV.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25 static struct randfd *allocate_rfd(int family);
26
27 #ifdef HAVE_DNSSEC
28 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
29 int class, char *name, char *keyname, struct server *server, int *keycount);
30 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class);
31 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname);
32 #endif
33
34
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
39 unsigned int iface)
40 {
41 struct msghdr msg;
42 struct iovec iov[1];
43 union {
44 struct cmsghdr align; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47 #elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49 #endif
50 #ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52 #endif
53 } control_u;
54
55 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
58 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
60 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
65
66 if (!nowild)
67 {
68 struct cmsghdr *cmptr;
69 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
71 cmptr = CMSG_FIRSTHDR(&msg);
72
73 if (to->sa.sa_family == AF_INET)
74 {
75 #if defined(HAVE_LINUX_NETWORK)
76 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
80 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
81 cmptr->cmsg_level = IPPROTO_IP;
82 cmptr->cmsg_type = IP_PKTINFO;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
85 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
88 #endif
89 }
90 else
91 #ifdef HAVE_IPV6
92 {
93 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
97 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
98 cmptr->cmsg_type = daemon->v6pktinfo;
99 cmptr->cmsg_level = IPPROTO_IPV6;
100 }
101 #else
102 (void)iface; /* eliminate warning */
103 #endif
104 }
105
106 while (sendmsg(fd, &msg, 0) == -1)
107 {
108 if (retry_send())
109 continue;
110
111 /* If interface is still in DAD, EINVAL results - ignore that. */
112 if (errno == EINVAL)
113 break;
114
115 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
116 return 0;
117 }
118
119 return 1;
120 }
121
122 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
123 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
124
125 {
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
129
130 unsigned int namelen = strlen(qdomain);
131 unsigned int matchlen = 0;
132 struct server *serv;
133 unsigned int flags = 0;
134
135 for (serv = daemon->servers; serv; serv=serv->next)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
138 {
139 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
140 *type = SERV_FOR_NODOTS;
141 if (serv->flags & SERV_NO_ADDR)
142 flags = F_NXDOMAIN;
143 else if (serv->flags & SERV_LITERAL_ADDRESS)
144 {
145 if (sflag & qtype)
146 {
147 flags = sflag;
148 if (serv->addr.sa.sa_family == AF_INET)
149 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
150 #ifdef HAVE_IPV6
151 else
152 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
153 #endif
154 }
155 else if (!flags || (flags & F_NXDOMAIN))
156 flags = F_NOERR;
157 }
158 }
159 else if (serv->flags & SERV_HAS_DOMAIN)
160 {
161 unsigned int domainlen = strlen(serv->domain);
162 char *matchstart = qdomain + namelen - domainlen;
163 if (namelen >= domainlen &&
164 hostname_isequal(matchstart, serv->domain) &&
165 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
166 {
167 if (serv->flags & SERV_NO_REBIND)
168 *norebind = 1;
169 else
170 {
171 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen != 0 && domainlen == matchlen)
176 {
177 if ((serv->flags & SERV_LITERAL_ADDRESS))
178 {
179 if (!(sflag & qtype) && flags == 0)
180 continue;
181 }
182 else
183 {
184 if (flags & (F_IPV4 | F_IPV6))
185 continue;
186 }
187 }
188
189 if (domainlen >= matchlen)
190 {
191 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
192 *domain = serv->domain;
193 matchlen = domainlen;
194 if (serv->flags & SERV_NO_ADDR)
195 flags = F_NXDOMAIN;
196 else if (serv->flags & SERV_LITERAL_ADDRESS)
197 {
198 if (sflag & qtype)
199 {
200 flags = sflag;
201 if (serv->addr.sa.sa_family == AF_INET)
202 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
203 #ifdef HAVE_IPV6
204 else
205 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
206 #endif
207 }
208 else if (!flags || (flags & F_NXDOMAIN))
209 flags = F_NOERR;
210 }
211 else
212 flags = 0;
213 }
214 }
215 }
216 }
217
218 if (flags == 0 && !(qtype & F_QUERY) &&
219 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
221 flags = F_NOERR;
222
223 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
224 flags = F_NOERR;
225
226 if (flags)
227 {
228 int logflags = 0;
229
230 if (flags == F_NXDOMAIN || flags == F_NOERR)
231 logflags = F_NEG | qtype;
232
233 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
234 }
235 else if ((*type) & SERV_USE_RESOLV)
236 {
237 *type = 0; /* use normal servers for this domain */
238 *domain = NULL;
239 }
240 return flags;
241 }
242
243 static int forward_query(int udpfd, union mysockaddr *udpaddr,
244 struct all_addr *dst_addr, unsigned int dst_iface,
245 struct dns_header *header, size_t plen, time_t now,
246 struct frec *forward, int ad_reqd, int do_bit)
247 {
248 char *domain = NULL;
249 int type = 0, norebind = 0;
250 struct all_addr *addrp = NULL;
251 unsigned int flags = 0;
252 struct server *start = NULL;
253 #ifdef HAVE_DNSSEC
254 void *hash = hash_questions(header, plen, daemon->namebuff);
255 #else
256 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
257 void *hash = &crc;
258 #endif
259 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
260
261 (void)do_bit;
262
263 /* may be no servers available. */
264 if (!daemon->servers)
265 forward = NULL;
266 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
267 {
268 #ifdef HAVE_DNSSEC
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward->blocking_query)
272 {
273 int fd;
274
275 while (forward->blocking_query)
276 forward = forward->blocking_query;
277
278 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
279 plen = forward->stash_len;
280
281 if (forward->sentto->addr.sa.sa_family == AF_INET)
282 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
283 #ifdef HAVE_IPV6
284 else
285 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
286 #endif
287
288 if (forward->sentto->sfd)
289 fd = forward->sentto->sfd->fd;
290 else
291 {
292 #ifdef HAVE_IPV6
293 if (forward->sentto->addr.sa.sa_family == AF_INET6)
294 fd = forward->rfd6->fd;
295 else
296 #endif
297 fd = forward->rfd4->fd;
298 }
299
300 while (sendto(fd, (char *)header, plen, 0,
301 &forward->sentto->addr.sa,
302 sa_len(&forward->sentto->addr)) == -1 && retry_send());
303
304 return 1;
305 }
306 #endif
307
308 /* retry on existing query, send to all available servers */
309 domain = forward->sentto->domain;
310 forward->sentto->failed_queries++;
311 if (!option_bool(OPT_ORDER))
312 {
313 forward->forwardall = 1;
314 daemon->last_server = NULL;
315 }
316 type = forward->sentto->flags & SERV_TYPE;
317 if (!(start = forward->sentto->next))
318 start = daemon->servers; /* at end of list, recycle */
319 header->id = htons(forward->new_id);
320 }
321 else
322 {
323 if (gotname)
324 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
325
326 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
327 /* table full - server failure. */
328 flags = F_NEG;
329
330 if (forward)
331 {
332 forward->source = *udpaddr;
333 forward->dest = *dst_addr;
334 forward->iface = dst_iface;
335 forward->orig_id = ntohs(header->id);
336 forward->new_id = get_id();
337 forward->fd = udpfd;
338 memcpy(forward->hash, hash, HASH_SIZE);
339 forward->forwardall = 0;
340 forward->flags = 0;
341 if (norebind)
342 forward->flags |= FREC_NOREBIND;
343 if (header->hb4 & HB4_CD)
344 forward->flags |= FREC_CHECKING_DISABLED;
345 if (ad_reqd)
346 forward->flags |= FREC_AD_QUESTION;
347 #ifdef HAVE_DNSSEC
348 forward->work_counter = DNSSEC_WORK;
349 if (do_bit)
350 forward->flags |= FREC_DO_QUESTION;
351 #endif
352
353 header->id = htons(forward->new_id);
354
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
359
360 if (type == 0)
361 {
362 if (option_bool(OPT_ORDER))
363 start = daemon->servers;
364 else if (!(start = daemon->last_server) ||
365 daemon->forwardcount++ > FORWARD_TEST ||
366 difftime(now, daemon->forwardtime) > FORWARD_TIME)
367 {
368 start = daemon->servers;
369 forward->forwardall = 1;
370 daemon->forwardcount = 0;
371 daemon->forwardtime = now;
372 }
373 }
374 else
375 {
376 start = daemon->servers;
377 if (!option_bool(OPT_ORDER))
378 forward->forwardall = 1;
379 }
380 }
381 }
382
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
386
387 if (!flags && forward)
388 {
389 struct server *firstsentto = start;
390 int forwarded = 0;
391
392 if (option_bool(OPT_ADD_MAC))
393 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
394
395 if (option_bool(OPT_CLIENT_SUBNET))
396 {
397 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
398 if (new != plen)
399 {
400 plen = new;
401 forward->flags |= FREC_HAS_SUBNET;
402 }
403 }
404
405 #ifdef HAVE_DNSSEC
406 if (option_bool(OPT_DNSSEC_VALID))
407 {
408 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
409
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG))
413 header->hb4 |= HB4_CD;
414
415 if (new_plen != plen)
416 forward->flags |= FREC_ADDED_PHEADER;
417
418 plen = new_plen;
419 }
420 #endif
421
422 while (1)
423 {
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
427
428 if (type == (start->flags & SERV_TYPE) &&
429 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
430 !(start->flags & SERV_LITERAL_ADDRESS))
431 {
432 int fd;
433
434 /* find server socket to use, may need to get random one. */
435 if (start->sfd)
436 fd = start->sfd->fd;
437 else
438 {
439 #ifdef HAVE_IPV6
440 if (start->addr.sa.sa_family == AF_INET6)
441 {
442 if (!forward->rfd6 &&
443 !(forward->rfd6 = allocate_rfd(AF_INET6)))
444 break;
445 daemon->rfd_save = forward->rfd6;
446 fd = forward->rfd6->fd;
447 }
448 else
449 #endif
450 {
451 if (!forward->rfd4 &&
452 !(forward->rfd4 = allocate_rfd(AF_INET)))
453 break;
454 daemon->rfd_save = forward->rfd4;
455 fd = forward->rfd4->fd;
456 }
457
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK))
461 {
462 unsigned int mark;
463 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
464 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
465 }
466 #endif
467 }
468
469 if (sendto(fd, (char *)header, plen, 0,
470 &start->addr.sa,
471 sa_len(&start->addr)) == -1)
472 {
473 if (retry_send())
474 continue;
475 }
476 else
477 {
478 /* Keep info in case we want to re-send this packet */
479 daemon->srv_save = start;
480 daemon->packet_len = plen;
481
482 if (!gotname)
483 strcpy(daemon->namebuff, "query");
484 if (start->addr.sa.sa_family == AF_INET)
485 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
486 (struct all_addr *)&start->addr.in.sin_addr, NULL);
487 #ifdef HAVE_IPV6
488 else
489 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
490 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
491 #endif
492 start->queries++;
493 forwarded = 1;
494 forward->sentto = start;
495 if (!forward->forwardall)
496 break;
497 forward->forwardall++;
498 }
499 }
500
501 if (!(start = start->next))
502 start = daemon->servers;
503
504 if (start == firstsentto)
505 break;
506 }
507
508 if (forwarded)
509 return 1;
510
511 /* could not send on, prepare to return */
512 header->id = htons(forward->orig_id);
513 free_frec(forward); /* cancel */
514 }
515
516 /* could not send on, return empty answer or address if known for whole domain */
517 if (udpfd != -1)
518 {
519 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
520 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
521 }
522
523 return 0;
524 }
525
526 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
527 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
528 {
529 unsigned char *pheader, *sizep;
530 char **sets = 0;
531 int munged = 0, is_sign;
532 size_t plen;
533
534 (void)ad_reqd;
535 (void) do_bit;
536
537 #ifdef HAVE_IPSET
538 /* Similar algorithm to search_servers. */
539 struct ipsets *ipset_pos;
540 unsigned int namelen = strlen(daemon->namebuff);
541 unsigned int matchlen = 0;
542 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
543 {
544 unsigned int domainlen = strlen(ipset_pos->domain);
545 char *matchstart = daemon->namebuff + namelen - domainlen;
546 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
547 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
548 domainlen >= matchlen)
549 {
550 matchlen = domainlen;
551 sets = ipset_pos->sets;
552 }
553 }
554 #endif
555
556 /* If upstream is advertising a larger UDP packet size
557 than we allow, trim it so that we don't get overlarge
558 requests for the client. We can't do this for signed packets. */
559
560 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
561 {
562 unsigned short udpsz;
563 unsigned char *psave = sizep;
564
565 GETSHORT(udpsz, sizep);
566
567 if (!is_sign && udpsz > daemon->edns_pktsz)
568 PUTSHORT(daemon->edns_pktsz, psave);
569
570 if (check_subnet && !check_source(header, plen, pheader, query_source))
571 {
572 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
573 return 0;
574 }
575
576 if (added_pheader)
577 {
578 pheader = 0;
579 header->arcount = htons(0);
580 }
581 }
582
583 /* RFC 4035 sect 4.6 para 3 */
584 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
585 header->hb4 &= ~HB4_AD;
586
587 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
588 return n;
589
590 /* Complain loudly if the upstream server is non-recursive. */
591 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
592 server && !(server->flags & SERV_WARNED_RECURSIVE))
593 {
594 prettyprint_addr(&server->addr, daemon->namebuff);
595 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
596 if (!option_bool(OPT_LOG))
597 server->flags |= SERV_WARNED_RECURSIVE;
598 }
599
600 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
601 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
602 {
603 munged = 1;
604 SET_RCODE(header, NXDOMAIN);
605 header->hb3 &= ~HB3_AA;
606 cache_secure = 0;
607 }
608 else
609 {
610 int doctored = 0;
611
612 if (RCODE(header) == NXDOMAIN &&
613 extract_request(header, n, daemon->namebuff, NULL) &&
614 check_for_local_domain(daemon->namebuff, now))
615 {
616 /* if we forwarded a query for a locally known name (because it was for
617 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
618 since we know that the domain exists, even if upstream doesn't */
619 munged = 1;
620 header->hb3 |= HB3_AA;
621 SET_RCODE(header, NOERROR);
622 cache_secure = 0;
623 }
624
625 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
626 {
627 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
628 munged = 1;
629 cache_secure = 0;
630 }
631
632 if (doctored)
633 cache_secure = 0;
634 }
635
636 #ifdef HAVE_DNSSEC
637 if (no_cache && !(header->hb4 & HB4_CD))
638 {
639 if (!option_bool(OPT_DNSSEC_DEBUG))
640 {
641 /* Bogus reply, turn into SERVFAIL */
642 SET_RCODE(header, SERVFAIL);
643 munged = 1;
644 }
645 }
646
647 if (option_bool(OPT_DNSSEC_VALID))
648 header->hb4 &= ~HB4_AD;
649
650 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
651 header->hb4 |= HB4_AD;
652
653 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
654 if (!do_bit)
655 n = filter_rrsigs(header, n);
656 #endif
657
658 /* do this after extract_addresses. Ensure NODATA reply and remove
659 nameserver info. */
660
661 if (munged)
662 {
663 header->ancount = htons(0);
664 header->nscount = htons(0);
665 header->arcount = htons(0);
666 }
667
668 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
669 sections of the packet. Find the new length here and put back pseudoheader
670 if it was removed. */
671 return resize_packet(header, n, pheader, plen);
672 }
673
674 /* sets new last_server */
675 void reply_query(int fd, int family, time_t now)
676 {
677 /* packet from peer server, extract data for cache, and send to
678 original requester */
679 struct dns_header *header;
680 union mysockaddr serveraddr;
681 struct frec *forward;
682 socklen_t addrlen = sizeof(serveraddr);
683 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
684 size_t nn;
685 struct server *server;
686 void *hash;
687 #ifndef HAVE_DNSSEC
688 unsigned int crc;
689 #endif
690
691 /* packet buffer overwritten */
692 daemon->srv_save = NULL;
693
694 /* Determine the address of the server replying so that we can mark that as good */
695 serveraddr.sa.sa_family = family;
696 #ifdef HAVE_IPV6
697 if (serveraddr.sa.sa_family == AF_INET6)
698 serveraddr.in6.sin6_flowinfo = 0;
699 #endif
700
701 header = (struct dns_header *)daemon->packet;
702
703 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
704 return;
705
706 /* spoof check: answer must come from known server, */
707 for (server = daemon->servers; server; server = server->next)
708 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
709 sockaddr_isequal(&server->addr, &serveraddr))
710 break;
711
712 if (!server)
713 return;
714
715 #ifdef HAVE_DNSSEC
716 hash = hash_questions(header, n, daemon->namebuff);
717 #else
718 hash = &crc;
719 crc = questions_crc(header, n, daemon->namebuff);
720 #endif
721
722 if (!(forward = lookup_frec(ntohs(header->id), hash)))
723 return;
724
725 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
726 !option_bool(OPT_ORDER) &&
727 forward->forwardall == 0)
728 /* for broken servers, attempt to send to another one. */
729 {
730 unsigned char *pheader;
731 size_t plen;
732 int is_sign;
733
734 /* recreate query from reply */
735 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
736 if (!is_sign)
737 {
738 header->ancount = htons(0);
739 header->nscount = htons(0);
740 header->arcount = htons(0);
741 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
742 {
743 header->hb3 &= ~(HB3_QR | HB3_TC);
744 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
745 return;
746 }
747 }
748 }
749
750 server = forward->sentto;
751
752 if ((forward->sentto->flags & SERV_TYPE) == 0)
753 {
754 if (RCODE(header) == REFUSED)
755 server = NULL;
756 else
757 {
758 struct server *last_server;
759
760 /* find good server by address if possible, otherwise assume the last one we sent to */
761 for (last_server = daemon->servers; last_server; last_server = last_server->next)
762 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
763 sockaddr_isequal(&last_server->addr, &serveraddr))
764 {
765 server = last_server;
766 break;
767 }
768 }
769 if (!option_bool(OPT_ALL_SERVERS))
770 daemon->last_server = server;
771 }
772
773 /* If the answer is an error, keep the forward record in place in case
774 we get a good reply from another server. Kill it when we've
775 had replies from all to avoid filling the forwarding table when
776 everything is broken */
777 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
778 {
779 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
780
781 if (option_bool(OPT_NO_REBIND))
782 check_rebind = !(forward->flags & FREC_NOREBIND);
783
784 /* Don't cache replies where DNSSEC validation was turned off, either
785 the upstream server told us so, or the original query specified it. */
786 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
787 no_cache_dnssec = 1;
788
789 #ifdef HAVE_DNSSEC
790 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
791 {
792 int status;
793
794 /* We've had a reply already, which we're validating. Ignore this duplicate */
795 if (forward->blocking_query)
796 return;
797
798 if (header->hb3 & HB3_TC)
799 {
800 /* Truncated answer can't be validated.
801 If this is an answer to a DNSSEC-generated query, we still
802 need to get the client to retry over TCP, so return
803 an answer with the TC bit set, even if the actual answer fits.
804 */
805 status = STAT_TRUNCATED;
806 }
807 else if (forward->flags & FREC_DNSKEY_QUERY)
808 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
809 else if (forward->flags & FREC_DS_QUERY)
810 {
811 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
812 if (status == STAT_NO_DS)
813 status = STAT_INSECURE;
814 }
815 else if (forward->flags & FREC_CHECK_NOSIGN)
816 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
817 else
818 {
819 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
820 if (status == STAT_NO_SIG)
821 {
822 if (option_bool(OPT_DNSSEC_NO_SIGN))
823 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
824 else
825 status = STAT_INSECURE;
826 }
827 }
828 /* Can't validate, as we're missing key data. Put this
829 answer aside, whilst we get that. */
830 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
831 {
832 struct frec *new, *orig;
833
834 /* Free any saved query */
835 if (forward->stash)
836 blockdata_free(forward->stash);
837
838 /* Now save reply pending receipt of key data */
839 if (!(forward->stash = blockdata_alloc((char *)header, n)))
840 return;
841 forward->stash_len = n;
842
843 anotherkey:
844 /* Find the original query that started it all.... */
845 for (orig = forward; orig->dependent; orig = orig->dependent);
846
847 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
848 status = STAT_INSECURE;
849 else
850 {
851 int fd;
852 struct frec *next = new->next;
853 *new = *forward; /* copy everything, then overwrite */
854 new->next = next;
855 new->blocking_query = NULL;
856 new->sentto = server;
857 new->rfd4 = NULL;
858 #ifdef HAVE_IPV6
859 new->rfd6 = NULL;
860 #endif
861 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
862
863 new->dependent = forward; /* to find query awaiting new one. */
864 forward->blocking_query = new; /* for garbage cleaning */
865 /* validate routines leave name of required record in daemon->keyname */
866 if (status == STAT_NEED_KEY)
867 {
868 new->flags |= FREC_DNSKEY_QUERY;
869 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
870 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
871 }
872 else
873 {
874 if (status == STAT_NEED_DS_NEG)
875 new->flags |= FREC_CHECK_NOSIGN;
876 else
877 new->flags |= FREC_DS_QUERY;
878 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
879 daemon->keyname, forward->class, T_DS, &server->addr);
880 }
881 if ((hash = hash_questions(header, nn, daemon->namebuff)))
882 memcpy(new->hash, hash, HASH_SIZE);
883 new->new_id = get_id();
884 header->id = htons(new->new_id);
885 /* Save query for retransmission */
886 new->stash = blockdata_alloc((char *)header, nn);
887 new->stash_len = nn;
888
889 /* Don't resend this. */
890 daemon->srv_save = NULL;
891
892 if (server->sfd)
893 fd = server->sfd->fd;
894 else
895 {
896 fd = -1;
897 #ifdef HAVE_IPV6
898 if (server->addr.sa.sa_family == AF_INET6)
899 {
900 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
901 fd = new->rfd6->fd;
902 }
903 else
904 #endif
905 {
906 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
907 fd = new->rfd4->fd;
908 }
909 }
910
911 if (fd != -1)
912 {
913 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
914 server->queries++;
915 }
916
917 return;
918 }
919 }
920
921 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
922 Now wind back down, pulling back answers which wouldn't previously validate
923 and validate them with the new data. Note that if an answer needs multiple
924 keys to validate, we may find another key is needed, in which case we set off
925 down another branch of the tree. Once we get to the original answer
926 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
927 while (forward->dependent)
928 {
929 struct frec *prev = forward->dependent;
930 free_frec(forward);
931 forward = prev;
932 forward->blocking_query = NULL; /* already gone */
933 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
934 n = forward->stash_len;
935
936 if (status == STAT_SECURE)
937 {
938 if (forward->flags & FREC_DNSKEY_QUERY)
939 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
940 else if (forward->flags & FREC_DS_QUERY)
941 {
942 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
943 if (status == STAT_NO_DS)
944 status = STAT_INSECURE;
945 }
946 else if (forward->flags & FREC_CHECK_NOSIGN)
947 status = do_check_sign(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
948 else
949 {
950 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL);
951 if (status == STAT_NO_SIG)
952 {
953 if (option_bool(OPT_DNSSEC_NO_SIGN))
954 status = send_check_sign(now, header, n, daemon->namebuff, daemon->keyname);
955 else
956 status = STAT_INSECURE;
957 }
958 }
959
960 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
961 goto anotherkey;
962 }
963 }
964
965 if (status == STAT_TRUNCATED)
966 header->hb3 |= HB3_TC;
967 else
968 {
969 char *result;
970
971 if (forward->work_counter == 0)
972 result = "ABANDONED";
973 else
974 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
975
976 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
977 }
978
979 no_cache_dnssec = 0;
980
981 if (status == STAT_SECURE)
982 cache_secure = 1;
983 else if (status == STAT_BOGUS)
984 no_cache_dnssec = 1;
985 }
986 #endif
987
988 /* restore CD bit to the value in the query */
989 if (forward->flags & FREC_CHECKING_DISABLED)
990 header->hb4 |= HB4_CD;
991 else
992 header->hb4 &= ~HB4_CD;
993
994 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
995 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
996 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
997 {
998 header->id = htons(forward->orig_id);
999 header->hb4 |= HB4_RA; /* recursion if available */
1000 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
1001 &forward->source, &forward->dest, forward->iface);
1002 }
1003 free_frec(forward); /* cancel */
1004 }
1005 }
1006
1007
1008 void receive_query(struct listener *listen, time_t now)
1009 {
1010 struct dns_header *header = (struct dns_header *)daemon->packet;
1011 union mysockaddr source_addr;
1012 unsigned short type;
1013 struct all_addr dst_addr;
1014 struct in_addr netmask, dst_addr_4;
1015 size_t m;
1016 ssize_t n;
1017 int if_index = 0, auth_dns = 0;
1018 #ifdef HAVE_AUTH
1019 int local_auth = 0;
1020 #endif
1021 struct iovec iov[1];
1022 struct msghdr msg;
1023 struct cmsghdr *cmptr;
1024 union {
1025 struct cmsghdr align; /* this ensures alignment */
1026 #ifdef HAVE_IPV6
1027 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1028 #endif
1029 #if defined(HAVE_LINUX_NETWORK)
1030 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1031 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1032 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1033 CMSG_SPACE(sizeof(unsigned int))];
1034 #elif defined(IP_RECVDSTADDR)
1035 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1036 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1037 #endif
1038 } control_u;
1039 #ifdef HAVE_IPV6
1040 /* Can always get recvd interface for IPv6 */
1041 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1042 #else
1043 int check_dst = !option_bool(OPT_NOWILD);
1044 #endif
1045
1046 /* packet buffer overwritten */
1047 daemon->srv_save = NULL;
1048
1049 dst_addr_4.s_addr = 0;
1050 netmask.s_addr = 0;
1051
1052 if (option_bool(OPT_NOWILD) && listen->iface)
1053 {
1054 auth_dns = listen->iface->dns_auth;
1055
1056 if (listen->family == AF_INET)
1057 {
1058 dst_addr_4 = listen->iface->addr.in.sin_addr;
1059 netmask = listen->iface->netmask;
1060 }
1061 }
1062
1063 iov[0].iov_base = daemon->packet;
1064 iov[0].iov_len = daemon->edns_pktsz;
1065
1066 msg.msg_control = control_u.control;
1067 msg.msg_controllen = sizeof(control_u);
1068 msg.msg_flags = 0;
1069 msg.msg_name = &source_addr;
1070 msg.msg_namelen = sizeof(source_addr);
1071 msg.msg_iov = iov;
1072 msg.msg_iovlen = 1;
1073
1074 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1075 return;
1076
1077 if (n < (int)sizeof(struct dns_header) ||
1078 (msg.msg_flags & MSG_TRUNC) ||
1079 (header->hb3 & HB3_QR))
1080 return;
1081
1082 source_addr.sa.sa_family = listen->family;
1083
1084 if (listen->family == AF_INET)
1085 {
1086 /* Source-port == 0 is an error, we can't send back to that.
1087 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1088 if (source_addr.in.sin_port == 0)
1089 return;
1090 }
1091 #ifdef HAVE_IPV6
1092 else
1093 {
1094 /* Source-port == 0 is an error, we can't send back to that. */
1095 if (source_addr.in6.sin6_port == 0)
1096 return;
1097 source_addr.in6.sin6_flowinfo = 0;
1098 }
1099 #endif
1100
1101 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1102 if (option_bool(OPT_LOCAL_SERVICE))
1103 {
1104 struct addrlist *addr;
1105 #ifdef HAVE_IPV6
1106 if (listen->family == AF_INET6)
1107 {
1108 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1109 if ((addr->flags & ADDRLIST_IPV6) &&
1110 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1111 break;
1112 }
1113 else
1114 #endif
1115 {
1116 struct in_addr netmask;
1117 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1118 {
1119 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1120 if (!(addr->flags & ADDRLIST_IPV6) &&
1121 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1122 break;
1123 }
1124 }
1125 if (!addr)
1126 {
1127 static int warned = 0;
1128 if (!warned)
1129 {
1130 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1131 warned = 1;
1132 }
1133 return;
1134 }
1135 }
1136
1137 if (check_dst)
1138 {
1139 struct ifreq ifr;
1140
1141 if (msg.msg_controllen < sizeof(struct cmsghdr))
1142 return;
1143
1144 #if defined(HAVE_LINUX_NETWORK)
1145 if (listen->family == AF_INET)
1146 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1147 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1148 {
1149 union {
1150 unsigned char *c;
1151 struct in_pktinfo *p;
1152 } p;
1153 p.c = CMSG_DATA(cmptr);
1154 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1155 if_index = p.p->ipi_ifindex;
1156 }
1157 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1158 if (listen->family == AF_INET)
1159 {
1160 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1161 {
1162 union {
1163 unsigned char *c;
1164 unsigned int *i;
1165 struct in_addr *a;
1166 #ifndef HAVE_SOLARIS_NETWORK
1167 struct sockaddr_dl *s;
1168 #endif
1169 } p;
1170 p.c = CMSG_DATA(cmptr);
1171 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1172 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1173 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1174 #ifdef HAVE_SOLARIS_NETWORK
1175 if_index = *(p.i);
1176 #else
1177 if_index = p.s->sdl_index;
1178 #endif
1179 }
1180 }
1181 #endif
1182
1183 #ifdef HAVE_IPV6
1184 if (listen->family == AF_INET6)
1185 {
1186 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1187 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1188 {
1189 union {
1190 unsigned char *c;
1191 struct in6_pktinfo *p;
1192 } p;
1193 p.c = CMSG_DATA(cmptr);
1194
1195 dst_addr.addr.addr6 = p.p->ipi6_addr;
1196 if_index = p.p->ipi6_ifindex;
1197 }
1198 }
1199 #endif
1200
1201 /* enforce available interface configuration */
1202
1203 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1204 return;
1205
1206 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1207 {
1208 if (!option_bool(OPT_CLEVERBIND))
1209 enumerate_interfaces(0);
1210 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1211 !label_exception(if_index, listen->family, &dst_addr))
1212 return;
1213 }
1214
1215 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1216 {
1217 struct irec *iface;
1218
1219 /* get the netmask of the interface whch has the address we were sent to.
1220 This is no neccessarily the interface we arrived on. */
1221
1222 for (iface = daemon->interfaces; iface; iface = iface->next)
1223 if (iface->addr.sa.sa_family == AF_INET &&
1224 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1225 break;
1226
1227 /* interface may be new */
1228 if (!iface && !option_bool(OPT_CLEVERBIND))
1229 enumerate_interfaces(0);
1230
1231 for (iface = daemon->interfaces; iface; iface = iface->next)
1232 if (iface->addr.sa.sa_family == AF_INET &&
1233 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1234 break;
1235
1236 /* If we failed, abandon localisation */
1237 if (iface)
1238 netmask = iface->netmask;
1239 else
1240 dst_addr_4.s_addr = 0;
1241 }
1242 }
1243
1244 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1245 {
1246 #ifdef HAVE_AUTH
1247 struct auth_zone *zone;
1248 #endif
1249 char *types = querystr(auth_dns ? "auth" : "query", type);
1250
1251 if (listen->family == AF_INET)
1252 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1253 (struct all_addr *)&source_addr.in.sin_addr, types);
1254 #ifdef HAVE_IPV6
1255 else
1256 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1257 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1258 #endif
1259
1260 #ifdef HAVE_AUTH
1261 /* find queries for zones we're authoritative for, and answer them directly */
1262 if (!auth_dns)
1263 for (zone = daemon->auth_zones; zone; zone = zone->next)
1264 if (in_zone(zone, daemon->namebuff, NULL))
1265 {
1266 auth_dns = 1;
1267 local_auth = 1;
1268 break;
1269 }
1270 #endif
1271 }
1272
1273 #ifdef HAVE_AUTH
1274 if (auth_dns)
1275 {
1276 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1277 if (m >= 1)
1278 {
1279 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1280 (char *)header, m, &source_addr, &dst_addr, if_index);
1281 daemon->auth_answer++;
1282 }
1283 }
1284 else
1285 #endif
1286 {
1287 int ad_reqd, do_bit;
1288 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1289 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1290
1291 if (m >= 1)
1292 {
1293 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1294 (char *)header, m, &source_addr, &dst_addr, if_index);
1295 daemon->local_answer++;
1296 }
1297 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1298 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1299 daemon->queries_forwarded++;
1300 else
1301 daemon->local_answer++;
1302 }
1303 }
1304
1305 #ifdef HAVE_DNSSEC
1306
1307 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1308 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1309 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1310 static int send_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname)
1311 {
1312 struct crec *crecp;
1313 char *name_start = name;
1314 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1315
1316 if (status != STAT_INSECURE)
1317 return status;
1318
1319 while (1)
1320 {
1321 crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1322
1323 if (crecp && (crecp->flags & F_DNSSECOK))
1324 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1325
1326 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1327 {
1328 name_start++; /* chop a label off and try again */
1329 continue;
1330 }
1331
1332 /* Reached the root */
1333 if (!name_start)
1334 return STAT_BOGUS;
1335
1336 strcpy(keyname, name_start);
1337 return STAT_NEED_DS_NEG;
1338 }
1339 }
1340
1341 /* Got answer to DS query from send_check_sign, check for proven non-existence, or make the next DS query to try. */
1342 static int do_check_sign(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int class)
1343
1344 {
1345 char *name_start;
1346 unsigned char *p;
1347 int status = dnssec_validate_ds(now, header, plen, name, keyname, class);
1348
1349 if (status != STAT_INSECURE)
1350 {
1351 if (status == STAT_NO_DS)
1352 status = STAT_INSECURE;
1353 return status;
1354 }
1355
1356 p = (unsigned char *)(header+1);
1357
1358 if (extract_name(header, plen, &p, name, 1, 4) &&
1359 (name_start = strchr(name, '.')))
1360 {
1361 name_start++; /* chop a label off and try again */
1362 strcpy(keyname, name_start);
1363 return STAT_NEED_DS_NEG;
1364 }
1365
1366 return STAT_BOGUS;
1367 }
1368
1369 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1370 an unsigned answer is OK, or we find a signed DS, in which case there should be
1371 a signature, and the answer is BOGUS */
1372 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1373 char *keyname, struct server *server, int *keycount)
1374 {
1375 size_t m;
1376 unsigned char *packet, *payload;
1377 u16 *length;
1378 unsigned char *p = (unsigned char *)(header+1);
1379 int status;
1380 char *name_start = name;
1381
1382 /* Get first insecure entry in CNAME chain */
1383 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1384 if (status == STAT_BOGUS)
1385 return STAT_BOGUS;
1386
1387 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1388 return STAT_BOGUS;
1389
1390 payload = &packet[2];
1391 header = (struct dns_header *)payload;
1392 length = (u16 *)packet;
1393
1394 while (1)
1395 {
1396 unsigned char *newhash, hash[HASH_SIZE];
1397 unsigned char c1, c2;
1398 struct crec *crecp = cache_find_by_name(NULL, name_start, now, F_DS);
1399
1400 if (--(*keycount) == 0)
1401 {
1402 free(packet);
1403 return STAT_BOGUS;
1404 }
1405
1406 if (crecp && (crecp->flags & F_DNSSECOK))
1407 {
1408 free(packet);
1409 return (crecp->flags & F_NEG) ? STAT_INSECURE : STAT_BOGUS;
1410 }
1411
1412 /* If we have cached insecurely that a DS doesn't exist,
1413 ise that is a hit for where to start looking for the secure one */
1414 if (crecp && (crecp->flags & F_NEG) && (name_start = strchr(name_start, '.')))
1415 {
1416 name_start++; /* chop a label off and try again */
1417 continue;
1418 }
1419
1420 /* reached the root */
1421 if (!name_start)
1422 {
1423 free(packet);
1424 return STAT_BOGUS;
1425 }
1426
1427 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1428
1429 /* We rely on the question section coming back unchanged, ensure it is with the hash. */
1430 if ((newhash = hash_questions(header, (unsigned int)m, name)))
1431 {
1432 memcpy(hash, newhash, HASH_SIZE);
1433
1434 *length = htons(m);
1435
1436 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1437 read_write(server->tcpfd, &c1, 1, 1) &&
1438 read_write(server->tcpfd, &c2, 1, 1) &&
1439 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1440 {
1441 m = (c1 << 8) | c2;
1442
1443 newhash = hash_questions(header, (unsigned int)m, name);
1444 if (newhash && memcmp(hash, newhash, HASH_SIZE) == 0)
1445 {
1446 /* Note this trashes all three name workspaces */
1447 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1448
1449 /* We've found a DS which proves the bit of the DNS where the
1450 original query is, is unsigned, so the answer is OK,
1451 if unvalidated. */
1452 if (status == STAT_NO_DS)
1453 {
1454 free(packet);
1455 return STAT_INSECURE;
1456 }
1457
1458 /* No DS, not got to DNSSEC-land yet, go up. */
1459 if (status == STAT_INSECURE)
1460 {
1461 p = (unsigned char *)(header+1);
1462
1463 if (extract_name(header, plen, &p, name, 1, 4) &&
1464 (name_start = strchr(name, '.')))
1465 {
1466 name_start++; /* chop a label off and try again */
1467 continue;
1468 }
1469 }
1470 }
1471 }
1472 }
1473
1474 free(packet);
1475
1476 return STAT_BOGUS;
1477 }
1478 }
1479
1480 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1481 int class, char *name, char *keyname, struct server *server, int *keycount)
1482 {
1483 /* Recurse up the key heirarchy */
1484 int new_status;
1485
1486 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1487 if (--(*keycount) == 0)
1488 return STAT_INSECURE;
1489
1490 if (status == STAT_NEED_KEY)
1491 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1492 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1493 {
1494 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1495 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1496 new_status = STAT_INSECURE;
1497 }
1498 else if (status == STAT_CHASE_CNAME)
1499 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1500 else
1501 {
1502 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1503
1504 if (new_status == STAT_NO_SIG)
1505 {
1506 if (option_bool(OPT_DNSSEC_NO_SIGN))
1507 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1508 else
1509 new_status = STAT_INSECURE;
1510 }
1511 }
1512
1513 /* Can't validate because we need a key/DS whose name now in keyname.
1514 Make query for same, and recurse to validate */
1515 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1516 {
1517 size_t m;
1518 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1519 unsigned char *payload = &packet[2];
1520 struct dns_header *new_header = (struct dns_header *)payload;
1521 u16 *length = (u16 *)packet;
1522 unsigned char c1, c2;
1523
1524 if (!packet)
1525 return STAT_INSECURE;
1526
1527 another_tcp_key:
1528 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1529 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1530
1531 *length = htons(m);
1532
1533 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1534 !read_write(server->tcpfd, &c1, 1, 1) ||
1535 !read_write(server->tcpfd, &c2, 1, 1) ||
1536 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1537 new_status = STAT_INSECURE;
1538 else
1539 {
1540 m = (c1 << 8) | c2;
1541
1542 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1543
1544 if (new_status == STAT_SECURE)
1545 {
1546 /* Reached a validated record, now try again at this level.
1547 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1548 If so, go round again. */
1549
1550 if (status == STAT_NEED_KEY)
1551 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1552 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1553 {
1554 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1555 if (status == STAT_NEED_DS && new_status == STAT_NO_DS)
1556 new_status = STAT_INSECURE; /* Validated no DS */
1557 }
1558 else if (status == STAT_CHASE_CNAME)
1559 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1560 else
1561 {
1562 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL);
1563
1564 if (new_status == STAT_NO_SIG)
1565 {
1566 if (option_bool(OPT_DNSSEC_NO_SIGN))
1567 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1568 else
1569 new_status = STAT_INSECURE;
1570 }
1571 }
1572
1573 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1574 goto another_tcp_key;
1575 }
1576 }
1577
1578 free(packet);
1579 }
1580 return new_status;
1581 }
1582 #endif
1583
1584
1585 /* The daemon forks before calling this: it should deal with one connection,
1586 blocking as neccessary, and then return. Note, need to be a bit careful
1587 about resources for debug mode, when the fork is suppressed: that's
1588 done by the caller. */
1589 unsigned char *tcp_request(int confd, time_t now,
1590 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1591 {
1592 size_t size = 0;
1593 int norebind = 0;
1594 #ifdef HAVE_AUTH
1595 int local_auth = 0;
1596 #endif
1597 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1598 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
1599 size_t m;
1600 unsigned short qtype;
1601 unsigned int gotname;
1602 unsigned char c1, c2;
1603 /* Max TCP packet + slop + size */
1604 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1605 unsigned char *payload = &packet[2];
1606 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1607 struct dns_header *header = (struct dns_header *)payload;
1608 u16 *length = (u16 *)packet;
1609 struct server *last_server;
1610 struct in_addr dst_addr_4;
1611 union mysockaddr peer_addr;
1612 socklen_t peer_len = sizeof(union mysockaddr);
1613
1614 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1615 return packet;
1616
1617 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1618 if (option_bool(OPT_LOCAL_SERVICE))
1619 {
1620 struct addrlist *addr;
1621 #ifdef HAVE_IPV6
1622 if (peer_addr.sa.sa_family == AF_INET6)
1623 {
1624 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1625 if ((addr->flags & ADDRLIST_IPV6) &&
1626 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1627 break;
1628 }
1629 else
1630 #endif
1631 {
1632 struct in_addr netmask;
1633 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1634 {
1635 netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
1636 if (!(addr->flags & ADDRLIST_IPV6) &&
1637 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1638 break;
1639 }
1640 }
1641 if (!addr)
1642 {
1643 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1644 return packet;
1645 }
1646 }
1647
1648 while (1)
1649 {
1650 if (!packet ||
1651 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1652 !(size = c1 << 8 | c2) ||
1653 !read_write(confd, payload, size, 1))
1654 return packet;
1655
1656 if (size < (int)sizeof(struct dns_header))
1657 continue;
1658
1659 check_subnet = 0;
1660
1661 /* save state of "cd" flag in query */
1662 if ((checking_disabled = header->hb4 & HB4_CD))
1663 no_cache_dnssec = 1;
1664
1665 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1666 {
1667 #ifdef HAVE_AUTH
1668 struct auth_zone *zone;
1669 #endif
1670 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1671
1672 if (peer_addr.sa.sa_family == AF_INET)
1673 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1674 (struct all_addr *)&peer_addr.in.sin_addr, types);
1675 #ifdef HAVE_IPV6
1676 else
1677 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1678 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1679 #endif
1680
1681 #ifdef HAVE_AUTH
1682 /* find queries for zones we're authoritative for, and answer them directly */
1683 if (!auth_dns)
1684 for (zone = daemon->auth_zones; zone; zone = zone->next)
1685 if (in_zone(zone, daemon->namebuff, NULL))
1686 {
1687 auth_dns = 1;
1688 local_auth = 1;
1689 break;
1690 }
1691 #endif
1692 }
1693
1694 if (local_addr->sa.sa_family == AF_INET)
1695 dst_addr_4 = local_addr->in.sin_addr;
1696 else
1697 dst_addr_4.s_addr = 0;
1698
1699 #ifdef HAVE_AUTH
1700 if (auth_dns)
1701 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1702 else
1703 #endif
1704 {
1705 /* m > 0 if answered from cache */
1706 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1707 dst_addr_4, netmask, now, &ad_question, &do_bit);
1708
1709 /* Do this by steam now we're not in the select() loop */
1710 check_log_writer(NULL);
1711
1712 if (m == 0)
1713 {
1714 unsigned int flags = 0;
1715 struct all_addr *addrp = NULL;
1716 int type = 0;
1717 char *domain = NULL;
1718
1719 if (option_bool(OPT_ADD_MAC))
1720 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1721
1722 if (option_bool(OPT_CLIENT_SUBNET))
1723 {
1724 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1725 if (size != new)
1726 {
1727 size = new;
1728 check_subnet = 1;
1729 }
1730 }
1731
1732 if (gotname)
1733 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1734
1735 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1736 last_server = daemon->servers;
1737 else
1738 last_server = daemon->last_server;
1739
1740 if (!flags && last_server)
1741 {
1742 struct server *firstsendto = NULL;
1743 #ifdef HAVE_DNSSEC
1744 unsigned char *newhash, hash[HASH_SIZE];
1745 if ((newhash = hash_questions(header, (unsigned int)size, daemon->keyname)))
1746 memcpy(hash, newhash, HASH_SIZE);
1747 else
1748 memset(hash, 0, HASH_SIZE);
1749 #else
1750 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1751 #endif
1752 /* Loop round available servers until we succeed in connecting to one.
1753 Note that this code subtley ensures that consecutive queries on this connection
1754 which can go to the same server, do so. */
1755 while (1)
1756 {
1757 if (!firstsendto)
1758 firstsendto = last_server;
1759 else
1760 {
1761 if (!(last_server = last_server->next))
1762 last_server = daemon->servers;
1763
1764 if (last_server == firstsendto)
1765 break;
1766 }
1767
1768 /* server for wrong domain */
1769 if (type != (last_server->flags & SERV_TYPE) ||
1770 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)))
1771 continue;
1772
1773 if (last_server->tcpfd == -1)
1774 {
1775 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1776 continue;
1777
1778 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1779 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1780 {
1781 close(last_server->tcpfd);
1782 last_server->tcpfd = -1;
1783 continue;
1784 }
1785
1786 #ifdef HAVE_DNSSEC
1787 if (option_bool(OPT_DNSSEC_VALID))
1788 {
1789 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1790
1791 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1792 this allows it to select auth servers when one is returning bad data. */
1793 if (option_bool(OPT_DNSSEC_DEBUG))
1794 header->hb4 |= HB4_CD;
1795
1796 if (size != new_size)
1797 added_pheader = 1;
1798
1799 size = new_size;
1800 }
1801 #endif
1802
1803 #ifdef HAVE_CONNTRACK
1804 /* Copy connection mark of incoming query to outgoing connection. */
1805 if (option_bool(OPT_CONNTRACK))
1806 {
1807 unsigned int mark;
1808 struct all_addr local;
1809 #ifdef HAVE_IPV6
1810 if (local_addr->sa.sa_family == AF_INET6)
1811 local.addr.addr6 = local_addr->in6.sin6_addr;
1812 else
1813 #endif
1814 local.addr.addr4 = local_addr->in.sin_addr;
1815
1816 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1817 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1818 }
1819 #endif
1820 }
1821
1822 *length = htons(size);
1823
1824 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1825 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1826 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1827 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1828 {
1829 close(last_server->tcpfd);
1830 last_server->tcpfd = -1;
1831 continue;
1832 }
1833
1834 m = (c1 << 8) | c2;
1835
1836 if (!gotname)
1837 strcpy(daemon->namebuff, "query");
1838 if (last_server->addr.sa.sa_family == AF_INET)
1839 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1840 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1841 #ifdef HAVE_IPV6
1842 else
1843 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1844 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1845 #endif
1846
1847 #ifdef HAVE_DNSSEC
1848 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1849 {
1850 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1851 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1852 char *result;
1853
1854 if (keycount == 0)
1855 result = "ABANDONED";
1856 else
1857 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1858
1859 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1860
1861 if (status == STAT_BOGUS)
1862 no_cache_dnssec = 1;
1863
1864 if (status == STAT_SECURE)
1865 cache_secure = 1;
1866 }
1867 #endif
1868
1869 /* restore CD bit to the value in the query */
1870 if (checking_disabled)
1871 header->hb4 |= HB4_CD;
1872 else
1873 header->hb4 &= ~HB4_CD;
1874
1875 /* There's no point in updating the cache, since this process will exit and
1876 lose the information after a few queries. We make this call for the alias and
1877 bogus-nxdomain side-effects. */
1878 /* If the crc of the question section doesn't match the crc we sent, then
1879 someone might be attempting to insert bogus values into the cache by
1880 sending replies containing questions and bogus answers. */
1881 #ifdef HAVE_DNSSEC
1882 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1883 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
1884 {
1885 m = 0;
1886 break;
1887 }
1888 #else
1889 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
1890 {
1891 m = 0;
1892 break;
1893 }
1894 #endif
1895
1896 m = process_reply(header, now, last_server, (unsigned int)m,
1897 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
1898 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
1899
1900 break;
1901 }
1902 }
1903
1904 /* In case of local answer or no connections made. */
1905 if (m == 0)
1906 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
1907 }
1908 }
1909
1910 check_log_writer(NULL);
1911
1912 *length = htons(m);
1913
1914 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
1915 return packet;
1916 }
1917 }
1918
1919 static struct frec *allocate_frec(time_t now)
1920 {
1921 struct frec *f;
1922
1923 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
1924 {
1925 f->next = daemon->frec_list;
1926 f->time = now;
1927 f->sentto = NULL;
1928 f->rfd4 = NULL;
1929 f->flags = 0;
1930 #ifdef HAVE_IPV6
1931 f->rfd6 = NULL;
1932 #endif
1933 #ifdef HAVE_DNSSEC
1934 f->dependent = NULL;
1935 f->blocking_query = NULL;
1936 f->stash = NULL;
1937 #endif
1938 daemon->frec_list = f;
1939 }
1940
1941 return f;
1942 }
1943
1944 static struct randfd *allocate_rfd(int family)
1945 {
1946 static int finger = 0;
1947 int i;
1948
1949 /* limit the number of sockets we have open to avoid starvation of
1950 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1951
1952 for (i = 0; i < RANDOM_SOCKS; i++)
1953 if (daemon->randomsocks[i].refcount == 0)
1954 {
1955 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
1956 break;
1957
1958 daemon->randomsocks[i].refcount = 1;
1959 daemon->randomsocks[i].family = family;
1960 return &daemon->randomsocks[i];
1961 }
1962
1963 /* No free ones or cannot get new socket, grab an existing one */
1964 for (i = 0; i < RANDOM_SOCKS; i++)
1965 {
1966 int j = (i+finger) % RANDOM_SOCKS;
1967 if (daemon->randomsocks[j].refcount != 0 &&
1968 daemon->randomsocks[j].family == family &&
1969 daemon->randomsocks[j].refcount != 0xffff)
1970 {
1971 finger = j;
1972 daemon->randomsocks[j].refcount++;
1973 return &daemon->randomsocks[j];
1974 }
1975 }
1976
1977 return NULL; /* doom */
1978 }
1979 static void free_frec(struct frec *f)
1980 {
1981 if (f->rfd4 && --(f->rfd4->refcount) == 0)
1982 close(f->rfd4->fd);
1983
1984 f->rfd4 = NULL;
1985 f->sentto = NULL;
1986 f->flags = 0;
1987
1988 #ifdef HAVE_IPV6
1989 if (f->rfd6 && --(f->rfd6->refcount) == 0)
1990 close(f->rfd6->fd);
1991
1992 f->rfd6 = NULL;
1993 #endif
1994
1995 #ifdef HAVE_DNSSEC
1996 if (f->stash)
1997 {
1998 blockdata_free(f->stash);
1999 f->stash = NULL;
2000 }
2001
2002 /* Anything we're waiting on is pointless now, too */
2003 if (f->blocking_query)
2004 free_frec(f->blocking_query);
2005 f->blocking_query = NULL;
2006 f->dependent = NULL;
2007 #endif
2008 }
2009
2010 /* if wait==NULL return a free or older than TIMEOUT record.
2011 else return *wait zero if one available, or *wait is delay to
2012 when the oldest in-use record will expire. Impose an absolute
2013 limit of 4*TIMEOUT before we wipe things (for random sockets).
2014 If force is set, always return a result, even if we have
2015 to allocate above the limit. */
2016 struct frec *get_new_frec(time_t now, int *wait, int force)
2017 {
2018 struct frec *f, *oldest, *target;
2019 int count;
2020
2021 if (wait)
2022 *wait = 0;
2023
2024 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
2025 if (!f->sentto)
2026 target = f;
2027 else
2028 {
2029 if (difftime(now, f->time) >= 4*TIMEOUT)
2030 {
2031 free_frec(f);
2032 target = f;
2033 }
2034
2035 if (!oldest || difftime(f->time, oldest->time) <= 0)
2036 oldest = f;
2037 }
2038
2039 if (target)
2040 {
2041 target->time = now;
2042 return target;
2043 }
2044
2045 /* can't find empty one, use oldest if there is one
2046 and it's older than timeout */
2047 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2048 {
2049 /* keep stuff for twice timeout if we can by allocating a new
2050 record instead */
2051 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2052 count <= daemon->ftabsize &&
2053 (f = allocate_frec(now)))
2054 return f;
2055
2056 if (!wait)
2057 {
2058 free_frec(oldest);
2059 oldest->time = now;
2060 }
2061 return oldest;
2062 }
2063
2064 /* none available, calculate time 'till oldest record expires */
2065 if (!force && count > daemon->ftabsize)
2066 {
2067 static time_t last_log = 0;
2068
2069 if (oldest && wait)
2070 *wait = oldest->time + (time_t)TIMEOUT - now;
2071
2072 if ((int)difftime(now, last_log) > 5)
2073 {
2074 last_log = now;
2075 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2076 }
2077
2078 return NULL;
2079 }
2080
2081 if (!(f = allocate_frec(now)) && wait)
2082 /* wait one second on malloc failure */
2083 *wait = 1;
2084
2085 return f; /* OK if malloc fails and this is NULL */
2086 }
2087
2088 /* crc is all-ones if not known. */
2089 static struct frec *lookup_frec(unsigned short id, void *hash)
2090 {
2091 struct frec *f;
2092
2093 for(f = daemon->frec_list; f; f = f->next)
2094 if (f->sentto && f->new_id == id &&
2095 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2096 return f;
2097
2098 return NULL;
2099 }
2100
2101 static struct frec *lookup_frec_by_sender(unsigned short id,
2102 union mysockaddr *addr,
2103 void *hash)
2104 {
2105 struct frec *f;
2106
2107 for(f = daemon->frec_list; f; f = f->next)
2108 if (f->sentto &&
2109 f->orig_id == id &&
2110 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2111 sockaddr_isequal(&f->source, addr))
2112 return f;
2113
2114 return NULL;
2115 }
2116
2117 /* A server record is going away, remove references to it */
2118 void server_gone(struct server *server)
2119 {
2120 struct frec *f;
2121
2122 for (f = daemon->frec_list; f; f = f->next)
2123 if (f->sentto && f->sentto == server)
2124 free_frec(f);
2125
2126 if (daemon->last_server == server)
2127 daemon->last_server = NULL;
2128
2129 if (daemon->srv_save == server)
2130 daemon->srv_save = NULL;
2131 }
2132
2133 /* return unique random ids. */
2134 static unsigned short get_id(void)
2135 {
2136 unsigned short ret = 0;
2137
2138 do
2139 ret = rand16();
2140 while (lookup_frec(ret, NULL));
2141
2142 return ret;
2143 }
2144
2145
2146
2147
2148
Michael's tree of dnsmasq.