]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
DNSSEC: do top-down search for limit of secure delegation.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25
26 #ifdef HAVE_DNSSEC
27 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
28 int class, char *name, char *keyname, struct server *server, int *keycount);
29 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname);
30 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
31 char *name, char *keyname);
32 #endif
33
34
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
39 unsigned int iface)
40 {
41 struct msghdr msg;
42 struct iovec iov[1];
43 union {
44 struct cmsghdr align; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47 #elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49 #endif
50 #ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52 #endif
53 } control_u;
54
55 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
58 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
60 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
65
66 if (!nowild)
67 {
68 struct cmsghdr *cmptr;
69 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
71 cmptr = CMSG_FIRSTHDR(&msg);
72
73 if (to->sa.sa_family == AF_INET)
74 {
75 #if defined(HAVE_LINUX_NETWORK)
76 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
80 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
81 cmptr->cmsg_level = IPPROTO_IP;
82 cmptr->cmsg_type = IP_PKTINFO;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
85 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
88 #endif
89 }
90 else
91 #ifdef HAVE_IPV6
92 {
93 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
97 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
98 cmptr->cmsg_type = daemon->v6pktinfo;
99 cmptr->cmsg_level = IPPROTO_IPV6;
100 }
101 #else
102 (void)iface; /* eliminate warning */
103 #endif
104 }
105
106 while (sendmsg(fd, &msg, 0) == -1)
107 {
108 if (retry_send())
109 continue;
110
111 /* If interface is still in DAD, EINVAL results - ignore that. */
112 if (errno == EINVAL)
113 break;
114
115 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
116 return 0;
117 }
118
119 return 1;
120 }
121
122 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
123 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
124
125 {
126 /* If the query ends in the domain in one of our servers, set
127 domain to point to that name. We find the largest match to allow both
128 domain.org and sub.domain.org to exist. */
129
130 unsigned int namelen = strlen(qdomain);
131 unsigned int matchlen = 0;
132 struct server *serv;
133 unsigned int flags = 0;
134
135 for (serv = daemon->servers; serv; serv=serv->next)
136 /* domain matches take priority over NODOTS matches */
137 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
138 {
139 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
140 *type = SERV_FOR_NODOTS;
141 if (serv->flags & SERV_NO_ADDR)
142 flags = F_NXDOMAIN;
143 else if (serv->flags & SERV_LITERAL_ADDRESS)
144 {
145 if (sflag & qtype)
146 {
147 flags = sflag;
148 if (serv->addr.sa.sa_family == AF_INET)
149 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
150 #ifdef HAVE_IPV6
151 else
152 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
153 #endif
154 }
155 else if (!flags || (flags & F_NXDOMAIN))
156 flags = F_NOERR;
157 }
158 }
159 else if (serv->flags & SERV_HAS_DOMAIN)
160 {
161 unsigned int domainlen = strlen(serv->domain);
162 char *matchstart = qdomain + namelen - domainlen;
163 if (namelen >= domainlen &&
164 hostname_isequal(matchstart, serv->domain) &&
165 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
166 {
167 if (serv->flags & SERV_NO_REBIND)
168 *norebind = 1;
169 else
170 {
171 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
172 /* implement priority rules for --address and --server for same domain.
173 --address wins if the address is for the correct AF
174 --server wins otherwise. */
175 if (domainlen != 0 && domainlen == matchlen)
176 {
177 if ((serv->flags & SERV_LITERAL_ADDRESS))
178 {
179 if (!(sflag & qtype) && flags == 0)
180 continue;
181 }
182 else
183 {
184 if (flags & (F_IPV4 | F_IPV6))
185 continue;
186 }
187 }
188
189 if (domainlen >= matchlen)
190 {
191 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
192 *domain = serv->domain;
193 matchlen = domainlen;
194 if (serv->flags & SERV_NO_ADDR)
195 flags = F_NXDOMAIN;
196 else if (serv->flags & SERV_LITERAL_ADDRESS)
197 {
198 if (sflag & qtype)
199 {
200 flags = sflag;
201 if (serv->addr.sa.sa_family == AF_INET)
202 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
203 #ifdef HAVE_IPV6
204 else
205 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
206 #endif
207 }
208 else if (!flags || (flags & F_NXDOMAIN))
209 flags = F_NOERR;
210 }
211 else
212 flags = 0;
213 }
214 }
215 }
216 }
217
218 if (flags == 0 && !(qtype & F_QUERY) &&
219 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
220 /* don't forward A or AAAA queries for simple names, except the empty name */
221 flags = F_NOERR;
222
223 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
224 flags = F_NOERR;
225
226 if (flags)
227 {
228 int logflags = 0;
229
230 if (flags == F_NXDOMAIN || flags == F_NOERR)
231 logflags = F_NEG | qtype;
232
233 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
234 }
235 else if ((*type) & SERV_USE_RESOLV)
236 {
237 *type = 0; /* use normal servers for this domain */
238 *domain = NULL;
239 }
240 return flags;
241 }
242
243 static int forward_query(int udpfd, union mysockaddr *udpaddr,
244 struct all_addr *dst_addr, unsigned int dst_iface,
245 struct dns_header *header, size_t plen, time_t now,
246 struct frec *forward, int ad_reqd, int do_bit)
247 {
248 char *domain = NULL;
249 int type = 0, norebind = 0;
250 struct all_addr *addrp = NULL;
251 unsigned int flags = 0;
252 struct server *start = NULL;
253 #ifdef HAVE_DNSSEC
254 void *hash = hash_questions(header, plen, daemon->namebuff);
255 #else
256 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
257 void *hash = &crc;
258 #endif
259 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
260
261 (void)do_bit;
262
263 /* may be no servers available. */
264 if (!daemon->servers)
265 forward = NULL;
266 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
267 {
268 #ifdef HAVE_DNSSEC
269 /* If we've already got an answer to this query, but we're awaiting keys for validation,
270 there's no point retrying the query, retry the key query instead...... */
271 if (forward->blocking_query)
272 {
273 int fd;
274
275 while (forward->blocking_query)
276 forward = forward->blocking_query;
277
278 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
279 plen = forward->stash_len;
280
281 if (forward->sentto->addr.sa.sa_family == AF_INET)
282 log_query(F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
283 #ifdef HAVE_IPV6
284 else
285 log_query(F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
286 #endif
287
288 if (forward->sentto->sfd)
289 fd = forward->sentto->sfd->fd;
290 else
291 {
292 #ifdef HAVE_IPV6
293 if (forward->sentto->addr.sa.sa_family == AF_INET6)
294 fd = forward->rfd6->fd;
295 else
296 #endif
297 fd = forward->rfd4->fd;
298 }
299
300 while (sendto(fd, (char *)header, plen, 0,
301 &forward->sentto->addr.sa,
302 sa_len(&forward->sentto->addr)) == -1 && retry_send());
303
304 return 1;
305 }
306 #endif
307
308 /* retry on existing query, send to all available servers */
309 domain = forward->sentto->domain;
310 forward->sentto->failed_queries++;
311 if (!option_bool(OPT_ORDER))
312 {
313 forward->forwardall = 1;
314 daemon->last_server = NULL;
315 }
316 type = forward->sentto->flags & SERV_TYPE;
317 if (!(start = forward->sentto->next))
318 start = daemon->servers; /* at end of list, recycle */
319 header->id = htons(forward->new_id);
320 }
321 else
322 {
323 if (gotname)
324 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
325
326 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
327 /* table full - server failure. */
328 flags = F_NEG;
329
330 if (forward)
331 {
332 forward->source = *udpaddr;
333 forward->dest = *dst_addr;
334 forward->iface = dst_iface;
335 forward->orig_id = ntohs(header->id);
336 forward->new_id = get_id();
337 forward->fd = udpfd;
338 memcpy(forward->hash, hash, HASH_SIZE);
339 forward->forwardall = 0;
340 forward->flags = 0;
341 if (norebind)
342 forward->flags |= FREC_NOREBIND;
343 if (header->hb4 & HB4_CD)
344 forward->flags |= FREC_CHECKING_DISABLED;
345 if (ad_reqd)
346 forward->flags |= FREC_AD_QUESTION;
347 #ifdef HAVE_DNSSEC
348 forward->work_counter = DNSSEC_WORK;
349 if (do_bit)
350 forward->flags |= FREC_DO_QUESTION;
351 #endif
352
353 header->id = htons(forward->new_id);
354
355 /* In strict_order mode, always try servers in the order
356 specified in resolv.conf, if a domain is given
357 always try all the available servers,
358 otherwise, use the one last known to work. */
359
360 if (type == 0)
361 {
362 if (option_bool(OPT_ORDER))
363 start = daemon->servers;
364 else if (!(start = daemon->last_server) ||
365 daemon->forwardcount++ > FORWARD_TEST ||
366 difftime(now, daemon->forwardtime) > FORWARD_TIME)
367 {
368 start = daemon->servers;
369 forward->forwardall = 1;
370 daemon->forwardcount = 0;
371 daemon->forwardtime = now;
372 }
373 }
374 else
375 {
376 start = daemon->servers;
377 if (!option_bool(OPT_ORDER))
378 forward->forwardall = 1;
379 }
380 }
381 }
382
383 /* check for send errors here (no route to host)
384 if we fail to send to all nameservers, send back an error
385 packet straight away (helps modem users when offline) */
386
387 if (!flags && forward)
388 {
389 struct server *firstsentto = start;
390 int forwarded = 0;
391
392 if (option_bool(OPT_ADD_MAC))
393 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
394
395 if (option_bool(OPT_CLIENT_SUBNET))
396 {
397 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
398 if (new != plen)
399 {
400 plen = new;
401 forward->flags |= FREC_HAS_SUBNET;
402 }
403 }
404
405 #ifdef HAVE_DNSSEC
406 if (option_bool(OPT_DNSSEC_VALID))
407 {
408 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
409
410 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
411 this allows it to select auth servers when one is returning bad data. */
412 if (option_bool(OPT_DNSSEC_DEBUG))
413 header->hb4 |= HB4_CD;
414
415 if (new_plen != plen)
416 forward->flags |= FREC_ADDED_PHEADER;
417
418 plen = new_plen;
419 }
420 #endif
421
422 while (1)
423 {
424 /* only send to servers dealing with our domain.
425 domain may be NULL, in which case server->domain
426 must be NULL also. */
427
428 if (type == (start->flags & SERV_TYPE) &&
429 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
430 !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
431 {
432 int fd;
433
434 /* find server socket to use, may need to get random one. */
435 if (start->sfd)
436 fd = start->sfd->fd;
437 else
438 {
439 #ifdef HAVE_IPV6
440 if (start->addr.sa.sa_family == AF_INET6)
441 {
442 if (!forward->rfd6 &&
443 !(forward->rfd6 = allocate_rfd(AF_INET6)))
444 break;
445 daemon->rfd_save = forward->rfd6;
446 fd = forward->rfd6->fd;
447 }
448 else
449 #endif
450 {
451 if (!forward->rfd4 &&
452 !(forward->rfd4 = allocate_rfd(AF_INET)))
453 break;
454 daemon->rfd_save = forward->rfd4;
455 fd = forward->rfd4->fd;
456 }
457
458 #ifdef HAVE_CONNTRACK
459 /* Copy connection mark of incoming query to outgoing connection. */
460 if (option_bool(OPT_CONNTRACK))
461 {
462 unsigned int mark;
463 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
464 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
465 }
466 #endif
467 }
468
469 if (sendto(fd, (char *)header, plen, 0,
470 &start->addr.sa,
471 sa_len(&start->addr)) == -1)
472 {
473 if (retry_send())
474 continue;
475 }
476 else
477 {
478 /* Keep info in case we want to re-send this packet */
479 daemon->srv_save = start;
480 daemon->packet_len = plen;
481
482 if (!gotname)
483 strcpy(daemon->namebuff, "query");
484 if (start->addr.sa.sa_family == AF_INET)
485 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
486 (struct all_addr *)&start->addr.in.sin_addr, NULL);
487 #ifdef HAVE_IPV6
488 else
489 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
490 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
491 #endif
492 start->queries++;
493 forwarded = 1;
494 forward->sentto = start;
495 if (!forward->forwardall)
496 break;
497 forward->forwardall++;
498 }
499 }
500
501 if (!(start = start->next))
502 start = daemon->servers;
503
504 if (start == firstsentto)
505 break;
506 }
507
508 if (forwarded)
509 return 1;
510
511 /* could not send on, prepare to return */
512 header->id = htons(forward->orig_id);
513 free_frec(forward); /* cancel */
514 }
515
516 /* could not send on, return empty answer or address if known for whole domain */
517 if (udpfd != -1)
518 {
519 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
520 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
521 }
522
523 return 0;
524 }
525
526 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
527 int no_cache, int cache_secure, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source)
528 {
529 unsigned char *pheader, *sizep;
530 char **sets = 0;
531 int munged = 0, is_sign;
532 size_t plen;
533
534 (void)ad_reqd;
535 (void) do_bit;
536
537 #ifdef HAVE_IPSET
538 if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL))
539 {
540 /* Similar algorithm to search_servers. */
541 struct ipsets *ipset_pos;
542 unsigned int namelen = strlen(daemon->namebuff);
543 unsigned int matchlen = 0;
544 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
545 {
546 unsigned int domainlen = strlen(ipset_pos->domain);
547 char *matchstart = daemon->namebuff + namelen - domainlen;
548 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
549 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
550 domainlen >= matchlen)
551 {
552 matchlen = domainlen;
553 sets = ipset_pos->sets;
554 }
555 }
556 }
557 #endif
558
559 /* If upstream is advertising a larger UDP packet size
560 than we allow, trim it so that we don't get overlarge
561 requests for the client. We can't do this for signed packets. */
562
563 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
564 {
565 unsigned short udpsz;
566 unsigned char *psave = sizep;
567
568 GETSHORT(udpsz, sizep);
569
570 if (!is_sign && udpsz > daemon->edns_pktsz)
571 PUTSHORT(daemon->edns_pktsz, psave);
572
573 if (check_subnet && !check_source(header, plen, pheader, query_source))
574 {
575 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
576 return 0;
577 }
578
579 if (added_pheader)
580 {
581 pheader = 0;
582 header->arcount = htons(0);
583 }
584 }
585
586 /* RFC 4035 sect 4.6 para 3 */
587 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
588 header->hb4 &= ~HB4_AD;
589
590 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
591 return resize_packet(header, n, pheader, plen);
592
593 /* Complain loudly if the upstream server is non-recursive. */
594 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
595 server && !(server->flags & SERV_WARNED_RECURSIVE))
596 {
597 prettyprint_addr(&server->addr, daemon->namebuff);
598 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
599 if (!option_bool(OPT_LOG))
600 server->flags |= SERV_WARNED_RECURSIVE;
601 }
602
603 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
604 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
605 {
606 munged = 1;
607 SET_RCODE(header, NXDOMAIN);
608 header->hb3 &= ~HB3_AA;
609 cache_secure = 0;
610 }
611 else
612 {
613 int doctored = 0;
614
615 if (RCODE(header) == NXDOMAIN &&
616 extract_request(header, n, daemon->namebuff, NULL) &&
617 check_for_local_domain(daemon->namebuff, now))
618 {
619 /* if we forwarded a query for a locally known name (because it was for
620 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
621 since we know that the domain exists, even if upstream doesn't */
622 munged = 1;
623 header->hb3 |= HB3_AA;
624 SET_RCODE(header, NOERROR);
625 cache_secure = 0;
626 }
627
628 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
629 {
630 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
631 munged = 1;
632 cache_secure = 0;
633 }
634
635 if (doctored)
636 cache_secure = 0;
637 }
638
639 #ifdef HAVE_DNSSEC
640 if (no_cache && !(header->hb4 & HB4_CD))
641 {
642 if (!option_bool(OPT_DNSSEC_DEBUG))
643 {
644 /* Bogus reply, turn into SERVFAIL */
645 SET_RCODE(header, SERVFAIL);
646 munged = 1;
647 }
648 }
649
650 if (option_bool(OPT_DNSSEC_VALID))
651 header->hb4 &= ~HB4_AD;
652
653 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
654 header->hb4 |= HB4_AD;
655
656 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
657 if (!do_bit)
658 n = filter_rrsigs(header, n);
659 #endif
660
661 /* do this after extract_addresses. Ensure NODATA reply and remove
662 nameserver info. */
663
664 if (munged)
665 {
666 header->ancount = htons(0);
667 header->nscount = htons(0);
668 header->arcount = htons(0);
669 }
670
671 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
672 sections of the packet. Find the new length here and put back pseudoheader
673 if it was removed. */
674 return resize_packet(header, n, pheader, plen);
675 }
676
677 /* sets new last_server */
678 void reply_query(int fd, int family, time_t now)
679 {
680 /* packet from peer server, extract data for cache, and send to
681 original requester */
682 struct dns_header *header;
683 union mysockaddr serveraddr;
684 struct frec *forward;
685 socklen_t addrlen = sizeof(serveraddr);
686 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
687 size_t nn;
688 struct server *server;
689 void *hash;
690 #ifndef HAVE_DNSSEC
691 unsigned int crc;
692 #endif
693
694 /* packet buffer overwritten */
695 daemon->srv_save = NULL;
696
697 /* Determine the address of the server replying so that we can mark that as good */
698 serveraddr.sa.sa_family = family;
699 #ifdef HAVE_IPV6
700 if (serveraddr.sa.sa_family == AF_INET6)
701 serveraddr.in6.sin6_flowinfo = 0;
702 #endif
703
704 header = (struct dns_header *)daemon->packet;
705
706 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
707 return;
708
709 /* spoof check: answer must come from known server, */
710 for (server = daemon->servers; server; server = server->next)
711 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
712 sockaddr_isequal(&server->addr, &serveraddr))
713 break;
714
715 if (!server)
716 return;
717
718 #ifdef HAVE_DNSSEC
719 hash = hash_questions(header, n, daemon->namebuff);
720 #else
721 hash = &crc;
722 crc = questions_crc(header, n, daemon->namebuff);
723 #endif
724
725 if (!(forward = lookup_frec(ntohs(header->id), hash)))
726 return;
727
728 if (daemon->ignore_addr && RCODE(header) == NOERROR &&
729 check_for_ignored_address(header, n, daemon->ignore_addr))
730 return;
731
732 if ((RCODE(header) == SERVFAIL || RCODE(header) == REFUSED) &&
733 !option_bool(OPT_ORDER) &&
734 forward->forwardall == 0)
735 /* for broken servers, attempt to send to another one. */
736 {
737 unsigned char *pheader;
738 size_t plen;
739 int is_sign;
740
741 /* recreate query from reply */
742 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
743 if (!is_sign)
744 {
745 header->ancount = htons(0);
746 header->nscount = htons(0);
747 header->arcount = htons(0);
748 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
749 {
750 header->hb3 &= ~(HB3_QR | HB3_TC);
751 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
752 return;
753 }
754 }
755 }
756
757 server = forward->sentto;
758
759 if ((forward->sentto->flags & SERV_TYPE) == 0)
760 {
761 if (RCODE(header) == REFUSED)
762 server = NULL;
763 else
764 {
765 struct server *last_server;
766
767 /* find good server by address if possible, otherwise assume the last one we sent to */
768 for (last_server = daemon->servers; last_server; last_server = last_server->next)
769 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
770 sockaddr_isequal(&last_server->addr, &serveraddr))
771 {
772 server = last_server;
773 break;
774 }
775 }
776 if (!option_bool(OPT_ALL_SERVERS))
777 daemon->last_server = server;
778 }
779
780 /* If the answer is an error, keep the forward record in place in case
781 we get a good reply from another server. Kill it when we've
782 had replies from all to avoid filling the forwarding table when
783 everything is broken */
784 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
785 {
786 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0;
787
788 if (option_bool(OPT_NO_REBIND))
789 check_rebind = !(forward->flags & FREC_NOREBIND);
790
791 /* Don't cache replies where DNSSEC validation was turned off, either
792 the upstream server told us so, or the original query specified it. */
793 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
794 no_cache_dnssec = 1;
795
796 #ifdef HAVE_DNSSEC
797 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
798 {
799 int status;
800
801 /* We've had a reply already, which we're validating. Ignore this duplicate */
802 if (forward->blocking_query)
803 return;
804
805 if (header->hb3 & HB3_TC)
806 {
807 /* Truncated answer can't be validated.
808 If this is an answer to a DNSSEC-generated query, we still
809 need to get the client to retry over TCP, so return
810 an answer with the TC bit set, even if the actual answer fits.
811 */
812 status = STAT_TRUNCATED;
813 }
814 else if (forward->flags & FREC_DNSKEY_QUERY)
815 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
816 else if (forward->flags & FREC_DS_QUERY)
817 {
818 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
819 if (status == STAT_NO_DS || status == STAT_NO_NS)
820 status = STAT_BOGUS;
821 }
822 else if (forward->flags & FREC_CHECK_NOSIGN)
823 {
824 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
825 if (status != STAT_NEED_KEY)
826 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
827 }
828 else
829 {
830 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
831 if (status == STAT_NO_SIG)
832 {
833 if (option_bool(OPT_DNSSEC_NO_SIGN))
834 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
835 else
836 status = STAT_INSECURE;
837 }
838 }
839 /* Can't validate, as we're missing key data. Put this
840 answer aside, whilst we get that. */
841 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
842 {
843 struct frec *new, *orig;
844
845 /* Free any saved query */
846 if (forward->stash)
847 blockdata_free(forward->stash);
848
849 /* Now save reply pending receipt of key data */
850 if (!(forward->stash = blockdata_alloc((char *)header, n)))
851 return;
852 forward->stash_len = n;
853
854 anotherkey:
855 /* Find the original query that started it all.... */
856 for (orig = forward; orig->dependent; orig = orig->dependent);
857
858 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
859 status = STAT_INSECURE;
860 else
861 {
862 int fd;
863 struct frec *next = new->next;
864 *new = *forward; /* copy everything, then overwrite */
865 new->next = next;
866 new->blocking_query = NULL;
867 new->sentto = server;
868 new->rfd4 = NULL;
869 new->orig_domain = NULL;
870 #ifdef HAVE_IPV6
871 new->rfd6 = NULL;
872 #endif
873 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
874
875 new->dependent = forward; /* to find query awaiting new one. */
876 forward->blocking_query = new; /* for garbage cleaning */
877 /* validate routines leave name of required record in daemon->keyname */
878 if (status == STAT_NEED_KEY)
879 {
880 new->flags |= FREC_DNSKEY_QUERY;
881 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
882 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
883 }
884 else
885 {
886 if (status == STAT_NEED_DS_NEG)
887 new->flags |= FREC_CHECK_NOSIGN;
888 else
889 new->flags |= FREC_DS_QUERY;
890 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
891 daemon->keyname, forward->class, T_DS, &server->addr);
892 }
893 if ((hash = hash_questions(header, nn, daemon->namebuff)))
894 memcpy(new->hash, hash, HASH_SIZE);
895 new->new_id = get_id();
896 header->id = htons(new->new_id);
897 /* Save query for retransmission */
898 if (!(new->stash = blockdata_alloc((char *)header, nn)))
899 return;
900
901 new->stash_len = nn;
902
903 /* Don't resend this. */
904 daemon->srv_save = NULL;
905
906 if (server->sfd)
907 fd = server->sfd->fd;
908 else
909 {
910 fd = -1;
911 #ifdef HAVE_IPV6
912 if (server->addr.sa.sa_family == AF_INET6)
913 {
914 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
915 fd = new->rfd6->fd;
916 }
917 else
918 #endif
919 {
920 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
921 fd = new->rfd4->fd;
922 }
923 }
924
925 if (fd != -1)
926 {
927 while (sendto(fd, (char *)header, nn, 0, &server->addr.sa, sa_len(&server->addr)) == -1 && retry_send());
928 server->queries++;
929 }
930
931 return;
932 }
933 }
934
935 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
936 Now wind back down, pulling back answers which wouldn't previously validate
937 and validate them with the new data. Note that if an answer needs multiple
938 keys to validate, we may find another key is needed, in which case we set off
939 down another branch of the tree. Once we get to the original answer
940 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
941 while (forward->dependent)
942 {
943 struct frec *prev = forward->dependent;
944 free_frec(forward);
945 forward = prev;
946 forward->blocking_query = NULL; /* already gone */
947 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
948 n = forward->stash_len;
949
950 if (status == STAT_SECURE)
951 {
952 if (forward->flags & FREC_DNSKEY_QUERY)
953 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
954 else if (forward->flags & FREC_DS_QUERY)
955 {
956 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
957 if (status == STAT_NO_DS || status == STAT_NO_NS)
958 status = STAT_BOGUS;
959 }
960 else if (forward->flags & FREC_CHECK_NOSIGN)
961 {
962 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
963 if (status != STAT_NEED_KEY)
964 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
965 }
966 else
967 {
968 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
969 if (status == STAT_NO_SIG)
970 {
971 if (option_bool(OPT_DNSSEC_NO_SIGN))
972 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
973 else
974 status = STAT_INSECURE;
975 }
976 }
977
978 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
979 goto anotherkey;
980 }
981 }
982
983 if (status == STAT_TRUNCATED)
984 header->hb3 |= HB3_TC;
985 else
986 {
987 char *result;
988
989 if (forward->work_counter == 0)
990 result = "ABANDONED";
991 else
992 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
993
994 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
995 }
996
997 no_cache_dnssec = 0;
998
999 if (status == STAT_SECURE)
1000 cache_secure = 1;
1001 else if (status == STAT_BOGUS)
1002 no_cache_dnssec = 1;
1003 }
1004 #endif
1005
1006 /* restore CD bit to the value in the query */
1007 if (forward->flags & FREC_CHECKING_DISABLED)
1008 header->hb4 |= HB4_CD;
1009 else
1010 header->hb4 &= ~HB4_CD;
1011
1012 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure,
1013 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
1014 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
1015 {
1016 header->id = htons(forward->orig_id);
1017 header->hb4 |= HB4_RA; /* recursion if available */
1018 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
1019 &forward->source, &forward->dest, forward->iface);
1020 }
1021 free_frec(forward); /* cancel */
1022 }
1023 }
1024
1025
1026 void receive_query(struct listener *listen, time_t now)
1027 {
1028 struct dns_header *header = (struct dns_header *)daemon->packet;
1029 union mysockaddr source_addr;
1030 unsigned short type;
1031 struct all_addr dst_addr;
1032 struct in_addr netmask, dst_addr_4;
1033 size_t m;
1034 ssize_t n;
1035 int if_index = 0, auth_dns = 0;
1036 #ifdef HAVE_AUTH
1037 int local_auth = 0;
1038 #endif
1039 struct iovec iov[1];
1040 struct msghdr msg;
1041 struct cmsghdr *cmptr;
1042 union {
1043 struct cmsghdr align; /* this ensures alignment */
1044 #ifdef HAVE_IPV6
1045 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1046 #endif
1047 #if defined(HAVE_LINUX_NETWORK)
1048 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1049 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1050 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1051 CMSG_SPACE(sizeof(unsigned int))];
1052 #elif defined(IP_RECVDSTADDR)
1053 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1054 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1055 #endif
1056 } control_u;
1057 #ifdef HAVE_IPV6
1058 /* Can always get recvd interface for IPv6 */
1059 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1060 #else
1061 int check_dst = !option_bool(OPT_NOWILD);
1062 #endif
1063
1064 /* packet buffer overwritten */
1065 daemon->srv_save = NULL;
1066
1067 dst_addr_4.s_addr = dst_addr.addr.addr4.s_addr = 0;
1068 netmask.s_addr = 0;
1069
1070 if (option_bool(OPT_NOWILD) && listen->iface)
1071 {
1072 auth_dns = listen->iface->dns_auth;
1073
1074 if (listen->family == AF_INET)
1075 {
1076 dst_addr_4 = dst_addr.addr.addr4 = listen->iface->addr.in.sin_addr;
1077 netmask = listen->iface->netmask;
1078 }
1079 }
1080
1081 iov[0].iov_base = daemon->packet;
1082 iov[0].iov_len = daemon->edns_pktsz;
1083
1084 msg.msg_control = control_u.control;
1085 msg.msg_controllen = sizeof(control_u);
1086 msg.msg_flags = 0;
1087 msg.msg_name = &source_addr;
1088 msg.msg_namelen = sizeof(source_addr);
1089 msg.msg_iov = iov;
1090 msg.msg_iovlen = 1;
1091
1092 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1093 return;
1094
1095 if (n < (int)sizeof(struct dns_header) ||
1096 (msg.msg_flags & MSG_TRUNC) ||
1097 (header->hb3 & HB3_QR))
1098 return;
1099
1100 source_addr.sa.sa_family = listen->family;
1101
1102 if (listen->family == AF_INET)
1103 {
1104 /* Source-port == 0 is an error, we can't send back to that.
1105 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1106 if (source_addr.in.sin_port == 0)
1107 return;
1108 }
1109 #ifdef HAVE_IPV6
1110 else
1111 {
1112 /* Source-port == 0 is an error, we can't send back to that. */
1113 if (source_addr.in6.sin6_port == 0)
1114 return;
1115 source_addr.in6.sin6_flowinfo = 0;
1116 }
1117 #endif
1118
1119 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1120 if (option_bool(OPT_LOCAL_SERVICE))
1121 {
1122 struct addrlist *addr;
1123 #ifdef HAVE_IPV6
1124 if (listen->family == AF_INET6)
1125 {
1126 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1127 if ((addr->flags & ADDRLIST_IPV6) &&
1128 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1129 break;
1130 }
1131 else
1132 #endif
1133 {
1134 struct in_addr netmask;
1135 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1136 {
1137 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1138 if (!(addr->flags & ADDRLIST_IPV6) &&
1139 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1140 break;
1141 }
1142 }
1143 if (!addr)
1144 {
1145 static int warned = 0;
1146 if (!warned)
1147 {
1148 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1149 warned = 1;
1150 }
1151 return;
1152 }
1153 }
1154
1155 if (check_dst)
1156 {
1157 struct ifreq ifr;
1158
1159 if (msg.msg_controllen < sizeof(struct cmsghdr))
1160 return;
1161
1162 #if defined(HAVE_LINUX_NETWORK)
1163 if (listen->family == AF_INET)
1164 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1165 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1166 {
1167 union {
1168 unsigned char *c;
1169 struct in_pktinfo *p;
1170 } p;
1171 p.c = CMSG_DATA(cmptr);
1172 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1173 if_index = p.p->ipi_ifindex;
1174 }
1175 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1176 if (listen->family == AF_INET)
1177 {
1178 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1179 {
1180 union {
1181 unsigned char *c;
1182 unsigned int *i;
1183 struct in_addr *a;
1184 #ifndef HAVE_SOLARIS_NETWORK
1185 struct sockaddr_dl *s;
1186 #endif
1187 } p;
1188 p.c = CMSG_DATA(cmptr);
1189 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1190 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1191 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1192 #ifdef HAVE_SOLARIS_NETWORK
1193 if_index = *(p.i);
1194 #else
1195 if_index = p.s->sdl_index;
1196 #endif
1197 }
1198 }
1199 #endif
1200
1201 #ifdef HAVE_IPV6
1202 if (listen->family == AF_INET6)
1203 {
1204 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1205 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1206 {
1207 union {
1208 unsigned char *c;
1209 struct in6_pktinfo *p;
1210 } p;
1211 p.c = CMSG_DATA(cmptr);
1212
1213 dst_addr.addr.addr6 = p.p->ipi6_addr;
1214 if_index = p.p->ipi6_ifindex;
1215 }
1216 }
1217 #endif
1218
1219 /* enforce available interface configuration */
1220
1221 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1222 return;
1223
1224 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1225 {
1226 if (!option_bool(OPT_CLEVERBIND))
1227 enumerate_interfaces(0);
1228 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1229 !label_exception(if_index, listen->family, &dst_addr))
1230 return;
1231 }
1232
1233 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1234 {
1235 struct irec *iface;
1236
1237 /* get the netmask of the interface whch has the address we were sent to.
1238 This is no neccessarily the interface we arrived on. */
1239
1240 for (iface = daemon->interfaces; iface; iface = iface->next)
1241 if (iface->addr.sa.sa_family == AF_INET &&
1242 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1243 break;
1244
1245 /* interface may be new */
1246 if (!iface && !option_bool(OPT_CLEVERBIND))
1247 enumerate_interfaces(0);
1248
1249 for (iface = daemon->interfaces; iface; iface = iface->next)
1250 if (iface->addr.sa.sa_family == AF_INET &&
1251 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1252 break;
1253
1254 /* If we failed, abandon localisation */
1255 if (iface)
1256 netmask = iface->netmask;
1257 else
1258 dst_addr_4.s_addr = 0;
1259 }
1260 }
1261
1262 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1263 {
1264 #ifdef HAVE_AUTH
1265 struct auth_zone *zone;
1266 #endif
1267 char *types = querystr(auth_dns ? "auth" : "query", type);
1268
1269 if (listen->family == AF_INET)
1270 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1271 (struct all_addr *)&source_addr.in.sin_addr, types);
1272 #ifdef HAVE_IPV6
1273 else
1274 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1275 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1276 #endif
1277
1278 #ifdef HAVE_AUTH
1279 /* find queries for zones we're authoritative for, and answer them directly */
1280 if (!auth_dns)
1281 for (zone = daemon->auth_zones; zone; zone = zone->next)
1282 if (in_zone(zone, daemon->namebuff, NULL))
1283 {
1284 auth_dns = 1;
1285 local_auth = 1;
1286 break;
1287 }
1288 #endif
1289
1290 #ifdef HAVE_LOOP
1291 /* Check for forwarding loop */
1292 if (detect_loop(daemon->namebuff, type))
1293 return;
1294 #endif
1295 }
1296
1297 #ifdef HAVE_AUTH
1298 if (auth_dns)
1299 {
1300 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1301 if (m >= 1)
1302 {
1303 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1304 (char *)header, m, &source_addr, &dst_addr, if_index);
1305 daemon->auth_answer++;
1306 }
1307 }
1308 else
1309 #endif
1310 {
1311 int ad_reqd, do_bit;
1312 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1313 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1314
1315 if (m >= 1)
1316 {
1317 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1318 (char *)header, m, &source_addr, &dst_addr, if_index);
1319 daemon->local_answer++;
1320 }
1321 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1322 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1323 daemon->queries_forwarded++;
1324 else
1325 daemon->local_answer++;
1326 }
1327 }
1328
1329 #ifdef HAVE_DNSSEC
1330
1331 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1332 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1333 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1334 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
1335 char *name, char *keyname)
1336 {
1337 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1338
1339 if (status != STAT_INSECURE)
1340 return status;
1341
1342 /* Store the domain we're trying to check. */
1343 forward->name_start = strlen(name);
1344 forward->name_len = forward->name_start + 1;
1345 if (!(forward->orig_domain = blockdata_alloc(name, forward->name_len)))
1346 return STAT_BOGUS;
1347
1348 return do_check_sign(forward, 0, now, name, keyname);
1349 }
1350
1351 /* We either have a a reply (header non-NULL, or we need to start by looking in the cache */
1352 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname)
1353 {
1354 /* get domain we're checking back from blockdata store, it's stored on the original query. */
1355 while (forward->dependent)
1356 forward = forward->dependent;
1357
1358 blockdata_retrieve(forward->orig_domain, forward->name_len, name);
1359
1360 while (1)
1361 {
1362 char *p;
1363
1364 if (status == 0)
1365 {
1366 struct crec *crecp;
1367
1368 /* Haven't received answer, see if in cache */
1369 if (!(crecp = cache_find_by_name(NULL, &name[forward->name_start], now, F_DS)))
1370 {
1371 /* put name of DS record we're missing into keyname */
1372 strcpy(keyname, &name[forward->name_start]);
1373 /* and wait for reply to arrive */
1374 return STAT_NEED_DS_NEG;
1375 }
1376
1377 /* F_DNSSECOK misused in DS cache records to non-existance of NS record */
1378 if (!(crecp->flags & F_NEG))
1379 status = STAT_SECURE;
1380 else if (crecp->flags & F_DNSSECOK)
1381 status = STAT_NO_DS;
1382 else
1383 status = STAT_NO_NS;
1384 }
1385
1386 /* Have entered non-signed part of DNS tree. */
1387 if (status == STAT_NO_DS)
1388 return STAT_INSECURE;
1389
1390 if (status == STAT_BOGUS)
1391 return STAT_BOGUS;
1392
1393 /* There's a proven DS record, or we're within a zone, where there doesn't need
1394 to be a DS record. Add a name and try again.
1395 If we've already tried the whole name, then fail */
1396
1397 if (forward->name_start == 0)
1398 return STAT_BOGUS;
1399
1400 for (p = &name[forward->name_start-2]; (*p != '.') && (p != name); p--);
1401
1402 if (p != name)
1403 p++;
1404
1405 forward->name_start = p - name;
1406 status = 0; /* force to cache when we iterate. */
1407 }
1408 }
1409
1410 /* Move toward the root, until we find a signed non-existance of a DS, in which case
1411 an unsigned answer is OK, or we find a signed DS, in which case there should be
1412 a signature, and the answer is BOGUS */
1413 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1414 char *keyname, struct server *server, int *keycount)
1415 {
1416 size_t m;
1417 unsigned char *packet, *payload;
1418 u16 *length;
1419 unsigned char *p = (unsigned char *)(header+1);
1420 int status, name_len;
1421 struct blockdata *block;
1422
1423 char *name_start;
1424
1425 /* Get first insecure entry in CNAME chain */
1426 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1427 if (status == STAT_BOGUS)
1428 return STAT_BOGUS;
1429
1430 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1431 return STAT_BOGUS;
1432
1433 payload = &packet[2];
1434 header = (struct dns_header *)payload;
1435 length = (u16 *)packet;
1436
1437 /* Stash the name away, since the buffer will be trashed when we recurse */
1438 name_len = strlen(name) + 1;
1439 name_start = name + name_len - 1;
1440
1441 if (!(block = blockdata_alloc(name, name_len)))
1442 {
1443 free(packet);
1444 return STAT_BOGUS;
1445 }
1446
1447 while (1)
1448 {
1449 unsigned char c1, c2;
1450 struct crec *crecp;
1451
1452 if (--(*keycount) == 0)
1453 {
1454 free(packet);
1455 blockdata_free(block);
1456 return STAT_BOGUS;
1457 }
1458
1459 while (crecp = cache_find_by_name(NULL, name_start, now, F_DS))
1460 {
1461 if ((crecp->flags & F_NEG) && (crecp->flags & F_DNSSECOK))
1462 {
1463 /* Found a secure denial of DS - delegation is indeed insecure */
1464 free(packet);
1465 blockdata_free(block);
1466 return STAT_INSECURE;
1467 }
1468
1469 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1470 Add another label and continue. */
1471
1472 if (name_start == name)
1473 {
1474 free(packet);
1475 blockdata_free(block);
1476 return STAT_BOGUS; /* run out of labels */
1477 }
1478
1479 name_start -= 2;
1480 while (*name_start != '.' && name_start != name)
1481 name_start--;
1482 if (name_start != name)
1483 name_start++;
1484 }
1485
1486 /* Can't find it in the cache, have to send a query */
1487
1488 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1489
1490 *length = htons(m);
1491
1492 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1493 read_write(server->tcpfd, &c1, 1, 1) &&
1494 read_write(server->tcpfd, &c2, 1, 1) &&
1495 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1496 {
1497 m = (c1 << 8) | c2;
1498
1499 /* Note this trashes all three name workspaces */
1500 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1501
1502 if (status == STAT_NO_DS)
1503 {
1504 /* Found a secure denial of DS - delegation is indeed insecure */
1505 free(packet);
1506 blockdata_free(block);
1507 return STAT_INSECURE;
1508 }
1509
1510 if (status == STAT_BOGUS)
1511 {
1512 free(packet);
1513 blockdata_free(block);
1514 return STAT_BOGUS;
1515 }
1516
1517 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1518 Add another label and continue. */
1519
1520 /* Get name we're checking back. */
1521 blockdata_retrieve(block, name_len, name);
1522
1523 if (name_start == name)
1524 {
1525 free(packet);
1526 blockdata_free(block);
1527 return STAT_BOGUS; /* run out of labels */
1528 }
1529
1530 name_start -= 2;
1531 while (*name_start != '.' && name_start != name)
1532 name_start--;
1533 if (name_start != name)
1534 name_start++;
1535 }
1536 else
1537 {
1538 /* IO failure */
1539 free(packet);
1540 blockdata_free(block);
1541 return STAT_BOGUS; /* run out of labels */
1542 }
1543 }
1544 }
1545
1546 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1547 int class, char *name, char *keyname, struct server *server, int *keycount)
1548 {
1549 /* Recurse up the key heirarchy */
1550 int new_status;
1551
1552 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1553 if (--(*keycount) == 0)
1554 return STAT_INSECURE;
1555
1556 if (status == STAT_NEED_KEY)
1557 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1558 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1559 {
1560 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1561 if (status == STAT_NEED_DS && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
1562 new_status = STAT_BOGUS;
1563 }
1564 else if (status == STAT_CHASE_CNAME)
1565 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1566 else
1567 {
1568 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1569
1570 if (new_status == STAT_NO_SIG)
1571 {
1572 if (option_bool(OPT_DNSSEC_NO_SIGN))
1573 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1574 else
1575 new_status = STAT_INSECURE;
1576 }
1577 }
1578
1579 /* Can't validate because we need a key/DS whose name now in keyname.
1580 Make query for same, and recurse to validate */
1581 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1582 {
1583 size_t m;
1584 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1585 unsigned char *payload = &packet[2];
1586 struct dns_header *new_header = (struct dns_header *)payload;
1587 u16 *length = (u16 *)packet;
1588 unsigned char c1, c2;
1589
1590 if (!packet)
1591 return STAT_INSECURE;
1592
1593 another_tcp_key:
1594 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1595 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1596
1597 *length = htons(m);
1598
1599 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1600 !read_write(server->tcpfd, &c1, 1, 1) ||
1601 !read_write(server->tcpfd, &c2, 1, 1) ||
1602 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1603 new_status = STAT_INSECURE;
1604 else
1605 {
1606 m = (c1 << 8) | c2;
1607
1608 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1609
1610 if (new_status == STAT_SECURE)
1611 {
1612 /* Reached a validated record, now try again at this level.
1613 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1614 If so, go round again. */
1615
1616 if (status == STAT_NEED_KEY)
1617 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1618 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1619 {
1620 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1621 if (status == STAT_NEED_DS && (new_status == STAT_NO_DS || new_status == STAT_NO_NS))
1622 new_status = STAT_BOGUS; /* Validated no DS */
1623 }
1624 else if (status == STAT_CHASE_CNAME)
1625 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1626 else
1627 {
1628 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1629
1630 if (new_status == STAT_NO_SIG)
1631 {
1632 if (option_bool(OPT_DNSSEC_NO_SIGN))
1633 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1634 else
1635 new_status = STAT_INSECURE;
1636 }
1637 }
1638
1639 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1640 goto another_tcp_key;
1641 }
1642 }
1643
1644 free(packet);
1645 }
1646 return new_status;
1647 }
1648 #endif
1649
1650
1651 /* The daemon forks before calling this: it should deal with one connection,
1652 blocking as neccessary, and then return. Note, need to be a bit careful
1653 about resources for debug mode, when the fork is suppressed: that's
1654 done by the caller. */
1655 unsigned char *tcp_request(int confd, time_t now,
1656 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1657 {
1658 size_t size = 0;
1659 int norebind = 0;
1660 #ifdef HAVE_AUTH
1661 int local_auth = 0;
1662 #endif
1663 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1664 int check_subnet, no_cache_dnssec = 0, cache_secure = 0;
1665 size_t m;
1666 unsigned short qtype;
1667 unsigned int gotname;
1668 unsigned char c1, c2;
1669 /* Max TCP packet + slop + size */
1670 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1671 unsigned char *payload = &packet[2];
1672 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1673 struct dns_header *header = (struct dns_header *)payload;
1674 u16 *length = (u16 *)packet;
1675 struct server *last_server;
1676 struct in_addr dst_addr_4;
1677 union mysockaddr peer_addr;
1678 socklen_t peer_len = sizeof(union mysockaddr);
1679
1680 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1681 return packet;
1682
1683 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1684 if (option_bool(OPT_LOCAL_SERVICE))
1685 {
1686 struct addrlist *addr;
1687 #ifdef HAVE_IPV6
1688 if (peer_addr.sa.sa_family == AF_INET6)
1689 {
1690 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1691 if ((addr->flags & ADDRLIST_IPV6) &&
1692 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1693 break;
1694 }
1695 else
1696 #endif
1697 {
1698 struct in_addr netmask;
1699 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1700 {
1701 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1702 if (!(addr->flags & ADDRLIST_IPV6) &&
1703 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1704 break;
1705 }
1706 }
1707 if (!addr)
1708 {
1709 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1710 return packet;
1711 }
1712 }
1713
1714 while (1)
1715 {
1716 if (!packet ||
1717 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1718 !(size = c1 << 8 | c2) ||
1719 !read_write(confd, payload, size, 1))
1720 return packet;
1721
1722 if (size < (int)sizeof(struct dns_header))
1723 continue;
1724
1725 check_subnet = 0;
1726
1727 /* save state of "cd" flag in query */
1728 if ((checking_disabled = header->hb4 & HB4_CD))
1729 no_cache_dnssec = 1;
1730
1731 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1732 {
1733 #ifdef HAVE_AUTH
1734 struct auth_zone *zone;
1735 #endif
1736 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1737
1738 if (peer_addr.sa.sa_family == AF_INET)
1739 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1740 (struct all_addr *)&peer_addr.in.sin_addr, types);
1741 #ifdef HAVE_IPV6
1742 else
1743 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1744 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1745 #endif
1746
1747 #ifdef HAVE_AUTH
1748 /* find queries for zones we're authoritative for, and answer them directly */
1749 if (!auth_dns)
1750 for (zone = daemon->auth_zones; zone; zone = zone->next)
1751 if (in_zone(zone, daemon->namebuff, NULL))
1752 {
1753 auth_dns = 1;
1754 local_auth = 1;
1755 break;
1756 }
1757 #endif
1758 }
1759
1760 if (local_addr->sa.sa_family == AF_INET)
1761 dst_addr_4 = local_addr->in.sin_addr;
1762 else
1763 dst_addr_4.s_addr = 0;
1764
1765 #ifdef HAVE_AUTH
1766 if (auth_dns)
1767 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1768 else
1769 #endif
1770 {
1771 /* m > 0 if answered from cache */
1772 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1773 dst_addr_4, netmask, now, &ad_question, &do_bit);
1774
1775 /* Do this by steam now we're not in the select() loop */
1776 check_log_writer(NULL);
1777
1778 if (m == 0)
1779 {
1780 unsigned int flags = 0;
1781 struct all_addr *addrp = NULL;
1782 int type = 0;
1783 char *domain = NULL;
1784
1785 if (option_bool(OPT_ADD_MAC))
1786 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1787
1788 if (option_bool(OPT_CLIENT_SUBNET))
1789 {
1790 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1791 if (size != new)
1792 {
1793 size = new;
1794 check_subnet = 1;
1795 }
1796 }
1797
1798 if (gotname)
1799 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1800
1801 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1802 last_server = daemon->servers;
1803 else
1804 last_server = daemon->last_server;
1805
1806 if (!flags && last_server)
1807 {
1808 struct server *firstsendto = NULL;
1809 #ifdef HAVE_DNSSEC
1810 unsigned char *newhash, hash[HASH_SIZE];
1811 if ((newhash = hash_questions(header, (unsigned int)size, daemon->namebuff)))
1812 memcpy(hash, newhash, HASH_SIZE);
1813 else
1814 memset(hash, 0, HASH_SIZE);
1815 #else
1816 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1817 #endif
1818 /* Loop round available servers until we succeed in connecting to one.
1819 Note that this code subtley ensures that consecutive queries on this connection
1820 which can go to the same server, do so. */
1821 while (1)
1822 {
1823 if (!firstsendto)
1824 firstsendto = last_server;
1825 else
1826 {
1827 if (!(last_server = last_server->next))
1828 last_server = daemon->servers;
1829
1830 if (last_server == firstsendto)
1831 break;
1832 }
1833
1834 /* server for wrong domain */
1835 if (type != (last_server->flags & SERV_TYPE) ||
1836 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)) ||
1837 (last_server->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
1838 continue;
1839
1840 if (last_server->tcpfd == -1)
1841 {
1842 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1843 continue;
1844
1845 #ifdef HAVE_CONNTRACK
1846 /* Copy connection mark of incoming query to outgoing connection. */
1847 if (option_bool(OPT_CONNTRACK))
1848 {
1849 unsigned int mark;
1850 struct all_addr local;
1851 #ifdef HAVE_IPV6
1852 if (local_addr->sa.sa_family == AF_INET6)
1853 local.addr.addr6 = local_addr->in6.sin6_addr;
1854 else
1855 #endif
1856 local.addr.addr4 = local_addr->in.sin_addr;
1857
1858 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1859 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1860 }
1861 #endif
1862
1863 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1864 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1865 {
1866 close(last_server->tcpfd);
1867 last_server->tcpfd = -1;
1868 continue;
1869 }
1870
1871 #ifdef HAVE_DNSSEC
1872 if (option_bool(OPT_DNSSEC_VALID))
1873 {
1874 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1875
1876 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1877 this allows it to select auth servers when one is returning bad data. */
1878 if (option_bool(OPT_DNSSEC_DEBUG))
1879 header->hb4 |= HB4_CD;
1880
1881 if (size != new_size)
1882 added_pheader = 1;
1883
1884 size = new_size;
1885 }
1886 #endif
1887 }
1888
1889 *length = htons(size);
1890
1891 /* get query name again for logging - may have been overwritten */
1892 if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1893 strcpy(daemon->namebuff, "query");
1894
1895 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1896 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1897 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1898 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1899 {
1900 close(last_server->tcpfd);
1901 last_server->tcpfd = -1;
1902 continue;
1903 }
1904
1905 m = (c1 << 8) | c2;
1906
1907 if (last_server->addr.sa.sa_family == AF_INET)
1908 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1909 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1910 #ifdef HAVE_IPV6
1911 else
1912 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1913 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1914 #endif
1915
1916 #ifdef HAVE_DNSSEC
1917 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1918 {
1919 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1920 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1921 char *result;
1922
1923 if (keycount == 0)
1924 result = "ABANDONED";
1925 else
1926 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1927
1928 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1929
1930 if (status == STAT_BOGUS)
1931 no_cache_dnssec = 1;
1932
1933 if (status == STAT_SECURE)
1934 cache_secure = 1;
1935 }
1936 #endif
1937
1938 /* restore CD bit to the value in the query */
1939 if (checking_disabled)
1940 header->hb4 |= HB4_CD;
1941 else
1942 header->hb4 &= ~HB4_CD;
1943
1944 /* There's no point in updating the cache, since this process will exit and
1945 lose the information after a few queries. We make this call for the alias and
1946 bogus-nxdomain side-effects. */
1947 /* If the crc of the question section doesn't match the crc we sent, then
1948 someone might be attempting to insert bogus values into the cache by
1949 sending replies containing questions and bogus answers. */
1950 #ifdef HAVE_DNSSEC
1951 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
1952 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
1953 {
1954 m = 0;
1955 break;
1956 }
1957 #else
1958 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
1959 {
1960 m = 0;
1961 break;
1962 }
1963 #endif
1964
1965 m = process_reply(header, now, last_server, (unsigned int)m,
1966 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec,
1967 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
1968
1969 break;
1970 }
1971 }
1972
1973 /* In case of local answer or no connections made. */
1974 if (m == 0)
1975 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
1976 }
1977 }
1978
1979 check_log_writer(NULL);
1980
1981 *length = htons(m);
1982
1983 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
1984 return packet;
1985 }
1986 }
1987
1988 static struct frec *allocate_frec(time_t now)
1989 {
1990 struct frec *f;
1991
1992 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
1993 {
1994 f->next = daemon->frec_list;
1995 f->time = now;
1996 f->sentto = NULL;
1997 f->rfd4 = NULL;
1998 f->flags = 0;
1999 #ifdef HAVE_IPV6
2000 f->rfd6 = NULL;
2001 #endif
2002 #ifdef HAVE_DNSSEC
2003 f->dependent = NULL;
2004 f->blocking_query = NULL;
2005 f->stash = NULL;
2006 f->orig_domain = NULL;
2007 #endif
2008 daemon->frec_list = f;
2009 }
2010
2011 return f;
2012 }
2013
2014 struct randfd *allocate_rfd(int family)
2015 {
2016 static int finger = 0;
2017 int i;
2018
2019 /* limit the number of sockets we have open to avoid starvation of
2020 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
2021
2022 for (i = 0; i < RANDOM_SOCKS; i++)
2023 if (daemon->randomsocks[i].refcount == 0)
2024 {
2025 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
2026 break;
2027
2028 daemon->randomsocks[i].refcount = 1;
2029 daemon->randomsocks[i].family = family;
2030 return &daemon->randomsocks[i];
2031 }
2032
2033 /* No free ones or cannot get new socket, grab an existing one */
2034 for (i = 0; i < RANDOM_SOCKS; i++)
2035 {
2036 int j = (i+finger) % RANDOM_SOCKS;
2037 if (daemon->randomsocks[j].refcount != 0 &&
2038 daemon->randomsocks[j].family == family &&
2039 daemon->randomsocks[j].refcount != 0xffff)
2040 {
2041 finger = j;
2042 daemon->randomsocks[j].refcount++;
2043 return &daemon->randomsocks[j];
2044 }
2045 }
2046
2047 return NULL; /* doom */
2048 }
2049
2050 void free_rfd(struct randfd *rfd)
2051 {
2052 if (rfd && --(rfd->refcount) == 0)
2053 close(rfd->fd);
2054 }
2055
2056 static void free_frec(struct frec *f)
2057 {
2058 free_rfd(f->rfd4);
2059 f->rfd4 = NULL;
2060 f->sentto = NULL;
2061 f->flags = 0;
2062
2063 #ifdef HAVE_IPV6
2064 free_rfd(f->rfd6);
2065 f->rfd6 = NULL;
2066 #endif
2067
2068 #ifdef HAVE_DNSSEC
2069 if (f->stash)
2070 {
2071 blockdata_free(f->stash);
2072 f->stash = NULL;
2073 }
2074
2075 if (f->orig_domain)
2076 {
2077 blockdata_free(f->orig_domain);
2078 f->orig_domain = NULL;
2079 }
2080
2081 /* Anything we're waiting on is pointless now, too */
2082 if (f->blocking_query)
2083 free_frec(f->blocking_query);
2084 f->blocking_query = NULL;
2085 f->dependent = NULL;
2086 #endif
2087 }
2088
2089 /* if wait==NULL return a free or older than TIMEOUT record.
2090 else return *wait zero if one available, or *wait is delay to
2091 when the oldest in-use record will expire. Impose an absolute
2092 limit of 4*TIMEOUT before we wipe things (for random sockets).
2093 If force is set, always return a result, even if we have
2094 to allocate above the limit. */
2095 struct frec *get_new_frec(time_t now, int *wait, int force)
2096 {
2097 struct frec *f, *oldest, *target;
2098 int count;
2099
2100 if (wait)
2101 *wait = 0;
2102
2103 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
2104 if (!f->sentto)
2105 target = f;
2106 else
2107 {
2108 if (difftime(now, f->time) >= 4*TIMEOUT)
2109 {
2110 free_frec(f);
2111 target = f;
2112 }
2113
2114 if (!oldest || difftime(f->time, oldest->time) <= 0)
2115 oldest = f;
2116 }
2117
2118 if (target)
2119 {
2120 target->time = now;
2121 return target;
2122 }
2123
2124 /* can't find empty one, use oldest if there is one
2125 and it's older than timeout */
2126 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2127 {
2128 /* keep stuff for twice timeout if we can by allocating a new
2129 record instead */
2130 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2131 count <= daemon->ftabsize &&
2132 (f = allocate_frec(now)))
2133 return f;
2134
2135 if (!wait)
2136 {
2137 free_frec(oldest);
2138 oldest->time = now;
2139 }
2140 return oldest;
2141 }
2142
2143 /* none available, calculate time 'till oldest record expires */
2144 if (!force && count > daemon->ftabsize)
2145 {
2146 static time_t last_log = 0;
2147
2148 if (oldest && wait)
2149 *wait = oldest->time + (time_t)TIMEOUT - now;
2150
2151 if ((int)difftime(now, last_log) > 5)
2152 {
2153 last_log = now;
2154 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2155 }
2156
2157 return NULL;
2158 }
2159
2160 if (!(f = allocate_frec(now)) && wait)
2161 /* wait one second on malloc failure */
2162 *wait = 1;
2163
2164 return f; /* OK if malloc fails and this is NULL */
2165 }
2166
2167 /* crc is all-ones if not known. */
2168 static struct frec *lookup_frec(unsigned short id, void *hash)
2169 {
2170 struct frec *f;
2171
2172 for(f = daemon->frec_list; f; f = f->next)
2173 if (f->sentto && f->new_id == id &&
2174 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2175 return f;
2176
2177 return NULL;
2178 }
2179
2180 static struct frec *lookup_frec_by_sender(unsigned short id,
2181 union mysockaddr *addr,
2182 void *hash)
2183 {
2184 struct frec *f;
2185
2186 for(f = daemon->frec_list; f; f = f->next)
2187 if (f->sentto &&
2188 f->orig_id == id &&
2189 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2190 sockaddr_isequal(&f->source, addr))
2191 return f;
2192
2193 return NULL;
2194 }
2195
2196 /* Send query packet again, if we can. */
2197 void resend_query()
2198 {
2199 if (daemon->srv_save)
2200 {
2201 int fd;
2202
2203 if (daemon->srv_save->sfd)
2204 fd = daemon->srv_save->sfd->fd;
2205 else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
2206 fd = daemon->rfd_save->fd;
2207 else
2208 return;
2209
2210 while(sendto(fd, daemon->packet, daemon->packet_len, 0,
2211 &daemon->srv_save->addr.sa, sa_len(&daemon->srv_save->addr)) == -1 && retry_send());
2212 }
2213 }
2214
2215 /* A server record is going away, remove references to it */
2216 void server_gone(struct server *server)
2217 {
2218 struct frec *f;
2219
2220 for (f = daemon->frec_list; f; f = f->next)
2221 if (f->sentto && f->sentto == server)
2222 free_frec(f);
2223
2224 if (daemon->last_server == server)
2225 daemon->last_server = NULL;
2226
2227 if (daemon->srv_save == server)
2228 daemon->srv_save = NULL;
2229 }
2230
2231 /* return unique random ids. */
2232 static unsigned short get_id(void)
2233 {
2234 unsigned short ret = 0;
2235
2236 do
2237 ret = rand16();
2238 while (lookup_frec(ret, NULL));
2239
2240 return ret;
2241 }
2242
2243
2244
2245
2246
Michael's tree of dnsmasq.