]> git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
projects / people / ms / dnsmasq.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Fix compiler warning when not including DNSSEC.
[people/ms/dnsmasq.git] / src / forward.c
1 /* dnsmasq is Copyright (c) 2000-2015 Simon Kelley
2
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
7
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
12
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
15 */
16
17 #include "dnsmasq.h"
18
19 static struct frec *lookup_frec(unsigned short id, void *hash);
20 static struct frec *lookup_frec_by_sender(unsigned short id,
21 union mysockaddr *addr,
22 void *hash);
23 static unsigned short get_id(void);
24 static void free_frec(struct frec *f);
25
26 #ifdef HAVE_DNSSEC
27 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
28 int class, char *name, char *keyname, struct server *server, int *keycount);
29 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname);
30 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
31 char *name, char *keyname);
32 #endif
33
34
35 /* Send a UDP packet with its source address set as "source"
36 unless nowild is true, when we just send it with the kernel default */
37 int send_from(int fd, int nowild, char *packet, size_t len,
38 union mysockaddr *to, struct all_addr *source,
39 unsigned int iface)
40 {
41 struct msghdr msg;
42 struct iovec iov[1];
43 union {
44 struct cmsghdr align; /* this ensures alignment */
45 #if defined(HAVE_LINUX_NETWORK)
46 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
47 #elif defined(IP_SENDSRCADDR)
48 char control[CMSG_SPACE(sizeof(struct in_addr))];
49 #endif
50 #ifdef HAVE_IPV6
51 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
52 #endif
53 } control_u;
54
55 iov[0].iov_base = packet;
56 iov[0].iov_len = len;
57
58 msg.msg_control = NULL;
59 msg.msg_controllen = 0;
60 msg.msg_flags = 0;
61 msg.msg_name = to;
62 msg.msg_namelen = sa_len(to);
63 msg.msg_iov = iov;
64 msg.msg_iovlen = 1;
65
66 if (!nowild)
67 {
68 struct cmsghdr *cmptr;
69 msg.msg_control = &control_u;
70 msg.msg_controllen = sizeof(control_u);
71 cmptr = CMSG_FIRSTHDR(&msg);
72
73 if (to->sa.sa_family == AF_INET)
74 {
75 #if defined(HAVE_LINUX_NETWORK)
76 struct in_pktinfo p;
77 p.ipi_ifindex = 0;
78 p.ipi_spec_dst = source->addr.addr4;
79 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
80 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
81 cmptr->cmsg_level = IPPROTO_IP;
82 cmptr->cmsg_type = IP_PKTINFO;
83 #elif defined(IP_SENDSRCADDR)
84 memcpy(CMSG_DATA(cmptr), &(source->addr.addr4), sizeof(source->addr.addr4));
85 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
86 cmptr->cmsg_level = IPPROTO_IP;
87 cmptr->cmsg_type = IP_SENDSRCADDR;
88 #endif
89 }
90 else
91 #ifdef HAVE_IPV6
92 {
93 struct in6_pktinfo p;
94 p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */
95 p.ipi6_addr = source->addr.addr6;
96 memcpy(CMSG_DATA(cmptr), &p, sizeof(p));
97 msg.msg_controllen = cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
98 cmptr->cmsg_type = daemon->v6pktinfo;
99 cmptr->cmsg_level = IPPROTO_IPV6;
100 }
101 #else
102 (void)iface; /* eliminate warning */
103 #endif
104 }
105
106 while (retry_send(sendmsg(fd, &msg, 0)));
107
108 /* If interface is still in DAD, EINVAL results - ignore that. */
109 if (errno != 0 && errno != EINVAL)
110 {
111 my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno));
112 return 0;
113 }
114
115 return 1;
116 }
117
118 static unsigned int search_servers(time_t now, struct all_addr **addrpp,
119 unsigned int qtype, char *qdomain, int *type, char **domain, int *norebind)
120
121 {
122 /* If the query ends in the domain in one of our servers, set
123 domain to point to that name. We find the largest match to allow both
124 domain.org and sub.domain.org to exist. */
125
126 unsigned int namelen = strlen(qdomain);
127 unsigned int matchlen = 0;
128 struct server *serv;
129 unsigned int flags = 0;
130
131 for (serv = daemon->servers; serv; serv=serv->next)
132 /* domain matches take priority over NODOTS matches */
133 if ((serv->flags & SERV_FOR_NODOTS) && *type != SERV_HAS_DOMAIN && !strchr(qdomain, '.') && namelen != 0)
134 {
135 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
136 *type = SERV_FOR_NODOTS;
137 if (serv->flags & SERV_NO_ADDR)
138 flags = F_NXDOMAIN;
139 else if (serv->flags & SERV_LITERAL_ADDRESS)
140 {
141 if (sflag & qtype)
142 {
143 flags = sflag;
144 if (serv->addr.sa.sa_family == AF_INET)
145 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
146 #ifdef HAVE_IPV6
147 else
148 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
149 #endif
150 }
151 else if (!flags || (flags & F_NXDOMAIN))
152 flags = F_NOERR;
153 }
154 }
155 else if (serv->flags & SERV_HAS_DOMAIN)
156 {
157 unsigned int domainlen = strlen(serv->domain);
158 char *matchstart = qdomain + namelen - domainlen;
159 if (namelen >= domainlen &&
160 hostname_isequal(matchstart, serv->domain) &&
161 (domainlen == 0 || namelen == domainlen || *(matchstart-1) == '.' ))
162 {
163 if (serv->flags & SERV_NO_REBIND)
164 *norebind = 1;
165 else
166 {
167 unsigned int sflag = serv->addr.sa.sa_family == AF_INET ? F_IPV4 : F_IPV6;
168 /* implement priority rules for --address and --server for same domain.
169 --address wins if the address is for the correct AF
170 --server wins otherwise. */
171 if (domainlen != 0 && domainlen == matchlen)
172 {
173 if ((serv->flags & SERV_LITERAL_ADDRESS))
174 {
175 if (!(sflag & qtype) && flags == 0)
176 continue;
177 }
178 else
179 {
180 if (flags & (F_IPV4 | F_IPV6))
181 continue;
182 }
183 }
184
185 if (domainlen >= matchlen)
186 {
187 *type = serv->flags & (SERV_HAS_DOMAIN | SERV_USE_RESOLV | SERV_NO_REBIND);
188 *domain = serv->domain;
189 matchlen = domainlen;
190 if (serv->flags & SERV_NO_ADDR)
191 flags = F_NXDOMAIN;
192 else if (serv->flags & SERV_LITERAL_ADDRESS)
193 {
194 if (sflag & qtype)
195 {
196 flags = sflag;
197 if (serv->addr.sa.sa_family == AF_INET)
198 *addrpp = (struct all_addr *)&serv->addr.in.sin_addr;
199 #ifdef HAVE_IPV6
200 else
201 *addrpp = (struct all_addr *)&serv->addr.in6.sin6_addr;
202 #endif
203 }
204 else if (!flags || (flags & F_NXDOMAIN))
205 flags = F_NOERR;
206 }
207 else
208 flags = 0;
209 }
210 }
211 }
212 }
213
214 if (flags == 0 && !(qtype & F_QUERY) &&
215 option_bool(OPT_NODOTS_LOCAL) && !strchr(qdomain, '.') && namelen != 0)
216 /* don't forward A or AAAA queries for simple names, except the empty name */
217 flags = F_NOERR;
218
219 if (flags == F_NXDOMAIN && check_for_local_domain(qdomain, now))
220 flags = F_NOERR;
221
222 if (flags)
223 {
224 int logflags = 0;
225
226 if (flags == F_NXDOMAIN || flags == F_NOERR)
227 logflags = F_NEG | qtype;
228
229 log_query(logflags | flags | F_CONFIG | F_FORWARD, qdomain, *addrpp, NULL);
230 }
231 else if ((*type) & SERV_USE_RESOLV)
232 {
233 *type = 0; /* use normal servers for this domain */
234 *domain = NULL;
235 }
236 return flags;
237 }
238
239 static int forward_query(int udpfd, union mysockaddr *udpaddr,
240 struct all_addr *dst_addr, unsigned int dst_iface,
241 struct dns_header *header, size_t plen, time_t now,
242 struct frec *forward, int ad_reqd, int do_bit)
243 {
244 char *domain = NULL;
245 int type = 0, norebind = 0;
246 struct all_addr *addrp = NULL;
247 unsigned int flags = 0;
248 struct server *start = NULL;
249 #ifdef HAVE_DNSSEC
250 void *hash = hash_questions(header, plen, daemon->namebuff);
251 #else
252 unsigned int crc = questions_crc(header, plen, daemon->namebuff);
253 void *hash = &crc;
254 #endif
255 unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL);
256
257 (void)do_bit;
258
259 /* may be no servers available. */
260 if (!daemon->servers)
261 forward = NULL;
262 else if (forward || (hash && (forward = lookup_frec_by_sender(ntohs(header->id), udpaddr, hash))))
263 {
264 #ifdef HAVE_DNSSEC
265 /* If we've already got an answer to this query, but we're awaiting keys for validation,
266 there's no point retrying the query, retry the key query instead...... */
267 if (forward->blocking_query)
268 {
269 int fd;
270
271 while (forward->blocking_query)
272 forward = forward->blocking_query;
273
274 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
275 plen = forward->stash_len;
276
277 if (forward->sentto->addr.sa.sa_family == AF_INET)
278 log_query(F_NOEXTRA | F_DNSSEC | F_IPV4, "retry", (struct all_addr *)&forward->sentto->addr.in.sin_addr, "dnssec");
279 #ifdef HAVE_IPV6
280 else
281 log_query(F_NOEXTRA | F_DNSSEC | F_IPV6, "retry", (struct all_addr *)&forward->sentto->addr.in6.sin6_addr, "dnssec");
282 #endif
283
284 if (forward->sentto->sfd)
285 fd = forward->sentto->sfd->fd;
286 else
287 {
288 #ifdef HAVE_IPV6
289 if (forward->sentto->addr.sa.sa_family == AF_INET6)
290 fd = forward->rfd6->fd;
291 else
292 #endif
293 fd = forward->rfd4->fd;
294 }
295
296 while (retry_send( sendto(fd, (char *)header, plen, 0,
297 &forward->sentto->addr.sa,
298 sa_len(&forward->sentto->addr))));
299
300 return 1;
301 }
302 #endif
303
304 /* retry on existing query, send to all available servers */
305 domain = forward->sentto->domain;
306 forward->sentto->failed_queries++;
307 if (!option_bool(OPT_ORDER))
308 {
309 forward->forwardall = 1;
310 daemon->last_server = NULL;
311 }
312 type = forward->sentto->flags & SERV_TYPE;
313 if (!(start = forward->sentto->next))
314 start = daemon->servers; /* at end of list, recycle */
315 header->id = htons(forward->new_id);
316 }
317 else
318 {
319 if (gotname)
320 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
321
322 if (!flags && !(forward = get_new_frec(now, NULL, 0)))
323 /* table full - server failure. */
324 flags = F_NEG;
325
326 if (forward)
327 {
328 forward->source = *udpaddr;
329 forward->dest = *dst_addr;
330 forward->iface = dst_iface;
331 forward->orig_id = ntohs(header->id);
332 forward->new_id = get_id();
333 forward->fd = udpfd;
334 memcpy(forward->hash, hash, HASH_SIZE);
335 forward->forwardall = 0;
336 forward->flags = 0;
337 if (norebind)
338 forward->flags |= FREC_NOREBIND;
339 if (header->hb4 & HB4_CD)
340 forward->flags |= FREC_CHECKING_DISABLED;
341 if (ad_reqd)
342 forward->flags |= FREC_AD_QUESTION;
343 #ifdef HAVE_DNSSEC
344 forward->work_counter = DNSSEC_WORK;
345 if (do_bit)
346 forward->flags |= FREC_DO_QUESTION;
347 #endif
348
349 header->id = htons(forward->new_id);
350
351 /* In strict_order mode, always try servers in the order
352 specified in resolv.conf, if a domain is given
353 always try all the available servers,
354 otherwise, use the one last known to work. */
355
356 if (type == 0)
357 {
358 if (option_bool(OPT_ORDER))
359 start = daemon->servers;
360 else if (!(start = daemon->last_server) ||
361 daemon->forwardcount++ > FORWARD_TEST ||
362 difftime(now, daemon->forwardtime) > FORWARD_TIME)
363 {
364 start = daemon->servers;
365 forward->forwardall = 1;
366 daemon->forwardcount = 0;
367 daemon->forwardtime = now;
368 }
369 }
370 else
371 {
372 start = daemon->servers;
373 if (!option_bool(OPT_ORDER))
374 forward->forwardall = 1;
375 }
376 }
377 }
378
379 /* check for send errors here (no route to host)
380 if we fail to send to all nameservers, send back an error
381 packet straight away (helps modem users when offline) */
382
383 if (!flags && forward)
384 {
385 struct server *firstsentto = start;
386 int forwarded = 0;
387
388 /* If a query is retried, use the log_id for the retry when logging the answer. */
389 forward->log_id = daemon->log_id;
390
391 if (option_bool(OPT_ADD_MAC))
392 plen = add_mac(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
393
394 if (option_bool(OPT_CLIENT_SUBNET))
395 {
396 size_t new = add_source_addr(header, plen, ((char *) header) + daemon->packet_buff_sz, &forward->source);
397 if (new != plen)
398 {
399 plen = new;
400 forward->flags |= FREC_HAS_SUBNET;
401 }
402 }
403
404 #ifdef HAVE_DNSSEC
405 if (option_bool(OPT_DNSSEC_VALID))
406 {
407 size_t new_plen = add_do_bit(header, plen, ((char *) header) + daemon->packet_buff_sz);
408
409 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
410 this allows it to select auth servers when one is returning bad data. */
411 if (option_bool(OPT_DNSSEC_DEBUG))
412 header->hb4 |= HB4_CD;
413
414 if (new_plen != plen)
415 forward->flags |= FREC_ADDED_PHEADER;
416
417 plen = new_plen;
418 }
419 #endif
420
421 while (1)
422 {
423 /* only send to servers dealing with our domain.
424 domain may be NULL, in which case server->domain
425 must be NULL also. */
426
427 if (type == (start->flags & SERV_TYPE) &&
428 (type != SERV_HAS_DOMAIN || hostname_isequal(domain, start->domain)) &&
429 !(start->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
430 {
431 int fd;
432
433 /* find server socket to use, may need to get random one. */
434 if (start->sfd)
435 fd = start->sfd->fd;
436 else
437 {
438 #ifdef HAVE_IPV6
439 if (start->addr.sa.sa_family == AF_INET6)
440 {
441 if (!forward->rfd6 &&
442 !(forward->rfd6 = allocate_rfd(AF_INET6)))
443 break;
444 daemon->rfd_save = forward->rfd6;
445 fd = forward->rfd6->fd;
446 }
447 else
448 #endif
449 {
450 if (!forward->rfd4 &&
451 !(forward->rfd4 = allocate_rfd(AF_INET)))
452 break;
453 daemon->rfd_save = forward->rfd4;
454 fd = forward->rfd4->fd;
455 }
456
457 #ifdef HAVE_CONNTRACK
458 /* Copy connection mark of incoming query to outgoing connection. */
459 if (option_bool(OPT_CONNTRACK))
460 {
461 unsigned int mark;
462 if (get_incoming_mark(&forward->source, &forward->dest, 0, &mark))
463 setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
464 }
465 #endif
466 }
467
468 if (retry_send(sendto(fd, (char *)header, plen, 0,
469 &start->addr.sa,
470 sa_len(&start->addr))))
471 continue;
472
473 if (errno == 0)
474 {
475 /* Keep info in case we want to re-send this packet */
476 daemon->srv_save = start;
477 daemon->packet_len = plen;
478
479 if (!gotname)
480 strcpy(daemon->namebuff, "query");
481 if (start->addr.sa.sa_family == AF_INET)
482 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
483 (struct all_addr *)&start->addr.in.sin_addr, NULL);
484 #ifdef HAVE_IPV6
485 else
486 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
487 (struct all_addr *)&start->addr.in6.sin6_addr, NULL);
488 #endif
489 start->queries++;
490 forwarded = 1;
491 forward->sentto = start;
492 if (!forward->forwardall)
493 break;
494 forward->forwardall++;
495 }
496 }
497
498 if (!(start = start->next))
499 start = daemon->servers;
500
501 if (start == firstsentto)
502 break;
503 }
504
505 if (forwarded)
506 return 1;
507
508 /* could not send on, prepare to return */
509 header->id = htons(forward->orig_id);
510 free_frec(forward); /* cancel */
511 }
512
513 /* could not send on, return empty answer or address if known for whole domain */
514 if (udpfd != -1)
515 {
516 plen = setup_reply(header, plen, addrp, flags, daemon->local_ttl);
517 send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface);
518 }
519
520 return 0;
521 }
522
523 static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind,
524 int no_cache, int cache_secure, int bogusanswer, int ad_reqd, int do_bit, int added_pheader,
525 int check_subnet, union mysockaddr *query_source)
526 {
527 unsigned char *pheader, *sizep;
528 char **sets = 0;
529 int munged = 0, is_sign;
530 size_t plen;
531
532 (void)ad_reqd;
533 (void)do_bit;
534 (void)bogusanswer;
535
536 #ifdef HAVE_IPSET
537 if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL))
538 {
539 /* Similar algorithm to search_servers. */
540 struct ipsets *ipset_pos;
541 unsigned int namelen = strlen(daemon->namebuff);
542 unsigned int matchlen = 0;
543 for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next)
544 {
545 unsigned int domainlen = strlen(ipset_pos->domain);
546 char *matchstart = daemon->namebuff + namelen - domainlen;
547 if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) &&
548 (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) &&
549 domainlen >= matchlen)
550 {
551 matchlen = domainlen;
552 sets = ipset_pos->sets;
553 }
554 }
555 }
556 #endif
557
558 /* If upstream is advertising a larger UDP packet size
559 than we allow, trim it so that we don't get overlarge
560 requests for the client. We can't do this for signed packets. */
561
562 if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign)))
563 {
564 unsigned short udpsz;
565 unsigned char *psave = sizep;
566
567 GETSHORT(udpsz, sizep);
568
569 if (!is_sign && udpsz > daemon->edns_pktsz)
570 PUTSHORT(daemon->edns_pktsz, psave);
571
572 if (check_subnet && !check_source(header, plen, pheader, query_source))
573 {
574 my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch"));
575 return 0;
576 }
577
578 if (added_pheader)
579 {
580 pheader = 0;
581 header->arcount = htons(0);
582 }
583 }
584
585 /* RFC 4035 sect 4.6 para 3 */
586 if (!is_sign && !option_bool(OPT_DNSSEC_PROXY))
587 header->hb4 &= ~HB4_AD;
588
589 if (OPCODE(header) != QUERY || (RCODE(header) != NOERROR && RCODE(header) != NXDOMAIN))
590 return resize_packet(header, n, pheader, plen);
591
592 /* Complain loudly if the upstream server is non-recursive. */
593 if (!(header->hb4 & HB4_RA) && RCODE(header) == NOERROR && ntohs(header->ancount) == 0 &&
594 server && !(server->flags & SERV_WARNED_RECURSIVE))
595 {
596 prettyprint_addr(&server->addr, daemon->namebuff);
597 my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff);
598 if (!option_bool(OPT_LOG))
599 server->flags |= SERV_WARNED_RECURSIVE;
600 }
601
602 if (daemon->bogus_addr && RCODE(header) != NXDOMAIN &&
603 check_for_bogus_wildcard(header, n, daemon->namebuff, daemon->bogus_addr, now))
604 {
605 munged = 1;
606 SET_RCODE(header, NXDOMAIN);
607 header->hb3 &= ~HB3_AA;
608 cache_secure = 0;
609 }
610 else
611 {
612 int doctored = 0;
613
614 if (RCODE(header) == NXDOMAIN &&
615 extract_request(header, n, daemon->namebuff, NULL) &&
616 check_for_local_domain(daemon->namebuff, now))
617 {
618 /* if we forwarded a query for a locally known name (because it was for
619 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
620 since we know that the domain exists, even if upstream doesn't */
621 munged = 1;
622 header->hb3 |= HB3_AA;
623 SET_RCODE(header, NOERROR);
624 cache_secure = 0;
625 }
626
627 if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored))
628 {
629 my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff);
630 munged = 1;
631 cache_secure = 0;
632 }
633
634 if (doctored)
635 cache_secure = 0;
636 }
637
638 #ifdef HAVE_DNSSEC
639 if (bogusanswer && !(header->hb4 & HB4_CD))
640 {
641 if (!option_bool(OPT_DNSSEC_DEBUG))
642 {
643 /* Bogus reply, turn into SERVFAIL */
644 SET_RCODE(header, SERVFAIL);
645 munged = 1;
646 }
647 }
648
649 if (option_bool(OPT_DNSSEC_VALID))
650 header->hb4 &= ~HB4_AD;
651
652 if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure)
653 header->hb4 |= HB4_AD;
654
655 /* If the requestor didn't set the DO bit, don't return DNSSEC info. */
656 if (!do_bit)
657 n = filter_rrsigs(header, n);
658 #endif
659
660 /* do this after extract_addresses. Ensure NODATA reply and remove
661 nameserver info. */
662
663 if (munged)
664 {
665 header->ancount = htons(0);
666 header->nscount = htons(0);
667 header->arcount = htons(0);
668 header->hb3 &= ~HB3_TC;
669 }
670
671 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
672 sections of the packet. Find the new length here and put back pseudoheader
673 if it was removed. */
674 return resize_packet(header, n, pheader, plen);
675 }
676
677 /* sets new last_server */
678 void reply_query(int fd, int family, time_t now)
679 {
680 /* packet from peer server, extract data for cache, and send to
681 original requester */
682 struct dns_header *header;
683 union mysockaddr serveraddr;
684 struct frec *forward;
685 socklen_t addrlen = sizeof(serveraddr);
686 ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen);
687 size_t nn;
688 struct server *server;
689 void *hash;
690 #ifndef HAVE_DNSSEC
691 unsigned int crc;
692 #endif
693
694 /* packet buffer overwritten */
695 daemon->srv_save = NULL;
696
697 /* Determine the address of the server replying so that we can mark that as good */
698 serveraddr.sa.sa_family = family;
699 #ifdef HAVE_IPV6
700 if (serveraddr.sa.sa_family == AF_INET6)
701 serveraddr.in6.sin6_flowinfo = 0;
702 #endif
703
704 header = (struct dns_header *)daemon->packet;
705
706 if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR))
707 return;
708
709 /* spoof check: answer must come from known server, */
710 for (server = daemon->servers; server; server = server->next)
711 if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_NO_ADDR)) &&
712 sockaddr_isequal(&server->addr, &serveraddr))
713 break;
714
715 if (!server)
716 return;
717
718 #ifdef HAVE_DNSSEC
719 hash = hash_questions(header, n, daemon->namebuff);
720 #else
721 hash = &crc;
722 crc = questions_crc(header, n, daemon->namebuff);
723 #endif
724
725 if (!(forward = lookup_frec(ntohs(header->id), hash)))
726 return;
727
728 /* log_query gets called indirectly all over the place, so
729 pass these in global variables - sorry. */
730 daemon->log_display_id = forward->log_id;
731 daemon->log_source_addr = &forward->source;
732
733 if (daemon->ignore_addr && RCODE(header) == NOERROR &&
734 check_for_ignored_address(header, n, daemon->ignore_addr))
735 return;
736
737 if (RCODE(header) == REFUSED &&
738 !option_bool(OPT_ORDER) &&
739 forward->forwardall == 0)
740 /* for broken servers, attempt to send to another one. */
741 {
742 unsigned char *pheader;
743 size_t plen;
744 int is_sign;
745
746 /* recreate query from reply */
747 pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign);
748 if (!is_sign)
749 {
750 header->ancount = htons(0);
751 header->nscount = htons(0);
752 header->arcount = htons(0);
753 if ((nn = resize_packet(header, (size_t)n, pheader, plen)))
754 {
755 header->hb3 &= ~(HB3_QR | HB3_TC);
756 forward_query(-1, NULL, NULL, 0, header, nn, now, forward, 0, 0);
757 return;
758 }
759 }
760 }
761
762 server = forward->sentto;
763
764 if ((forward->sentto->flags & SERV_TYPE) == 0)
765 {
766 if (RCODE(header) == REFUSED)
767 server = NULL;
768 else
769 {
770 struct server *last_server;
771
772 /* find good server by address if possible, otherwise assume the last one we sent to */
773 for (last_server = daemon->servers; last_server; last_server = last_server->next)
774 if (!(last_server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR)) &&
775 sockaddr_isequal(&last_server->addr, &serveraddr))
776 {
777 server = last_server;
778 break;
779 }
780 }
781 if (!option_bool(OPT_ALL_SERVERS))
782 daemon->last_server = server;
783 }
784
785 /* If the answer is an error, keep the forward record in place in case
786 we get a good reply from another server. Kill it when we've
787 had replies from all to avoid filling the forwarding table when
788 everything is broken */
789 if (forward->forwardall == 0 || --forward->forwardall == 1 || RCODE(header) != SERVFAIL)
790 {
791 int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;
792
793 if (option_bool(OPT_NO_REBIND))
794 check_rebind = !(forward->flags & FREC_NOREBIND);
795
796 /* Don't cache replies where DNSSEC validation was turned off, either
797 the upstream server told us so, or the original query specified it. */
798 if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED))
799 no_cache_dnssec = 1;
800
801 #ifdef HAVE_DNSSEC
802 if (server && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED))
803 {
804 int status;
805
806 /* We've had a reply already, which we're validating. Ignore this duplicate */
807 if (forward->blocking_query)
808 return;
809
810 if (header->hb3 & HB3_TC)
811 {
812 /* Truncated answer can't be validated.
813 If this is an answer to a DNSSEC-generated query, we still
814 need to get the client to retry over TCP, so return
815 an answer with the TC bit set, even if the actual answer fits.
816 */
817 status = STAT_TRUNCATED;
818 }
819 else if (forward->flags & FREC_DNSKEY_QUERY)
820 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
821 else if (forward->flags & FREC_DS_QUERY)
822 {
823 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
824 /* Provably no DS, everything below is insecure, even if signatures are offered */
825 if (status == STAT_NO_DS)
826 /* We only cache sigs when we've validated a reply.
827 Avoid caching a reply with sigs if there's a vaildated break in the
828 DS chain, so we don't return replies from cache missing sigs. */
829 status = STAT_INSECURE_DS;
830 else if (status == STAT_NO_NS)
831 status = STAT_BOGUS;
832 }
833 else if (forward->flags & FREC_CHECK_NOSIGN)
834 {
835 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
836 if (status != STAT_NEED_KEY)
837 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
838 }
839 else
840 {
841 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
842 if (status == STAT_NO_SIG)
843 {
844 if (option_bool(OPT_DNSSEC_NO_SIGN))
845 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
846 else
847 status = STAT_INSECURE;
848 }
849 }
850 /* Can't validate, as we're missing key data. Put this
851 answer aside, whilst we get that. */
852 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
853 {
854 struct frec *new, *orig;
855
856 /* Free any saved query */
857 if (forward->stash)
858 blockdata_free(forward->stash);
859
860 /* Now save reply pending receipt of key data */
861 if (!(forward->stash = blockdata_alloc((char *)header, n)))
862 return;
863 forward->stash_len = n;
864
865 anotherkey:
866 /* Find the original query that started it all.... */
867 for (orig = forward; orig->dependent; orig = orig->dependent);
868
869 if (--orig->work_counter == 0 || !(new = get_new_frec(now, NULL, 1)))
870 status = STAT_INSECURE;
871 else
872 {
873 int fd;
874 struct frec *next = new->next;
875 *new = *forward; /* copy everything, then overwrite */
876 new->next = next;
877 new->blocking_query = NULL;
878 new->sentto = server;
879 new->rfd4 = NULL;
880 new->orig_domain = NULL;
881 #ifdef HAVE_IPV6
882 new->rfd6 = NULL;
883 #endif
884 new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_CHECK_NOSIGN);
885
886 new->dependent = forward; /* to find query awaiting new one. */
887 forward->blocking_query = new; /* for garbage cleaning */
888 /* validate routines leave name of required record in daemon->keyname */
889 if (status == STAT_NEED_KEY)
890 {
891 new->flags |= FREC_DNSKEY_QUERY;
892 nn = dnssec_generate_query(header, ((char *) header) + daemon->packet_buff_sz,
893 daemon->keyname, forward->class, T_DNSKEY, &server->addr);
894 }
895 else
896 {
897 if (status == STAT_NEED_DS_NEG)
898 new->flags |= FREC_CHECK_NOSIGN;
899 else
900 new->flags |= FREC_DS_QUERY;
901 nn = dnssec_generate_query(header,((char *) header) + daemon->packet_buff_sz,
902 daemon->keyname, forward->class, T_DS, &server->addr);
903 }
904 if ((hash = hash_questions(header, nn, daemon->namebuff)))
905 memcpy(new->hash, hash, HASH_SIZE);
906 new->new_id = get_id();
907 header->id = htons(new->new_id);
908 /* Save query for retransmission */
909 if (!(new->stash = blockdata_alloc((char *)header, nn)))
910 return;
911
912 new->stash_len = nn;
913
914 /* Don't resend this. */
915 daemon->srv_save = NULL;
916
917 if (server->sfd)
918 fd = server->sfd->fd;
919 else
920 {
921 fd = -1;
922 #ifdef HAVE_IPV6
923 if (server->addr.sa.sa_family == AF_INET6)
924 {
925 if (new->rfd6 || (new->rfd6 = allocate_rfd(AF_INET6)))
926 fd = new->rfd6->fd;
927 }
928 else
929 #endif
930 {
931 if (new->rfd4 || (new->rfd4 = allocate_rfd(AF_INET)))
932 fd = new->rfd4->fd;
933 }
934 }
935
936 if (fd != -1)
937 {
938 while (retry_send(sendto(fd, (char *)header, nn, 0,
939 &server->addr.sa,
940 sa_len(&server->addr))));
941 server->queries++;
942 }
943
944 return;
945 }
946 }
947
948 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
949 Now wind back down, pulling back answers which wouldn't previously validate
950 and validate them with the new data. Note that if an answer needs multiple
951 keys to validate, we may find another key is needed, in which case we set off
952 down another branch of the tree. Once we get to the original answer
953 (FREC_DNSSEC_QUERY not set) and it validates, return it to the original requestor. */
954 while (forward->dependent)
955 {
956 struct frec *prev = forward->dependent;
957 free_frec(forward);
958 forward = prev;
959 forward->blocking_query = NULL; /* already gone */
960 blockdata_retrieve(forward->stash, forward->stash_len, (void *)header);
961 n = forward->stash_len;
962
963 if (status == STAT_SECURE)
964 {
965 if (forward->flags & FREC_DNSKEY_QUERY)
966 status = dnssec_validate_by_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
967 else if (forward->flags & FREC_DS_QUERY)
968 {
969 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
970 /* Provably no DS, everything below is insecure, even if signatures are offered */
971 if (status == STAT_NO_DS)
972 /* We only cache sigs when we've validated a reply.
973 Avoid caching a reply with sigs if there's a vaildated break in the
974 DS chain, so we don't return replies from cache missing sigs. */
975 status = STAT_INSECURE_DS;
976 else if (status == STAT_NO_NS)
977 status = STAT_BOGUS;
978 }
979 else if (forward->flags & FREC_CHECK_NOSIGN)
980 {
981 status = dnssec_validate_ds(now, header, n, daemon->namebuff, daemon->keyname, forward->class);
982 if (status != STAT_NEED_KEY)
983 status = do_check_sign(forward, status, now, daemon->namebuff, daemon->keyname);
984 }
985 else
986 {
987 status = dnssec_validate_reply(now, header, n, daemon->namebuff, daemon->keyname, &forward->class, NULL, NULL);
988 if (status == STAT_NO_SIG)
989 {
990 if (option_bool(OPT_DNSSEC_NO_SIGN))
991 status = send_check_sign(forward, now, header, n, daemon->namebuff, daemon->keyname);
992 else
993 status = STAT_INSECURE;
994 }
995 }
996
997 if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG || status == STAT_NEED_KEY)
998 goto anotherkey;
999 }
1000 }
1001
1002 no_cache_dnssec = 0;
1003
1004 if (status == STAT_INSECURE_DS)
1005 {
1006 /* We only cache sigs when we've validated a reply.
1007 Avoid caching a reply with sigs if there's a vaildated break in the
1008 DS chain, so we don't return replies from cache missing sigs. */
1009 status = STAT_INSECURE;
1010 no_cache_dnssec = 1;
1011 }
1012
1013 if (status == STAT_TRUNCATED)
1014 header->hb3 |= HB3_TC;
1015 else
1016 {
1017 char *result;
1018
1019 if (forward->work_counter == 0)
1020 {
1021 result = "ABANDONED";
1022 status = STAT_BOGUS;
1023 }
1024 else
1025 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1026
1027 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1028 }
1029
1030 if (status == STAT_SECURE)
1031 cache_secure = 1;
1032 else if (status == STAT_BOGUS)
1033 {
1034 no_cache_dnssec = 1;
1035 bogusanswer = 1;
1036 }
1037 }
1038 #endif
1039
1040 /* restore CD bit to the value in the query */
1041 if (forward->flags & FREC_CHECKING_DISABLED)
1042 header->hb4 |= HB4_CD;
1043 else
1044 header->hb4 &= ~HB4_CD;
1045
1046 if ((nn = process_reply(header, now, server, (size_t)n, check_rebind, no_cache_dnssec, cache_secure, bogusanswer,
1047 forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION,
1048 forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->source)))
1049 {
1050 header->id = htons(forward->orig_id);
1051 header->hb4 |= HB4_RA; /* recursion if available */
1052 send_from(forward->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn,
1053 &forward->source, &forward->dest, forward->iface);
1054 }
1055 free_frec(forward); /* cancel */
1056 }
1057 }
1058
1059
1060 void receive_query(struct listener *listen, time_t now)
1061 {
1062 struct dns_header *header = (struct dns_header *)daemon->packet;
1063 union mysockaddr source_addr;
1064 unsigned short type;
1065 struct all_addr dst_addr;
1066 struct in_addr netmask, dst_addr_4;
1067 size_t m;
1068 ssize_t n;
1069 int if_index = 0, auth_dns = 0;
1070 #ifdef HAVE_AUTH
1071 int local_auth = 0;
1072 #endif
1073 struct iovec iov[1];
1074 struct msghdr msg;
1075 struct cmsghdr *cmptr;
1076 union {
1077 struct cmsghdr align; /* this ensures alignment */
1078 #ifdef HAVE_IPV6
1079 char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))];
1080 #endif
1081 #if defined(HAVE_LINUX_NETWORK)
1082 char control[CMSG_SPACE(sizeof(struct in_pktinfo))];
1083 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
1084 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1085 CMSG_SPACE(sizeof(unsigned int))];
1086 #elif defined(IP_RECVDSTADDR)
1087 char control[CMSG_SPACE(sizeof(struct in_addr)) +
1088 CMSG_SPACE(sizeof(struct sockaddr_dl))];
1089 #endif
1090 } control_u;
1091 #ifdef HAVE_IPV6
1092 /* Can always get recvd interface for IPv6 */
1093 int check_dst = !option_bool(OPT_NOWILD) || listen->family == AF_INET6;
1094 #else
1095 int check_dst = !option_bool(OPT_NOWILD);
1096 #endif
1097
1098 /* packet buffer overwritten */
1099 daemon->srv_save = NULL;
1100
1101 dst_addr_4.s_addr = dst_addr.addr.addr4.s_addr = 0;
1102 netmask.s_addr = 0;
1103
1104 if (option_bool(OPT_NOWILD) && listen->iface)
1105 {
1106 auth_dns = listen->iface->dns_auth;
1107
1108 if (listen->family == AF_INET)
1109 {
1110 dst_addr_4 = dst_addr.addr.addr4 = listen->iface->addr.in.sin_addr;
1111 netmask = listen->iface->netmask;
1112 }
1113 }
1114
1115 iov[0].iov_base = daemon->packet;
1116 iov[0].iov_len = daemon->edns_pktsz;
1117
1118 msg.msg_control = control_u.control;
1119 msg.msg_controllen = sizeof(control_u);
1120 msg.msg_flags = 0;
1121 msg.msg_name = &source_addr;
1122 msg.msg_namelen = sizeof(source_addr);
1123 msg.msg_iov = iov;
1124 msg.msg_iovlen = 1;
1125
1126 if ((n = recvmsg(listen->fd, &msg, 0)) == -1)
1127 return;
1128
1129 if (n < (int)sizeof(struct dns_header) ||
1130 (msg.msg_flags & MSG_TRUNC) ||
1131 (header->hb3 & HB3_QR))
1132 return;
1133
1134 source_addr.sa.sa_family = listen->family;
1135
1136 if (listen->family == AF_INET)
1137 {
1138 /* Source-port == 0 is an error, we can't send back to that.
1139 http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
1140 if (source_addr.in.sin_port == 0)
1141 return;
1142 }
1143 #ifdef HAVE_IPV6
1144 else
1145 {
1146 /* Source-port == 0 is an error, we can't send back to that. */
1147 if (source_addr.in6.sin6_port == 0)
1148 return;
1149 source_addr.in6.sin6_flowinfo = 0;
1150 }
1151 #endif
1152
1153 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1154 if (option_bool(OPT_LOCAL_SERVICE))
1155 {
1156 struct addrlist *addr;
1157 #ifdef HAVE_IPV6
1158 if (listen->family == AF_INET6)
1159 {
1160 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1161 if ((addr->flags & ADDRLIST_IPV6) &&
1162 is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
1163 break;
1164 }
1165 else
1166 #endif
1167 {
1168 struct in_addr netmask;
1169 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1170 {
1171 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1172 if (!(addr->flags & ADDRLIST_IPV6) &&
1173 is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
1174 break;
1175 }
1176 }
1177 if (!addr)
1178 {
1179 static int warned = 0;
1180 if (!warned)
1181 {
1182 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1183 warned = 1;
1184 }
1185 return;
1186 }
1187 }
1188
1189 if (check_dst)
1190 {
1191 struct ifreq ifr;
1192
1193 if (msg.msg_controllen < sizeof(struct cmsghdr))
1194 return;
1195
1196 #if defined(HAVE_LINUX_NETWORK)
1197 if (listen->family == AF_INET)
1198 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1199 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO)
1200 {
1201 union {
1202 unsigned char *c;
1203 struct in_pktinfo *p;
1204 } p;
1205 p.c = CMSG_DATA(cmptr);
1206 dst_addr_4 = dst_addr.addr.addr4 = p.p->ipi_spec_dst;
1207 if_index = p.p->ipi_ifindex;
1208 }
1209 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1210 if (listen->family == AF_INET)
1211 {
1212 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1213 {
1214 union {
1215 unsigned char *c;
1216 unsigned int *i;
1217 struct in_addr *a;
1218 #ifndef HAVE_SOLARIS_NETWORK
1219 struct sockaddr_dl *s;
1220 #endif
1221 } p;
1222 p.c = CMSG_DATA(cmptr);
1223 if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR)
1224 dst_addr_4 = dst_addr.addr.addr4 = *(p.a);
1225 else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF)
1226 #ifdef HAVE_SOLARIS_NETWORK
1227 if_index = *(p.i);
1228 #else
1229 if_index = p.s->sdl_index;
1230 #endif
1231 }
1232 }
1233 #endif
1234
1235 #ifdef HAVE_IPV6
1236 if (listen->family == AF_INET6)
1237 {
1238 for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr))
1239 if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo)
1240 {
1241 union {
1242 unsigned char *c;
1243 struct in6_pktinfo *p;
1244 } p;
1245 p.c = CMSG_DATA(cmptr);
1246
1247 dst_addr.addr.addr6 = p.p->ipi6_addr;
1248 if_index = p.p->ipi6_ifindex;
1249 }
1250 }
1251 #endif
1252
1253 /* enforce available interface configuration */
1254
1255 if (!indextoname(listen->fd, if_index, ifr.ifr_name))
1256 return;
1257
1258 if (!iface_check(listen->family, &dst_addr, ifr.ifr_name, &auth_dns))
1259 {
1260 if (!option_bool(OPT_CLEVERBIND))
1261 enumerate_interfaces(0);
1262 if (!loopback_exception(listen->fd, listen->family, &dst_addr, ifr.ifr_name) &&
1263 !label_exception(if_index, listen->family, &dst_addr))
1264 return;
1265 }
1266
1267 if (listen->family == AF_INET && option_bool(OPT_LOCALISE))
1268 {
1269 struct irec *iface;
1270
1271 /* get the netmask of the interface whch has the address we were sent to.
1272 This is no neccessarily the interface we arrived on. */
1273
1274 for (iface = daemon->interfaces; iface; iface = iface->next)
1275 if (iface->addr.sa.sa_family == AF_INET &&
1276 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1277 break;
1278
1279 /* interface may be new */
1280 if (!iface && !option_bool(OPT_CLEVERBIND))
1281 enumerate_interfaces(0);
1282
1283 for (iface = daemon->interfaces; iface; iface = iface->next)
1284 if (iface->addr.sa.sa_family == AF_INET &&
1285 iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr)
1286 break;
1287
1288 /* If we failed, abandon localisation */
1289 if (iface)
1290 netmask = iface->netmask;
1291 else
1292 dst_addr_4.s_addr = 0;
1293 }
1294 }
1295
1296 /* log_query gets called indirectly all over the place, so
1297 pass these in global variables - sorry. */
1298 daemon->log_display_id = ++daemon->log_id;
1299 daemon->log_source_addr = &source_addr;
1300
1301 if (extract_request(header, (size_t)n, daemon->namebuff, &type))
1302 {
1303 #ifdef HAVE_AUTH
1304 struct auth_zone *zone;
1305 #endif
1306 char *types = querystr(auth_dns ? "auth" : "query", type);
1307
1308 if (listen->family == AF_INET)
1309 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1310 (struct all_addr *)&source_addr.in.sin_addr, types);
1311 #ifdef HAVE_IPV6
1312 else
1313 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1314 (struct all_addr *)&source_addr.in6.sin6_addr, types);
1315 #endif
1316
1317 #ifdef HAVE_AUTH
1318 /* find queries for zones we're authoritative for, and answer them directly */
1319 if (!auth_dns)
1320 for (zone = daemon->auth_zones; zone; zone = zone->next)
1321 if (in_zone(zone, daemon->namebuff, NULL))
1322 {
1323 auth_dns = 1;
1324 local_auth = 1;
1325 break;
1326 }
1327 #endif
1328
1329 #ifdef HAVE_LOOP
1330 /* Check for forwarding loop */
1331 if (detect_loop(daemon->namebuff, type))
1332 return;
1333 #endif
1334 }
1335
1336 #ifdef HAVE_AUTH
1337 if (auth_dns)
1338 {
1339 m = answer_auth(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n, now, &source_addr, local_auth);
1340 if (m >= 1)
1341 {
1342 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1343 (char *)header, m, &source_addr, &dst_addr, if_index);
1344 daemon->auth_answer++;
1345 }
1346 }
1347 else
1348 #endif
1349 {
1350 int ad_reqd, do_bit;
1351 m = answer_request(header, ((char *) header) + daemon->packet_buff_sz, (size_t)n,
1352 dst_addr_4, netmask, now, &ad_reqd, &do_bit);
1353
1354 if (m >= 1)
1355 {
1356 send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND),
1357 (char *)header, m, &source_addr, &dst_addr, if_index);
1358 daemon->local_answer++;
1359 }
1360 else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index,
1361 header, (size_t)n, now, NULL, ad_reqd, do_bit))
1362 daemon->queries_forwarded++;
1363 else
1364 daemon->local_answer++;
1365 }
1366 }
1367
1368 #ifdef HAVE_DNSSEC
1369
1370 /* UDP: we've got an unsigned answer, return STAT_INSECURE if we can prove there's no DS
1371 and therefore the answer shouldn't be signed, or STAT_BOGUS if it should be, or
1372 STAT_NEED_DS_NEG and keyname if we need to do the query. */
1373 static int send_check_sign(struct frec *forward, time_t now, struct dns_header *header, size_t plen,
1374 char *name, char *keyname)
1375 {
1376 int status = dnssec_chase_cname(now, header, plen, name, keyname);
1377
1378 if (status != STAT_INSECURE)
1379 return status;
1380
1381 /* Store the domain we're trying to check. */
1382 forward->name_start = strlen(name);
1383 forward->name_len = forward->name_start + 1;
1384 if (!(forward->orig_domain = blockdata_alloc(name, forward->name_len)))
1385 return STAT_BOGUS;
1386
1387 return do_check_sign(forward, 0, now, name, keyname);
1388 }
1389
1390 /* We either have a a reply (header non-NULL, or we need to start by looking in the cache */
1391 static int do_check_sign(struct frec *forward, int status, time_t now, char *name, char *keyname)
1392 {
1393 /* get domain we're checking back from blockdata store, it's stored on the original query. */
1394 while (forward->dependent)
1395 forward = forward->dependent;
1396
1397 blockdata_retrieve(forward->orig_domain, forward->name_len, name);
1398
1399 while (1)
1400 {
1401 char *p;
1402
1403 if (status == 0)
1404 {
1405 struct crec *crecp;
1406
1407 /* Haven't received answer, see if in cache */
1408 if (!(crecp = cache_find_by_name(NULL, &name[forward->name_start], now, F_DS)))
1409 {
1410 /* put name of DS record we're missing into keyname */
1411 strcpy(keyname, &name[forward->name_start]);
1412 /* and wait for reply to arrive */
1413 return STAT_NEED_DS_NEG;
1414 }
1415
1416 /* F_DNSSECOK misused in DS cache records to non-existance of NS record */
1417 if (!(crecp->flags & F_NEG))
1418 status = STAT_SECURE;
1419 else if (crecp->flags & F_DNSSECOK)
1420 status = STAT_NO_DS;
1421 else
1422 status = STAT_NO_NS;
1423 }
1424
1425 /* Have entered non-signed part of DNS tree. */
1426 if (status == STAT_NO_DS)
1427 return STAT_INSECURE;
1428
1429 if (status == STAT_BOGUS)
1430 return STAT_BOGUS;
1431
1432 /* There's a proven DS record, or we're within a zone, where there doesn't need
1433 to be a DS record. Add a name and try again.
1434 If we've already tried the whole name, then fail */
1435
1436 if (forward->name_start == 0)
1437 return STAT_BOGUS;
1438
1439 for (p = &name[forward->name_start-2]; (*p != '.') && (p != name); p--);
1440
1441 if (p != name)
1442 p++;
1443
1444 forward->name_start = p - name;
1445 status = 0; /* force to cache when we iterate. */
1446 }
1447 }
1448
1449 /* Move down from the root, until we find a signed non-existance of a DS, in which case
1450 an unsigned answer is OK, or we find a signed DS, in which case there should be
1451 a signature, and the answer is BOGUS */
1452 static int tcp_check_for_unsigned_zone(time_t now, struct dns_header *header, size_t plen, int class, char *name,
1453 char *keyname, struct server *server, int *keycount)
1454 {
1455 size_t m;
1456 unsigned char *packet, *payload;
1457 u16 *length;
1458 int status, name_len;
1459 struct blockdata *block;
1460
1461 char *name_start;
1462
1463 /* Get first insecure entry in CNAME chain */
1464 status = tcp_key_recurse(now, STAT_CHASE_CNAME, header, plen, class, name, keyname, server, keycount);
1465 if (status == STAT_BOGUS)
1466 return STAT_BOGUS;
1467
1468 if (!(packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16))))
1469 return STAT_BOGUS;
1470
1471 payload = &packet[2];
1472 header = (struct dns_header *)payload;
1473 length = (u16 *)packet;
1474
1475 /* Stash the name away, since the buffer will be trashed when we recurse */
1476 name_len = strlen(name) + 1;
1477 name_start = name + name_len - 1;
1478
1479 if (!(block = blockdata_alloc(name, name_len)))
1480 {
1481 free(packet);
1482 return STAT_BOGUS;
1483 }
1484
1485 while (1)
1486 {
1487 unsigned char c1, c2;
1488 struct crec *crecp;
1489
1490 if (--(*keycount) == 0)
1491 {
1492 free(packet);
1493 blockdata_free(block);
1494 return STAT_BOGUS;
1495 }
1496
1497 while ((crecp = cache_find_by_name(NULL, name_start, now, F_DS)))
1498 {
1499 if ((crecp->flags & F_NEG) && (crecp->flags & F_DNSSECOK))
1500 {
1501 /* Found a secure denial of DS - delegation is indeed insecure */
1502 free(packet);
1503 blockdata_free(block);
1504 return STAT_INSECURE;
1505 }
1506
1507 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1508 Add another label and continue. */
1509
1510 if (name_start == name)
1511 {
1512 free(packet);
1513 blockdata_free(block);
1514 return STAT_BOGUS; /* run out of labels */
1515 }
1516
1517 name_start -= 2;
1518 while (*name_start != '.' && name_start != name)
1519 name_start--;
1520 if (name_start != name)
1521 name_start++;
1522 }
1523
1524 /* Can't find it in the cache, have to send a query */
1525
1526 m = dnssec_generate_query(header, ((char *) header) + 65536, name_start, class, T_DS, &server->addr);
1527
1528 *length = htons(m);
1529
1530 if (read_write(server->tcpfd, packet, m + sizeof(u16), 0) &&
1531 read_write(server->tcpfd, &c1, 1, 1) &&
1532 read_write(server->tcpfd, &c2, 1, 1) &&
1533 read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1534 {
1535 m = (c1 << 8) | c2;
1536
1537 /* Note this trashes all three name workspaces */
1538 status = tcp_key_recurse(now, STAT_NEED_DS_NEG, header, m, class, name, keyname, server, keycount);
1539
1540 if (status == STAT_NO_DS)
1541 {
1542 /* Found a secure denial of DS - delegation is indeed insecure */
1543 free(packet);
1544 blockdata_free(block);
1545 return STAT_INSECURE;
1546 }
1547
1548 if (status == STAT_BOGUS)
1549 {
1550 free(packet);
1551 blockdata_free(block);
1552 return STAT_BOGUS;
1553 }
1554
1555 /* Here, either there's a secure DS, or no NS and no DS, and therefore no delegation.
1556 Add another label and continue. */
1557
1558 /* Get name we're checking back. */
1559 blockdata_retrieve(block, name_len, name);
1560
1561 if (name_start == name)
1562 {
1563 free(packet);
1564 blockdata_free(block);
1565 return STAT_BOGUS; /* run out of labels */
1566 }
1567
1568 name_start -= 2;
1569 while (*name_start != '.' && name_start != name)
1570 name_start--;
1571 if (name_start != name)
1572 name_start++;
1573 }
1574 else
1575 {
1576 /* IO failure */
1577 free(packet);
1578 blockdata_free(block);
1579 return STAT_BOGUS; /* run out of labels */
1580 }
1581 }
1582 }
1583
1584 static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n,
1585 int class, char *name, char *keyname, struct server *server, int *keycount)
1586 {
1587 /* Recurse up the key heirarchy */
1588 int new_status;
1589
1590 /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */
1591 if (--(*keycount) == 0)
1592 return STAT_INSECURE;
1593
1594 if (status == STAT_NEED_KEY)
1595 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1596 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1597 {
1598 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1599 if (status == STAT_NEED_DS)
1600 {
1601 if (new_status == STAT_NO_DS)
1602 new_status = STAT_INSECURE_DS;
1603 else if (new_status == STAT_NO_NS)
1604 new_status = STAT_BOGUS;
1605 }
1606 }
1607 else if (status == STAT_CHASE_CNAME)
1608 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1609 else
1610 {
1611 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1612
1613 if (new_status == STAT_NO_SIG)
1614 {
1615 if (option_bool(OPT_DNSSEC_NO_SIGN))
1616 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1617 else
1618 new_status = STAT_INSECURE;
1619 }
1620 }
1621
1622 /* Can't validate because we need a key/DS whose name now in keyname.
1623 Make query for same, and recurse to validate */
1624 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1625 {
1626 size_t m;
1627 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1628 unsigned char *payload = &packet[2];
1629 struct dns_header *new_header = (struct dns_header *)payload;
1630 u16 *length = (u16 *)packet;
1631 unsigned char c1, c2;
1632
1633 if (!packet)
1634 return STAT_INSECURE;
1635
1636 another_tcp_key:
1637 m = dnssec_generate_query(new_header, ((char *) new_header) + 65536, keyname, class,
1638 new_status == STAT_NEED_KEY ? T_DNSKEY : T_DS, &server->addr);
1639
1640 *length = htons(m);
1641
1642 if (!read_write(server->tcpfd, packet, m + sizeof(u16), 0) ||
1643 !read_write(server->tcpfd, &c1, 1, 1) ||
1644 !read_write(server->tcpfd, &c2, 1, 1) ||
1645 !read_write(server->tcpfd, payload, (c1 << 8) | c2, 1))
1646 new_status = STAT_INSECURE;
1647 else
1648 {
1649 m = (c1 << 8) | c2;
1650
1651 new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, keycount);
1652
1653 if (new_status == STAT_SECURE)
1654 {
1655 /* Reached a validated record, now try again at this level.
1656 Note that we may get ANOTHER NEED_* if an answer needs more than one key.
1657 If so, go round again. */
1658
1659 if (status == STAT_NEED_KEY)
1660 new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class);
1661 else if (status == STAT_NEED_DS || status == STAT_NEED_DS_NEG)
1662 {
1663 new_status = dnssec_validate_ds(now, header, n, name, keyname, class);
1664 if (status == STAT_NEED_DS)
1665 {
1666 if (new_status == STAT_NO_DS)
1667 new_status = STAT_INSECURE_DS;
1668 else if (new_status == STAT_NO_NS)
1669 new_status = STAT_BOGUS; /* Validated no DS */
1670 }
1671 }
1672 else if (status == STAT_CHASE_CNAME)
1673 new_status = dnssec_chase_cname(now, header, n, name, keyname);
1674 else
1675 {
1676 new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, NULL, NULL);
1677
1678 if (new_status == STAT_NO_SIG)
1679 {
1680 if (option_bool(OPT_DNSSEC_NO_SIGN))
1681 new_status = tcp_check_for_unsigned_zone(now, header, n, class, name, keyname, server, keycount);
1682 else
1683 new_status = STAT_INSECURE;
1684 }
1685 }
1686
1687 if (new_status == STAT_NEED_DS || new_status == STAT_NEED_KEY)
1688 goto another_tcp_key;
1689 }
1690 }
1691
1692 free(packet);
1693 }
1694 return new_status;
1695 }
1696 #endif
1697
1698
1699 /* The daemon forks before calling this: it should deal with one connection,
1700 blocking as neccessary, and then return. Note, need to be a bit careful
1701 about resources for debug mode, when the fork is suppressed: that's
1702 done by the caller. */
1703 unsigned char *tcp_request(int confd, time_t now,
1704 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
1705 {
1706 size_t size = 0;
1707 int norebind = 0;
1708 #ifdef HAVE_AUTH
1709 int local_auth = 0;
1710 #endif
1711 int checking_disabled, ad_question, do_bit, added_pheader = 0;
1712 int check_subnet, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;
1713 size_t m;
1714 unsigned short qtype;
1715 unsigned int gotname;
1716 unsigned char c1, c2;
1717 /* Max TCP packet + slop + size */
1718 unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
1719 unsigned char *payload = &packet[2];
1720 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1721 struct dns_header *header = (struct dns_header *)payload;
1722 u16 *length = (u16 *)packet;
1723 struct server *last_server;
1724 struct in_addr dst_addr_4;
1725 union mysockaddr peer_addr;
1726 socklen_t peer_len = sizeof(union mysockaddr);
1727 int query_count = 0;
1728
1729 if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
1730 return packet;
1731
1732 /* We can be configured to only accept queries from at-most-one-hop-away addresses. */
1733 if (option_bool(OPT_LOCAL_SERVICE))
1734 {
1735 struct addrlist *addr;
1736 #ifdef HAVE_IPV6
1737 if (peer_addr.sa.sa_family == AF_INET6)
1738 {
1739 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1740 if ((addr->flags & ADDRLIST_IPV6) &&
1741 is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
1742 break;
1743 }
1744 else
1745 #endif
1746 {
1747 struct in_addr netmask;
1748 for (addr = daemon->interface_addrs; addr; addr = addr->next)
1749 {
1750 netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen));
1751 if (!(addr->flags & ADDRLIST_IPV6) &&
1752 is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
1753 break;
1754 }
1755 }
1756 if (!addr)
1757 {
1758 my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
1759 return packet;
1760 }
1761 }
1762
1763 while (1)
1764 {
1765 if (query_count == TCP_MAX_QUERIES ||
1766 !packet ||
1767 !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) ||
1768 !(size = c1 << 8 | c2) ||
1769 !read_write(confd, payload, size, 1))
1770 return packet;
1771
1772 if (size < (int)sizeof(struct dns_header))
1773 continue;
1774
1775 query_count++;
1776
1777 /* log_query gets called indirectly all over the place, so
1778 pass these in global variables - sorry. */
1779 daemon->log_display_id = ++daemon->log_id;
1780 daemon->log_source_addr = &peer_addr;
1781
1782 check_subnet = 0;
1783
1784 /* save state of "cd" flag in query */
1785 if ((checking_disabled = header->hb4 & HB4_CD))
1786 no_cache_dnssec = 1;
1787
1788 if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1789 {
1790 #ifdef HAVE_AUTH
1791 struct auth_zone *zone;
1792 #endif
1793 char *types = querystr(auth_dns ? "auth" : "query", qtype);
1794
1795 if (peer_addr.sa.sa_family == AF_INET)
1796 log_query(F_QUERY | F_IPV4 | F_FORWARD, daemon->namebuff,
1797 (struct all_addr *)&peer_addr.in.sin_addr, types);
1798 #ifdef HAVE_IPV6
1799 else
1800 log_query(F_QUERY | F_IPV6 | F_FORWARD, daemon->namebuff,
1801 (struct all_addr *)&peer_addr.in6.sin6_addr, types);
1802 #endif
1803
1804 #ifdef HAVE_AUTH
1805 /* find queries for zones we're authoritative for, and answer them directly */
1806 if (!auth_dns)
1807 for (zone = daemon->auth_zones; zone; zone = zone->next)
1808 if (in_zone(zone, daemon->namebuff, NULL))
1809 {
1810 auth_dns = 1;
1811 local_auth = 1;
1812 break;
1813 }
1814 #endif
1815 }
1816
1817 if (local_addr->sa.sa_family == AF_INET)
1818 dst_addr_4 = local_addr->in.sin_addr;
1819 else
1820 dst_addr_4.s_addr = 0;
1821
1822 #ifdef HAVE_AUTH
1823 if (auth_dns)
1824 m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
1825 else
1826 #endif
1827 {
1828 /* m > 0 if answered from cache */
1829 m = answer_request(header, ((char *) header) + 65536, (size_t)size,
1830 dst_addr_4, netmask, now, &ad_question, &do_bit);
1831
1832 /* Do this by steam now we're not in the select() loop */
1833 check_log_writer(NULL);
1834
1835 if (m == 0)
1836 {
1837 unsigned int flags = 0;
1838 struct all_addr *addrp = NULL;
1839 int type = 0;
1840 char *domain = NULL;
1841
1842 if (option_bool(OPT_ADD_MAC))
1843 size = add_mac(header, size, ((char *) header) + 65536, &peer_addr);
1844
1845 if (option_bool(OPT_CLIENT_SUBNET))
1846 {
1847 size_t new = add_source_addr(header, size, ((char *) header) + 65536, &peer_addr);
1848 if (size != new)
1849 {
1850 size = new;
1851 check_subnet = 1;
1852 }
1853 }
1854
1855 if (gotname)
1856 flags = search_servers(now, &addrp, gotname, daemon->namebuff, &type, &domain, &norebind);
1857
1858 if (type != 0 || option_bool(OPT_ORDER) || !daemon->last_server)
1859 last_server = daemon->servers;
1860 else
1861 last_server = daemon->last_server;
1862
1863 if (!flags && last_server)
1864 {
1865 struct server *firstsendto = NULL;
1866 #ifdef HAVE_DNSSEC
1867 unsigned char *newhash, hash[HASH_SIZE];
1868 if ((newhash = hash_questions(header, (unsigned int)size, daemon->namebuff)))
1869 memcpy(hash, newhash, HASH_SIZE);
1870 else
1871 memset(hash, 0, HASH_SIZE);
1872 #else
1873 unsigned int crc = questions_crc(header, (unsigned int)size, daemon->namebuff);
1874 #endif
1875 /* Loop round available servers until we succeed in connecting to one.
1876 Note that this code subtley ensures that consecutive queries on this connection
1877 which can go to the same server, do so. */
1878 while (1)
1879 {
1880 if (!firstsendto)
1881 firstsendto = last_server;
1882 else
1883 {
1884 if (!(last_server = last_server->next))
1885 last_server = daemon->servers;
1886
1887 if (last_server == firstsendto)
1888 break;
1889 }
1890
1891 /* server for wrong domain */
1892 if (type != (last_server->flags & SERV_TYPE) ||
1893 (type == SERV_HAS_DOMAIN && !hostname_isequal(domain, last_server->domain)) ||
1894 (last_server->flags & (SERV_LITERAL_ADDRESS | SERV_LOOP)))
1895 continue;
1896
1897 if (last_server->tcpfd == -1)
1898 {
1899 if ((last_server->tcpfd = socket(last_server->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
1900 continue;
1901
1902 #ifdef HAVE_CONNTRACK
1903 /* Copy connection mark of incoming query to outgoing connection. */
1904 if (option_bool(OPT_CONNTRACK))
1905 {
1906 unsigned int mark;
1907 struct all_addr local;
1908 #ifdef HAVE_IPV6
1909 if (local_addr->sa.sa_family == AF_INET6)
1910 local.addr.addr6 = local_addr->in6.sin6_addr;
1911 else
1912 #endif
1913 local.addr.addr4 = local_addr->in.sin_addr;
1914
1915 if (get_incoming_mark(&peer_addr, &local, 1, &mark))
1916 setsockopt(last_server->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int));
1917 }
1918 #endif
1919
1920 if ((!local_bind(last_server->tcpfd, &last_server->source_addr, last_server->interface, 1) ||
1921 connect(last_server->tcpfd, &last_server->addr.sa, sa_len(&last_server->addr)) == -1))
1922 {
1923 close(last_server->tcpfd);
1924 last_server->tcpfd = -1;
1925 continue;
1926 }
1927
1928 #ifdef HAVE_DNSSEC
1929 if (option_bool(OPT_DNSSEC_VALID))
1930 {
1931 size_t new_size = add_do_bit(header, size, ((char *) header) + 65536);
1932
1933 /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
1934 this allows it to select auth servers when one is returning bad data. */
1935 if (option_bool(OPT_DNSSEC_DEBUG))
1936 header->hb4 |= HB4_CD;
1937
1938 if (size != new_size)
1939 added_pheader = 1;
1940
1941 size = new_size;
1942 }
1943 #endif
1944 }
1945
1946 *length = htons(size);
1947
1948 /* get query name again for logging - may have been overwritten */
1949 if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype)))
1950 strcpy(daemon->namebuff, "query");
1951
1952 if (!read_write(last_server->tcpfd, packet, size + sizeof(u16), 0) ||
1953 !read_write(last_server->tcpfd, &c1, 1, 1) ||
1954 !read_write(last_server->tcpfd, &c2, 1, 1) ||
1955 !read_write(last_server->tcpfd, payload, (c1 << 8) | c2, 1))
1956 {
1957 close(last_server->tcpfd);
1958 last_server->tcpfd = -1;
1959 continue;
1960 }
1961
1962 m = (c1 << 8) | c2;
1963
1964 if (last_server->addr.sa.sa_family == AF_INET)
1965 log_query(F_SERVER | F_IPV4 | F_FORWARD, daemon->namebuff,
1966 (struct all_addr *)&last_server->addr.in.sin_addr, NULL);
1967 #ifdef HAVE_IPV6
1968 else
1969 log_query(F_SERVER | F_IPV6 | F_FORWARD, daemon->namebuff,
1970 (struct all_addr *)&last_server->addr.in6.sin6_addr, NULL);
1971 #endif
1972
1973 #ifdef HAVE_DNSSEC
1974 if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled)
1975 {
1976 int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
1977 int status = tcp_key_recurse(now, STAT_TRUNCATED, header, m, 0, daemon->namebuff, daemon->keyname, last_server, &keycount);
1978 char *result;
1979
1980 if (status == STAT_INSECURE_DS)
1981 {
1982 /* We only cache sigs when we've validated a reply.
1983 Avoid caching a reply with sigs if there's a vaildated break in the
1984 DS chain, so we don't return replies from cache missing sigs. */
1985 status = STAT_INSECURE;
1986 no_cache_dnssec = 1;
1987 }
1988
1989 if (keycount == 0)
1990 {
1991 result = "ABANDONED";
1992 status = STAT_BOGUS;
1993 }
1994 else
1995 result = (status == STAT_SECURE ? "SECURE" : (status == STAT_INSECURE ? "INSECURE" : "BOGUS"));
1996
1997 log_query(F_KEYTAG | F_SECSTAT, "result", NULL, result);
1998
1999 if (status == STAT_BOGUS)
2000 {
2001 no_cache_dnssec = 1;
2002 bogusanswer = 1;
2003 }
2004
2005 if (status == STAT_SECURE)
2006 cache_secure = 1;
2007 }
2008 #endif
2009
2010 /* restore CD bit to the value in the query */
2011 if (checking_disabled)
2012 header->hb4 |= HB4_CD;
2013 else
2014 header->hb4 &= ~HB4_CD;
2015
2016 /* There's no point in updating the cache, since this process will exit and
2017 lose the information after a few queries. We make this call for the alias and
2018 bogus-nxdomain side-effects. */
2019 /* If the crc of the question section doesn't match the crc we sent, then
2020 someone might be attempting to insert bogus values into the cache by
2021 sending replies containing questions and bogus answers. */
2022 #ifdef HAVE_DNSSEC
2023 newhash = hash_questions(header, (unsigned int)m, daemon->namebuff);
2024 if (!newhash || memcmp(hash, newhash, HASH_SIZE) != 0)
2025 {
2026 m = 0;
2027 break;
2028 }
2029 #else
2030 if (crc != questions_crc(header, (unsigned int)m, daemon->namebuff))
2031 {
2032 m = 0;
2033 break;
2034 }
2035 #endif
2036
2037 m = process_reply(header, now, last_server, (unsigned int)m,
2038 option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec, bogusanswer,
2039 cache_secure, ad_question, do_bit, added_pheader, check_subnet, &peer_addr);
2040
2041 break;
2042 }
2043 }
2044
2045 /* In case of local answer or no connections made. */
2046 if (m == 0)
2047 m = setup_reply(header, (unsigned int)size, addrp, flags, daemon->local_ttl);
2048 }
2049 }
2050
2051 check_log_writer(NULL);
2052
2053 *length = htons(m);
2054
2055 if (m == 0 || !read_write(confd, packet, m + sizeof(u16), 0))
2056 return packet;
2057 }
2058 }
2059
2060 static struct frec *allocate_frec(time_t now)
2061 {
2062 struct frec *f;
2063
2064 if ((f = (struct frec *)whine_malloc(sizeof(struct frec))))
2065 {
2066 f->next = daemon->frec_list;
2067 f->time = now;
2068 f->sentto = NULL;
2069 f->rfd4 = NULL;
2070 f->flags = 0;
2071 #ifdef HAVE_IPV6
2072 f->rfd6 = NULL;
2073 #endif
2074 #ifdef HAVE_DNSSEC
2075 f->dependent = NULL;
2076 f->blocking_query = NULL;
2077 f->stash = NULL;
2078 f->orig_domain = NULL;
2079 #endif
2080 daemon->frec_list = f;
2081 }
2082
2083 return f;
2084 }
2085
2086 struct randfd *allocate_rfd(int family)
2087 {
2088 static int finger = 0;
2089 int i;
2090
2091 /* limit the number of sockets we have open to avoid starvation of
2092 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
2093
2094 for (i = 0; i < RANDOM_SOCKS; i++)
2095 if (daemon->randomsocks[i].refcount == 0)
2096 {
2097 if ((daemon->randomsocks[i].fd = random_sock(family)) == -1)
2098 break;
2099
2100 daemon->randomsocks[i].refcount = 1;
2101 daemon->randomsocks[i].family = family;
2102 return &daemon->randomsocks[i];
2103 }
2104
2105 /* No free ones or cannot get new socket, grab an existing one */
2106 for (i = 0; i < RANDOM_SOCKS; i++)
2107 {
2108 int j = (i+finger) % RANDOM_SOCKS;
2109 if (daemon->randomsocks[j].refcount != 0 &&
2110 daemon->randomsocks[j].family == family &&
2111 daemon->randomsocks[j].refcount != 0xffff)
2112 {
2113 finger = j;
2114 daemon->randomsocks[j].refcount++;
2115 return &daemon->randomsocks[j];
2116 }
2117 }
2118
2119 return NULL; /* doom */
2120 }
2121
2122 void free_rfd(struct randfd *rfd)
2123 {
2124 if (rfd && --(rfd->refcount) == 0)
2125 close(rfd->fd);
2126 }
2127
2128 static void free_frec(struct frec *f)
2129 {
2130 free_rfd(f->rfd4);
2131 f->rfd4 = NULL;
2132 f->sentto = NULL;
2133 f->flags = 0;
2134
2135 #ifdef HAVE_IPV6
2136 free_rfd(f->rfd6);
2137 f->rfd6 = NULL;
2138 #endif
2139
2140 #ifdef HAVE_DNSSEC
2141 if (f->stash)
2142 {
2143 blockdata_free(f->stash);
2144 f->stash = NULL;
2145 }
2146
2147 if (f->orig_domain)
2148 {
2149 blockdata_free(f->orig_domain);
2150 f->orig_domain = NULL;
2151 }
2152
2153 /* Anything we're waiting on is pointless now, too */
2154 if (f->blocking_query)
2155 free_frec(f->blocking_query);
2156 f->blocking_query = NULL;
2157 f->dependent = NULL;
2158 #endif
2159 }
2160
2161 /* if wait==NULL return a free or older than TIMEOUT record.
2162 else return *wait zero if one available, or *wait is delay to
2163 when the oldest in-use record will expire. Impose an absolute
2164 limit of 4*TIMEOUT before we wipe things (for random sockets).
2165 If force is set, always return a result, even if we have
2166 to allocate above the limit. */
2167 struct frec *get_new_frec(time_t now, int *wait, int force)
2168 {
2169 struct frec *f, *oldest, *target;
2170 int count;
2171
2172 if (wait)
2173 *wait = 0;
2174
2175 for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next, count++)
2176 if (!f->sentto)
2177 target = f;
2178 else
2179 {
2180 if (difftime(now, f->time) >= 4*TIMEOUT)
2181 {
2182 free_frec(f);
2183 target = f;
2184 }
2185
2186 if (!oldest || difftime(f->time, oldest->time) <= 0)
2187 oldest = f;
2188 }
2189
2190 if (target)
2191 {
2192 target->time = now;
2193 return target;
2194 }
2195
2196 /* can't find empty one, use oldest if there is one
2197 and it's older than timeout */
2198 if (oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT)
2199 {
2200 /* keep stuff for twice timeout if we can by allocating a new
2201 record instead */
2202 if (difftime(now, oldest->time) < 2*TIMEOUT &&
2203 count <= daemon->ftabsize &&
2204 (f = allocate_frec(now)))
2205 return f;
2206
2207 if (!wait)
2208 {
2209 free_frec(oldest);
2210 oldest->time = now;
2211 }
2212 return oldest;
2213 }
2214
2215 /* none available, calculate time 'till oldest record expires */
2216 if (!force && count > daemon->ftabsize)
2217 {
2218 static time_t last_log = 0;
2219
2220 if (oldest && wait)
2221 *wait = oldest->time + (time_t)TIMEOUT - now;
2222
2223 if ((int)difftime(now, last_log) > 5)
2224 {
2225 last_log = now;
2226 my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize);
2227 }
2228
2229 return NULL;
2230 }
2231
2232 if (!(f = allocate_frec(now)) && wait)
2233 /* wait one second on malloc failure */
2234 *wait = 1;
2235
2236 return f; /* OK if malloc fails and this is NULL */
2237 }
2238
2239 /* crc is all-ones if not known. */
2240 static struct frec *lookup_frec(unsigned short id, void *hash)
2241 {
2242 struct frec *f;
2243
2244 for(f = daemon->frec_list; f; f = f->next)
2245 if (f->sentto && f->new_id == id &&
2246 (!hash || memcmp(hash, f->hash, HASH_SIZE) == 0))
2247 return f;
2248
2249 return NULL;
2250 }
2251
2252 static struct frec *lookup_frec_by_sender(unsigned short id,
2253 union mysockaddr *addr,
2254 void *hash)
2255 {
2256 struct frec *f;
2257
2258 for(f = daemon->frec_list; f; f = f->next)
2259 if (f->sentto &&
2260 f->orig_id == id &&
2261 memcmp(hash, f->hash, HASH_SIZE) == 0 &&
2262 sockaddr_isequal(&f->source, addr))
2263 return f;
2264
2265 return NULL;
2266 }
2267
2268 /* Send query packet again, if we can. */
2269 void resend_query()
2270 {
2271 if (daemon->srv_save)
2272 {
2273 int fd;
2274
2275 if (daemon->srv_save->sfd)
2276 fd = daemon->srv_save->sfd->fd;
2277 else if (daemon->rfd_save && daemon->rfd_save->refcount != 0)
2278 fd = daemon->rfd_save->fd;
2279 else
2280 return;
2281
2282 while(retry_send(sendto(fd, daemon->packet, daemon->packet_len, 0,
2283 &daemon->srv_save->addr.sa,
2284 sa_len(&daemon->srv_save->addr))));
2285 }
2286 }
2287
2288 /* A server record is going away, remove references to it */
2289 void server_gone(struct server *server)
2290 {
2291 struct frec *f;
2292
2293 for (f = daemon->frec_list; f; f = f->next)
2294 if (f->sentto && f->sentto == server)
2295 free_frec(f);
2296
2297 if (daemon->last_server == server)
2298 daemon->last_server = NULL;
2299
2300 if (daemon->srv_save == server)
2301 daemon->srv_save = NULL;
2302 }
2303
2304 /* return unique random ids. */
2305 static unsigned short get_id(void)
2306 {
2307 unsigned short ret = 0;
2308
2309 do
2310 ret = rand16();
2311 while (lookup_frec(ret, NULL));
2312
2313 return ret;
2314 }
2315
2316
2317
2318
2319
Michael's tree of dnsmasq.