]>
git.ipfire.org Git - people/ms/dnsmasq.git/blob - src/forward.c
1 /* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
3 This program is free software; you can redistribute it and/or modify
4 it under the terms of the GNU General Public License as published by
5 the Free Software Foundation; version 2 dated June, 1991, or
6 (at your option) version 3 dated 29 June, 2007.
8 This program is distributed in the hope that it will be useful,
9 but WITHOUT ANY WARRANTY; without even the implied warranty of
10 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 GNU General Public License for more details.
13 You should have received a copy of the GNU General Public License
14 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
);
20 static struct frec
*lookup_frec_by_sender(unsigned short id
,
21 union mysockaddr
*addr
,
23 static unsigned short get_id(unsigned int crc
);
24 static void free_frec(struct frec
*f
);
25 static struct randfd
*allocate_rfd(int family
);
27 /* Send a UDP packet with its source address set as "source"
28 unless nowild is true, when we just send it with the kernel default */
29 int send_from(int fd
, int nowild
, char *packet
, size_t len
,
30 union mysockaddr
*to
, struct all_addr
*source
,
36 struct cmsghdr align
; /* this ensures alignment */
37 #if defined(HAVE_LINUX_NETWORK)
38 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
39 #elif defined(IP_SENDSRCADDR)
40 char control
[CMSG_SPACE(sizeof(struct in_addr
))];
43 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
47 iov
[0].iov_base
= packet
;
50 msg
.msg_control
= NULL
;
51 msg
.msg_controllen
= 0;
54 msg
.msg_namelen
= sa_len(to
);
60 struct cmsghdr
*cmptr
;
61 msg
.msg_control
= &control_u
;
62 msg
.msg_controllen
= sizeof(control_u
);
63 cmptr
= CMSG_FIRSTHDR(&msg
);
65 if (to
->sa
.sa_family
== AF_INET
)
67 #if defined(HAVE_LINUX_NETWORK)
70 p
.ipi_spec_dst
= source
->addr
.addr4
;
71 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
72 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_pktinfo
));
73 cmptr
->cmsg_level
= IPPROTO_IP
;
74 cmptr
->cmsg_type
= IP_PKTINFO
;
75 #elif defined(IP_SENDSRCADDR)
76 memcpy(CMSG_DATA(cmptr
), &(source
->addr
.addr4
), sizeof(source
->addr
.addr4
));
77 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in_addr
));
78 cmptr
->cmsg_level
= IPPROTO_IP
;
79 cmptr
->cmsg_type
= IP_SENDSRCADDR
;
86 p
.ipi6_ifindex
= iface
; /* Need iface for IPv6 to handle link-local addrs */
87 p
.ipi6_addr
= source
->addr
.addr6
;
88 memcpy(CMSG_DATA(cmptr
), &p
, sizeof(p
));
89 msg
.msg_controllen
= cmptr
->cmsg_len
= CMSG_LEN(sizeof(struct in6_pktinfo
));
90 cmptr
->cmsg_type
= daemon
->v6pktinfo
;
91 cmptr
->cmsg_level
= IPPROTO_IPV6
;
94 (void)iface
; /* eliminate warning */
98 while (sendmsg(fd
, &msg
, 0) == -1)
103 /* If interface is still in DAD, EINVAL results - ignore that. */
107 my_syslog(LOG_ERR
, _("failed to send packet: %s"), strerror(errno
));
114 static unsigned int search_servers(time_t now
, struct all_addr
**addrpp
,
115 unsigned int qtype
, char *qdomain
, int *type
, char **domain
, int *norebind
)
118 /* If the query ends in the domain in one of our servers, set
119 domain to point to that name. We find the largest match to allow both
120 domain.org and sub.domain.org to exist. */
122 unsigned int namelen
= strlen(qdomain
);
123 unsigned int matchlen
= 0;
125 unsigned int flags
= 0;
127 for (serv
= daemon
->servers
; serv
; serv
=serv
->next
)
128 /* domain matches take priority over NODOTS matches */
129 if ((serv
->flags
& SERV_FOR_NODOTS
) && *type
!= SERV_HAS_DOMAIN
&& !strchr(qdomain
, '.') && namelen
!= 0)
131 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
132 *type
= SERV_FOR_NODOTS
;
133 if (serv
->flags
& SERV_NO_ADDR
)
135 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
140 if (serv
->addr
.sa
.sa_family
== AF_INET
)
141 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
144 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
147 else if (!flags
|| (flags
& F_NXDOMAIN
))
151 else if (serv
->flags
& SERV_HAS_DOMAIN
)
153 unsigned int domainlen
= strlen(serv
->domain
);
154 char *matchstart
= qdomain
+ namelen
- domainlen
;
155 if (namelen
>= domainlen
&&
156 hostname_isequal(matchstart
, serv
->domain
) &&
157 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
-1) == '.' ))
159 if (serv
->flags
& SERV_NO_REBIND
)
163 unsigned int sflag
= serv
->addr
.sa
.sa_family
== AF_INET
? F_IPV4
: F_IPV6
;
164 /* implement priority rules for --address and --server for same domain.
165 --address wins if the address is for the correct AF
166 --server wins otherwise. */
167 if (domainlen
!= 0 && domainlen
== matchlen
)
169 if ((serv
->flags
& SERV_LITERAL_ADDRESS
))
171 if (!(sflag
& qtype
) && flags
== 0)
176 if (flags
& (F_IPV4
| F_IPV6
))
181 if (domainlen
>= matchlen
)
183 *type
= serv
->flags
& (SERV_HAS_DOMAIN
| SERV_USE_RESOLV
| SERV_NO_REBIND
);
184 *domain
= serv
->domain
;
185 matchlen
= domainlen
;
186 if (serv
->flags
& SERV_NO_ADDR
)
188 else if (serv
->flags
& SERV_LITERAL_ADDRESS
)
193 if (serv
->addr
.sa
.sa_family
== AF_INET
)
194 *addrpp
= (struct all_addr
*)&serv
->addr
.in
.sin_addr
;
197 *addrpp
= (struct all_addr
*)&serv
->addr
.in6
.sin6_addr
;
200 else if (!flags
|| (flags
& F_NXDOMAIN
))
210 if (flags
== 0 && !(qtype
& F_QUERY
) &&
211 option_bool(OPT_NODOTS_LOCAL
) && !strchr(qdomain
, '.') && namelen
!= 0)
212 /* don't forward A or AAAA queries for simple names, except the empty name */
215 if (flags
== F_NXDOMAIN
&& check_for_local_domain(qdomain
, now
))
222 if (flags
== F_NXDOMAIN
|| flags
== F_NOERR
)
223 logflags
= F_NEG
| qtype
;
225 log_query(logflags
| flags
| F_CONFIG
| F_FORWARD
, qdomain
, *addrpp
, NULL
);
227 else if ((*type
) & SERV_USE_RESOLV
)
229 *type
= 0; /* use normal servers for this domain */
235 static int forward_query(int udpfd
, union mysockaddr
*udpaddr
,
236 struct all_addr
*dst_addr
, unsigned int dst_iface
,
237 struct dns_header
*header
, size_t plen
, time_t now
, struct frec
*forward
)
240 int type
= 0, norebind
= 0;
241 struct all_addr
*addrp
= NULL
;
242 unsigned int crc
= questions_crc(header
, plen
, daemon
->namebuff
);
243 unsigned int flags
= 0;
244 unsigned int gotname
= extract_request(header
, plen
, daemon
->namebuff
, NULL
);
245 struct server
*start
= NULL
;
247 /* RFC 4035: sect 4.6 para 2 */
248 header
->hb4
&= ~HB4_AD
;
250 /* may be no servers available. */
251 if (!daemon
->servers
)
253 else if (forward
|| (forward
= lookup_frec_by_sender(ntohs(header
->id
), udpaddr
, crc
)))
256 /* If we've already got an answer to this query, but we're awaiting keys for vaildation,
257 there's no point retrying the query, retry the key query instead...... */
258 if (forward
->blocking_query
)
262 while (forward
->blocking_query
)
263 forward
= forward
->blocking_query
;
265 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
266 plen
= forward
->stash_len
;
268 if (forward
->sentto
->addr
.sa
.sa_family
)
269 log_query(F_DNSSEC
| F_IPV4
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in
.sin_addr
, "dnssec");
272 log_query(F_DNSSEC
| F_IPV6
, "retry", (struct all_addr
*)&forward
->sentto
->addr
.in6
.sin6_addr
, "dnssec");
275 if (forward
->sentto
->sfd
)
276 fd
= forward
->sentto
->sfd
->fd
;
280 if (forward
->sentto
->addr
.sa
.sa_family
== AF_INET6
)
281 fd
= forward
->rfd6
->fd
;
284 fd
= forward
->rfd4
->fd
;
287 while (sendto(fd
, (char *)header
, plen
, 0,
288 &forward
->sentto
->addr
.sa
,
289 sa_len(&forward
->sentto
->addr
)) == -1 && retry_send());
295 /* retry on existing query, send to all available servers */
296 domain
= forward
->sentto
->domain
;
297 forward
->sentto
->failed_queries
++;
298 if (!option_bool(OPT_ORDER
))
300 forward
->forwardall
= 1;
301 daemon
->last_server
= NULL
;
303 type
= forward
->sentto
->flags
& SERV_TYPE
;
304 if (!(start
= forward
->sentto
->next
))
305 start
= daemon
->servers
; /* at end of list, recycle */
306 header
->id
= htons(forward
->new_id
);
311 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
313 if (!flags
&& !(forward
= get_new_frec(now
, NULL
, 0)))
314 /* table full - server failure. */
319 forward
->source
= *udpaddr
;
320 forward
->dest
= *dst_addr
;
321 forward
->iface
= dst_iface
;
322 forward
->orig_id
= ntohs(header
->id
);
323 forward
->new_id
= get_id(crc
);
326 forward
->forwardall
= 0;
329 forward
->flags
|= FREC_NOREBIND
;
330 if (header
->hb4
& HB4_CD
)
331 forward
->flags
|= FREC_CHECKING_DISABLED
;
333 header
->id
= htons(forward
->new_id
);
335 /* In strict_order mode, always try servers in the order
336 specified in resolv.conf, if a domain is given
337 always try all the available servers,
338 otherwise, use the one last known to work. */
342 if (option_bool(OPT_ORDER
))
343 start
= daemon
->servers
;
344 else if (!(start
= daemon
->last_server
) ||
345 daemon
->forwardcount
++ > FORWARD_TEST
||
346 difftime(now
, daemon
->forwardtime
) > FORWARD_TIME
)
348 start
= daemon
->servers
;
349 forward
->forwardall
= 1;
350 daemon
->forwardcount
= 0;
351 daemon
->forwardtime
= now
;
356 start
= daemon
->servers
;
357 if (!option_bool(OPT_ORDER
))
358 forward
->forwardall
= 1;
363 /* check for send errors here (no route to host)
364 if we fail to send to all nameservers, send back an error
365 packet straight away (helps modem users when offline) */
367 if (!flags
&& forward
)
369 struct server
*firstsentto
= start
;
372 if (option_bool(OPT_ADD_MAC
))
373 plen
= add_mac(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
375 if (option_bool(OPT_CLIENT_SUBNET
))
377 size_t new = add_source_addr(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
, &forward
->source
);
381 forward
->flags
|= FREC_HAS_SUBNET
;
386 if (option_bool(OPT_DNSSEC_VALID
))
388 plen
= add_do_bit(header
, plen
, ((char *) header
) + daemon
->packet_buff_sz
);
389 header
->hb4
|= HB4_CD
;
395 /* only send to servers dealing with our domain.
396 domain may be NULL, in which case server->domain
397 must be NULL also. */
399 if (type
== (start
->flags
& SERV_TYPE
) &&
400 (type
!= SERV_HAS_DOMAIN
|| hostname_isequal(domain
, start
->domain
)) &&
401 !(start
->flags
& SERV_LITERAL_ADDRESS
))
405 /* find server socket to use, may need to get random one. */
411 if (start
->addr
.sa
.sa_family
== AF_INET6
)
413 if (!forward
->rfd6
&&
414 !(forward
->rfd6
= allocate_rfd(AF_INET6
)))
416 daemon
->rfd_save
= forward
->rfd6
;
417 fd
= forward
->rfd6
->fd
;
422 if (!forward
->rfd4
&&
423 !(forward
->rfd4
= allocate_rfd(AF_INET
)))
425 daemon
->rfd_save
= forward
->rfd4
;
426 fd
= forward
->rfd4
->fd
;
429 #ifdef HAVE_CONNTRACK
430 /* Copy connection mark of incoming query to outgoing connection. */
431 if (option_bool(OPT_CONNTRACK
))
434 if (get_incoming_mark(&forward
->source
, &forward
->dest
, 0, &mark
))
435 setsockopt(fd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
440 if (sendto(fd
, (char *)header
, plen
, 0,
442 sa_len(&start
->addr
)) == -1)
449 /* Keep info in case we want to re-send this packet */
450 daemon
->srv_save
= start
;
451 daemon
->packet_len
= plen
;
454 strcpy(daemon
->namebuff
, "query");
455 if (start
->addr
.sa
.sa_family
== AF_INET
)
456 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
457 (struct all_addr
*)&start
->addr
.in
.sin_addr
, NULL
);
460 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
461 (struct all_addr
*)&start
->addr
.in6
.sin6_addr
, NULL
);
465 forward
->sentto
= start
;
466 if (!forward
->forwardall
)
468 forward
->forwardall
++;
472 if (!(start
= start
->next
))
473 start
= daemon
->servers
;
475 if (start
== firstsentto
)
482 /* could not send on, prepare to return */
483 header
->id
= htons(forward
->orig_id
);
484 free_frec(forward
); /* cancel */
487 /* could not send on, return empty answer or address if known for whole domain */
490 plen
= setup_reply(header
, plen
, addrp
, flags
, daemon
->local_ttl
);
491 send_from(udpfd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
), (char *)header
, plen
, udpaddr
, dst_addr
, dst_iface
);
497 static size_t process_reply(struct dns_header
*header
, time_t now
, struct server
*server
, size_t n
, int check_rebind
,
498 int no_cache
, int cache_secure
, int check_subnet
, union mysockaddr
*query_source
)
500 unsigned char *pheader
, *sizep
;
502 int munged
= 0, is_sign
;
506 /* Similar algorithm to search_servers. */
507 struct ipsets
*ipset_pos
;
508 unsigned int namelen
= strlen(daemon
->namebuff
);
509 unsigned int matchlen
= 0;
510 for (ipset_pos
= daemon
->ipsets
; ipset_pos
; ipset_pos
= ipset_pos
->next
)
512 unsigned int domainlen
= strlen(ipset_pos
->domain
);
513 char *matchstart
= daemon
->namebuff
+ namelen
- domainlen
;
514 if (namelen
>= domainlen
&& hostname_isequal(matchstart
, ipset_pos
->domain
) &&
515 (domainlen
== 0 || namelen
== domainlen
|| *(matchstart
- 1) == '.' ) &&
516 domainlen
>= matchlen
) {
517 matchlen
= domainlen
;
518 sets
= ipset_pos
->sets
;
523 /* If upstream is advertising a larger UDP packet size
524 than we allow, trim it so that we don't get overlarge
525 requests for the client. We can't do this for signed packets. */
527 if ((pheader
= find_pseudoheader(header
, n
, &plen
, &sizep
, &is_sign
)))
531 unsigned short udpsz
;
532 unsigned char *psave
= sizep
;
534 GETSHORT(udpsz
, sizep
);
535 if (udpsz
> daemon
->edns_pktsz
)
536 PUTSHORT(daemon
->edns_pktsz
, psave
);
539 if (check_subnet
&& !check_source(header
, plen
, pheader
, query_source
))
541 my_syslog(LOG_WARNING
, _("discarding DNS reply: subnet option mismatch"));
546 /* RFC 4035 sect 4.6 para 3 */
547 if (!is_sign
&& !option_bool(OPT_DNSSEC_PROXY
))
548 header
->hb4
&= ~HB4_AD
;
551 if (option_bool(OPT_DNSSEC_VALID
))
552 header
->hb4
&= ~HB4_AD
;
554 if (!(header
->hb4
& HB4_CD
) && cache_secure
)
555 header
->hb4
|= HB4_AD
;
558 if (OPCODE(header
) != QUERY
|| (RCODE(header
) != NOERROR
&& RCODE(header
) != NXDOMAIN
))
561 /* Complain loudly if the upstream server is non-recursive. */
562 if (!(header
->hb4
& HB4_RA
) && RCODE(header
) == NOERROR
&& ntohs(header
->ancount
) == 0 &&
563 server
&& !(server
->flags
& SERV_WARNED_RECURSIVE
))
565 prettyprint_addr(&server
->addr
, daemon
->namebuff
);
566 my_syslog(LOG_WARNING
, _("nameserver %s refused to do a recursive query"), daemon
->namebuff
);
567 if (!option_bool(OPT_LOG
))
568 server
->flags
|= SERV_WARNED_RECURSIVE
;
571 if (daemon
->bogus_addr
&& RCODE(header
) != NXDOMAIN
&&
572 check_for_bogus_wildcard(header
, n
, daemon
->namebuff
, daemon
->bogus_addr
, now
))
575 SET_RCODE(header
, NXDOMAIN
);
576 header
->hb3
&= ~HB3_AA
;
580 if (RCODE(header
) == NXDOMAIN
&&
581 extract_request(header
, n
, daemon
->namebuff
, NULL
) &&
582 check_for_local_domain(daemon
->namebuff
, now
))
584 /* if we forwarded a query for a locally known name (because it was for
585 an unknown type) and the answer is NXDOMAIN, convert that to NODATA,
586 since we know that the domain exists, even if upstream doesn't */
588 header
->hb3
|= HB3_AA
;
589 SET_RCODE(header
, NOERROR
);
592 if (extract_addresses(header
, n
, daemon
->namebuff
, now
, sets
, is_sign
, check_rebind
, no_cache
, cache_secure
))
594 my_syslog(LOG_WARNING
, _("possible DNS-rebind attack detected: %s"), daemon
->namebuff
);
600 if (no_cache
&& !(header
->hb4
& HB4_CD
))
602 if (option_bool(OPT_DNSSEC_PERMISS
))
607 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
609 querystr("", types
, type
);
610 my_syslog(LOG_WARNING
, _("DNSSEC validation failed: query %s%s"), daemon
->namebuff
, types
);
613 my_syslog(LOG_WARNING
, _("DNSSEC validation failed for unknown query"));
617 /* Bogus reply, turn into SERVFAIL */
618 SET_RCODE(header
, SERVFAIL
);
624 /* do this after extract_addresses. Ensure NODATA reply and remove
629 header
->ancount
= htons(0);
630 header
->nscount
= htons(0);
631 header
->arcount
= htons(0);
634 /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide
635 sections of the packet. Find the new length here and put back pseudoheader
636 if it was removed. */
637 return resize_packet(header
, n
, pheader
, plen
);
640 /* sets new last_server */
641 void reply_query(int fd
, int family
, time_t now
)
643 /* packet from peer server, extract data for cache, and send to
644 original requester */
645 struct dns_header
*header
;
646 union mysockaddr serveraddr
;
647 struct frec
*forward
;
648 socklen_t addrlen
= sizeof(serveraddr
);
649 ssize_t n
= recvfrom(fd
, daemon
->packet
, daemon
->packet_buff_sz
, 0, &serveraddr
.sa
, &addrlen
);
651 struct server
*server
;
653 /* packet buffer overwritten */
654 daemon
->srv_save
= NULL
;
656 /* Determine the address of the server replying so that we can mark that as good */
657 serveraddr
.sa
.sa_family
= family
;
659 if (serveraddr
.sa
.sa_family
== AF_INET6
)
660 serveraddr
.in6
.sin6_flowinfo
= 0;
663 /* spoof check: answer must come from known server, */
664 for (server
= daemon
->servers
; server
; server
= server
->next
)
665 if (!(server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_NO_ADDR
)) &&
666 sockaddr_isequal(&server
->addr
, &serveraddr
))
669 header
= (struct dns_header
*)daemon
->packet
;
672 n
< (int)sizeof(struct dns_header
) || !(header
->hb3
& HB3_QR
) ||
673 !(forward
= lookup_frec(ntohs(header
->id
), questions_crc(header
, n
, daemon
->namebuff
))))
676 if ((RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
) &&
677 !option_bool(OPT_ORDER
) &&
678 forward
->forwardall
== 0)
679 /* for broken servers, attempt to send to another one. */
681 unsigned char *pheader
;
685 /* recreate query from reply */
686 pheader
= find_pseudoheader(header
, (size_t)n
, &plen
, NULL
, &is_sign
);
689 header
->ancount
= htons(0);
690 header
->nscount
= htons(0);
691 header
->arcount
= htons(0);
692 if ((nn
= resize_packet(header
, (size_t)n
, pheader
, plen
)))
694 header
->hb3
&= ~(HB3_QR
| HB3_TC
);
695 forward_query(-1, NULL
, NULL
, 0, header
, nn
, now
, forward
);
701 server
= forward
->sentto
;
703 if ((forward
->sentto
->flags
& SERV_TYPE
) == 0)
705 if (RCODE(header
) == SERVFAIL
|| RCODE(header
) == REFUSED
)
709 struct server
*last_server
;
711 /* find good server by address if possible, otherwise assume the last one we sent to */
712 for (last_server
= daemon
->servers
; last_server
; last_server
= last_server
->next
)
713 if (!(last_server
->flags
& (SERV_LITERAL_ADDRESS
| SERV_HAS_DOMAIN
| SERV_FOR_NODOTS
| SERV_NO_ADDR
)) &&
714 sockaddr_isequal(&last_server
->addr
, &serveraddr
))
716 server
= last_server
;
720 if (!option_bool(OPT_ALL_SERVERS
))
721 daemon
->last_server
= server
;
724 /* If the answer is an error, keep the forward record in place in case
725 we get a good reply from another server. Kill it when we've
726 had replies from all to avoid filling the forwarding table when
727 everything is broken */
728 if (forward
->forwardall
== 0 || --forward
->forwardall
== 1 ||
729 (RCODE(header
) != REFUSED
&& RCODE(header
) != SERVFAIL
))
731 int check_rebind
= 0, no_cache_dnssec
= 0, cache_secure
= 0;
733 if (option_bool(OPT_NO_REBIND
))
734 check_rebind
= !(forward
->flags
& FREC_NOREBIND
);
736 /* Don't cache replies where DNSSEC validation was turned off, either
737 the upstream server told us so, or the original query specified it. */
738 if ((header
->hb4
& HB4_CD
) || (forward
->flags
& FREC_CHECKING_DISABLED
))
742 if (option_bool(OPT_DNSSEC_VALID
) && !(forward
->flags
& FREC_CHECKING_DISABLED
))
746 /* We've had a reply already, which we're validating. Ignore this duplicate */
747 if (forward
->blocking_query
)
750 if (header
->hb3
& HB3_TC
)
752 /* Truncated answer can't be validated.
753 The client will retry over TCP, but if this is an answer to a
754 DNSSEC-generated query, we have a problem. Should really re-send
755 over TCP. No-one with any sense will make a DNSKEY or DS RRset
756 exceed 4096, so this may not be a real problem. Just log
758 if (forward
->flags
& (FREC_DNSKEY_QUERY
| FREC_DS_QUERY
))
759 my_syslog(LOG_ERR
, _("Reply to DNSSEC query truncated - validation fails."));
760 status
= STAT_INSECURE
;
762 else if (forward
->flags
& FREC_DNSKEY_QUERY
)
763 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
764 else if (forward
->flags
& FREC_DS_QUERY
)
765 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
767 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
769 /* Can't validate, as we're missing key data. Put this
770 answer aside, whilst we get that. */
771 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
775 if ((new = get_new_frec(now
, NULL
, 1)))
777 struct frec
*next
= new->next
;
778 *new = *forward
; /* copy everything, then overwrite */
780 new->blocking_query
= NULL
;
785 new->flags
&= ~(FREC_DNSKEY_QUERY
| FREC_DS_QUERY
);
787 /* Free any saved query */
789 blockdata_free(forward
->stash
);
791 /* Now save reply pending receipt of key data */
792 if (!(forward
->stash
= blockdata_alloc((char *)header
, n
)))
793 free_frec(new); /* malloc failure, unwind */
798 forward
->stash_len
= n
;
800 new->dependent
= forward
; /* to find query awaiting new one. */
801 forward
->blocking_query
= new; /* for garbage cleaning */
802 /* validate routines leave name of required record in daemon->keyname */
803 if (status
== STAT_NEED_KEY
)
805 new->flags
|= FREC_DNSKEY_QUERY
;
806 nn
= dnssec_generate_query(header
, ((char *) header
) + daemon
->packet_buff_sz
,
807 daemon
->keyname
, forward
->class, T_DNSKEY
, &server
->addr
);
811 new->flags
|= FREC_DS_QUERY
;
812 nn
= dnssec_generate_query(header
,((char *) header
) + daemon
->packet_buff_sz
,
813 daemon
->keyname
, forward
->class, T_DS
, &server
->addr
);
815 new->crc
= questions_crc(header
, nn
, daemon
->namebuff
);
816 new->new_id
= get_id(new->crc
);
817 header
->id
= htons(new->new_id
);
818 /* Save query for retransmission */
819 new->stash
= blockdata_alloc((char *)header
, nn
);
822 /* Don't resend this. */
823 daemon
->srv_save
= NULL
;
826 fd
= server
->sfd
->fd
;
831 if (server
->addr
.sa
.sa_family
== AF_INET6
)
833 if (new->rfd6
|| (new->rfd6
= allocate_rfd(AF_INET6
)))
839 if (new->rfd4
|| (new->rfd4
= allocate_rfd(AF_INET
)))
846 while (sendto(fd
, (char *)header
, nn
, 0, &server
->addr
.sa
, sa_len(&server
->addr
)) == -1 && retry_send());
855 /* Ok, we reached far enough up the chain-of-trust that we can validate something.
856 Now wind back down, pulling back answers which wouldn't previously validate
857 and validate them with the new data. Failure to find needed data here is an internal error.
858 Once we get to the original answer (FREC_DNSSEC_QUERY not set) and it validates,
859 return it to the original requestor. */
860 if (forward
->flags
& (FREC_DNSKEY_QUERY
| FREC_DS_QUERY
))
862 while (forward
->dependent
)
866 if (status
== STAT_SECURE
)
868 if (forward
->flags
& FREC_DNSKEY_QUERY
)
869 status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
870 else if (forward
->flags
& FREC_DS_QUERY
)
871 status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, forward
->class);
874 prev
= forward
->dependent
;
877 forward
->blocking_query
= NULL
; /* already gone */
878 blockdata_retrieve(forward
->stash
, forward
->stash_len
, (void *)header
);
879 n
= forward
->stash_len
;
882 /* All DNSKEY and DS records done and in cache, now finally validate original
883 answer, provided last DNSKEY is OK. */
884 if (status
== STAT_SECURE
)
885 status
= dnssec_validate_reply(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, &forward
->class);
887 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
889 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
890 status
= STAT_INSECURE
;
894 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
895 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
899 if (status
== STAT_SECURE
)
901 else if (status
== STAT_BOGUS
)
904 /* restore CD bit to the value in the query */
905 if (forward
->flags
& FREC_CHECKING_DISABLED
)
906 header
->hb4
|= HB4_CD
;
908 header
->hb4
&= ~HB4_CD
;
912 if ((nn
= process_reply(header
, now
, server
, (size_t)n
, check_rebind
, no_cache_dnssec
, cache_secure
,
913 forward
->flags
& FREC_HAS_SUBNET
, &forward
->source
)))
915 header
->id
= htons(forward
->orig_id
);
916 header
->hb4
|= HB4_RA
; /* recursion if available */
917 send_from(forward
->fd
, option_bool(OPT_NOWILD
) || option_bool (OPT_CLEVERBIND
), daemon
->packet
, nn
,
918 &forward
->source
, &forward
->dest
, forward
->iface
);
920 free_frec(forward
); /* cancel */
925 void receive_query(struct listener
*listen
, time_t now
)
927 struct dns_header
*header
= (struct dns_header
*)daemon
->packet
;
928 union mysockaddr source_addr
;
930 struct all_addr dst_addr
;
931 struct in_addr netmask
, dst_addr_4
;
934 int if_index
= 0, auth_dns
= 0;
940 struct cmsghdr
*cmptr
;
942 struct cmsghdr align
; /* this ensures alignment */
944 char control6
[CMSG_SPACE(sizeof(struct in6_pktinfo
))];
946 #if defined(HAVE_LINUX_NETWORK)
947 char control
[CMSG_SPACE(sizeof(struct in_pktinfo
))];
948 #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK)
949 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
950 CMSG_SPACE(sizeof(unsigned int))];
951 #elif defined(IP_RECVDSTADDR)
952 char control
[CMSG_SPACE(sizeof(struct in_addr
)) +
953 CMSG_SPACE(sizeof(struct sockaddr_dl
))];
957 /* Can always get recvd interface for IPv6 */
958 int check_dst
= !option_bool(OPT_NOWILD
) || listen
->family
== AF_INET6
;
960 int check_dst
= !option_bool(OPT_NOWILD
);
963 /* packet buffer overwritten */
964 daemon
->srv_save
= NULL
;
966 dst_addr_4
.s_addr
= 0;
969 if (option_bool(OPT_NOWILD
) && listen
->iface
)
971 auth_dns
= listen
->iface
->dns_auth
;
973 if (listen
->family
== AF_INET
)
975 dst_addr_4
= listen
->iface
->addr
.in
.sin_addr
;
976 netmask
= listen
->iface
->netmask
;
980 iov
[0].iov_base
= daemon
->packet
;
981 iov
[0].iov_len
= daemon
->edns_pktsz
;
983 msg
.msg_control
= control_u
.control
;
984 msg
.msg_controllen
= sizeof(control_u
);
986 msg
.msg_name
= &source_addr
;
987 msg
.msg_namelen
= sizeof(source_addr
);
991 if ((n
= recvmsg(listen
->fd
, &msg
, 0)) == -1)
994 if (n
< (int)sizeof(struct dns_header
) ||
995 (msg
.msg_flags
& MSG_TRUNC
) ||
996 (header
->hb3
& HB3_QR
))
999 source_addr
.sa
.sa_family
= listen
->family
;
1001 if (listen
->family
== AF_INET6
)
1002 source_addr
.in6
.sin6_flowinfo
= 0;
1009 if (msg
.msg_controllen
< sizeof(struct cmsghdr
))
1012 #if defined(HAVE_LINUX_NETWORK)
1013 if (listen
->family
== AF_INET
)
1014 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1015 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_PKTINFO
)
1019 struct in_pktinfo
*p
;
1021 p
.c
= CMSG_DATA(cmptr
);
1022 dst_addr_4
= dst_addr
.addr
.addr4
= p
.p
->ipi_spec_dst
;
1023 if_index
= p
.p
->ipi_ifindex
;
1025 #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF)
1026 if (listen
->family
== AF_INET
)
1028 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1034 #ifndef HAVE_SOLARIS_NETWORK
1035 struct sockaddr_dl
*s
;
1038 p
.c
= CMSG_DATA(cmptr
);
1039 if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVDSTADDR
)
1040 dst_addr_4
= dst_addr
.addr
.addr4
= *(p
.a
);
1041 else if (cmptr
->cmsg_level
== IPPROTO_IP
&& cmptr
->cmsg_type
== IP_RECVIF
)
1042 #ifdef HAVE_SOLARIS_NETWORK
1045 if_index
= p
.s
->sdl_index
;
1052 if (listen
->family
== AF_INET6
)
1054 for (cmptr
= CMSG_FIRSTHDR(&msg
); cmptr
; cmptr
= CMSG_NXTHDR(&msg
, cmptr
))
1055 if (cmptr
->cmsg_level
== IPPROTO_IPV6
&& cmptr
->cmsg_type
== daemon
->v6pktinfo
)
1059 struct in6_pktinfo
*p
;
1061 p
.c
= CMSG_DATA(cmptr
);
1063 dst_addr
.addr
.addr6
= p
.p
->ipi6_addr
;
1064 if_index
= p
.p
->ipi6_ifindex
;
1069 /* enforce available interface configuration */
1071 if (!indextoname(listen
->fd
, if_index
, ifr
.ifr_name
))
1074 if (!iface_check(listen
->family
, &dst_addr
, ifr
.ifr_name
, &auth_dns
))
1076 if (!option_bool(OPT_CLEVERBIND
))
1077 enumerate_interfaces(0);
1078 if (!loopback_exception(listen
->fd
, listen
->family
, &dst_addr
, ifr
.ifr_name
) &&
1079 !label_exception(if_index
, listen
->family
, &dst_addr
))
1083 if (listen
->family
== AF_INET
&& option_bool(OPT_LOCALISE
))
1087 /* get the netmask of the interface whch has the address we were sent to.
1088 This is no neccessarily the interface we arrived on. */
1090 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1091 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1092 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1095 /* interface may be new */
1096 if (!iface
&& !option_bool(OPT_CLEVERBIND
))
1097 enumerate_interfaces(0);
1099 for (iface
= daemon
->interfaces
; iface
; iface
= iface
->next
)
1100 if (iface
->addr
.sa
.sa_family
== AF_INET
&&
1101 iface
->addr
.in
.sin_addr
.s_addr
== dst_addr_4
.s_addr
)
1104 /* If we failed, abandon localisation */
1106 netmask
= iface
->netmask
;
1108 dst_addr_4
.s_addr
= 0;
1112 if (extract_request(header
, (size_t)n
, daemon
->namebuff
, &type
))
1116 struct auth_zone
*zone
;
1119 querystr(auth_dns
? "auth" : "query", types
, type
);
1121 if (listen
->family
== AF_INET
)
1122 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1123 (struct all_addr
*)&source_addr
.in
.sin_addr
, types
);
1126 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1127 (struct all_addr
*)&source_addr
.in6
.sin6_addr
, types
);
1131 /* find queries for zones we're authoritative for, and answer them directly */
1133 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1134 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1146 m
= answer_auth(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
, now
, &source_addr
, local_auth
);
1149 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1150 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1151 daemon
->auth_answer
++;
1157 m
= answer_request(header
, ((char *) header
) + daemon
->packet_buff_sz
, (size_t)n
,
1158 dst_addr_4
, netmask
, now
);
1162 send_from(listen
->fd
, option_bool(OPT_NOWILD
) || option_bool(OPT_CLEVERBIND
),
1163 (char *)header
, m
, &source_addr
, &dst_addr
, if_index
);
1164 daemon
->local_answer
++;
1166 else if (forward_query(listen
->fd
, &source_addr
, &dst_addr
, if_index
,
1167 header
, (size_t)n
, now
, NULL
))
1168 daemon
->queries_forwarded
++;
1170 daemon
->local_answer
++;
1175 static int tcp_key_recurse(time_t now
, int status
, int class, char *keyname
, struct server
*server
)
1177 /* Recurse up the key heirarchy */
1179 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1180 unsigned char *payload
= &packet
[2];
1181 struct dns_header
*header
= (struct dns_header
*)payload
;
1182 u16
*length
= (u16
*)packet
;
1184 unsigned char c1
, c2
;
1186 n
= dnssec_generate_query(header
, ((char *) header
) + 65536, keyname
, class,
1187 status
== STAT_NEED_KEY
? T_DNSKEY
: T_DS
, &server
->addr
);
1191 if (!read_write(server
->tcpfd
, packet
, n
+ sizeof(u16
), 0) ||
1192 !read_write(server
->tcpfd
, &c1
, 1, 1) ||
1193 !read_write(server
->tcpfd
, &c2
, 1, 1) ||
1194 !read_write(server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1196 close(server
->tcpfd
);
1198 new_status
= STAT_INSECURE
;
1204 if (status
== STAT_NEED_KEY
)
1205 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1207 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1209 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1211 if ((new_status
= tcp_key_recurse(now
, new_status
, class, daemon
->keyname
, server
) == STAT_SECURE
))
1213 if (status
== STAT_NEED_KEY
)
1214 new_status
= dnssec_validate_by_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1216 new_status
= dnssec_validate_ds(now
, header
, n
, daemon
->namebuff
, daemon
->keyname
, class);
1218 if (new_status
== STAT_NEED_DS
|| new_status
== STAT_NEED_KEY
)
1220 my_syslog(LOG_ERR
, _("Unexpected missing data for DNSSEC validation"));
1221 status
= STAT_INSECURE
;
1234 /* The daemon forks before calling this: it should deal with one connection,
1235 blocking as neccessary, and then return. Note, need to be a bit careful
1236 about resources for debug mode, when the fork is suppressed: that's
1237 done by the caller. */
1238 unsigned char *tcp_request(int confd
, time_t now
,
1239 union mysockaddr
*local_addr
, struct in_addr netmask
, int auth_dns
)
1246 int checking_disabled
, check_subnet
, no_cache_dnssec
= 0, cache_secure
= 0;
1248 unsigned short qtype
;
1249 unsigned int gotname
;
1250 unsigned char c1
, c2
;
1251 /* Max TCP packet + slop + size */
1252 unsigned char *packet
= whine_malloc(65536 + MAXDNAME
+ RRFIXEDSZ
+ sizeof(u16
));
1253 unsigned char *payload
= &packet
[2];
1254 /* largest field in header is 16-bits, so this is still sufficiently aligned */
1255 struct dns_header
*header
= (struct dns_header
*)payload
;
1256 u16
*length
= (u16
*)packet
;
1257 struct server
*last_server
;
1258 struct in_addr dst_addr_4
;
1259 union mysockaddr peer_addr
;
1260 socklen_t peer_len
= sizeof(union mysockaddr
);
1262 if (getpeername(confd
, (struct sockaddr
*)&peer_addr
, &peer_len
) == -1)
1268 !read_write(confd
, &c1
, 1, 1) || !read_write(confd
, &c2
, 1, 1) ||
1269 !(size
= c1
<< 8 | c2
) ||
1270 !read_write(confd
, payload
, size
, 1))
1273 if (size
< (int)sizeof(struct dns_header
))
1278 /* save state of "cd" flag in query */
1279 if ((checking_disabled
= header
->hb4
& HB4_CD
))
1280 no_cache_dnssec
= 1;
1282 /* RFC 4035: sect 4.6 para 2 */
1283 header
->hb4
&= ~HB4_AD
;
1285 if ((gotname
= extract_request(header
, (unsigned int)size
, daemon
->namebuff
, &qtype
)))
1289 struct auth_zone
*zone
;
1291 querystr(auth_dns
? "auth" : "query", types
, qtype
);
1293 if (peer_addr
.sa
.sa_family
== AF_INET
)
1294 log_query(F_QUERY
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1295 (struct all_addr
*)&peer_addr
.in
.sin_addr
, types
);
1298 log_query(F_QUERY
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1299 (struct all_addr
*)&peer_addr
.in6
.sin6_addr
, types
);
1303 /* find queries for zones we're authoritative for, and answer them directly */
1305 for (zone
= daemon
->auth_zones
; zone
; zone
= zone
->next
)
1306 if (in_zone(zone
, daemon
->namebuff
, NULL
))
1315 if (local_addr
->sa
.sa_family
== AF_INET
)
1316 dst_addr_4
= local_addr
->in
.sin_addr
;
1318 dst_addr_4
.s_addr
= 0;
1322 m
= answer_auth(header
, ((char *) header
) + 65536, (size_t)size
, now
, &peer_addr
, local_auth
);
1326 /* m > 0 if answered from cache */
1327 m
= answer_request(header
, ((char *) header
) + 65536, (size_t)size
,
1328 dst_addr_4
, netmask
, now
);
1330 /* Do this by steam now we're not in the select() loop */
1331 check_log_writer(NULL
);
1335 unsigned int flags
= 0;
1336 struct all_addr
*addrp
= NULL
;
1338 char *domain
= NULL
;
1340 if (option_bool(OPT_ADD_MAC
))
1341 size
= add_mac(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1343 if (option_bool(OPT_CLIENT_SUBNET
))
1345 size_t new = add_source_addr(header
, size
, ((char *) header
) + 65536, &peer_addr
);
1354 flags
= search_servers(now
, &addrp
, gotname
, daemon
->namebuff
, &type
, &domain
, &norebind
);
1356 if (type
!= 0 || option_bool(OPT_ORDER
) || !daemon
->last_server
)
1357 last_server
= daemon
->servers
;
1359 last_server
= daemon
->last_server
;
1361 if (!flags
&& last_server
)
1363 struct server
*firstsendto
= NULL
;
1364 unsigned int crc
= questions_crc(header
, (unsigned int)size
, daemon
->namebuff
);
1366 /* Loop round available servers until we succeed in connecting to one.
1367 Note that this code subtley ensures that consecutive queries on this connection
1368 which can go to the same server, do so. */
1372 firstsendto
= last_server
;
1375 if (!(last_server
= last_server
->next
))
1376 last_server
= daemon
->servers
;
1378 if (last_server
== firstsendto
)
1382 /* server for wrong domain */
1383 if (type
!= (last_server
->flags
& SERV_TYPE
) ||
1384 (type
== SERV_HAS_DOMAIN
&& !hostname_isequal(domain
, last_server
->domain
)))
1387 if (last_server
->tcpfd
== -1)
1389 if ((last_server
->tcpfd
= socket(last_server
->addr
.sa
.sa_family
, SOCK_STREAM
, 0)) == -1)
1392 if ((!local_bind(last_server
->tcpfd
, &last_server
->source_addr
, last_server
->interface
, 1) ||
1393 connect(last_server
->tcpfd
, &last_server
->addr
.sa
, sa_len(&last_server
->addr
)) == -1))
1395 close(last_server
->tcpfd
);
1396 last_server
->tcpfd
= -1;
1401 if (option_bool(OPT_DNSSEC_VALID
))
1403 size
= add_do_bit(header
, size
, ((char *) header
) + 65536);
1404 header
->hb4
|= HB4_CD
;
1408 #ifdef HAVE_CONNTRACK
1409 /* Copy connection mark of incoming query to outgoing connection. */
1410 if (option_bool(OPT_CONNTRACK
))
1413 struct all_addr local
;
1415 if (local_addr
->sa
.sa_family
== AF_INET6
)
1416 local
.addr
.addr6
= local_addr
->in6
.sin6_addr
;
1419 local
.addr
.addr4
= local_addr
->in
.sin_addr
;
1421 if (get_incoming_mark(&peer_addr
, &local
, 1, &mark
))
1422 setsockopt(last_server
->tcpfd
, SOL_SOCKET
, SO_MARK
, &mark
, sizeof(unsigned int));
1427 *length
= htons(size
);
1429 if (!read_write(last_server
->tcpfd
, packet
, size
+ sizeof(u16
), 0) ||
1430 !read_write(last_server
->tcpfd
, &c1
, 1, 1) ||
1431 !read_write(last_server
->tcpfd
, &c2
, 1, 1) ||
1432 !read_write(last_server
->tcpfd
, payload
, (c1
<< 8) | c2
, 1))
1434 close(last_server
->tcpfd
);
1435 last_server
->tcpfd
= -1;
1442 strcpy(daemon
->namebuff
, "query");
1443 if (last_server
->addr
.sa
.sa_family
== AF_INET
)
1444 log_query(F_SERVER
| F_IPV4
| F_FORWARD
, daemon
->namebuff
,
1445 (struct all_addr
*)&last_server
->addr
.in
.sin_addr
, NULL
);
1448 log_query(F_SERVER
| F_IPV6
| F_FORWARD
, daemon
->namebuff
,
1449 (struct all_addr
*)&last_server
->addr
.in6
.sin6_addr
, NULL
);
1453 if (option_bool(OPT_DNSSEC_VALID
) && !checking_disabled
)
1457 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1459 if (status
== STAT_NEED_DS
|| status
== STAT_NEED_KEY
)
1461 if ((status
= tcp_key_recurse(now
, status
, class, daemon
->keyname
, last_server
)) == STAT_SECURE
)
1462 status
= dnssec_validate_reply(now
, header
, m
, daemon
->namebuff
, daemon
->keyname
, &class);
1465 log_query(F_KEYTAG
| F_SECSTAT
, "result", NULL
,
1466 status
== STAT_SECURE
? "SECURE" : (status
== STAT_INSECURE
? "INSECURE" : "BOGUS"));
1468 if (status
== STAT_BOGUS
)
1469 no_cache_dnssec
= 1;
1471 if (status
== STAT_SECURE
)
1476 /* restore CD bit to the value in the query */
1477 if (checking_disabled
)
1478 header
->hb4
|= HB4_CD
;
1480 header
->hb4
&= ~HB4_CD
;
1482 /* There's no point in updating the cache, since this process will exit and
1483 lose the information after a few queries. We make this call for the alias and
1484 bogus-nxdomain side-effects. */
1485 /* If the crc of the question section doesn't match the crc we sent, then
1486 someone might be attempting to insert bogus values into the cache by
1487 sending replies containing questions and bogus answers. */
1488 if (crc
== questions_crc(header
, (unsigned int)m
, daemon
->namebuff
))
1489 m
= process_reply(header
, now
, last_server
, (unsigned int)m
,
1490 option_bool(OPT_NO_REBIND
) && !norebind
, no_cache_dnssec
,
1491 cache_secure
, check_subnet
, &peer_addr
);
1497 /* In case of local answer or no connections made. */
1499 m
= setup_reply(header
, (unsigned int)size
, addrp
, flags
, daemon
->local_ttl
);
1503 check_log_writer(NULL
);
1507 if (m
== 0 || !read_write(confd
, packet
, m
+ sizeof(u16
), 0))
1512 static struct frec
*allocate_frec(time_t now
)
1516 if ((f
= (struct frec
*)whine_malloc(sizeof(struct frec
))))
1518 f
->next
= daemon
->frec_list
;
1527 f
->blocking_query
= NULL
;
1530 daemon
->frec_list
= f
;
1536 static struct randfd
*allocate_rfd(int family
)
1538 static int finger
= 0;
1541 /* limit the number of sockets we have open to avoid starvation of
1542 (eg) TFTP. Once we have a reasonable number, randomness should be OK */
1544 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1545 if (daemon
->randomsocks
[i
].refcount
== 0)
1547 if ((daemon
->randomsocks
[i
].fd
= random_sock(family
)) == -1)
1550 daemon
->randomsocks
[i
].refcount
= 1;
1551 daemon
->randomsocks
[i
].family
= family
;
1552 return &daemon
->randomsocks
[i
];
1555 /* No free ones or cannot get new socket, grab an existing one */
1556 for (i
= 0; i
< RANDOM_SOCKS
; i
++)
1558 int j
= (i
+finger
) % RANDOM_SOCKS
;
1559 if (daemon
->randomsocks
[j
].refcount
!= 0 &&
1560 daemon
->randomsocks
[j
].family
== family
&&
1561 daemon
->randomsocks
[j
].refcount
!= 0xffff)
1564 daemon
->randomsocks
[j
].refcount
++;
1565 return &daemon
->randomsocks
[j
];
1569 return NULL
; /* doom */
1571 static void free_frec(struct frec
*f
)
1573 if (f
->rfd4
&& --(f
->rfd4
->refcount
) == 0)
1581 if (f
->rfd6
&& --(f
->rfd6
->refcount
) == 0)
1590 blockdata_free(f
->stash
);
1594 /* Anything we're waiting on is pointless now, too */
1595 if (f
->blocking_query
)
1596 free_frec(f
->blocking_query
);
1597 f
->blocking_query
= NULL
;
1602 /* if wait==NULL return a free or older than TIMEOUT record.
1603 else return *wait zero if one available, or *wait is delay to
1604 when the oldest in-use record will expire. Impose an absolute
1605 limit of 4*TIMEOUT before we wipe things (for random sockets).
1606 If force is set, always return a result, even if we have
1607 to allocate above the limit. */
1608 struct frec
*get_new_frec(time_t now
, int *wait
, int force
)
1610 struct frec
*f
, *oldest
, *target
;
1616 for (f
= daemon
->frec_list
, oldest
= NULL
, target
= NULL
, count
= 0; f
; f
= f
->next
, count
++)
1621 if (difftime(now
, f
->time
) >= 4*TIMEOUT
)
1627 if (!oldest
|| difftime(f
->time
, oldest
->time
) <= 0)
1637 /* can't find empty one, use oldest if there is one
1638 and it's older than timeout */
1639 if (oldest
&& ((int)difftime(now
, oldest
->time
)) >= TIMEOUT
)
1641 /* keep stuff for twice timeout if we can by allocating a new
1643 if (difftime(now
, oldest
->time
) < 2*TIMEOUT
&&
1644 count
<= daemon
->ftabsize
&&
1645 (f
= allocate_frec(now
)))
1656 /* none available, calculate time 'till oldest record expires */
1657 if (!force
&& count
> daemon
->ftabsize
)
1659 static time_t last_log
= 0;
1662 *wait
= oldest
->time
+ (time_t)TIMEOUT
- now
;
1664 if ((int)difftime(now
, last_log
) > 5)
1667 my_syslog(LOG_WARNING
, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon
->ftabsize
);
1673 if (!(f
= allocate_frec(now
)) && wait
)
1674 /* wait one second on malloc failure */
1677 return f
; /* OK if malloc fails and this is NULL */
1680 /* crc is all-ones if not known. */
1681 static struct frec
*lookup_frec(unsigned short id
, unsigned int crc
)
1685 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1686 if (f
->sentto
&& f
->new_id
== id
&&
1687 (f
->crc
== crc
|| crc
== 0xffffffff))
1693 static struct frec
*lookup_frec_by_sender(unsigned short id
,
1694 union mysockaddr
*addr
,
1699 for(f
= daemon
->frec_list
; f
; f
= f
->next
)
1703 sockaddr_isequal(&f
->source
, addr
))
1709 /* A server record is going away, remove references to it */
1710 void server_gone(struct server
*server
)
1714 for (f
= daemon
->frec_list
; f
; f
= f
->next
)
1715 if (f
->sentto
&& f
->sentto
== server
)
1718 if (daemon
->last_server
== server
)
1719 daemon
->last_server
= NULL
;
1721 if (daemon
->srv_save
== server
)
1722 daemon
->srv_save
= NULL
;
1725 /* return unique random ids. */
1726 static unsigned short get_id(unsigned int crc
)
1728 unsigned short ret
= 0;
1732 while (lookup_frec(ret
, crc
));