2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
29 #include <netinet/tcp.h>
31 #include <sys/resource.h>
34 #if defined (__OpenBSD__) || defined(__NetBSD__)
35 #include <readline/readline.h>
37 #include <editline/readline.h>
41 #include <systemd/sd-daemon.h>
45 #include "dnsdist-cache.hh"
46 #include "dnsdist-console.hh"
47 #include "dnsdist-ecs.hh"
48 #include "dnsdist-lua.hh"
49 #include "dnsdist-rings.hh"
50 #include "dnsdist-secpoll.hh"
51 #include "dnsdist-xpf.hh"
54 #include "delaypipe.hh"
57 #include "dnsparser.hh"
58 #include "dnswriter.hh"
59 #include "ednsoptions.hh"
63 #include "sodcrypto.hh"
65 #include "threadname.hh"
69 Receiver is currently single threaded
70 not *that* bad actually, but now that we are thread safe, might want to scale
74 Set of Rules, if one matches, it leads to an Action
75 Both rules and actions could conceivably be Lua based.
76 On the C++ side, both could be inherited from a class Rule and a class Action,
77 on the Lua side we can't do that. */
83 struct DNSDistStats g_stats
;
84 MetricDefinitionStorage g_metricDefinitions
;
86 uint16_t g_maxOutstanding
{std::numeric_limits
<uint16_t>::max()};
87 bool g_verboseHealthChecks
{false};
88 uint32_t g_staleCacheEntriesTTL
{0};
90 bool g_allowEmptyResponse
{false};
92 GlobalStateHolder
<NetmaskGroup
> g_ACL
;
93 string g_outputBuffer
;
95 std::vector
<std::shared_ptr
<TLSFrontend
>> g_tlslocals
;
96 std::vector
<std::shared_ptr
<DOHFrontend
>> g_dohlocals
;
97 std::vector
<std::shared_ptr
<DNSCryptContext
>> g_dnsCryptLocals
;
99 shared_ptr
<BPFFilter
> g_defaultBPFFilter
;
100 std::vector
<std::shared_ptr
<DynBPFFilter
> > g_dynBPFFilters
;
101 #endif /* HAVE_EBPF */
102 std::vector
<std::unique_ptr
<ClientState
>> g_frontends
;
103 GlobalStateHolder
<pools_t
> g_pools
;
104 size_t g_udpVectorSize
{1};
106 bool g_snmpEnabled
{false};
107 bool g_snmpTrapsEnabled
{false};
108 DNSDistSNMPAgent
* g_snmpAgent
{nullptr};
110 /* UDP: the grand design. Per socket we listen on for incoming queries there is one thread.
111 Then we have a bunch of connected sockets for talking to downstream servers.
112 We send directly to those sockets.
114 For the return path, per downstream server we have a thread that listens to responses.
116 Per socket there is an array of 2^16 states, when we send out a packet downstream, we note
117 there the original requestor and the original id. The new ID is the offset in the array.
119 When an answer comes in on a socket, we look up the offset by the id, and lob it to the
122 IDs are assigned by atomic increments of the socket offset.
125 GlobalStateHolder
<vector
<DNSDistRuleAction
> > g_rulactions
;
126 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_resprulactions
;
127 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_cachehitresprulactions
;
128 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_selfansweredresprulactions
;
133 GlobalStateHolder
<servers_t
> g_dstates
;
134 GlobalStateHolder
<NetmaskTree
<DynBlock
>> g_dynblockNMG
;
135 GlobalStateHolder
<SuffixMatchTree
<DynBlock
>> g_dynblockSMT
;
136 DNSAction::Action g_dynBlockAction
= DNSAction::Action::Drop
;
137 int g_tcpRecvTimeout
{2};
138 int g_tcpSendTimeout
{2};
141 bool g_servFailOnNoPolicy
{false};
142 bool g_truncateTC
{false};
143 bool g_fixupCase
{false};
144 bool g_preserveTrailingData
{false};
145 bool g_roundrobinFailOnNoServer
{false};
147 std::set
<std::string
> g_capabilitiesToRetain
;
149 static void truncateTC(char* packet
, uint16_t* len
, size_t responseSize
, unsigned int consumed
)
152 bool hadEDNS
= false;
153 uint16_t payloadSize
= 0;
156 if (g_addEDNSToSelfGeneratedResponses
) {
157 hadEDNS
= getEDNSUDPPayloadSizeAndZ(packet
, *len
, &payloadSize
, &z
);
160 *len
=static_cast<uint16_t>(sizeof(dnsheader
)+consumed
+DNS_TYPE_SIZE
+DNS_CLASS_SIZE
);
161 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(packet
);
162 dh
->ancount
= dh
->arcount
= dh
->nscount
= 0;
165 addEDNS(dh
, *len
, responseSize
, z
& EDNS_HEADER_FLAG_DO
, payloadSize
, 0);
177 ComboAddress destination
;
178 ComboAddress origDest
;
182 if(origDest
.sin4
.sin_family
== 0) {
183 res
= sendto(fd
, packet
.c_str(), packet
.size(), 0, (struct sockaddr
*)&destination
, destination
.getSocklen());
186 res
= sendfromto(fd
, packet
.c_str(), packet
.size(), 0, origDest
, destination
);
190 vinfolog("Error sending delayed response to %s: %s", destination
.toStringWithPort(), strerror(err
));
195 DelayPipe
<DelayedPacket
>* g_delay
= nullptr;
197 void doLatencyStats(double udiff
)
199 if(udiff
< 1000) ++g_stats
.latency0_1
;
200 else if(udiff
< 10000) ++g_stats
.latency1_10
;
201 else if(udiff
< 50000) ++g_stats
.latency10_50
;
202 else if(udiff
< 100000) ++g_stats
.latency50_100
;
203 else if(udiff
< 1000000) ++g_stats
.latency100_1000
;
204 else ++g_stats
.latencySlow
;
205 g_stats
.latencySum
+= udiff
/ 1000;
207 auto doAvg
= [](double& var
, double n
, double weight
) {
208 var
= (weight
-1) * var
/weight
+ n
/weight
;
211 doAvg(g_stats
.latencyAvg100
, udiff
, 100);
212 doAvg(g_stats
.latencyAvg1000
, udiff
, 1000);
213 doAvg(g_stats
.latencyAvg10000
, udiff
, 10000);
214 doAvg(g_stats
.latencyAvg1000000
, udiff
, 1000000);
217 bool responseContentMatches(const char* response
, const uint16_t responseLen
, const DNSName
& qname
, const uint16_t qtype
, const uint16_t qclass
, const ComboAddress
& remote
, unsigned int& consumed
)
219 if (responseLen
< sizeof(dnsheader
)) {
223 const struct dnsheader
* dh
= reinterpret_cast<const struct dnsheader
*>(response
);
224 if (dh
->qdcount
== 0) {
225 if ((dh
->rcode
!= RCode::NoError
&& dh
->rcode
!= RCode::NXDomain
) || g_allowEmptyResponse
) {
229 ++g_stats
.nonCompliantResponses
;
234 uint16_t rqtype
, rqclass
;
237 rqname
=DNSName(response
, responseLen
, sizeof(dnsheader
), false, &rqtype
, &rqclass
, &consumed
);
239 catch(const std::exception
& e
) {
240 if(responseLen
> 0 && static_cast<size_t>(responseLen
) > sizeof(dnsheader
)) {
241 infolog("Backend %s sent us a response with id %d that did not parse: %s", remote
.toStringWithPort(), ntohs(dh
->id
), e
.what());
243 ++g_stats
.nonCompliantResponses
;
247 if (rqtype
!= qtype
|| rqclass
!= qclass
|| rqname
!= qname
) {
254 static void restoreFlags(struct dnsheader
* dh
, uint16_t origFlags
)
256 static const uint16_t rdMask
= 1 << FLAGS_RD_OFFSET
;
257 static const uint16_t cdMask
= 1 << FLAGS_CD_OFFSET
;
258 static const uint16_t restoreFlagsMask
= UINT16_MAX
& ~(rdMask
| cdMask
);
259 uint16_t * flags
= getFlagsFromDNSHeader(dh
);
260 /* clear the flags we are about to restore */
261 *flags
&= restoreFlagsMask
;
262 /* only keep the flags we want to restore */
263 origFlags
&= ~restoreFlagsMask
;
264 /* set the saved flags as they were */
268 static bool fixUpQueryTurnedResponse(DNSQuestion
& dq
, const uint16_t origFlags
)
270 restoreFlags(dq
.dh
, origFlags
);
272 return addEDNSToQueryTurnedResponse(dq
);
275 static bool fixUpResponse(char** response
, uint16_t* responseLen
, size_t* responseSize
, const DNSName
& qname
, uint16_t origFlags
, bool ednsAdded
, bool ecsAdded
, std::vector
<uint8_t>& rewrittenResponse
, uint16_t addRoom
, bool* zeroScope
)
277 if (*responseLen
< sizeof(dnsheader
)) {
281 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(*response
);
282 restoreFlags(dh
, origFlags
);
284 if (*responseLen
== sizeof(dnsheader
)) {
289 string realname
= qname
.toDNSString();
290 if (*responseLen
>= (sizeof(dnsheader
) + realname
.length())) {
291 memcpy(*response
+ sizeof(dnsheader
), realname
.c_str(), realname
.length());
295 if (ednsAdded
|| ecsAdded
) {
300 const std::string
responseStr(*response
, *responseLen
);
301 int res
= locateEDNSOptRR(responseStr
, &optStart
, &optLen
, &last
);
304 if (zeroScope
) { // this finds if an EDNS Client Subnet scope was set, and if it is 0
305 size_t optContentStart
= 0;
306 uint16_t optContentLen
= 0;
307 /* we need at least 4 bytes after the option length (family: 2, source prefix-length: 1, scope prefix-length: 1) */
308 if (isEDNSOptionInOpt(responseStr
, optStart
, optLen
, EDNSOptionCode::ECS
, &optContentStart
, &optContentLen
) && optContentLen
>= 4) {
309 /* see if the EDNS Client Subnet SCOPE PREFIX-LENGTH byte in position 3 is set to 0, which is the only thing
311 *zeroScope
= responseStr
.at(optContentStart
+ 3) == 0;
316 /* we added the entire OPT RR,
317 therefore we need to remove it entirely */
319 /* simply remove the last AR */
320 *responseLen
-= optLen
;
321 uint16_t arcount
= ntohs(dh
->arcount
);
323 dh
->arcount
= htons(arcount
);
326 /* Removing an intermediary RR could lead to compression error */
327 if (rewriteResponseWithoutEDNS(responseStr
, rewrittenResponse
) == 0) {
328 *responseLen
= rewrittenResponse
.size();
329 if (addRoom
&& (UINT16_MAX
- *responseLen
) > addRoom
) {
330 rewrittenResponse
.reserve(*responseLen
+ addRoom
);
332 *responseSize
= rewrittenResponse
.capacity();
333 *response
= reinterpret_cast<char*>(rewrittenResponse
.data());
336 warnlog("Error rewriting content");
341 /* the OPT RR was already present, but without ECS,
342 we need to remove the ECS option if any */
344 /* nothing after the OPT RR, we can simply remove the
346 size_t existingOptLen
= optLen
;
347 removeEDNSOptionFromOPT(*response
+ optStart
, &optLen
, EDNSOptionCode::ECS
);
348 *responseLen
-= (existingOptLen
- optLen
);
351 /* Removing an intermediary RR could lead to compression error */
352 if (rewriteResponseWithoutEDNSOption(responseStr
, EDNSOptionCode::ECS
, rewrittenResponse
) == 0) {
353 *responseLen
= rewrittenResponse
.size();
354 if (addRoom
&& (UINT16_MAX
- *responseLen
) > addRoom
) {
355 rewrittenResponse
.reserve(*responseLen
+ addRoom
);
357 *responseSize
= rewrittenResponse
.capacity();
358 *response
= reinterpret_cast<char*>(rewrittenResponse
.data());
361 warnlog("Error rewriting content");
372 static bool encryptResponse(char* response
, uint16_t* responseLen
, size_t responseSize
, bool tcp
, std::shared_ptr
<DNSCryptQuery
> dnsCryptQuery
, dnsheader
** dh
, dnsheader
* dhCopy
)
375 uint16_t encryptedResponseLen
= 0;
377 /* save the original header before encrypting it in place */
378 if (dh
!= nullptr && *dh
!= nullptr && dhCopy
!= nullptr) {
379 memcpy(dhCopy
, *dh
, sizeof(dnsheader
));
383 int res
= dnsCryptQuery
->encryptResponse(response
, *responseLen
, responseSize
, tcp
, &encryptedResponseLen
);
385 *responseLen
= encryptedResponseLen
;
387 /* dropping response */
388 vinfolog("Error encrypting the response, dropping.");
394 #endif /* HAVE_DNSCRYPT */
396 static bool applyRulesToResponse(LocalStateHolder
<vector
<DNSDistResponseRuleAction
> >& localRespRulactions
, DNSResponse
& dr
)
398 DNSResponseAction::Action action
=DNSResponseAction::Action::None
;
399 std::string ruleresult
;
400 for(const auto& lr
: *localRespRulactions
) {
401 if(lr
.d_rule
->matches(&dr
)) {
402 lr
.d_rule
->d_matches
++;
403 action
=(*lr
.d_action
)(&dr
, &ruleresult
);
405 case DNSResponseAction::Action::Allow
:
408 case DNSResponseAction::Action::Drop
:
411 case DNSResponseAction::Action::HeaderModify
:
414 case DNSResponseAction::Action::ServFail
:
415 dr
.dh
->rcode
= RCode::ServFail
;
418 /* non-terminal actions follow */
419 case DNSResponseAction::Action::Delay
:
420 dr
.delayMsec
= static_cast<int>(pdns_stou(ruleresult
)); // sorry
422 case DNSResponseAction::Action::None
:
431 bool processResponse(char** response
, uint16_t* responseLen
, size_t* responseSize
, LocalStateHolder
<vector
<DNSDistResponseRuleAction
> >& localRespRulactions
, DNSResponse
& dr
, size_t addRoom
, std::vector
<uint8_t>& rewrittenResponse
, bool muted
)
433 if (!applyRulesToResponse(localRespRulactions
, dr
)) {
437 bool zeroScope
= false;
438 if (!fixUpResponse(response
, responseLen
, responseSize
, *dr
.qname
, dr
.origFlags
, dr
.ednsAdded
, dr
.ecsAdded
, rewrittenResponse
, addRoom
, dr
.useZeroScope
? &zeroScope
: nullptr)) {
442 if (dr
.packetCache
&& !dr
.skipCache
&& *responseLen
<= s_maxPacketCacheEntrySize
) {
443 if (!dr
.useZeroScope
) {
444 /* if the query was not suitable for zero-scope, for
445 example because it had an existing ECS entry so the hash is
446 not really 'no ECS', so just insert it for the existing subnet
448 - we don't have the correct hash for a non-ECS query
449 - inserting with hash computed before the ECS replacement but with
450 the subnet extracted _after_ the replacement would not work.
454 // if zeroScope, pass the pre-ECS hash-key and do not pass the subnet to the cache
455 dr
.packetCache
->insert(zeroScope
? dr
.cacheKeyNoECS
: dr
.cacheKey
, zeroScope
? boost::none
: dr
.subnet
, dr
.origFlags
, dr
.dnssecOK
, *dr
.qname
, dr
.qtype
, dr
.qclass
, *response
, *responseLen
, dr
.tcp
, dr
.dh
->rcode
, dr
.tempFailureTTL
);
460 if (!encryptResponse(*response
, responseLen
, *responseSize
, dr
.tcp
, dr
.dnsCryptQuery
, nullptr, nullptr)) {
464 #endif /* HAVE_DNSCRYPT */
469 static bool sendUDPResponse(int origFD
, const char* response
, const uint16_t responseLen
, const int delayMsec
, const ComboAddress
& origDest
, const ComboAddress
& origRemote
)
471 if(delayMsec
&& g_delay
) {
472 DelayedPacket dp
{origFD
, string(response
,responseLen
), origRemote
, origDest
};
473 g_delay
->submit(dp
, delayMsec
);
477 if(origDest
.sin4
.sin_family
== 0) {
478 res
= sendto(origFD
, response
, responseLen
, 0, reinterpret_cast<const struct sockaddr
*>(&origRemote
), origRemote
.getSocklen());
481 res
= sendfromto(origFD
, response
, responseLen
, 0, origDest
, origRemote
);
485 vinfolog("Error sending response to %s: %s", origRemote
.toStringWithPort(), stringerror(err
));
493 int pickBackendSocketForSending(std::shared_ptr
<DownstreamState
>& state
)
495 return state
->sockets
[state
->socketsOffset
++ % state
->sockets
.size()];
498 static void pickBackendSocketsReadyForReceiving(const std::shared_ptr
<DownstreamState
>& state
, std::vector
<int>& ready
)
502 if (state
->sockets
.size() == 1) {
503 ready
.push_back(state
->sockets
[0]);
508 std::lock_guard
<std::mutex
> lock(state
->socketsLock
);
509 state
->mplexer
->getAvailableFDs(ready
, -1);
513 // listens on a dedicated socket, lobs answers from downstream servers to original requestors
514 void responderThread(std::shared_ptr
<DownstreamState
> dss
)
516 setThreadName("dnsdist/respond");
517 auto localRespRulactions
= g_resprulactions
.getLocal();
518 char packet
[s_maxPacketCacheEntrySize
+ DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE
];
519 static_assert(sizeof(packet
) <= UINT16_MAX
, "Packet size should fit in a uint16_t");
520 /* when the answer is encrypted in place, we need to get a copy
521 of the original header before encryption to fill the ring buffer */
522 dnsheader cleartextDH
;
523 vector
<uint8_t> rewrittenResponse
;
525 uint16_t queryId
= 0;
526 std::vector
<int> sockets
;
527 sockets
.reserve(dss
->sockets
.size());
530 dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(packet
);
532 pickBackendSocketsReadyForReceiving(dss
, sockets
);
533 for (const auto& fd
: sockets
) {
534 ssize_t got
= recv(fd
, packet
, sizeof(packet
), 0);
535 char * response
= packet
;
536 size_t responseSize
= sizeof(packet
);
538 if (got
< 0 || static_cast<size_t>(got
) < sizeof(dnsheader
))
541 uint16_t responseLen
= static_cast<uint16_t>(got
);
544 if(queryId
>= dss
->idStates
.size()) {
548 IDState
* ids
= &dss
->idStates
[queryId
];
549 int64_t usageIndicator
= ids
->usageIndicator
;
551 if(!IDState::isInUse(usageIndicator
)) {
552 /* the corresponding state is marked as not in use, meaning that:
553 - it was already cleaned up by another thread and the state is gone ;
554 - we already got a response for this query and this one is a duplicate.
555 Either way, we don't touch it.
560 /* read the potential DOHUnit state as soon as possible, but don't use it
561 until we have confirmed that we own this state by updating usageIndicator */
563 /* setting age to 0 to prevent the maintainer thread from
564 cleaning this IDS while we process the response.
567 int origFD
= ids
->origFD
;
569 unsigned int consumed
= 0;
570 if (!responseContentMatches(response
, responseLen
, ids
->qname
, ids
->qtype
, ids
->qclass
, dss
->remote
, consumed
)) {
574 bool isDoH
= du
!= nullptr;
575 /* atomically mark the state as available, but only if it has not been altered
577 if (ids
->tryMarkUnused(usageIndicator
)) {
578 /* clear the potential DOHUnit asap, it's ours now
579 and since we just marked the state as unused,
580 someone could overwrite it. */
582 /* we only decrement the outstanding counter if the value was not
583 altered in the meantime, which would mean that the state has been actively reused
584 and the other thread has not incremented the outstanding counter, so we don't
585 want it to be decremented twice. */
586 --dss
->outstanding
; // you'd think an attacker could game this, but we're using connected socket
588 /* someone updated the state in the meantime, we can't touch the existing pointer */
590 /* since the state has been updated, we can't safely access it so let's just drop
595 if(dh
->tc
&& g_truncateTC
) {
596 truncateTC(response
, &responseLen
, responseSize
, consumed
);
599 dh
->id
= ids
->origID
;
601 uint16_t addRoom
= 0;
602 DNSResponse dr
= makeDNSResponseFromIDState(*ids
, dh
, sizeof(packet
), responseLen
, false);
603 if (dr
.dnsCryptQuery
) {
604 addRoom
= DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE
;
607 memcpy(&cleartextDH
, dr
.dh
, sizeof(cleartextDH
));
608 if (!processResponse(&response
, &responseLen
, &responseSize
, localRespRulactions
, dr
, addRoom
, rewrittenResponse
, ids
->cs
&& ids
->cs
->muted
)) {
612 if (ids
->cs
&& !ids
->cs
->muted
) {
614 #ifdef HAVE_DNS_OVER_HTTPS
616 du
->response
= std::string(response
, responseLen
);
617 if (send(du
->rsock
, &du
, sizeof(du
), 0) != sizeof(du
)) {
618 /* at this point we have the only remaining pointer on this
619 DOHUnit object since we did set ids->du to nullptr earlier */
622 #endif /* HAVE_DNS_OVER_HTTPS */
627 empty
.sin4
.sin_family
= 0;
628 /* if ids->destHarvested is false, origDest holds the listening address.
629 We don't want to use that as a source since it could be 0.0.0.0 for example. */
630 sendUDPResponse(origFD
, response
, responseLen
, dr
.delayMsec
, ids
->destHarvested
? ids
->origDest
: empty
, ids
->origRemote
);
635 ++ids
->cs
->responses
;
638 double udiff
= ids
->sentTime
.udiff();
639 vinfolog("Got answer from %s, relayed to %s%s, took %f usec", dss
->remote
.toStringWithPort(), ids
->origRemote
.toStringWithPort(),
640 isDoH
? " (https)": "", udiff
);
644 g_rings
.insertResponse(ts
, *dr
.remote
, *dr
.qname
, dr
.qtype
, static_cast<unsigned int>(udiff
), static_cast<unsigned int>(got
), cleartextDH
, dss
->remote
);
646 switch (cleartextDH
.rcode
) {
647 case RCode::NXDomain
:
648 ++g_stats
.frontendNXDomain
;
650 case RCode::ServFail
:
651 ++g_stats
.servfailResponses
;
652 ++g_stats
.frontendServFail
;
655 ++g_stats
.frontendNoError
;
658 dss
->latencyUsec
= (127.0 * dss
->latencyUsec
/ 128.0) + udiff
/128.0;
660 doLatencyStats(udiff
);
662 rewrittenResponse
.clear();
665 catch(const std::exception
& e
){
666 vinfolog("Got an error in UDP responder thread while parsing a response from %s, id %d: %s", dss
->remote
.toStringWithPort(), queryId
, e
.what());
670 catch(const std::exception
& e
)
672 errlog("UDP responder thread died because of exception: %s", e
.what());
674 catch(const PDNSException
& e
)
676 errlog("UDP responder thread died because of PowerDNS exception: %s", e
.reason
);
680 errlog("UDP responder thread died because of an exception: %s", "unknown");
683 bool DownstreamState::reconnect()
685 std::unique_lock
<std::mutex
> tl(connectLock
, std::try_to_lock
);
686 if (!tl
.owns_lock()) {
687 /* we are already reconnecting */
692 for (auto& fd
: sockets
) {
694 if (sockets
.size() > 1) {
695 std::lock_guard
<std::mutex
> lock(socketsLock
);
696 mplexer
->removeReadFD(fd
);
698 /* shutdown() is needed to wake up recv() in the responderThread */
699 shutdown(fd
, SHUT_RDWR
);
703 if (!IsAnyAddress(remote
)) {
704 fd
= SSocket(remote
.sin4
.sin_family
, SOCK_DGRAM
, 0);
705 if (!IsAnyAddress(sourceAddr
)) {
706 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEADDR
, 1);
707 if (!sourceItfName
.empty()) {
708 #ifdef SO_BINDTODEVICE
709 int res
= setsockopt(fd
, SOL_SOCKET
, SO_BINDTODEVICE
, sourceItfName
.c_str(), sourceItfName
.length());
711 infolog("Error setting up the interface on backend socket '%s': %s", remote
.toStringWithPort(), stringerror());
716 SBind(fd
, sourceAddr
);
719 SConnect(fd
, remote
);
720 if (sockets
.size() > 1) {
721 std::lock_guard
<std::mutex
> lock(socketsLock
);
722 mplexer
->addReadFD(fd
, [](int, boost::any
) {});
726 catch(const std::runtime_error
& error
) {
727 infolog("Error connecting to new server with address %s: %s", remote
.toStringWithPort(), error
.what());
734 /* if at least one (re-)connection failed, close all sockets */
736 for (auto& fd
: sockets
) {
738 if (sockets
.size() > 1) {
739 std::lock_guard
<std::mutex
> lock(socketsLock
);
740 mplexer
->removeReadFD(fd
);
742 /* shutdown() is needed to wake up recv() in the responderThread */
743 shutdown(fd
, SHUT_RDWR
);
752 void DownstreamState::hash()
754 vinfolog("Computing hashes for id=%s and weight=%d", id
, weight
);
756 WriteLock
wl(&d_lock
);
759 std::string uuid
= boost::str(boost::format("%s-%d") % id
% w
);
760 unsigned int wshash
= burtleCI((const unsigned char*)uuid
.c_str(), uuid
.size(), g_hashperturb
);
761 hashes
.insert(wshash
);
766 void DownstreamState::setId(const boost::uuids::uuid
& newId
)
769 // compute hashes only if already done
770 if (!hashes
.empty()) {
775 void DownstreamState::setWeight(int newWeight
)
778 errlog("Error setting server's weight: downstream weight value must be greater than 0.");
782 if (!hashes
.empty()) {
787 DownstreamState::DownstreamState(const ComboAddress
& remote_
, const ComboAddress
& sourceAddr_
, unsigned int sourceItf_
, const std::string
& sourceItfName_
, size_t numberOfSockets
): sourceItfName(sourceItfName_
), remote(remote_
), sourceAddr(sourceAddr_
), sourceItf(sourceItf_
)
789 pthread_rwlock_init(&d_lock
, nullptr);
791 threadStarted
.clear();
793 mplexer
= std::unique_ptr
<FDMultiplexer
>(FDMultiplexer::getMultiplexerSilent());
795 sockets
.resize(numberOfSockets
);
796 for (auto& fd
: sockets
) {
800 if (!IsAnyAddress(remote
)) {
802 idStates
.resize(g_maxOutstanding
);
804 infolog("Added downstream server %s", remote
.toStringWithPort());
809 std::mutex g_luamutex
;
812 GlobalStateHolder
<ServerPolicy
> g_policy
;
814 shared_ptr
<DownstreamState
> firstAvailable(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
816 for(auto& d
: servers
) {
817 if(d
.second
->isUp() && d
.second
->qps
.check())
820 return leastOutstanding(servers
, dq
);
823 // get server with least outstanding queries, and within those, with the lowest order, and within those: the fastest
824 shared_ptr
<DownstreamState
> leastOutstanding(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
826 if (servers
.size() == 1 && servers
[0].second
->isUp()) {
827 return servers
[0].second
;
830 vector
<pair
<tuple
<int,int,double>, shared_ptr
<DownstreamState
>>> poss
;
831 /* so you might wonder, why do we go through this trouble? The data on which we sort could change during the sort,
832 which would suck royally and could even lead to crashes. So first we snapshot on what we sort, and then we sort */
833 poss
.reserve(servers
.size());
834 for(auto& d
: servers
) {
835 if(d
.second
->isUp()) {
836 poss
.push_back({make_tuple(d
.second
->outstanding
.load(), d
.second
->order
, d
.second
->latencyUsec
), d
.second
});
840 return shared_ptr
<DownstreamState
>();
841 nth_element(poss
.begin(), poss
.begin(), poss
.end(), [](const decltype(poss
)::value_type
& a
, const decltype(poss
)::value_type
& b
) { return a
.first
< b
.first
; });
842 return poss
.begin()->second
;
845 shared_ptr
<DownstreamState
> valrandom(unsigned int val
, const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
847 vector
<pair
<int, shared_ptr
<DownstreamState
>>> poss
;
849 int max
= std::numeric_limits
<int>::max();
851 for(auto& d
: servers
) { // w=1, w=10 -> 1, 11
852 if(d
.second
->isUp()) {
853 // Don't overflow sum when adding high weights
854 if(d
.second
->weight
> max
- sum
) {
857 sum
+= d
.second
->weight
;
860 poss
.push_back({sum
, d
.second
});
864 // Catch poss & sum are empty to avoid SIGFPE
866 return shared_ptr
<DownstreamState
>();
869 auto p
= upper_bound(poss
.begin(), poss
.end(),r
, [](int r_
, const decltype(poss
)::value_type
& a
) { return r_
< a
.first
;});
871 return shared_ptr
<DownstreamState
>();
875 shared_ptr
<DownstreamState
> wrandom(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
877 return valrandom(random(), servers
, dq
);
880 uint32_t g_hashperturb
;
881 shared_ptr
<DownstreamState
> whashed(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
883 return valrandom(dq
->qname
->hash(g_hashperturb
), servers
, dq
);
886 shared_ptr
<DownstreamState
> chashed(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
888 unsigned int qhash
= dq
->qname
->hash(g_hashperturb
);
889 unsigned int sel
= std::numeric_limits
<unsigned int>::max();
890 unsigned int min
= std::numeric_limits
<unsigned int>::max();
891 shared_ptr
<DownstreamState
> ret
= nullptr, first
= nullptr;
893 for (const auto& d
: servers
) {
894 if (d
.second
->isUp()) {
895 // make sure hashes have been computed
896 if (d
.second
->hashes
.empty()) {
900 ReadLock
rl(&(d
.second
->d_lock
));
901 const auto& server
= d
.second
;
902 // we want to keep track of the last hash
903 if (min
> *(server
->hashes
.begin())) {
904 min
= *(server
->hashes
.begin());
908 auto hash_it
= server
->hashes
.lower_bound(qhash
);
909 if (hash_it
!= server
->hashes
.end()) {
910 if (*hash_it
< sel
) {
918 if (ret
!= nullptr) {
921 if (first
!= nullptr) {
924 return shared_ptr
<DownstreamState
>();
927 shared_ptr
<DownstreamState
> roundrobin(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
929 NumberedServerVector poss
;
931 for(auto& d
: servers
) {
932 if(d
.second
->isUp()) {
937 const auto *res
=&poss
;
938 if(poss
.empty() && !g_roundrobinFailOnNoServer
)
942 return shared_ptr
<DownstreamState
>();
944 static unsigned int counter
;
946 return (*res
)[(counter
++) % res
->size()].second
;
949 ComboAddress g_serverControl
{"127.0.0.1:5199"};
951 std::shared_ptr
<ServerPool
> createPoolIfNotExists(pools_t
& pools
, const string
& poolName
)
953 std::shared_ptr
<ServerPool
> pool
;
954 pools_t::iterator it
= pools
.find(poolName
);
955 if (it
!= pools
.end()) {
959 if (!poolName
.empty())
960 vinfolog("Creating pool %s", poolName
);
961 pool
= std::make_shared
<ServerPool
>();
962 pools
.insert(std::pair
<std::string
,std::shared_ptr
<ServerPool
> >(poolName
, pool
));
967 void setPoolPolicy(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<ServerPolicy
> policy
)
969 std::shared_ptr
<ServerPool
> pool
= createPoolIfNotExists(pools
, poolName
);
970 if (!poolName
.empty()) {
971 vinfolog("Setting pool %s server selection policy to %s", poolName
, policy
->name
);
973 vinfolog("Setting default pool server selection policy to %s", policy
->name
);
975 pool
->policy
= policy
;
978 void addServerToPool(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<DownstreamState
> server
)
980 std::shared_ptr
<ServerPool
> pool
= createPoolIfNotExists(pools
, poolName
);
981 if (!poolName
.empty()) {
982 vinfolog("Adding server to pool %s", poolName
);
984 vinfolog("Adding server to default pool");
986 pool
->addServer(server
);
989 void removeServerFromPool(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<DownstreamState
> server
)
991 std::shared_ptr
<ServerPool
> pool
= getPool(pools
, poolName
);
993 if (!poolName
.empty()) {
994 vinfolog("Removing server from pool %s", poolName
);
997 vinfolog("Removing server from default pool");
1000 pool
->removeServer(server
);
1003 std::shared_ptr
<ServerPool
> getPool(const pools_t
& pools
, const std::string
& poolName
)
1005 pools_t::const_iterator it
= pools
.find(poolName
);
1007 if (it
== pools
.end()) {
1008 throw std::out_of_range("No pool named " + poolName
);
1014 NumberedServerVector
getDownstreamCandidates(const pools_t
& pools
, const std::string
& poolName
)
1016 std::shared_ptr
<ServerPool
> pool
= getPool(pools
, poolName
);
1017 return pool
->getServers();
1020 static void spoofResponseFromString(DNSQuestion
& dq
, const string
& spoofContent
)
1024 std::vector
<std::string
> addrs
;
1025 stringtok(addrs
, spoofContent
, " ,");
1027 if (addrs
.size() == 1) {
1029 ComboAddress
spoofAddr(spoofContent
);
1030 SpoofAction
sa({spoofAddr
});
1033 catch(const PDNSException
&e
) {
1034 SpoofAction
sa(spoofContent
); // CNAME then
1038 std::vector
<ComboAddress
> cas
;
1039 for (const auto& addr
: addrs
) {
1041 cas
.push_back(ComboAddress(addr
));
1046 SpoofAction
sa(cas
);
1051 bool processRulesResult(const DNSAction::Action
& action
, DNSQuestion
& dq
, std::string
& ruleresult
, bool& drop
)
1054 case DNSAction::Action::Allow
:
1057 case DNSAction::Action::Drop
:
1062 case DNSAction::Action::Nxdomain
:
1063 dq
.dh
->rcode
= RCode::NXDomain
;
1065 ++g_stats
.ruleNXDomain
;
1068 case DNSAction::Action::Refused
:
1069 dq
.dh
->rcode
= RCode::Refused
;
1071 ++g_stats
.ruleRefused
;
1074 case DNSAction::Action::ServFail
:
1075 dq
.dh
->rcode
= RCode::ServFail
;
1077 ++g_stats
.ruleServFail
;
1080 case DNSAction::Action::Spoof
:
1081 spoofResponseFromString(dq
, ruleresult
);
1084 case DNSAction::Action::Truncate
:
1089 case DNSAction::Action::HeaderModify
:
1092 case DNSAction::Action::Pool
:
1093 dq
.poolname
=ruleresult
;
1096 case DNSAction::Action::NoRecurse
:
1100 /* non-terminal actions follow */
1101 case DNSAction::Action::Delay
:
1102 dq
.delayMsec
= static_cast<int>(pdns_stou(ruleresult
)); // sorry
1104 case DNSAction::Action::None
:
1106 case DNSAction::Action::NoOp
:
1110 /* false means that we don't stop the processing */
1115 static bool applyRulesToQuery(LocalHolders
& holders
, DNSQuestion
& dq
, const struct timespec
& now
)
1117 g_rings
.insertQuery(now
, *dq
.remote
, *dq
.qname
, dq
.qtype
, dq
.len
, *dq
.dh
);
1119 if(g_qcount
.enabled
) {
1120 string qname
= (*dq
.qname
).toLogString();
1121 bool countQuery
{true};
1122 if(g_qcount
.filter
) {
1123 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1124 std::tie (countQuery
, qname
) = g_qcount
.filter(&dq
);
1128 WriteLock
wl(&g_qcount
.queryLock
);
1129 if(!g_qcount
.records
.count(qname
)) {
1130 g_qcount
.records
[qname
] = 0;
1132 g_qcount
.records
[qname
]++;
1136 if(auto got
= holders
.dynNMGBlock
->lookup(*dq
.remote
)) {
1137 auto updateBlockStats
= [&got
]() {
1138 ++g_stats
.dynBlocked
;
1139 got
->second
.blocks
++;
1142 if(now
< got
->second
.until
) {
1143 DNSAction::Action action
= got
->second
.action
;
1144 if (action
== DNSAction::Action::None
) {
1145 action
= g_dynBlockAction
;
1148 case DNSAction::Action::NoOp
:
1152 case DNSAction::Action::Nxdomain
:
1153 vinfolog("Query from %s turned into NXDomain because of dynamic block", dq
.remote
->toStringWithPort());
1156 dq
.dh
->rcode
= RCode::NXDomain
;
1160 case DNSAction::Action::Refused
:
1161 vinfolog("Query from %s refused because of dynamic block", dq
.remote
->toStringWithPort());
1164 dq
.dh
->rcode
= RCode::Refused
;
1168 case DNSAction::Action::Truncate
:
1171 vinfolog("Query from %s truncated because of dynamic block", dq
.remote
->toStringWithPort());
1177 vinfolog("Query from %s for %s over TCP *not* truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1180 case DNSAction::Action::NoRecurse
:
1182 vinfolog("Query from %s setting rd=0 because of dynamic block", dq
.remote
->toStringWithPort());
1187 vinfolog("Query from %s dropped because of dynamic block", dq
.remote
->toStringWithPort());
1193 if(auto got
= holders
.dynSMTBlock
->lookup(*dq
.qname
)) {
1194 auto updateBlockStats
= [&got
]() {
1195 ++g_stats
.dynBlocked
;
1199 if(now
< got
->until
) {
1200 DNSAction::Action action
= got
->action
;
1201 if (action
== DNSAction::Action::None
) {
1202 action
= g_dynBlockAction
;
1205 case DNSAction::Action::NoOp
:
1208 case DNSAction::Action::Nxdomain
:
1209 vinfolog("Query from %s for %s turned into NXDomain because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1212 dq
.dh
->rcode
= RCode::NXDomain
;
1215 case DNSAction::Action::Refused
:
1216 vinfolog("Query from %s for %s refused because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1219 dq
.dh
->rcode
= RCode::Refused
;
1222 case DNSAction::Action::Truncate
:
1226 vinfolog("Query from %s for %s truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1232 vinfolog("Query from %s for %s over TCP *not* truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1235 case DNSAction::Action::NoRecurse
:
1237 vinfolog("Query from %s setting rd=0 because of dynamic block", dq
.remote
->toStringWithPort());
1242 vinfolog("Query from %s for %s dropped because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1248 DNSAction::Action action
=DNSAction::Action::None
;
1251 for(const auto& lr
: *holders
.rulactions
) {
1252 if(lr
.d_rule
->matches(&dq
)) {
1253 lr
.d_rule
->d_matches
++;
1254 action
=(*lr
.d_action
)(&dq
, &ruleresult
);
1255 if (processRulesResult(action
, dq
, ruleresult
, drop
)) {
1268 ssize_t
udpClientSendRequestToBackend(const std::shared_ptr
<DownstreamState
>& ss
, const int sd
, const char* request
, const size_t requestLen
, bool healthCheck
)
1272 if (ss
->sourceItf
== 0) {
1273 result
= send(sd
, request
, requestLen
, 0);
1278 cmsgbuf_aligned cbuf
;
1279 ComboAddress
remote(ss
->remote
);
1280 fillMSGHdr(&msgh
, &iov
, &cbuf
, sizeof(cbuf
), const_cast<char*>(request
), requestLen
, &remote
);
1281 addCMsgSrcAddr(&msgh
, &cbuf
, &ss
->sourceAddr
, ss
->sourceItf
);
1282 result
= sendmsg(sd
, &msgh
, 0);
1286 int savederrno
= errno
;
1287 vinfolog("Error sending request to backend %s: %d", ss
->remote
.toStringWithPort(), savederrno
);
1289 /* This might sound silly, but on Linux send() might fail with EINVAL
1290 if the interface the socket was bound to doesn't exist anymore.
1291 We don't want to reconnect the real socket if the healthcheck failed,
1292 because it's not using the same socket.
1294 if (!healthCheck
&& (savederrno
== EINVAL
|| savederrno
== ENODEV
)) {
1302 static bool isUDPQueryAcceptable(ClientState
& cs
, LocalHolders
& holders
, const struct msghdr
* msgh
, const ComboAddress
& remote
, ComboAddress
& dest
)
1304 if (msgh
->msg_flags
& MSG_TRUNC
) {
1305 /* message was too large for our buffer */
1306 vinfolog("Dropping message too large for our buffer");
1307 ++g_stats
.nonCompliantQueries
;
1311 if(!holders
.acl
->match(remote
)) {
1312 vinfolog("Query from %s dropped because of ACL", remote
.toStringWithPort());
1320 if (HarvestDestinationAddress(msgh
, &dest
)) {
1321 /* we don't get the port, only the address */
1322 dest
.sin4
.sin_port
= cs
.local
.sin4
.sin_port
;
1325 dest
.sin4
.sin_family
= 0;
1331 boost::optional
<std::vector
<uint8_t>> checkDNSCryptQuery(const ClientState
& cs
, const char* query
, uint16_t& len
, std::shared_ptr
<DNSCryptQuery
>& dnsCryptQuery
, time_t now
, bool tcp
)
1333 if (cs
.dnscryptCtx
) {
1334 #ifdef HAVE_DNSCRYPT
1335 vector
<uint8_t> response
;
1336 uint16_t decryptedQueryLen
= 0;
1338 dnsCryptQuery
= std::make_shared
<DNSCryptQuery
>(cs
.dnscryptCtx
);
1340 bool decrypted
= handleDNSCryptQuery(const_cast<char*>(query
), len
, dnsCryptQuery
, &decryptedQueryLen
, tcp
, now
, response
);
1343 if (response
.size() > 0) {
1346 throw std::runtime_error("Unable to decrypt DNSCrypt query, dropping.");
1349 len
= decryptedQueryLen
;
1350 #endif /* HAVE_DNSCRYPT */
1355 bool checkQueryHeaders(const struct dnsheader
* dh
)
1357 if (dh
->qr
) { // don't respond to responses
1358 ++g_stats
.nonCompliantQueries
;
1362 if (dh
->qdcount
== 0) {
1363 ++g_stats
.emptyQueries
;
1368 ++g_stats
.rdQueries
;
1374 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1375 static void queueResponse(const ClientState
& cs
, const char* response
, uint16_t responseLen
, const ComboAddress
& dest
, const ComboAddress
& remote
, struct mmsghdr
& outMsg
, struct iovec
* iov
, cmsgbuf_aligned
* cbuf
)
1378 fillMSGHdr(&outMsg
.msg_hdr
, iov
, nullptr, 0, const_cast<char*>(response
), responseLen
, const_cast<ComboAddress
*>(&remote
));
1380 if (dest
.sin4
.sin_family
== 0) {
1381 outMsg
.msg_hdr
.msg_control
= nullptr;
1384 addCMsgSrcAddr(&outMsg
.msg_hdr
, cbuf
, &dest
, 0);
1387 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1389 /* self-generated responses or cache hits */
1390 static bool prepareOutgoingResponse(LocalHolders
& holders
, ClientState
& cs
, DNSQuestion
& dq
, bool cacheHit
)
1392 DNSResponse
dr(dq
.qname
, dq
.qtype
, dq
.qclass
, dq
.consumed
, dq
.local
, dq
.remote
, reinterpret_cast<dnsheader
*>(dq
.dh
), dq
.size
, dq
.len
, dq
.tcp
, dq
.queryTime
);
1394 #ifdef HAVE_PROTOBUF
1395 dr
.uniqueId
= dq
.uniqueId
;
1398 dr
.delayMsec
= dq
.delayMsec
;
1400 if (!applyRulesToResponse(cacheHit
? holders
.cacheHitRespRulactions
: holders
.selfAnsweredRespRulactions
, dr
)) {
1404 /* in case a rule changed it */
1405 dq
.delayMsec
= dr
.delayMsec
;
1407 #ifdef HAVE_DNSCRYPT
1409 if (!encryptResponse(reinterpret_cast<char*>(dq
.dh
), &dq
.len
, dq
.size
, dq
.tcp
, dq
.dnsCryptQuery
, nullptr, nullptr)) {
1413 #endif /* HAVE_DNSCRYPT */
1416 ++g_stats
.cacheHits
;
1419 switch (dr
.dh
->rcode
) {
1420 case RCode::NXDomain
:
1421 ++g_stats
.frontendNXDomain
;
1423 case RCode::ServFail
:
1424 ++g_stats
.frontendServFail
;
1426 case RCode::NoError
:
1427 ++g_stats
.frontendNoError
;
1431 doLatencyStats(0); // we're not going to measure this
1435 ProcessQueryResult
processQuery(DNSQuestion
& dq
, ClientState
& cs
, LocalHolders
& holders
, std::shared_ptr
<DownstreamState
>& selectedBackend
)
1437 const uint16_t queryId
= ntohs(dq
.dh
->id
);
1440 /* we need an accurate ("real") value for the response and
1441 to store into the IDS, but not for insertion into the
1442 rings for example */
1443 struct timespec now
;
1446 if (!applyRulesToQuery(holders
, dq
, now
)) {
1447 return ProcessQueryResult::Drop
;
1450 if(dq
.dh
->qr
) { // something turned it into a response
1451 fixUpQueryTurnedResponse(dq
, dq
.origFlags
);
1453 if (!prepareOutgoingResponse(holders
, cs
, dq
, false)) {
1454 return ProcessQueryResult::Drop
;
1457 ++g_stats
.selfAnswered
;
1459 return ProcessQueryResult::SendAnswer
;
1462 std::shared_ptr
<ServerPool
> serverPool
= getPool(*holders
.pools
, dq
.poolname
);
1463 dq
.packetCache
= serverPool
->packetCache
;
1464 auto policy
= *(holders
.policy
);
1465 if (serverPool
->policy
!= nullptr) {
1466 policy
= *(serverPool
->policy
);
1468 auto servers
= serverPool
->getServers();
1470 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1471 selectedBackend
= policy
.policy(servers
, &dq
);
1474 selectedBackend
= policy
.policy(servers
, &dq
);
1477 uint16_t cachedResponseSize
= dq
.size
;
1478 uint32_t allowExpired
= selectedBackend
? 0 : g_staleCacheEntriesTTL
;
1480 if (dq
.packetCache
&& !dq
.skipCache
) {
1481 dq
.dnssecOK
= (getEDNSZ(dq
) & EDNS_HEADER_FLAG_DO
);
1484 if (dq
.useECS
&& ((selectedBackend
&& selectedBackend
->useECS
) || (!selectedBackend
&& serverPool
->getECS()))) {
1485 // we special case our cache in case a downstream explicitly gave us a universally valid response with a 0 scope
1486 if (dq
.packetCache
&& !dq
.skipCache
&& (!selectedBackend
|| !selectedBackend
->disableZeroScope
) && dq
.packetCache
->isECSParsingEnabled()) {
1487 if (dq
.packetCache
->get(dq
, dq
.consumed
, dq
.dh
->id
, reinterpret_cast<char*>(dq
.dh
), &cachedResponseSize
, &dq
.cacheKeyNoECS
, dq
.subnet
, dq
.dnssecOK
, allowExpired
)) {
1488 dq
.len
= cachedResponseSize
;
1490 if (!prepareOutgoingResponse(holders
, cs
, dq
, true)) {
1491 return ProcessQueryResult::Drop
;
1494 return ProcessQueryResult::SendAnswer
;
1498 /* there was no existing ECS on the query, enable the zero-scope feature */
1499 dq
.useZeroScope
= true;
1503 if (!handleEDNSClientSubnet(dq
, &(dq
.ednsAdded
), &(dq
.ecsAdded
), g_preserveTrailingData
)) {
1504 vinfolog("Dropping query from %s because we couldn't insert the ECS value", dq
.remote
->toStringWithPort());
1505 return ProcessQueryResult::Drop
;
1509 if (dq
.packetCache
&& !dq
.skipCache
) {
1510 if (dq
.packetCache
->get(dq
, dq
.consumed
, dq
.dh
->id
, reinterpret_cast<char*>(dq
.dh
), &cachedResponseSize
, &dq
.cacheKey
, dq
.subnet
, dq
.dnssecOK
, allowExpired
)) {
1511 dq
.len
= cachedResponseSize
;
1513 if (!prepareOutgoingResponse(holders
, cs
, dq
, true)) {
1514 return ProcessQueryResult::Drop
;
1517 return ProcessQueryResult::SendAnswer
;
1519 ++g_stats
.cacheMisses
;
1522 if(!selectedBackend
) {
1525 vinfolog("%s query for %s|%s from %s, no policy applied", g_servFailOnNoPolicy
? "ServFailed" : "Dropped", dq
.qname
->toLogString(), QType(dq
.qtype
).getName(), dq
.remote
->toStringWithPort());
1526 if (g_servFailOnNoPolicy
) {
1527 restoreFlags(dq
.dh
, dq
.origFlags
);
1529 dq
.dh
->rcode
= RCode::ServFail
;
1532 if (!prepareOutgoingResponse(holders
, cs
, dq
, false)) {
1533 return ProcessQueryResult::Drop
;
1535 // no response-only statistics counter to update.
1536 return ProcessQueryResult::SendAnswer
;
1539 return ProcessQueryResult::Drop
;
1542 if (dq
.addXPF
&& selectedBackend
->xpfRRCode
!= 0) {
1543 addXPF(dq
, selectedBackend
->xpfRRCode
, g_preserveTrailingData
);
1546 selectedBackend
->queries
++;
1547 return ProcessQueryResult::PassToBackend
;
1549 catch(const std::exception
& e
){
1550 vinfolog("Got an error while parsing a %s query from %s, id %d: %s", (dq
.tcp
? "TCP" : "UDP"), dq
.remote
->toStringWithPort(), queryId
, e
.what());
1552 return ProcessQueryResult::Drop
;
1555 static void processUDPQuery(ClientState
& cs
, LocalHolders
& holders
, const struct msghdr
* msgh
, const ComboAddress
& remote
, ComboAddress
& dest
, char* query
, uint16_t len
, size_t queryBufferSize
, struct mmsghdr
* responsesVect
, unsigned int* queuedResponses
, struct iovec
* respIOV
, cmsgbuf_aligned
* respCBuf
)
1557 assert(responsesVect
== nullptr || (queuedResponses
!= nullptr && respIOV
!= nullptr && respCBuf
!= nullptr));
1558 uint16_t queryId
= 0;
1561 if (!isUDPQueryAcceptable(cs
, holders
, msgh
, remote
, dest
)) {
1565 /* we need an accurate ("real") value for the response and
1566 to store into the IDS, but not for insertion into the
1567 rings for example */
1568 struct timespec queryRealTime
;
1569 gettime(&queryRealTime
, true);
1571 std::shared_ptr
<DNSCryptQuery
> dnsCryptQuery
= nullptr;
1572 auto dnsCryptResponse
= checkDNSCryptQuery(cs
, query
, len
, dnsCryptQuery
, queryRealTime
.tv_sec
, false);
1573 if (dnsCryptResponse
) {
1574 sendUDPResponse(cs
.udpFD
, reinterpret_cast<char*>(dnsCryptResponse
->data()), static_cast<uint16_t>(dnsCryptResponse
->size()), 0, dest
, remote
);
1578 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(query
);
1579 queryId
= ntohs(dh
->id
);
1581 if (!checkQueryHeaders(dh
)) {
1585 uint16_t qtype
, qclass
;
1586 unsigned int consumed
= 0;
1587 DNSName
qname(query
, len
, sizeof(dnsheader
), false, &qtype
, &qclass
, &consumed
);
1588 DNSQuestion
dq(&qname
, qtype
, qclass
, consumed
, dest
.sin4
.sin_family
!= 0 ? &dest
: &cs
.local
, &remote
, dh
, queryBufferSize
, len
, false, &queryRealTime
);
1589 dq
.dnsCryptQuery
= std::move(dnsCryptQuery
);
1590 std::shared_ptr
<DownstreamState
> ss
{nullptr};
1591 auto result
= processQuery(dq
, cs
, holders
, ss
);
1593 if (result
== ProcessQueryResult::Drop
) {
1597 if (result
== ProcessQueryResult::SendAnswer
) {
1598 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1599 if (dq
.delayMsec
== 0 && responsesVect
!= nullptr) {
1600 queueResponse(cs
, reinterpret_cast<char*>(dq
.dh
), dq
.len
, *dq
.local
, *dq
.remote
, responsesVect
[*queuedResponses
], respIOV
, respCBuf
);
1601 (*queuedResponses
)++;
1604 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1605 /* we use dest, always, because we don't want to use the listening address to send a response since it could be 0.0.0.0 */
1606 sendUDPResponse(cs
.udpFD
, reinterpret_cast<char*>(dq
.dh
), dq
.len
, dq
.delayMsec
, dest
, *dq
.remote
);
1610 if (result
!= ProcessQueryResult::PassToBackend
|| ss
== nullptr) {
1614 unsigned int idOffset
= (ss
->idOffset
++) % ss
->idStates
.size();
1615 IDState
* ids
= &ss
->idStates
[idOffset
];
1617 DOHUnit
* du
= nullptr;
1619 /* that means that the state was in use, possibly with an allocated
1620 DOHUnit that we will need to handle, but we can't touch it before
1621 confirming that we now own this state */
1622 if (ids
->isInUse()) {
1626 /* we atomically replace the value, we now own this state */
1627 if (!ids
->markAsUsed()) {
1628 /* the state was not in use.
1629 we reset 'du' because it might have still been in use when we read it. */
1634 /* we are reusing a state, no change in outstanding but if there was an existing DOHUnit we need
1635 to handle it because it's about to be overwritten. */
1638 ++g_stats
.downstreamTimeouts
;
1639 handleDOHTimeout(du
);
1643 ids
->origFD
= cs
.udpFD
;
1644 ids
->origID
= dh
->id
;
1645 setIDStateFromDNSQuestion(*ids
, dq
, std::move(qname
));
1647 /* If we couldn't harvest the real dest addr, still
1648 write down the listening addr since it will be useful
1649 (especially if it's not an 'any' one).
1650 We need to keep track of which one it is since we may
1651 want to use the real but not the listening addr to reply.
1653 if (dest
.sin4
.sin_family
!= 0) {
1654 ids
->origDest
= dest
;
1655 ids
->destHarvested
= true;
1658 ids
->origDest
= cs
.local
;
1659 ids
->destHarvested
= false;
1664 int fd
= pickBackendSocketForSending(ss
);
1665 ssize_t ret
= udpClientSendRequestToBackend(ss
, fd
, query
, dq
.len
);
1669 ++g_stats
.downstreamSendErrors
;
1672 vinfolog("Got query for %s|%s from %s, relayed to %s", ids
->qname
.toLogString(), QType(ids
->qtype
).getName(), remote
.toStringWithPort(), ss
->getName());
1674 catch(const std::exception
& e
){
1675 vinfolog("Got an error in UDP question thread while parsing a query from %s, id %d: %s", remote
.toStringWithPort(), queryId
, e
.what());
1679 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1680 static void MultipleMessagesUDPClientThread(ClientState
* cs
, LocalHolders
& holders
)
1684 char packet
[s_maxPacketCacheEntrySize
];
1685 ComboAddress remote
;
1688 /* used by HarvestDestinationAddress */
1689 cmsgbuf_aligned cbuf
;
1691 const size_t vectSize
= g_udpVectorSize
;
1692 /* the actual buffer is larger because:
1693 - we may have to add EDNS and/or ECS
1694 - we use it for self-generated responses (from rule or cache)
1695 but we only accept incoming payloads up to that size
1697 static_assert(s_udpIncomingBufferSize
<= sizeof(MMReceiver::packet
), "the incoming buffer size should not be larger than sizeof(MMReceiver::packet)");
1699 auto recvData
= std::unique_ptr
<MMReceiver
[]>(new MMReceiver
[vectSize
]);
1700 auto msgVec
= std::unique_ptr
<struct mmsghdr
[]>(new struct mmsghdr
[vectSize
]);
1701 auto outMsgVec
= std::unique_ptr
<struct mmsghdr
[]>(new struct mmsghdr
[vectSize
]);
1703 /* initialize the structures needed to receive our messages */
1704 for (size_t idx
= 0; idx
< vectSize
; idx
++) {
1705 recvData
[idx
].remote
.sin4
.sin_family
= cs
->local
.sin4
.sin_family
;
1706 fillMSGHdr(&msgVec
[idx
].msg_hdr
, &recvData
[idx
].iov
, &recvData
[idx
].cbuf
, sizeof(recvData
[idx
].cbuf
), recvData
[idx
].packet
, s_udpIncomingBufferSize
, &recvData
[idx
].remote
);
1712 /* reset the IO vector, since it's also used to send the vector of responses
1713 to avoid having to copy the data around */
1714 for (size_t idx
= 0; idx
< vectSize
; idx
++) {
1715 recvData
[idx
].iov
.iov_base
= recvData
[idx
].packet
;
1716 recvData
[idx
].iov
.iov_len
= sizeof(recvData
[idx
].packet
);
1719 /* block until we have at least one message ready, but return
1720 as many as possible to save the syscall costs */
1721 int msgsGot
= recvmmsg(cs
->udpFD
, msgVec
.get(), vectSize
, MSG_WAITFORONE
| MSG_TRUNC
, nullptr);
1724 vinfolog("Getting UDP messages via recvmmsg() failed with: %s", stringerror());
1728 unsigned int msgsToSend
= 0;
1730 /* process the received messages */
1731 for (int msgIdx
= 0; msgIdx
< msgsGot
; msgIdx
++) {
1732 const struct msghdr
* msgh
= &msgVec
[msgIdx
].msg_hdr
;
1733 unsigned int got
= msgVec
[msgIdx
].msg_len
;
1734 const ComboAddress
& remote
= recvData
[msgIdx
].remote
;
1736 if (static_cast<size_t>(got
) < sizeof(struct dnsheader
)) {
1737 ++g_stats
.nonCompliantQueries
;
1741 processUDPQuery(*cs
, holders
, msgh
, remote
, recvData
[msgIdx
].dest
, recvData
[msgIdx
].packet
, static_cast<uint16_t>(got
), sizeof(recvData
[msgIdx
].packet
), outMsgVec
.get(), &msgsToSend
, &recvData
[msgIdx
].iov
, &recvData
[msgIdx
].cbuf
);
1745 /* immediate (not delayed or sent to a backend) responses (mostly from a rule, dynamic block
1746 or the cache) can be sent in batch too */
1748 if (msgsToSend
> 0 && msgsToSend
<= static_cast<unsigned int>(msgsGot
)) {
1749 int sent
= sendmmsg(cs
->udpFD
, outMsgVec
.get(), msgsToSend
, 0);
1751 if (sent
< 0 || static_cast<unsigned int>(sent
) != msgsToSend
) {
1752 vinfolog("Error sending responses with sendmmsg() (%d on %u): %s", sent
, msgsToSend
, stringerror());
1758 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1760 // listens to incoming queries, sends out to downstream servers, noting the intended return path
1761 static void udpClientThread(ClientState
* cs
)
1764 setThreadName("dnsdist/udpClie");
1765 LocalHolders holders
;
1767 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1768 if (g_udpVectorSize
> 1) {
1769 MultipleMessagesUDPClientThread(cs
, holders
);
1773 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1775 char packet
[s_maxPacketCacheEntrySize
];
1776 /* the actual buffer is larger because:
1777 - we may have to add EDNS and/or ECS
1778 - we use it for self-generated responses (from rule or cache)
1779 but we only accept incoming payloads up to that size
1781 static_assert(s_udpIncomingBufferSize
<= sizeof(packet
), "the incoming buffer size should not be larger than sizeof(MMReceiver::packet)");
1784 /* used by HarvestDestinationAddress */
1785 cmsgbuf_aligned cbuf
;
1787 ComboAddress remote
;
1789 remote
.sin4
.sin_family
= cs
->local
.sin4
.sin_family
;
1790 fillMSGHdr(&msgh
, &iov
, &cbuf
, sizeof(cbuf
), packet
, s_udpIncomingBufferSize
, &remote
);
1793 ssize_t got
= recvmsg(cs
->udpFD
, &msgh
, 0);
1795 if (got
< 0 || static_cast<size_t>(got
) < sizeof(struct dnsheader
)) {
1796 ++g_stats
.nonCompliantQueries
;
1800 processUDPQuery(*cs
, holders
, &msgh
, remote
, dest
, packet
, static_cast<uint16_t>(got
), sizeof(packet
), nullptr, nullptr, nullptr, nullptr);
1804 catch(const std::exception
&e
)
1806 errlog("UDP client thread died because of exception: %s", e
.what());
1808 catch(const PDNSException
&e
)
1810 errlog("UDP client thread died because of PowerDNS exception: %s", e
.reason
);
1814 errlog("UDP client thread died because of an exception: %s", "unknown");
1817 uint16_t getRandomDNSID()
1819 #ifdef HAVE_LIBSODIUM
1820 return (randombytes_random() % 65536);
1822 return (random() % 65536);
1826 static bool upCheck(const shared_ptr
<DownstreamState
>& ds
)
1829 DNSName checkName
= ds
->checkName
;
1830 uint16_t checkType
= ds
->checkType
.getCode();
1831 uint16_t checkClass
= ds
->checkClass
;
1832 dnsheader checkHeader
;
1833 memset(&checkHeader
, 0, sizeof(checkHeader
));
1835 checkHeader
.qdcount
= htons(1);
1836 checkHeader
.id
= getRandomDNSID();
1838 checkHeader
.rd
= true;
1840 checkHeader
.cd
= true;
1843 if (ds
->checkFunction
) {
1844 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1845 auto ret
= ds
->checkFunction(checkName
, checkType
, checkClass
, &checkHeader
);
1846 checkName
= std::get
<0>(ret
);
1847 checkType
= std::get
<1>(ret
);
1848 checkClass
= std::get
<2>(ret
);
1851 vector
<uint8_t> packet
;
1852 DNSPacketWriter
dpw(packet
, checkName
, checkType
, checkClass
);
1853 dnsheader
* requestHeader
= dpw
.getHeader();
1854 *requestHeader
= checkHeader
;
1856 Socket
sock(ds
->remote
.sin4
.sin_family
, SOCK_DGRAM
);
1857 sock
.setNonBlocking();
1858 if (!IsAnyAddress(ds
->sourceAddr
)) {
1859 sock
.setReuseAddr();
1860 if (!ds
->sourceItfName
.empty()) {
1861 #ifdef SO_BINDTODEVICE
1862 int res
= setsockopt(sock
.getHandle(), SOL_SOCKET
, SO_BINDTODEVICE
, ds
->sourceItfName
.c_str(), ds
->sourceItfName
.length());
1863 if (res
!= 0 && g_verboseHealthChecks
) {
1864 infolog("Error settting SO_BINDTODEVICE on the health check socket for backend '%s': %s", ds
->getNameWithAddr(), stringerror());
1868 sock
.bind(ds
->sourceAddr
);
1870 sock
.connect(ds
->remote
);
1871 ssize_t sent
= udpClientSendRequestToBackend(ds
, sock
.getHandle(), reinterpret_cast<char*>(&packet
[0]), packet
.size(), true);
1874 if (g_verboseHealthChecks
)
1875 infolog("Error while sending a health check query to backend %s: %d", ds
->getNameWithAddr(), ret
);
1879 int ret
= waitForRWData(sock
.getHandle(), true, /* ms to seconds */ ds
->checkTimeout
/ 1000, /* remaining ms to us */ (ds
->checkTimeout
% 1000) * 1000);
1880 if(ret
< 0 || !ret
) { // error, timeout, both are down!
1883 if (g_verboseHealthChecks
)
1884 infolog("Error while waiting for the health check response from backend %s: %d", ds
->getNameWithAddr(), ret
);
1887 if (g_verboseHealthChecks
)
1888 infolog("Timeout while waiting for the health check response from backend %s", ds
->getNameWithAddr());
1895 sock
.recvFrom(reply
, from
);
1897 /* we are using a connected socket but hey.. */
1898 if (from
!= ds
->remote
) {
1899 if (g_verboseHealthChecks
)
1900 infolog("Invalid health check response received from %s, expecting one from %s", from
.toStringWithPort(), ds
->remote
.toStringWithPort());
1904 const dnsheader
* responseHeader
= reinterpret_cast<const dnsheader
*>(reply
.c_str());
1906 if (reply
.size() < sizeof(*responseHeader
)) {
1907 if (g_verboseHealthChecks
)
1908 infolog("Invalid health check response of size %d from backend %s, expecting at least %d", reply
.size(), ds
->getNameWithAddr(), sizeof(*responseHeader
));
1912 if (responseHeader
->id
!= requestHeader
->id
) {
1913 if (g_verboseHealthChecks
)
1914 infolog("Invalid health check response id %d from backend %s, expecting %d", responseHeader
->id
, ds
->getNameWithAddr(), requestHeader
->id
);
1918 if (!responseHeader
->qr
) {
1919 if (g_verboseHealthChecks
)
1920 infolog("Invalid health check response from backend %s, expecting QR to be set", ds
->getNameWithAddr());
1924 if (responseHeader
->rcode
== RCode::ServFail
) {
1925 if (g_verboseHealthChecks
)
1926 infolog("Backend %s responded to health check with ServFail", ds
->getNameWithAddr());
1930 if (ds
->mustResolve
&& (responseHeader
->rcode
== RCode::NXDomain
|| responseHeader
->rcode
== RCode::Refused
)) {
1931 if (g_verboseHealthChecks
)
1932 infolog("Backend %s responded to health check with %s while mustResolve is set", ds
->getNameWithAddr(), responseHeader
->rcode
== RCode::NXDomain
? "NXDomain" : "Refused");
1936 uint16_t receivedType
;
1937 uint16_t receivedClass
;
1938 DNSName
receivedName(reply
.c_str(), reply
.size(), sizeof(dnsheader
), false, &receivedType
, &receivedClass
);
1940 if (receivedName
!= checkName
|| receivedType
!= checkType
|| receivedClass
!= checkClass
) {
1941 if (g_verboseHealthChecks
)
1942 infolog("Backend %s responded to health check with an invalid qname (%s vs %s), qtype (%s vs %s) or qclass (%d vs %d)", ds
->getNameWithAddr(), receivedName
.toLogString(), checkName
.toLogString(), QType(receivedType
).getName(), QType(checkType
).getName(), receivedClass
, checkClass
);
1948 catch(const std::exception
& e
)
1950 if (g_verboseHealthChecks
)
1951 infolog("Error checking the health of backend %s: %s", ds
->getNameWithAddr(), e
.what());
1956 if (g_verboseHealthChecks
)
1957 infolog("Unknown exception while checking the health of backend %s", ds
->getNameWithAddr());
1961 uint64_t g_maxTCPClientThreads
{10};
1962 std::atomic
<uint16_t> g_cacheCleaningDelay
{60};
1963 std::atomic
<uint16_t> g_cacheCleaningPercentage
{100};
1967 setThreadName("dnsdist/main");
1970 int32_t secondsToWaitLog
= 0;
1976 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1977 auto f
= g_lua
.readVariable
<boost::optional
<std::function
<void()> > >("maintenance");
1981 secondsToWaitLog
= 0;
1983 catch(std::exception
&e
) {
1984 if (secondsToWaitLog
<= 0) {
1985 infolog("Error during execution of maintenance function: %s", e
.what());
1986 secondsToWaitLog
= 61;
1988 secondsToWaitLog
-= interval
;
1994 if (counter
>= g_cacheCleaningDelay
) {
1995 /* keep track, for each cache, of whether we should keep
1997 std::map
<std::shared_ptr
<DNSDistPacketCache
>, bool> caches
;
1999 /* gather all caches actually used by at least one pool, and see
2000 if something prevents us from cleaning the expired entries */
2001 auto localPools
= g_pools
.getLocal();
2002 for (const auto& entry
: *localPools
) {
2003 auto& pool
= entry
.second
;
2005 auto packetCache
= pool
->packetCache
;
2010 auto pair
= caches
.insert({packetCache
, false});
2011 auto& iter
= pair
.first
;
2012 /* if we need to keep stale data for this cache (ie, not clear
2013 expired entries when at least one pool using this cache
2014 has all its backends down) */
2015 if (packetCache
->keepStaleData() && iter
->second
== false) {
2016 /* so far all pools had at least one backend up */
2017 if (pool
->countServers(true) == 0) {
2018 iter
->second
= true;
2023 for (auto pair
: caches
) {
2024 /* shall we keep expired entries ? */
2025 if (pair
.second
== true) {
2028 auto& packetCache
= pair
.first
;
2029 size_t upTo
= (packetCache
->getMaxEntries()* (100 - g_cacheCleaningPercentage
)) / 100;
2030 packetCache
->purgeExpired(upTo
);
2035 // ponder pruning g_dynblocks of expired entries here
2039 static void secPollThread()
2041 setThreadName("dnsdist/secpoll");
2045 doSecPoll(g_secPollSuffix
);
2049 sleep(g_secPollInterval
);
2053 static void healthChecksThread()
2055 setThreadName("dnsdist/healthC");
2062 if(g_tcpclientthreads
->getQueuedCount() > 1 && !g_tcpclientthreads
->hasReachedMaxThreads())
2063 g_tcpclientthreads
->addTCPClientThread();
2065 auto states
= g_dstates
.getLocal(); // this points to the actual shared_ptrs!
2066 for(auto& dss
: *states
) {
2067 if(++dss
->lastCheck
< dss
->checkInterval
)
2070 if(dss
->availability
==DownstreamState::Availability::Auto
) {
2071 bool newState
=upCheck(dss
);
2073 /* check succeeded */
2074 dss
->currentCheckFailures
= 0;
2076 if (!dss
->upStatus
) {
2077 /* we were marked as down */
2078 dss
->consecutiveSuccessfulChecks
++;
2079 if (dss
->consecutiveSuccessfulChecks
< dss
->minRiseSuccesses
) {
2080 /* if we need more than one successful check to rise
2081 and we didn't reach the threshold yet,
2089 dss
->consecutiveSuccessfulChecks
= 0;
2091 if (dss
->upStatus
) {
2092 /* we are currently up */
2093 dss
->currentCheckFailures
++;
2094 if (dss
->currentCheckFailures
< dss
->maxCheckFailures
) {
2095 /* we need more than one failure to be marked as down,
2096 and we did not reach the threshold yet, let's stay down */
2102 if(newState
!= dss
->upStatus
) {
2103 warnlog("Marking downstream %s as '%s'", dss
->getNameWithAddr(), newState
? "up" : "down");
2105 if (newState
&& !dss
->connected
) {
2106 newState
= dss
->reconnect();
2108 if (dss
->connected
&& !dss
->threadStarted
.test_and_set()) {
2109 dss
->tid
= thread(responderThread
, dss
);
2113 dss
->upStatus
= newState
;
2114 dss
->currentCheckFailures
= 0;
2115 dss
->consecutiveSuccessfulChecks
= 0;
2116 if (g_snmpAgent
&& g_snmpTrapsEnabled
) {
2117 g_snmpAgent
->sendBackendStatusChangeTrap(dss
);
2122 auto delta
= dss
->sw
.udiffAndSet()/1000000.0;
2123 dss
->queryLoad
= 1.0*(dss
->queries
.load() - dss
->prev
.queries
.load())/delta
;
2124 dss
->dropRate
= 1.0*(dss
->reuseds
.load() - dss
->prev
.reuseds
.load())/delta
;
2125 dss
->prev
.queries
.store(dss
->queries
.load());
2126 dss
->prev
.reuseds
.store(dss
->reuseds
.load());
2128 for(IDState
& ids
: dss
->idStates
) { // timeouts
2129 int64_t usageIndicator
= ids
.usageIndicator
;
2130 if(IDState::isInUse(usageIndicator
) && ids
.age
++ > g_udpTimeout
) {
2131 /* We mark the state as unused as soon as possible
2132 to limit the risk of racing with the
2135 auto oldDU
= ids
.du
;
2137 if (!ids
.tryMarkUnused(usageIndicator
)) {
2138 /* this state has been altered in the meantime,
2139 don't go anywhere near it */
2143 handleDOHTimeout(oldDU
);
2147 ++g_stats
.downstreamTimeouts
; // this is an 'actively' discovered timeout
2148 vinfolog("Had a downstream timeout from %s (%s) for query for %s|%s from %s",
2149 dss
->remote
.toStringWithPort(), dss
->name
,
2150 ids
.qname
.toLogString(), QType(ids
.qtype
).getName(), ids
.origRemote
.toStringWithPort());
2155 struct dnsheader fake
;
2156 memset(&fake
, 0, sizeof(fake
));
2157 fake
.id
= ids
.origID
;
2159 g_rings
.insertResponse(ts
, ids
.origRemote
, ids
.qname
, ids
.qtype
, std::numeric_limits
<unsigned int>::max(), 0, fake
, dss
->remote
);
2166 static void bindAny(int af
, int sock
)
2168 __attribute__((unused
)) int one
= 1;
2171 if (setsockopt(sock
, IPPROTO_IP
, IP_FREEBIND
, &one
, sizeof(one
)) < 0)
2172 warnlog("Warning: IP_FREEBIND setsockopt failed: %s", stringerror());
2177 if (setsockopt(sock
, IPPROTO_IP
, IP_BINDANY
, &one
, sizeof(one
)) < 0)
2178 warnlog("Warning: IP_BINDANY setsockopt failed: %s", stringerror());
2182 if (setsockopt(sock
, IPPROTO_IPV6
, IPV6_BINDANY
, &one
, sizeof(one
)) < 0)
2183 warnlog("Warning: IPV6_BINDANY setsockopt failed: %s", stringerror());
2186 if (setsockopt(sock
, SOL_SOCKET
, SO_BINDANY
, &one
, sizeof(one
)) < 0)
2187 warnlog("Warning: SO_BINDANY setsockopt failed: %s", stringerror());
2191 static void dropGroupPrivs(gid_t gid
)
2194 if (setgid(gid
) == 0) {
2195 if (setgroups(0, NULL
) < 0) {
2196 warnlog("Warning: Unable to drop supplementary gids: %s", stringerror());
2200 warnlog("Warning: Unable to set group ID to %d: %s", gid
, stringerror());
2205 static void dropUserPrivs(uid_t uid
)
2208 if(setuid(uid
) < 0) {
2209 warnlog("Warning: Unable to set user ID to %d: %s", uid
, stringerror());
2214 static void checkFileDescriptorsLimits(size_t udpBindsCount
, size_t tcpBindsCount
)
2216 /* stdin, stdout, stderr */
2217 size_t requiredFDsCount
= 3;
2218 auto backends
= g_dstates
.getLocal();
2219 /* UDP sockets to backends */
2220 size_t backendUDPSocketsCount
= 0;
2221 for (const auto& backend
: *backends
) {
2222 backendUDPSocketsCount
+= backend
->sockets
.size();
2224 requiredFDsCount
+= backendUDPSocketsCount
;
2225 /* TCP sockets to backends */
2226 requiredFDsCount
+= (backends
->size() * g_maxTCPClientThreads
);
2227 /* listening sockets */
2228 requiredFDsCount
+= udpBindsCount
;
2229 requiredFDsCount
+= tcpBindsCount
;
2230 /* max TCP connections currently served */
2231 requiredFDsCount
+= g_maxTCPClientThreads
;
2232 /* max pipes for communicating between TCP acceptors and client threads */
2233 requiredFDsCount
+= (g_maxTCPClientThreads
* 2);
2234 /* max TCP queued connections */
2235 requiredFDsCount
+= g_maxTCPQueuedConnections
;
2236 /* DelayPipe pipe */
2237 requiredFDsCount
+= 2;
2240 /* webserver main socket */
2242 /* console main socket */
2249 getrlimit(RLIMIT_NOFILE
, &rl
);
2250 if (rl
.rlim_cur
<= requiredFDsCount
) {
2251 warnlog("Warning, this configuration can use more than %d file descriptors, web server and console connections not included, and the current limit is %d.", std::to_string(requiredFDsCount
), std::to_string(rl
.rlim_cur
));
2253 warnlog("You can increase this value by using LimitNOFILE= in the systemd unit file or ulimit.");
2255 warnlog("You can increase this value by using ulimit.");
2260 static void setUpLocalBind(std::unique_ptr
<ClientState
>& cs
)
2262 /* skip some warnings if there is an identical UDP context */
2263 bool warn
= cs
->tcp
== false || cs
->tlsFrontend
!= nullptr || cs
->dohFrontend
!= nullptr;
2264 int& fd
= cs
->tcp
== false ? cs
->udpFD
: cs
->tcpFD
;
2267 fd
= SSocket(cs
->local
.sin4
.sin_family
, cs
->tcp
== false ? SOCK_DGRAM
: SOCK_STREAM
, 0);
2270 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEADDR
, 1);
2271 #ifdef TCP_DEFER_ACCEPT
2272 SSetsockopt(fd
, IPPROTO_TCP
, TCP_DEFER_ACCEPT
, 1);
2274 if (cs
->fastOpenQueueSize
> 0) {
2276 SSetsockopt(fd
, IPPROTO_TCP
, TCP_FASTOPEN
, cs
->fastOpenQueueSize
);
2279 warnlog("TCP Fast Open has been configured on local address '%s' but is not supported", cs
->local
.toStringWithPort());
2285 if(cs
->local
.sin4
.sin_family
== AF_INET6
) {
2286 SSetsockopt(fd
, IPPROTO_IPV6
, IPV6_V6ONLY
, 1);
2289 bindAny(cs
->local
.sin4
.sin_family
, fd
);
2291 if(!cs
->tcp
&& IsAnyAddress(cs
->local
)) {
2293 setsockopt(fd
, IPPROTO_IP
, GEN_IP_PKTINFO
, &one
, sizeof(one
)); // linux supports this, so why not - might fail on other systems
2294 #ifdef IPV6_RECVPKTINFO
2295 setsockopt(fd
, IPPROTO_IPV6
, IPV6_RECVPKTINFO
, &one
, sizeof(one
));
2299 if (cs
->reuseport
) {
2301 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEPORT
, 1);
2304 /* no need to warn again if configured but support is not available, we already did for UDP */
2305 warnlog("SO_REUSEPORT has been configured on local address '%s' but is not supported", cs
->local
.toStringWithPort());
2311 if (cs
->local
.isIPv4()) {
2313 setSocketIgnorePMTU(cs
->udpFD
);
2315 catch(const std::exception
& e
) {
2316 warnlog("Failed to set IP_MTU_DISCOVER on UDP server socket for local address '%s': %s", cs
->local
.toStringWithPort(), e
.what());
2321 const std::string
& itf
= cs
->interface
;
2323 #ifdef SO_BINDTODEVICE
2324 int res
= setsockopt(fd
, SOL_SOCKET
, SO_BINDTODEVICE
, itf
.c_str(), itf
.length());
2326 warnlog("Error setting up the interface on local address '%s': %s", cs
->local
.toStringWithPort(), stringerror());
2330 warnlog("An interface has been configured on local address '%s' but SO_BINDTODEVICE is not supported", cs
->local
.toStringWithPort());
2336 if (g_defaultBPFFilter
) {
2337 cs
->attachFilter(g_defaultBPFFilter
);
2338 vinfolog("Attaching default BPF Filter to %s frontend %s", (!cs
->tcp
? "UDP" : "TCP"), cs
->local
.toStringWithPort());
2340 #endif /* HAVE_EBPF */
2342 if (cs
->tlsFrontend
!= nullptr) {
2343 if (!cs
->tlsFrontend
->setupTLS()) {
2344 errlog("Error while setting up TLS on local address '%s', exiting", cs
->local
.toStringWithPort());
2345 _exit(EXIT_FAILURE
);
2349 if (cs
->dohFrontend
!= nullptr) {
2350 cs
->dohFrontend
->setup();
2353 SBind(fd
, cs
->local
);
2356 SListen(cs
->tcpFD
, SOMAXCONN
);
2357 if (cs
->tlsFrontend
!= nullptr) {
2358 warnlog("Listening on %s for TLS", cs
->local
.toStringWithPort());
2360 else if (cs
->dohFrontend
!= nullptr) {
2361 warnlog("Listening on %s for DoH", cs
->local
.toStringWithPort());
2363 else if (cs
->dnscryptCtx
!= nullptr) {
2364 warnlog("Listening on %s for DNSCrypt", cs
->local
.toStringWithPort());
2367 warnlog("Listening on %s", cs
->local
.toStringWithPort());
2376 vector
<string
> locals
;
2377 vector
<string
> remotes
;
2378 bool checkConfig
{false};
2379 bool beClient
{false};
2380 bool beSupervised
{false};
2387 std::atomic
<bool> g_configurationDone
{false};
2392 cout
<<"Syntax: dnsdist [-C,--config file] [-c,--client [IP[:PORT]]]\n";
2393 cout
<<"[-e,--execute cmd] [-h,--help] [-l,--local addr]\n";
2394 cout
<<"[-v,--verbose] [--check-config] [--version]\n";
2396 cout
<<"-a,--acl netmask Add this netmask to the ACL\n";
2397 cout
<<"-C,--config file Load configuration from 'file'\n";
2398 cout
<<"-c,--client Operate as a client, connect to dnsdist. This reads\n";
2399 cout
<<" controlSocket from your configuration file, but also\n";
2400 cout
<<" accepts an IP:PORT argument\n";
2401 #ifdef HAVE_LIBSODIUM
2402 cout
<<"-k,--setkey KEY Use KEY for encrypted communication to dnsdist. This\n";
2403 cout
<<" is similar to setting setKey in the configuration file.\n";
2404 cout
<<" NOTE: this will leak this key in your shell's history\n";
2405 cout
<<" and in the systems running process list.\n";
2407 cout
<<"--check-config Validate the configuration file and exit. The exit-code\n";
2408 cout
<<" reflects the validation, 0 is OK, 1 means an error.\n";
2409 cout
<<" Any errors are printed as well.\n";
2410 cout
<<"-e,--execute cmd Connect to dnsdist and execute 'cmd'\n";
2411 cout
<<"-g,--gid gid Change the process group ID after binding sockets\n";
2412 cout
<<"-h,--help Display this helpful message\n";
2413 cout
<<"-l,--local address Listen on this local address\n";
2414 cout
<<"--supervised Don't open a console, I'm supervised\n";
2415 cout
<<" (use with e.g. systemd and daemontools)\n";
2416 cout
<<"--disable-syslog Don't log to syslog, only to stdout\n";
2417 cout
<<" (use with e.g. systemd)\n";
2418 cout
<<"-u,--uid uid Change the process user ID after binding sockets\n";
2419 cout
<<"-v,--verbose Enable verbose mode\n";
2420 cout
<<"-V,--version Show dnsdist version information and exit\n";
2423 int main(int argc
, char** argv
)
2426 size_t udpBindsCount
= 0;
2427 size_t tcpBindsCount
= 0;
2428 rl_attempted_completion_function
= my_completion
;
2429 rl_completion_append_character
= 0;
2431 signal(SIGPIPE
, SIG_IGN
);
2432 signal(SIGCHLD
, SIG_IGN
);
2433 openlog("dnsdist", LOG_PID
|LOG_NDELAY
, LOG_DAEMON
);
2435 #ifdef HAVE_LIBSODIUM
2436 if (sodium_init() == -1) {
2437 cerr
<<"Unable to initialize crypto library"<<endl
;
2440 g_hashperturb
=randombytes_uniform(0xffffffff);
2441 srandom(randombytes_uniform(0xffffffff));
2445 gettimeofday(&tv
, 0);
2446 srandom(tv
.tv_sec
^ tv
.tv_usec
^ getpid());
2447 g_hashperturb
=random();
2451 ComboAddress clientAddress
= ComboAddress();
2452 g_cmdLine
.config
=SYSCONFDIR
"/dnsdist.conf";
2453 struct option longopts
[]={
2454 {"acl", required_argument
, 0, 'a'},
2455 {"check-config", no_argument
, 0, 1},
2456 {"client", no_argument
, 0, 'c'},
2457 {"config", required_argument
, 0, 'C'},
2458 {"disable-syslog", no_argument
, 0, 2},
2459 {"execute", required_argument
, 0, 'e'},
2460 {"gid", required_argument
, 0, 'g'},
2461 {"help", no_argument
, 0, 'h'},
2462 {"local", required_argument
, 0, 'l'},
2463 {"setkey", required_argument
, 0, 'k'},
2464 {"supervised", no_argument
, 0, 3},
2465 {"uid", required_argument
, 0, 'u'},
2466 {"verbose", no_argument
, 0, 'v'},
2467 {"version", no_argument
, 0, 'V'},
2473 int c
=getopt_long(argc
, argv
, "a:cC:e:g:hk:l:u:vV", longopts
, &longindex
);
2478 g_cmdLine
.checkConfig
=true;
2484 g_cmdLine
.beSupervised
=true;
2487 g_cmdLine
.config
=optarg
;
2490 g_cmdLine
.beClient
=true;
2493 g_cmdLine
.command
=optarg
;
2496 g_cmdLine
.gid
=optarg
;
2499 cout
<<"dnsdist "<<VERSION
<<endl
;
2506 g_ACL
.modify([optstring
](NetmaskGroup
& nmg
) { nmg
.addMask(optstring
); });
2509 #ifdef HAVE_LIBSODIUM
2510 if (B64Decode(string(optarg
), g_consoleKey
) < 0) {
2511 cerr
<<"Unable to decode key '"<<optarg
<<"'."<<endl
;
2515 cerr
<<"dnsdist has been built without libsodium, -k/--setkey is unsupported."<<endl
;
2520 g_cmdLine
.locals
.push_back(trim_copy(string(optarg
)));
2523 g_cmdLine
.uid
=optarg
;
2529 #ifdef LUAJIT_VERSION
2530 cout
<<"dnsdist "<<VERSION
<<" ("<<LUA_RELEASE
<<" ["<<LUAJIT_VERSION
<<"])"<<endl
;
2532 cout
<<"dnsdist "<<VERSION
<<" ("<<LUA_RELEASE
<<")"<<endl
;
2534 cout
<<"Enabled features: ";
2538 #ifdef HAVE_DNS_OVER_TLS
2539 cout
<<"dns-over-tls(";
2551 #ifdef HAVE_DNS_OVER_HTTPS
2552 cout
<<"dns-over-https(DOH) ";
2554 #ifdef HAVE_DNSCRYPT
2563 #ifdef HAVE_LIBCRYPTO
2566 #ifdef HAVE_LIBSODIUM
2572 #ifdef HAVE_PROTOBUF
2578 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
2579 cout
<<"recvmmsg/sendmmsg ";
2581 #ifdef HAVE_NET_SNMP
2591 //getopt_long printed an error message.
2600 for(auto p
= argv
; *p
; ++p
) {
2601 if(g_cmdLine
.beClient
) {
2602 clientAddress
= ComboAddress(*p
, 5199);
2604 g_cmdLine
.remotes
.push_back(*p
);
2608 ServerPolicy leastOutstandingPol
{"leastOutstanding", leastOutstanding
, false};
2610 g_policy
.setState(leastOutstandingPol
);
2611 if(g_cmdLine
.beClient
|| !g_cmdLine
.command
.empty()) {
2612 setupLua(true, g_cmdLine
.config
);
2613 if (clientAddress
!= ComboAddress())
2614 g_serverControl
= clientAddress
;
2615 doClient(g_serverControl
, g_cmdLine
.command
);
2616 _exit(EXIT_SUCCESS
);
2619 auto acl
= g_ACL
.getCopy();
2621 for(auto& addr
: {"127.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "169.254.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "::1/128", "fc00::/7", "fe80::/10"})
2623 g_ACL
.setState(acl
);
2626 auto consoleACL
= g_consoleACL
.getCopy();
2627 for (const auto& mask
: { "127.0.0.1/8", "::1/128" }) {
2628 consoleACL
.addMask(mask
);
2630 g_consoleACL
.setState(consoleACL
);
2632 if (g_cmdLine
.checkConfig
) {
2633 setupLua(true, g_cmdLine
.config
);
2634 // No exception was thrown
2635 infolog("Configuration '%s' OK!", g_cmdLine
.config
);
2636 _exit(EXIT_SUCCESS
);
2639 auto todo
=setupLua(false, g_cmdLine
.config
);
2641 auto localPools
= g_pools
.getCopy();
2643 bool precompute
= false;
2644 if (g_policy
.getLocal()->name
== "chashed") {
2647 for (const auto& entry
: localPools
) {
2648 if (entry
.second
->policy
!= nullptr && entry
.second
->policy
->name
== "chashed") {
2655 vinfolog("Pre-computing hashes for consistent hash load-balancing policy");
2656 // pre compute hashes
2657 auto backends
= g_dstates
.getLocal();
2658 for (auto& backend
: *backends
) {
2664 if (!g_cmdLine
.locals
.empty()) {
2665 for (auto it
= g_frontends
.begin(); it
!= g_frontends
.end(); ) {
2666 /* DoH, DoT and DNSCrypt frontends are separate */
2667 if ((*it
)->dohFrontend
== nullptr && (*it
)->tlsFrontend
== nullptr && (*it
)->dnscryptCtx
== nullptr) {
2668 it
= g_frontends
.erase(it
);
2675 for(const auto& loc
: g_cmdLine
.locals
) {
2677 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress(loc
, 53), false, false, 0, "", {})));
2679 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress(loc
, 53), true, false, 0, "", {})));
2683 if (g_frontends
.empty()) {
2685 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress("127.0.0.1", 53), false, false, 0, "", {})));
2687 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress("127.0.0.1", 53), true, false, 0, "", {})));
2690 g_configurationDone
= true;
2692 for(auto& frontend
: g_frontends
) {
2693 setUpLocalBind(frontend
);
2695 if (frontend
->tcp
== false) {
2703 warnlog("dnsdist %s comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2", VERSION
);
2707 g_ACL
.getLocal()->toStringVector(&vec
);
2708 for(const auto& s
: vec
) {
2713 infolog("ACL allowing queries from: %s", acls
.c_str());
2716 g_consoleACL
.getLocal()->toStringVector(&vec
);
2717 for (const auto& entry
: vec
) {
2718 if (!acls
.empty()) {
2723 infolog("Console ACL allowing connections from: %s", acls
.c_str());
2725 #ifdef HAVE_LIBSODIUM
2726 if (g_consoleEnabled
&& g_consoleKey
.empty()) {
2727 warnlog("Warning, the console has been enabled via 'controlSocket()' but no key has been set with 'setKey()' so all connections will fail until a key has been set");
2734 if(!g_cmdLine
.gid
.empty())
2735 newgid
= strToGID(g_cmdLine
.gid
.c_str());
2737 if(!g_cmdLine
.uid
.empty())
2738 newuid
= strToUID(g_cmdLine
.uid
.c_str());
2740 dropGroupPrivs(newgid
);
2741 dropUserPrivs(newuid
);
2743 /* we might still have capabilities remaining,
2744 for example if we have been started as root
2745 without --uid or --gid (please don't do that)
2746 or as an unprivileged user with ambient
2747 capabilities like CAP_NET_BIND_SERVICE.
2749 dropCapabilities(g_capabilitiesToRetain
);
2751 catch(const std::exception
& e
) {
2752 warnlog("%s", e
.what());
2755 /* this need to be done _after_ dropping privileges */
2756 g_delay
= new DelayPipe
<DelayedPacket
>();
2762 g_tcpclientthreads
= std::unique_ptr
<TCPClientCollection
>(new TCPClientCollection(g_maxTCPClientThreads
, g_useTCPSinglePipe
));
2767 localPools
= g_pools
.getCopy();
2768 /* create the default pool no matter what */
2769 createPoolIfNotExists(localPools
, "");
2770 if(g_cmdLine
.remotes
.size()) {
2771 for(const auto& address
: g_cmdLine
.remotes
) {
2772 auto ret
=std::make_shared
<DownstreamState
>(ComboAddress(address
, 53));
2773 addServerToPool(localPools
, "", ret
);
2774 if (ret
->connected
&& !ret
->threadStarted
.test_and_set()) {
2775 ret
->tid
= thread(responderThread
, ret
);
2777 g_dstates
.modify([ret
](servers_t
& servers
) { servers
.push_back(ret
); });
2780 g_pools
.setState(localPools
);
2782 if(g_dstates
.getLocal()->empty()) {
2783 errlog("No downstream servers defined: all packets will get dropped");
2784 // you might define them later, but you need to know
2787 checkFileDescriptorsLimits(udpBindsCount
, tcpBindsCount
);
2789 for(auto& dss
: g_dstates
.getCopy()) { // it is a copy, but the internal shared_ptrs are the real deal
2790 if(dss
->availability
==DownstreamState::Availability::Auto
) {
2791 bool newState
=upCheck(dss
);
2792 warnlog("Marking downstream %s as '%s'", dss
->getNameWithAddr(), newState
? "up" : "down");
2793 dss
->upStatus
= newState
;
2797 for(auto& cs
: g_frontends
) {
2798 if (cs
->dohFrontend
!= nullptr) {
2799 #ifdef HAVE_DNS_OVER_HTTPS
2800 std::thread
t1(dohThread
, cs
.get());
2801 if (!cs
->cpus
.empty()) {
2802 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2805 #endif /* HAVE_DNS_OVER_HTTPS */
2808 if (cs
->udpFD
>= 0) {
2809 thread
t1(udpClientThread
, cs
.get());
2810 if (!cs
->cpus
.empty()) {
2811 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2815 else if (cs
->tcpFD
>= 0) {
2816 thread
t1(tcpAcceptorThread
, cs
.get());
2817 if (!cs
->cpus
.empty()) {
2818 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2824 thread
carbonthread(carbonDumpThread
);
2825 carbonthread
.detach();
2827 thread
stattid(maintThread
);
2830 thread
healththread(healthChecksThread
);
2832 if (!g_secPollSuffix
.empty()) {
2833 thread
secpollthread(secPollThread
);
2834 secpollthread
.detach();
2837 if(g_cmdLine
.beSupervised
) {
2839 sd_notify(0, "READY=1");
2841 healththread
.join();
2844 healththread
.detach();
2847 _exit(EXIT_SUCCESS
);
2850 catch(const LuaContext::ExecutionErrorException
& e
) {
2852 errlog("Fatal Lua error: %s", e
.what());
2853 std::rethrow_if_nested(e
);
2854 } catch(const std::exception
& ne
) {
2855 errlog("Details: %s", ne
.what());
2857 catch(PDNSException
&ae
)
2859 errlog("Fatal pdns error: %s", ae
.reason
);
2861 _exit(EXIT_FAILURE
);
2863 catch(std::exception
&e
)
2865 errlog("Fatal error: %s", e
.what());
2866 _exit(EXIT_FAILURE
);
2868 catch(PDNSException
&ae
)
2870 errlog("Fatal pdns error: %s", ae
.reason
);
2871 _exit(EXIT_FAILURE
);
2874 uint64_t getLatencyCount(const std::string
&)
2876 return g_stats
.responses
+ g_stats
.selfAnswered
+ g_stats
.cacheHits
;