2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
29 #include <netinet/tcp.h>
31 #include <sys/resource.h>
34 #if defined (__OpenBSD__) || defined(__NetBSD__)
35 #include <readline/readline.h>
37 #include <editline/readline.h>
41 #include <systemd/sd-daemon.h>
45 #include "dnsdist-cache.hh"
46 #include "dnsdist-console.hh"
47 #include "dnsdist-ecs.hh"
48 #include "dnsdist-lua.hh"
49 #include "dnsdist-rings.hh"
50 #include "dnsdist-secpoll.hh"
51 #include "dnsdist-xpf.hh"
54 #include "delaypipe.hh"
57 #include "dnsparser.hh"
58 #include "dnswriter.hh"
59 #include "ednsoptions.hh"
63 #include "sodcrypto.hh"
65 #include "threadname.hh"
69 Receiver is currently single threaded
70 not *that* bad actually, but now that we are thread safe, might want to scale
74 Set of Rules, if one matches, it leads to an Action
75 Both rules and actions could conceivably be Lua based.
76 On the C++ side, both could be inherited from a class Rule and a class Action,
77 on the Lua side we can't do that. */
83 struct DNSDistStats g_stats
;
84 MetricDefinitionStorage g_metricDefinitions
;
86 uint16_t g_maxOutstanding
{std::numeric_limits
<uint16_t>::max()};
87 bool g_verboseHealthChecks
{false};
88 uint32_t g_staleCacheEntriesTTL
{0};
90 bool g_allowEmptyResponse
{false};
92 GlobalStateHolder
<NetmaskGroup
> g_ACL
;
93 string g_outputBuffer
;
95 std::vector
<std::shared_ptr
<TLSFrontend
>> g_tlslocals
;
96 std::vector
<std::shared_ptr
<DOHFrontend
>> g_dohlocals
;
97 std::vector
<std::shared_ptr
<DNSCryptContext
>> g_dnsCryptLocals
;
99 shared_ptr
<BPFFilter
> g_defaultBPFFilter
;
100 std::vector
<std::shared_ptr
<DynBPFFilter
> > g_dynBPFFilters
;
101 #endif /* HAVE_EBPF */
102 std::vector
<std::unique_ptr
<ClientState
>> g_frontends
;
103 GlobalStateHolder
<pools_t
> g_pools
;
104 size_t g_udpVectorSize
{1};
106 bool g_snmpEnabled
{false};
107 bool g_snmpTrapsEnabled
{false};
108 DNSDistSNMPAgent
* g_snmpAgent
{nullptr};
110 /* UDP: the grand design. Per socket we listen on for incoming queries there is one thread.
111 Then we have a bunch of connected sockets for talking to downstream servers.
112 We send directly to those sockets.
114 For the return path, per downstream server we have a thread that listens to responses.
116 Per socket there is an array of 2^16 states, when we send out a packet downstream, we note
117 there the original requestor and the original id. The new ID is the offset in the array.
119 When an answer comes in on a socket, we look up the offset by the id, and lob it to the
122 IDs are assigned by atomic increments of the socket offset.
125 GlobalStateHolder
<vector
<DNSDistRuleAction
> > g_rulactions
;
126 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_resprulactions
;
127 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_cachehitresprulactions
;
128 GlobalStateHolder
<vector
<DNSDistResponseRuleAction
> > g_selfansweredresprulactions
;
133 GlobalStateHolder
<servers_t
> g_dstates
;
134 GlobalStateHolder
<NetmaskTree
<DynBlock
>> g_dynblockNMG
;
135 GlobalStateHolder
<SuffixMatchTree
<DynBlock
>> g_dynblockSMT
;
136 DNSAction::Action g_dynBlockAction
= DNSAction::Action::Drop
;
137 int g_tcpRecvTimeout
{2};
138 int g_tcpSendTimeout
{2};
141 bool g_servFailOnNoPolicy
{false};
142 bool g_truncateTC
{false};
143 bool g_fixupCase
{false};
144 bool g_preserveTrailingData
{false};
145 bool g_roundrobinFailOnNoServer
{false};
147 std::set
<std::string
> g_capabilitiesToRetain
;
149 static void truncateTC(char* packet
, uint16_t* len
, size_t responseSize
, unsigned int consumed
)
152 bool hadEDNS
= false;
153 uint16_t payloadSize
= 0;
156 if (g_addEDNSToSelfGeneratedResponses
) {
157 hadEDNS
= getEDNSUDPPayloadSizeAndZ(packet
, *len
, &payloadSize
, &z
);
160 *len
=static_cast<uint16_t>(sizeof(dnsheader
)+consumed
+DNS_TYPE_SIZE
+DNS_CLASS_SIZE
);
161 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(packet
);
162 dh
->ancount
= dh
->arcount
= dh
->nscount
= 0;
165 addEDNS(dh
, *len
, responseSize
, z
& EDNS_HEADER_FLAG_DO
, payloadSize
, 0);
177 ComboAddress destination
;
178 ComboAddress origDest
;
182 if(origDest
.sin4
.sin_family
== 0) {
183 res
= sendto(fd
, packet
.c_str(), packet
.size(), 0, (struct sockaddr
*)&destination
, destination
.getSocklen());
186 res
= sendfromto(fd
, packet
.c_str(), packet
.size(), 0, origDest
, destination
);
190 vinfolog("Error sending delayed response to %s: %s", destination
.toStringWithPort(), strerror(err
));
195 DelayPipe
<DelayedPacket
>* g_delay
= nullptr;
197 void doLatencyStats(double udiff
)
199 if(udiff
< 1000) ++g_stats
.latency0_1
;
200 else if(udiff
< 10000) ++g_stats
.latency1_10
;
201 else if(udiff
< 50000) ++g_stats
.latency10_50
;
202 else if(udiff
< 100000) ++g_stats
.latency50_100
;
203 else if(udiff
< 1000000) ++g_stats
.latency100_1000
;
204 else ++g_stats
.latencySlow
;
205 g_stats
.latencySum
+= udiff
/ 1000;
207 auto doAvg
= [](double& var
, double n
, double weight
) {
208 var
= (weight
-1) * var
/weight
+ n
/weight
;
211 doAvg(g_stats
.latencyAvg100
, udiff
, 100);
212 doAvg(g_stats
.latencyAvg1000
, udiff
, 1000);
213 doAvg(g_stats
.latencyAvg10000
, udiff
, 10000);
214 doAvg(g_stats
.latencyAvg1000000
, udiff
, 1000000);
217 bool responseContentMatches(const char* response
, const uint16_t responseLen
, const DNSName
& qname
, const uint16_t qtype
, const uint16_t qclass
, const ComboAddress
& remote
, unsigned int& consumed
)
219 if (responseLen
< sizeof(dnsheader
)) {
223 const struct dnsheader
* dh
= reinterpret_cast<const struct dnsheader
*>(response
);
224 if (dh
->qdcount
== 0) {
225 if ((dh
->rcode
!= RCode::NoError
&& dh
->rcode
!= RCode::NXDomain
) || g_allowEmptyResponse
) {
229 ++g_stats
.nonCompliantResponses
;
234 uint16_t rqtype
, rqclass
;
237 rqname
=DNSName(response
, responseLen
, sizeof(dnsheader
), false, &rqtype
, &rqclass
, &consumed
);
239 catch(const std::exception
& e
) {
240 if(responseLen
> 0 && static_cast<size_t>(responseLen
) > sizeof(dnsheader
)) {
241 infolog("Backend %s sent us a response with id %d that did not parse: %s", remote
.toStringWithPort(), ntohs(dh
->id
), e
.what());
243 ++g_stats
.nonCompliantResponses
;
247 if (rqtype
!= qtype
|| rqclass
!= qclass
|| rqname
!= qname
) {
254 static void restoreFlags(struct dnsheader
* dh
, uint16_t origFlags
)
256 static const uint16_t rdMask
= 1 << FLAGS_RD_OFFSET
;
257 static const uint16_t cdMask
= 1 << FLAGS_CD_OFFSET
;
258 static const uint16_t restoreFlagsMask
= UINT16_MAX
& ~(rdMask
| cdMask
);
259 uint16_t * flags
= getFlagsFromDNSHeader(dh
);
260 /* clear the flags we are about to restore */
261 *flags
&= restoreFlagsMask
;
262 /* only keep the flags we want to restore */
263 origFlags
&= ~restoreFlagsMask
;
264 /* set the saved flags as they were */
268 static bool fixUpQueryTurnedResponse(DNSQuestion
& dq
, const uint16_t origFlags
)
270 restoreFlags(dq
.dh
, origFlags
);
272 return addEDNSToQueryTurnedResponse(dq
);
275 static bool fixUpResponse(char** response
, uint16_t* responseLen
, size_t* responseSize
, const DNSName
& qname
, uint16_t origFlags
, bool ednsAdded
, bool ecsAdded
, std::vector
<uint8_t>& rewrittenResponse
, uint16_t addRoom
, bool* zeroScope
)
277 if (*responseLen
< sizeof(dnsheader
)) {
281 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(*response
);
282 restoreFlags(dh
, origFlags
);
284 if (*responseLen
== sizeof(dnsheader
)) {
289 string realname
= qname
.toDNSString();
290 if (*responseLen
>= (sizeof(dnsheader
) + realname
.length())) {
291 memcpy(*response
+ sizeof(dnsheader
), realname
.c_str(), realname
.length());
295 if (ednsAdded
|| ecsAdded
) {
300 const std::string
responseStr(*response
, *responseLen
);
301 int res
= locateEDNSOptRR(responseStr
, &optStart
, &optLen
, &last
);
304 if (zeroScope
) { // this finds if an EDNS Client Subnet scope was set, and if it is 0
305 size_t optContentStart
= 0;
306 uint16_t optContentLen
= 0;
307 /* we need at least 4 bytes after the option length (family: 2, source prefix-length: 1, scope prefix-length: 1) */
308 if (isEDNSOptionInOpt(responseStr
, optStart
, optLen
, EDNSOptionCode::ECS
, &optContentStart
, &optContentLen
) && optContentLen
>= 4) {
309 /* see if the EDNS Client Subnet SCOPE PREFIX-LENGTH byte in position 3 is set to 0, which is the only thing
311 *zeroScope
= responseStr
.at(optContentStart
+ 3) == 0;
316 /* we added the entire OPT RR,
317 therefore we need to remove it entirely */
319 /* simply remove the last AR */
320 *responseLen
-= optLen
;
321 uint16_t arcount
= ntohs(dh
->arcount
);
323 dh
->arcount
= htons(arcount
);
326 /* Removing an intermediary RR could lead to compression error */
327 if (rewriteResponseWithoutEDNS(responseStr
, rewrittenResponse
) == 0) {
328 *responseLen
= rewrittenResponse
.size();
329 if (addRoom
&& (UINT16_MAX
- *responseLen
) > addRoom
) {
330 rewrittenResponse
.reserve(*responseLen
+ addRoom
);
332 *responseSize
= rewrittenResponse
.capacity();
333 *response
= reinterpret_cast<char*>(rewrittenResponse
.data());
336 warnlog("Error rewriting content");
341 /* the OPT RR was already present, but without ECS,
342 we need to remove the ECS option if any */
344 /* nothing after the OPT RR, we can simply remove the
346 size_t existingOptLen
= optLen
;
347 removeEDNSOptionFromOPT(*response
+ optStart
, &optLen
, EDNSOptionCode::ECS
);
348 *responseLen
-= (existingOptLen
- optLen
);
351 /* Removing an intermediary RR could lead to compression error */
352 if (rewriteResponseWithoutEDNSOption(responseStr
, EDNSOptionCode::ECS
, rewrittenResponse
) == 0) {
353 *responseLen
= rewrittenResponse
.size();
354 if (addRoom
&& (UINT16_MAX
- *responseLen
) > addRoom
) {
355 rewrittenResponse
.reserve(*responseLen
+ addRoom
);
357 *responseSize
= rewrittenResponse
.capacity();
358 *response
= reinterpret_cast<char*>(rewrittenResponse
.data());
361 warnlog("Error rewriting content");
372 static bool encryptResponse(char* response
, uint16_t* responseLen
, size_t responseSize
, bool tcp
, std::shared_ptr
<DNSCryptQuery
> dnsCryptQuery
, dnsheader
** dh
, dnsheader
* dhCopy
)
375 uint16_t encryptedResponseLen
= 0;
377 /* save the original header before encrypting it in place */
378 if (dh
!= nullptr && *dh
!= nullptr && dhCopy
!= nullptr) {
379 memcpy(dhCopy
, *dh
, sizeof(dnsheader
));
383 int res
= dnsCryptQuery
->encryptResponse(response
, *responseLen
, responseSize
, tcp
, &encryptedResponseLen
);
385 *responseLen
= encryptedResponseLen
;
387 /* dropping response */
388 vinfolog("Error encrypting the response, dropping.");
394 #endif /* HAVE_DNSCRYPT */
396 static bool applyRulesToResponse(LocalStateHolder
<vector
<DNSDistResponseRuleAction
> >& localRespRulactions
, DNSResponse
& dr
)
398 DNSResponseAction::Action action
=DNSResponseAction::Action::None
;
399 std::string ruleresult
;
400 for(const auto& lr
: *localRespRulactions
) {
401 if(lr
.d_rule
->matches(&dr
)) {
402 lr
.d_rule
->d_matches
++;
403 action
=(*lr
.d_action
)(&dr
, &ruleresult
);
405 case DNSResponseAction::Action::Allow
:
408 case DNSResponseAction::Action::Drop
:
411 case DNSResponseAction::Action::HeaderModify
:
414 case DNSResponseAction::Action::ServFail
:
415 dr
.dh
->rcode
= RCode::ServFail
;
418 /* non-terminal actions follow */
419 case DNSResponseAction::Action::Delay
:
420 dr
.delayMsec
= static_cast<int>(pdns_stou(ruleresult
)); // sorry
422 case DNSResponseAction::Action::None
:
431 bool processResponse(char** response
, uint16_t* responseLen
, size_t* responseSize
, LocalStateHolder
<vector
<DNSDistResponseRuleAction
> >& localRespRulactions
, DNSResponse
& dr
, size_t addRoom
, std::vector
<uint8_t>& rewrittenResponse
, bool muted
)
433 if (!applyRulesToResponse(localRespRulactions
, dr
)) {
437 bool zeroScope
= false;
438 if (!fixUpResponse(response
, responseLen
, responseSize
, *dr
.qname
, dr
.origFlags
, dr
.ednsAdded
, dr
.ecsAdded
, rewrittenResponse
, addRoom
, dr
.useZeroScope
? &zeroScope
: nullptr)) {
442 if (dr
.packetCache
&& !dr
.skipCache
&& *responseLen
<= s_maxPacketCacheEntrySize
) {
443 if (!dr
.useZeroScope
) {
444 /* if the query was not suitable for zero-scope, for
445 example because it had an existing ECS entry so the hash is
446 not really 'no ECS', so just insert it for the existing subnet
448 - we don't have the correct hash for a non-ECS query
449 - inserting with hash computed before the ECS replacement but with
450 the subnet extracted _after_ the replacement would not work.
454 // if zeroScope, pass the pre-ECS hash-key and do not pass the subnet to the cache
455 dr
.packetCache
->insert(zeroScope
? dr
.cacheKeyNoECS
: dr
.cacheKey
, zeroScope
? boost::none
: dr
.subnet
, dr
.origFlags
, dr
.dnssecOK
, *dr
.qname
, dr
.qtype
, dr
.qclass
, *response
, *responseLen
, dr
.tcp
, dr
.dh
->rcode
, dr
.tempFailureTTL
);
460 if (!encryptResponse(*response
, responseLen
, *responseSize
, dr
.tcp
, dr
.dnsCryptQuery
, nullptr, nullptr)) {
464 #endif /* HAVE_DNSCRYPT */
469 static bool sendUDPResponse(int origFD
, const char* response
, const uint16_t responseLen
, const int delayMsec
, const ComboAddress
& origDest
, const ComboAddress
& origRemote
)
471 if(delayMsec
&& g_delay
) {
472 DelayedPacket dp
{origFD
, string(response
,responseLen
), origRemote
, origDest
};
473 g_delay
->submit(dp
, delayMsec
);
477 if(origDest
.sin4
.sin_family
== 0) {
478 res
= sendto(origFD
, response
, responseLen
, 0, reinterpret_cast<const struct sockaddr
*>(&origRemote
), origRemote
.getSocklen());
481 res
= sendfromto(origFD
, response
, responseLen
, 0, origDest
, origRemote
);
485 vinfolog("Error sending response to %s: %s", origRemote
.toStringWithPort(), stringerror(err
));
493 int pickBackendSocketForSending(std::shared_ptr
<DownstreamState
>& state
)
495 return state
->sockets
[state
->socketsOffset
++ % state
->sockets
.size()];
498 static void pickBackendSocketsReadyForReceiving(const std::shared_ptr
<DownstreamState
>& state
, std::vector
<int>& ready
)
502 if (state
->sockets
.size() == 1) {
503 ready
.push_back(state
->sockets
[0]);
508 std::lock_guard
<std::mutex
> lock(state
->socketsLock
);
509 state
->mplexer
->getAvailableFDs(ready
, -1);
513 // listens on a dedicated socket, lobs answers from downstream servers to original requestors
514 void responderThread(std::shared_ptr
<DownstreamState
> dss
)
516 setThreadName("dnsdist/respond");
517 auto localRespRulactions
= g_resprulactions
.getLocal();
518 char packet
[s_maxPacketCacheEntrySize
+ DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE
];
519 static_assert(sizeof(packet
) <= UINT16_MAX
, "Packet size should fit in a uint16_t");
520 /* when the answer is encrypted in place, we need to get a copy
521 of the original header before encryption to fill the ring buffer */
522 dnsheader cleartextDH
;
523 vector
<uint8_t> rewrittenResponse
;
525 uint16_t queryId
= 0;
526 std::vector
<int> sockets
;
527 sockets
.reserve(dss
->sockets
.size());
530 dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(packet
);
532 pickBackendSocketsReadyForReceiving(dss
, sockets
);
533 for (const auto& fd
: sockets
) {
534 ssize_t got
= recv(fd
, packet
, sizeof(packet
), 0);
535 char * response
= packet
;
536 size_t responseSize
= sizeof(packet
);
538 if (got
< 0 || static_cast<size_t>(got
) < sizeof(dnsheader
))
541 uint16_t responseLen
= static_cast<uint16_t>(got
);
544 if(queryId
>= dss
->idStates
.size()) {
548 IDState
* ids
= &dss
->idStates
[queryId
];
549 int64_t usageIndicator
= ids
->usageIndicator
;
551 if(!IDState::isInUse(usageIndicator
)) {
552 /* the corresponding state is marked as not in use, meaning that:
553 - it was already cleaned up by another thread and the state is gone ;
554 - we already got a response for this query and this one is a duplicate.
555 Either way, we don't touch it.
560 /* read the potential DOHUnit state as soon as possible, but don't use it
561 until we have confirmed that we own this state by updating usageIndicator */
563 /* setting age to 0 to prevent the maintainer thread from
564 cleaning this IDS while we process the response.
567 int origFD
= ids
->origFD
;
569 unsigned int consumed
= 0;
570 if (!responseContentMatches(response
, responseLen
, ids
->qname
, ids
->qtype
, ids
->qclass
, dss
->remote
, consumed
)) {
574 bool isDoH
= du
!= nullptr;
575 /* atomically mark the state as available, but only if it has not been altered
577 if (ids
->tryMarkUnused(usageIndicator
)) {
578 /* clear the potential DOHUnit asap, it's ours now
579 and since we just marked the state as unused,
580 someone could overwrite it. */
582 /* we only decrement the outstanding counter if the value was not
583 altered in the meantime, which would mean that the state has been actively reused
584 and the other thread has not incremented the outstanding counter, so we don't
585 want it to be decremented twice. */
586 --dss
->outstanding
; // you'd think an attacker could game this, but we're using connected socket
588 /* someone updated the state in the meantime, we can't touch the existing pointer */
590 /* since the state has been updated, we can't safely access it so let's just drop
595 if(dh
->tc
&& g_truncateTC
) {
596 truncateTC(response
, &responseLen
, responseSize
, consumed
);
599 dh
->id
= ids
->origID
;
601 uint16_t addRoom
= 0;
602 DNSResponse dr
= makeDNSResponseFromIDState(*ids
, dh
, sizeof(packet
), responseLen
, false);
603 if (dr
.dnsCryptQuery
) {
604 addRoom
= DNSCRYPT_MAX_RESPONSE_PADDING_AND_MAC_SIZE
;
607 memcpy(&cleartextDH
, dr
.dh
, sizeof(cleartextDH
));
608 if (!processResponse(&response
, &responseLen
, &responseSize
, localRespRulactions
, dr
, addRoom
, rewrittenResponse
, ids
->cs
&& ids
->cs
->muted
)) {
612 if (ids
->cs
&& !ids
->cs
->muted
) {
614 #ifdef HAVE_DNS_OVER_HTTPS
616 du
->response
= std::string(response
, responseLen
);
617 if (send(du
->rsock
, &du
, sizeof(du
), 0) != sizeof(du
)) {
618 /* at this point we have the only remaining pointer on this
619 DOHUnit object since we did set ids->du to nullptr earlier */
622 #endif /* HAVE_DNS_OVER_HTTPS */
627 empty
.sin4
.sin_family
= 0;
628 /* if ids->destHarvested is false, origDest holds the listening address.
629 We don't want to use that as a source since it could be 0.0.0.0 for example. */
630 sendUDPResponse(origFD
, response
, responseLen
, dr
.delayMsec
, ids
->destHarvested
? ids
->origDest
: empty
, ids
->origRemote
);
636 ++ids
->cs
->responses
;
640 double udiff
= ids
->sentTime
.udiff();
641 vinfolog("Got answer from %s, relayed to %s%s, took %f usec", dss
->remote
.toStringWithPort(), ids
->origRemote
.toStringWithPort(),
642 isDoH
? " (https)": "", udiff
);
646 g_rings
.insertResponse(ts
, *dr
.remote
, *dr
.qname
, dr
.qtype
, static_cast<unsigned int>(udiff
), static_cast<unsigned int>(got
), cleartextDH
, dss
->remote
);
648 switch (cleartextDH
.rcode
) {
649 case RCode::NXDomain
:
650 ++g_stats
.frontendNXDomain
;
652 case RCode::ServFail
:
653 ++g_stats
.servfailResponses
;
654 ++g_stats
.frontendServFail
;
657 ++g_stats
.frontendNoError
;
660 dss
->latencyUsec
= (127.0 * dss
->latencyUsec
/ 128.0) + udiff
/128.0;
662 doLatencyStats(udiff
);
664 rewrittenResponse
.clear();
667 catch(const std::exception
& e
){
668 vinfolog("Got an error in UDP responder thread while parsing a response from %s, id %d: %s", dss
->remote
.toStringWithPort(), queryId
, e
.what());
672 catch(const std::exception
& e
)
674 errlog("UDP responder thread died because of exception: %s", e
.what());
676 catch(const PDNSException
& e
)
678 errlog("UDP responder thread died because of PowerDNS exception: %s", e
.reason
);
682 errlog("UDP responder thread died because of an exception: %s", "unknown");
685 bool DownstreamState::reconnect()
687 std::unique_lock
<std::mutex
> tl(connectLock
, std::try_to_lock
);
688 if (!tl
.owns_lock()) {
689 /* we are already reconnecting */
694 for (auto& fd
: sockets
) {
696 if (sockets
.size() > 1) {
697 std::lock_guard
<std::mutex
> lock(socketsLock
);
698 mplexer
->removeReadFD(fd
);
700 /* shutdown() is needed to wake up recv() in the responderThread */
701 shutdown(fd
, SHUT_RDWR
);
705 if (!IsAnyAddress(remote
)) {
706 fd
= SSocket(remote
.sin4
.sin_family
, SOCK_DGRAM
, 0);
707 if (!IsAnyAddress(sourceAddr
)) {
708 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEADDR
, 1);
709 if (!sourceItfName
.empty()) {
710 #ifdef SO_BINDTODEVICE
711 int res
= setsockopt(fd
, SOL_SOCKET
, SO_BINDTODEVICE
, sourceItfName
.c_str(), sourceItfName
.length());
713 infolog("Error setting up the interface on backend socket '%s': %s", remote
.toStringWithPort(), stringerror());
718 SBind(fd
, sourceAddr
);
721 SConnect(fd
, remote
);
722 if (sockets
.size() > 1) {
723 std::lock_guard
<std::mutex
> lock(socketsLock
);
724 mplexer
->addReadFD(fd
, [](int, boost::any
) {});
728 catch(const std::runtime_error
& error
) {
729 infolog("Error connecting to new server with address %s: %s", remote
.toStringWithPort(), error
.what());
736 /* if at least one (re-)connection failed, close all sockets */
738 for (auto& fd
: sockets
) {
740 if (sockets
.size() > 1) {
741 std::lock_guard
<std::mutex
> lock(socketsLock
);
742 mplexer
->removeReadFD(fd
);
744 /* shutdown() is needed to wake up recv() in the responderThread */
745 shutdown(fd
, SHUT_RDWR
);
754 void DownstreamState::hash()
756 vinfolog("Computing hashes for id=%s and weight=%d", id
, weight
);
758 WriteLock
wl(&d_lock
);
761 std::string uuid
= boost::str(boost::format("%s-%d") % id
% w
);
762 unsigned int wshash
= burtleCI((const unsigned char*)uuid
.c_str(), uuid
.size(), g_hashperturb
);
763 hashes
.insert(wshash
);
768 void DownstreamState::setId(const boost::uuids::uuid
& newId
)
771 // compute hashes only if already done
772 if (!hashes
.empty()) {
777 void DownstreamState::setWeight(int newWeight
)
780 errlog("Error setting server's weight: downstream weight value must be greater than 0.");
784 if (!hashes
.empty()) {
789 DownstreamState::DownstreamState(const ComboAddress
& remote_
, const ComboAddress
& sourceAddr_
, unsigned int sourceItf_
, const std::string
& sourceItfName_
, size_t numberOfSockets
): sourceItfName(sourceItfName_
), remote(remote_
), sourceAddr(sourceAddr_
), sourceItf(sourceItf_
)
791 pthread_rwlock_init(&d_lock
, nullptr);
793 threadStarted
.clear();
795 mplexer
= std::unique_ptr
<FDMultiplexer
>(FDMultiplexer::getMultiplexerSilent());
797 sockets
.resize(numberOfSockets
);
798 for (auto& fd
: sockets
) {
802 if (!IsAnyAddress(remote
)) {
804 idStates
.resize(g_maxOutstanding
);
806 infolog("Added downstream server %s", remote
.toStringWithPort());
811 std::mutex g_luamutex
;
814 GlobalStateHolder
<ServerPolicy
> g_policy
;
816 shared_ptr
<DownstreamState
> firstAvailable(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
818 for(auto& d
: servers
) {
819 if(d
.second
->isUp() && d
.second
->qps
.check())
822 return leastOutstanding(servers
, dq
);
825 // get server with least outstanding queries, and within those, with the lowest order, and within those: the fastest
826 shared_ptr
<DownstreamState
> leastOutstanding(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
828 if (servers
.size() == 1 && servers
[0].second
->isUp()) {
829 return servers
[0].second
;
832 vector
<pair
<tuple
<int,int,double>, shared_ptr
<DownstreamState
>>> poss
;
833 /* so you might wonder, why do we go through this trouble? The data on which we sort could change during the sort,
834 which would suck royally and could even lead to crashes. So first we snapshot on what we sort, and then we sort */
835 poss
.reserve(servers
.size());
836 for(auto& d
: servers
) {
837 if(d
.second
->isUp()) {
838 poss
.push_back({make_tuple(d
.second
->outstanding
.load(), d
.second
->order
, d
.second
->latencyUsec
), d
.second
});
842 return shared_ptr
<DownstreamState
>();
843 nth_element(poss
.begin(), poss
.begin(), poss
.end(), [](const decltype(poss
)::value_type
& a
, const decltype(poss
)::value_type
& b
) { return a
.first
< b
.first
; });
844 return poss
.begin()->second
;
847 shared_ptr
<DownstreamState
> valrandom(unsigned int val
, const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
849 vector
<pair
<int, shared_ptr
<DownstreamState
>>> poss
;
851 int max
= std::numeric_limits
<int>::max();
853 for(auto& d
: servers
) { // w=1, w=10 -> 1, 11
854 if(d
.second
->isUp()) {
855 // Don't overflow sum when adding high weights
856 if(d
.second
->weight
> max
- sum
) {
859 sum
+= d
.second
->weight
;
862 poss
.push_back({sum
, d
.second
});
866 // Catch poss & sum are empty to avoid SIGFPE
868 return shared_ptr
<DownstreamState
>();
871 auto p
= upper_bound(poss
.begin(), poss
.end(),r
, [](int r_
, const decltype(poss
)::value_type
& a
) { return r_
< a
.first
;});
873 return shared_ptr
<DownstreamState
>();
877 shared_ptr
<DownstreamState
> wrandom(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
879 return valrandom(random(), servers
, dq
);
882 uint32_t g_hashperturb
;
883 shared_ptr
<DownstreamState
> whashed(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
885 return valrandom(dq
->qname
->hash(g_hashperturb
), servers
, dq
);
888 shared_ptr
<DownstreamState
> chashed(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
890 unsigned int qhash
= dq
->qname
->hash(g_hashperturb
);
891 unsigned int sel
= std::numeric_limits
<unsigned int>::max();
892 unsigned int min
= std::numeric_limits
<unsigned int>::max();
893 shared_ptr
<DownstreamState
> ret
= nullptr, first
= nullptr;
895 for (const auto& d
: servers
) {
896 if (d
.second
->isUp()) {
897 // make sure hashes have been computed
898 if (d
.second
->hashes
.empty()) {
902 ReadLock
rl(&(d
.second
->d_lock
));
903 const auto& server
= d
.second
;
904 // we want to keep track of the last hash
905 if (min
> *(server
->hashes
.begin())) {
906 min
= *(server
->hashes
.begin());
910 auto hash_it
= server
->hashes
.lower_bound(qhash
);
911 if (hash_it
!= server
->hashes
.end()) {
912 if (*hash_it
< sel
) {
920 if (ret
!= nullptr) {
923 if (first
!= nullptr) {
926 return shared_ptr
<DownstreamState
>();
929 shared_ptr
<DownstreamState
> roundrobin(const NumberedServerVector
& servers
, const DNSQuestion
* dq
)
931 NumberedServerVector poss
;
933 for(auto& d
: servers
) {
934 if(d
.second
->isUp()) {
939 const auto *res
=&poss
;
940 if(poss
.empty() && !g_roundrobinFailOnNoServer
)
944 return shared_ptr
<DownstreamState
>();
946 static unsigned int counter
;
948 return (*res
)[(counter
++) % res
->size()].second
;
951 ComboAddress g_serverControl
{"127.0.0.1:5199"};
953 std::shared_ptr
<ServerPool
> createPoolIfNotExists(pools_t
& pools
, const string
& poolName
)
955 std::shared_ptr
<ServerPool
> pool
;
956 pools_t::iterator it
= pools
.find(poolName
);
957 if (it
!= pools
.end()) {
961 if (!poolName
.empty())
962 vinfolog("Creating pool %s", poolName
);
963 pool
= std::make_shared
<ServerPool
>();
964 pools
.insert(std::pair
<std::string
,std::shared_ptr
<ServerPool
> >(poolName
, pool
));
969 void setPoolPolicy(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<ServerPolicy
> policy
)
971 std::shared_ptr
<ServerPool
> pool
= createPoolIfNotExists(pools
, poolName
);
972 if (!poolName
.empty()) {
973 vinfolog("Setting pool %s server selection policy to %s", poolName
, policy
->name
);
975 vinfolog("Setting default pool server selection policy to %s", policy
->name
);
977 pool
->policy
= policy
;
980 void addServerToPool(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<DownstreamState
> server
)
982 std::shared_ptr
<ServerPool
> pool
= createPoolIfNotExists(pools
, poolName
);
983 if (!poolName
.empty()) {
984 vinfolog("Adding server to pool %s", poolName
);
986 vinfolog("Adding server to default pool");
988 pool
->addServer(server
);
991 void removeServerFromPool(pools_t
& pools
, const string
& poolName
, std::shared_ptr
<DownstreamState
> server
)
993 std::shared_ptr
<ServerPool
> pool
= getPool(pools
, poolName
);
995 if (!poolName
.empty()) {
996 vinfolog("Removing server from pool %s", poolName
);
999 vinfolog("Removing server from default pool");
1002 pool
->removeServer(server
);
1005 std::shared_ptr
<ServerPool
> getPool(const pools_t
& pools
, const std::string
& poolName
)
1007 pools_t::const_iterator it
= pools
.find(poolName
);
1009 if (it
== pools
.end()) {
1010 throw std::out_of_range("No pool named " + poolName
);
1016 NumberedServerVector
getDownstreamCandidates(const pools_t
& pools
, const std::string
& poolName
)
1018 std::shared_ptr
<ServerPool
> pool
= getPool(pools
, poolName
);
1019 return pool
->getServers();
1022 static void spoofResponseFromString(DNSQuestion
& dq
, const string
& spoofContent
)
1026 std::vector
<std::string
> addrs
;
1027 stringtok(addrs
, spoofContent
, " ,");
1029 if (addrs
.size() == 1) {
1031 ComboAddress
spoofAddr(spoofContent
);
1032 SpoofAction
sa({spoofAddr
});
1035 catch(const PDNSException
&e
) {
1036 SpoofAction
sa(spoofContent
); // CNAME then
1040 std::vector
<ComboAddress
> cas
;
1041 for (const auto& addr
: addrs
) {
1043 cas
.push_back(ComboAddress(addr
));
1048 SpoofAction
sa(cas
);
1053 bool processRulesResult(const DNSAction::Action
& action
, DNSQuestion
& dq
, std::string
& ruleresult
, bool& drop
)
1056 case DNSAction::Action::Allow
:
1059 case DNSAction::Action::Drop
:
1064 case DNSAction::Action::Nxdomain
:
1065 dq
.dh
->rcode
= RCode::NXDomain
;
1067 ++g_stats
.ruleNXDomain
;
1070 case DNSAction::Action::Refused
:
1071 dq
.dh
->rcode
= RCode::Refused
;
1073 ++g_stats
.ruleRefused
;
1076 case DNSAction::Action::ServFail
:
1077 dq
.dh
->rcode
= RCode::ServFail
;
1079 ++g_stats
.ruleServFail
;
1082 case DNSAction::Action::Spoof
:
1083 spoofResponseFromString(dq
, ruleresult
);
1086 case DNSAction::Action::Truncate
:
1091 case DNSAction::Action::HeaderModify
:
1094 case DNSAction::Action::Pool
:
1095 dq
.poolname
=ruleresult
;
1098 case DNSAction::Action::NoRecurse
:
1102 /* non-terminal actions follow */
1103 case DNSAction::Action::Delay
:
1104 dq
.delayMsec
= static_cast<int>(pdns_stou(ruleresult
)); // sorry
1106 case DNSAction::Action::None
:
1108 case DNSAction::Action::NoOp
:
1112 /* false means that we don't stop the processing */
1117 static bool applyRulesToQuery(LocalHolders
& holders
, DNSQuestion
& dq
, const struct timespec
& now
)
1119 g_rings
.insertQuery(now
, *dq
.remote
, *dq
.qname
, dq
.qtype
, dq
.len
, *dq
.dh
);
1121 if(g_qcount
.enabled
) {
1122 string qname
= (*dq
.qname
).toLogString();
1123 bool countQuery
{true};
1124 if(g_qcount
.filter
) {
1125 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1126 std::tie (countQuery
, qname
) = g_qcount
.filter(&dq
);
1130 WriteLock
wl(&g_qcount
.queryLock
);
1131 if(!g_qcount
.records
.count(qname
)) {
1132 g_qcount
.records
[qname
] = 0;
1134 g_qcount
.records
[qname
]++;
1138 if(auto got
= holders
.dynNMGBlock
->lookup(*dq
.remote
)) {
1139 auto updateBlockStats
= [&got
]() {
1140 ++g_stats
.dynBlocked
;
1141 got
->second
.blocks
++;
1144 if(now
< got
->second
.until
) {
1145 DNSAction::Action action
= got
->second
.action
;
1146 if (action
== DNSAction::Action::None
) {
1147 action
= g_dynBlockAction
;
1150 case DNSAction::Action::NoOp
:
1154 case DNSAction::Action::Nxdomain
:
1155 vinfolog("Query from %s turned into NXDomain because of dynamic block", dq
.remote
->toStringWithPort());
1158 dq
.dh
->rcode
= RCode::NXDomain
;
1162 case DNSAction::Action::Refused
:
1163 vinfolog("Query from %s refused because of dynamic block", dq
.remote
->toStringWithPort());
1166 dq
.dh
->rcode
= RCode::Refused
;
1170 case DNSAction::Action::Truncate
:
1173 vinfolog("Query from %s truncated because of dynamic block", dq
.remote
->toStringWithPort());
1179 vinfolog("Query from %s for %s over TCP *not* truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1182 case DNSAction::Action::NoRecurse
:
1184 vinfolog("Query from %s setting rd=0 because of dynamic block", dq
.remote
->toStringWithPort());
1189 vinfolog("Query from %s dropped because of dynamic block", dq
.remote
->toStringWithPort());
1195 if(auto got
= holders
.dynSMTBlock
->lookup(*dq
.qname
)) {
1196 auto updateBlockStats
= [&got
]() {
1197 ++g_stats
.dynBlocked
;
1201 if(now
< got
->until
) {
1202 DNSAction::Action action
= got
->action
;
1203 if (action
== DNSAction::Action::None
) {
1204 action
= g_dynBlockAction
;
1207 case DNSAction::Action::NoOp
:
1210 case DNSAction::Action::Nxdomain
:
1211 vinfolog("Query from %s for %s turned into NXDomain because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1214 dq
.dh
->rcode
= RCode::NXDomain
;
1217 case DNSAction::Action::Refused
:
1218 vinfolog("Query from %s for %s refused because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1221 dq
.dh
->rcode
= RCode::Refused
;
1224 case DNSAction::Action::Truncate
:
1228 vinfolog("Query from %s for %s truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1234 vinfolog("Query from %s for %s over TCP *not* truncated because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1237 case DNSAction::Action::NoRecurse
:
1239 vinfolog("Query from %s setting rd=0 because of dynamic block", dq
.remote
->toStringWithPort());
1244 vinfolog("Query from %s for %s dropped because of dynamic block", dq
.remote
->toStringWithPort(), dq
.qname
->toLogString());
1250 DNSAction::Action action
=DNSAction::Action::None
;
1253 for(const auto& lr
: *holders
.rulactions
) {
1254 if(lr
.d_rule
->matches(&dq
)) {
1255 lr
.d_rule
->d_matches
++;
1256 action
=(*lr
.d_action
)(&dq
, &ruleresult
);
1257 if (processRulesResult(action
, dq
, ruleresult
, drop
)) {
1270 ssize_t
udpClientSendRequestToBackend(const std::shared_ptr
<DownstreamState
>& ss
, const int sd
, const char* request
, const size_t requestLen
, bool healthCheck
)
1274 if (ss
->sourceItf
== 0) {
1275 result
= send(sd
, request
, requestLen
, 0);
1280 cmsgbuf_aligned cbuf
;
1281 ComboAddress
remote(ss
->remote
);
1282 fillMSGHdr(&msgh
, &iov
, &cbuf
, sizeof(cbuf
), const_cast<char*>(request
), requestLen
, &remote
);
1283 addCMsgSrcAddr(&msgh
, &cbuf
, &ss
->sourceAddr
, ss
->sourceItf
);
1284 result
= sendmsg(sd
, &msgh
, 0);
1288 int savederrno
= errno
;
1289 vinfolog("Error sending request to backend %s: %d", ss
->remote
.toStringWithPort(), savederrno
);
1291 /* This might sound silly, but on Linux send() might fail with EINVAL
1292 if the interface the socket was bound to doesn't exist anymore.
1293 We don't want to reconnect the real socket if the healthcheck failed,
1294 because it's not using the same socket.
1296 if (!healthCheck
&& (savederrno
== EINVAL
|| savederrno
== ENODEV
)) {
1304 static bool isUDPQueryAcceptable(ClientState
& cs
, LocalHolders
& holders
, const struct msghdr
* msgh
, const ComboAddress
& remote
, ComboAddress
& dest
)
1306 if (msgh
->msg_flags
& MSG_TRUNC
) {
1307 /* message was too large for our buffer */
1308 vinfolog("Dropping message too large for our buffer");
1309 ++g_stats
.nonCompliantQueries
;
1313 if(!holders
.acl
->match(remote
)) {
1314 vinfolog("Query from %s dropped because of ACL", remote
.toStringWithPort());
1322 if (HarvestDestinationAddress(msgh
, &dest
)) {
1323 /* we don't get the port, only the address */
1324 dest
.sin4
.sin_port
= cs
.local
.sin4
.sin_port
;
1327 dest
.sin4
.sin_family
= 0;
1333 boost::optional
<std::vector
<uint8_t>> checkDNSCryptQuery(const ClientState
& cs
, const char* query
, uint16_t& len
, std::shared_ptr
<DNSCryptQuery
>& dnsCryptQuery
, time_t now
, bool tcp
)
1335 if (cs
.dnscryptCtx
) {
1336 #ifdef HAVE_DNSCRYPT
1337 vector
<uint8_t> response
;
1338 uint16_t decryptedQueryLen
= 0;
1340 dnsCryptQuery
= std::make_shared
<DNSCryptQuery
>(cs
.dnscryptCtx
);
1342 bool decrypted
= handleDNSCryptQuery(const_cast<char*>(query
), len
, dnsCryptQuery
, &decryptedQueryLen
, tcp
, now
, response
);
1345 if (response
.size() > 0) {
1348 throw std::runtime_error("Unable to decrypt DNSCrypt query, dropping.");
1351 len
= decryptedQueryLen
;
1352 #endif /* HAVE_DNSCRYPT */
1357 bool checkQueryHeaders(const struct dnsheader
* dh
)
1359 if (dh
->qr
) { // don't respond to responses
1360 ++g_stats
.nonCompliantQueries
;
1364 if (dh
->qdcount
== 0) {
1365 ++g_stats
.emptyQueries
;
1370 ++g_stats
.rdQueries
;
1376 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1377 static void queueResponse(const ClientState
& cs
, const char* response
, uint16_t responseLen
, const ComboAddress
& dest
, const ComboAddress
& remote
, struct mmsghdr
& outMsg
, struct iovec
* iov
, cmsgbuf_aligned
* cbuf
)
1380 fillMSGHdr(&outMsg
.msg_hdr
, iov
, nullptr, 0, const_cast<char*>(response
), responseLen
, const_cast<ComboAddress
*>(&remote
));
1382 if (dest
.sin4
.sin_family
== 0) {
1383 outMsg
.msg_hdr
.msg_control
= nullptr;
1386 addCMsgSrcAddr(&outMsg
.msg_hdr
, cbuf
, &dest
, 0);
1389 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1391 /* self-generated responses or cache hits */
1392 static bool prepareOutgoingResponse(LocalHolders
& holders
, ClientState
& cs
, DNSQuestion
& dq
, bool cacheHit
)
1394 DNSResponse
dr(dq
.qname
, dq
.qtype
, dq
.qclass
, dq
.consumed
, dq
.local
, dq
.remote
, reinterpret_cast<dnsheader
*>(dq
.dh
), dq
.size
, dq
.len
, dq
.tcp
, dq
.queryTime
);
1396 #ifdef HAVE_PROTOBUF
1397 dr
.uniqueId
= dq
.uniqueId
;
1400 dr
.delayMsec
= dq
.delayMsec
;
1402 if (!applyRulesToResponse(cacheHit
? holders
.cacheHitRespRulactions
: holders
.selfAnsweredRespRulactions
, dr
)) {
1406 /* in case a rule changed it */
1407 dq
.delayMsec
= dr
.delayMsec
;
1409 #ifdef HAVE_DNSCRYPT
1411 if (!encryptResponse(reinterpret_cast<char*>(dq
.dh
), &dq
.len
, dq
.size
, dq
.tcp
, dq
.dnsCryptQuery
, nullptr, nullptr)) {
1415 #endif /* HAVE_DNSCRYPT */
1418 ++g_stats
.cacheHits
;
1421 switch (dr
.dh
->rcode
) {
1422 case RCode::NXDomain
:
1423 ++g_stats
.frontendNXDomain
;
1425 case RCode::ServFail
:
1426 ++g_stats
.frontendServFail
;
1428 case RCode::NoError
:
1429 ++g_stats
.frontendNoError
;
1433 doLatencyStats(0); // we're not going to measure this
1437 ProcessQueryResult
processQuery(DNSQuestion
& dq
, ClientState
& cs
, LocalHolders
& holders
, std::shared_ptr
<DownstreamState
>& selectedBackend
)
1439 const uint16_t queryId
= ntohs(dq
.dh
->id
);
1442 /* we need an accurate ("real") value for the response and
1443 to store into the IDS, but not for insertion into the
1444 rings for example */
1445 struct timespec now
;
1448 if (!applyRulesToQuery(holders
, dq
, now
)) {
1449 return ProcessQueryResult::Drop
;
1452 if(dq
.dh
->qr
) { // something turned it into a response
1453 fixUpQueryTurnedResponse(dq
, dq
.origFlags
);
1455 if (!prepareOutgoingResponse(holders
, cs
, dq
, false)) {
1456 return ProcessQueryResult::Drop
;
1459 ++g_stats
.selfAnswered
;
1461 return ProcessQueryResult::SendAnswer
;
1464 std::shared_ptr
<ServerPool
> serverPool
= getPool(*holders
.pools
, dq
.poolname
);
1465 dq
.packetCache
= serverPool
->packetCache
;
1466 auto policy
= *(holders
.policy
);
1467 if (serverPool
->policy
!= nullptr) {
1468 policy
= *(serverPool
->policy
);
1470 auto servers
= serverPool
->getServers();
1472 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1473 selectedBackend
= policy
.policy(servers
, &dq
);
1476 selectedBackend
= policy
.policy(servers
, &dq
);
1479 uint16_t cachedResponseSize
= dq
.size
;
1480 uint32_t allowExpired
= selectedBackend
? 0 : g_staleCacheEntriesTTL
;
1482 if (dq
.packetCache
&& !dq
.skipCache
) {
1483 dq
.dnssecOK
= (getEDNSZ(dq
) & EDNS_HEADER_FLAG_DO
);
1486 if (dq
.useECS
&& ((selectedBackend
&& selectedBackend
->useECS
) || (!selectedBackend
&& serverPool
->getECS()))) {
1487 // we special case our cache in case a downstream explicitly gave us a universally valid response with a 0 scope
1488 if (dq
.packetCache
&& !dq
.skipCache
&& (!selectedBackend
|| !selectedBackend
->disableZeroScope
) && dq
.packetCache
->isECSParsingEnabled()) {
1489 if (dq
.packetCache
->get(dq
, dq
.consumed
, dq
.dh
->id
, reinterpret_cast<char*>(dq
.dh
), &cachedResponseSize
, &dq
.cacheKeyNoECS
, dq
.subnet
, dq
.dnssecOK
, allowExpired
)) {
1490 dq
.len
= cachedResponseSize
;
1492 if (!prepareOutgoingResponse(holders
, cs
, dq
, true)) {
1493 return ProcessQueryResult::Drop
;
1496 return ProcessQueryResult::SendAnswer
;
1500 /* there was no existing ECS on the query, enable the zero-scope feature */
1501 dq
.useZeroScope
= true;
1505 if (!handleEDNSClientSubnet(dq
, &(dq
.ednsAdded
), &(dq
.ecsAdded
), g_preserveTrailingData
)) {
1506 vinfolog("Dropping query from %s because we couldn't insert the ECS value", dq
.remote
->toStringWithPort());
1507 return ProcessQueryResult::Drop
;
1511 if (dq
.packetCache
&& !dq
.skipCache
) {
1512 if (dq
.packetCache
->get(dq
, dq
.consumed
, dq
.dh
->id
, reinterpret_cast<char*>(dq
.dh
), &cachedResponseSize
, &dq
.cacheKey
, dq
.subnet
, dq
.dnssecOK
, allowExpired
)) {
1513 dq
.len
= cachedResponseSize
;
1515 if (!prepareOutgoingResponse(holders
, cs
, dq
, true)) {
1516 return ProcessQueryResult::Drop
;
1519 return ProcessQueryResult::SendAnswer
;
1521 ++g_stats
.cacheMisses
;
1524 if(!selectedBackend
) {
1527 vinfolog("%s query for %s|%s from %s, no policy applied", g_servFailOnNoPolicy
? "ServFailed" : "Dropped", dq
.qname
->toLogString(), QType(dq
.qtype
).getName(), dq
.remote
->toStringWithPort());
1528 if (g_servFailOnNoPolicy
) {
1529 restoreFlags(dq
.dh
, dq
.origFlags
);
1531 dq
.dh
->rcode
= RCode::ServFail
;
1534 if (!prepareOutgoingResponse(holders
, cs
, dq
, false)) {
1535 return ProcessQueryResult::Drop
;
1537 // no response-only statistics counter to update.
1538 return ProcessQueryResult::SendAnswer
;
1541 return ProcessQueryResult::Drop
;
1544 if (dq
.addXPF
&& selectedBackend
->xpfRRCode
!= 0) {
1545 addXPF(dq
, selectedBackend
->xpfRRCode
, g_preserveTrailingData
);
1548 selectedBackend
->queries
++;
1549 return ProcessQueryResult::PassToBackend
;
1551 catch(const std::exception
& e
){
1552 vinfolog("Got an error while parsing a %s query from %s, id %d: %s", (dq
.tcp
? "TCP" : "UDP"), dq
.remote
->toStringWithPort(), queryId
, e
.what());
1554 return ProcessQueryResult::Drop
;
1557 static void processUDPQuery(ClientState
& cs
, LocalHolders
& holders
, const struct msghdr
* msgh
, const ComboAddress
& remote
, ComboAddress
& dest
, char* query
, uint16_t len
, size_t queryBufferSize
, struct mmsghdr
* responsesVect
, unsigned int* queuedResponses
, struct iovec
* respIOV
, cmsgbuf_aligned
* respCBuf
)
1559 assert(responsesVect
== nullptr || (queuedResponses
!= nullptr && respIOV
!= nullptr && respCBuf
!= nullptr));
1560 uint16_t queryId
= 0;
1563 if (!isUDPQueryAcceptable(cs
, holders
, msgh
, remote
, dest
)) {
1567 /* we need an accurate ("real") value for the response and
1568 to store into the IDS, but not for insertion into the
1569 rings for example */
1570 struct timespec queryRealTime
;
1571 gettime(&queryRealTime
, true);
1573 std::shared_ptr
<DNSCryptQuery
> dnsCryptQuery
= nullptr;
1574 auto dnsCryptResponse
= checkDNSCryptQuery(cs
, query
, len
, dnsCryptQuery
, queryRealTime
.tv_sec
, false);
1575 if (dnsCryptResponse
) {
1576 sendUDPResponse(cs
.udpFD
, reinterpret_cast<char*>(dnsCryptResponse
->data()), static_cast<uint16_t>(dnsCryptResponse
->size()), 0, dest
, remote
);
1580 struct dnsheader
* dh
= reinterpret_cast<struct dnsheader
*>(query
);
1581 queryId
= ntohs(dh
->id
);
1583 if (!checkQueryHeaders(dh
)) {
1587 uint16_t qtype
, qclass
;
1588 unsigned int consumed
= 0;
1589 DNSName
qname(query
, len
, sizeof(dnsheader
), false, &qtype
, &qclass
, &consumed
);
1590 DNSQuestion
dq(&qname
, qtype
, qclass
, consumed
, dest
.sin4
.sin_family
!= 0 ? &dest
: &cs
.local
, &remote
, dh
, queryBufferSize
, len
, false, &queryRealTime
);
1591 dq
.dnsCryptQuery
= std::move(dnsCryptQuery
);
1592 std::shared_ptr
<DownstreamState
> ss
{nullptr};
1593 auto result
= processQuery(dq
, cs
, holders
, ss
);
1595 if (result
== ProcessQueryResult::Drop
) {
1599 if (result
== ProcessQueryResult::SendAnswer
) {
1600 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1601 if (dq
.delayMsec
== 0 && responsesVect
!= nullptr) {
1602 queueResponse(cs
, reinterpret_cast<char*>(dq
.dh
), dq
.len
, *dq
.local
, *dq
.remote
, responsesVect
[*queuedResponses
], respIOV
, respCBuf
);
1603 (*queuedResponses
)++;
1606 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1607 /* we use dest, always, because we don't want to use the listening address to send a response since it could be 0.0.0.0 */
1608 sendUDPResponse(cs
.udpFD
, reinterpret_cast<char*>(dq
.dh
), dq
.len
, dq
.delayMsec
, dest
, *dq
.remote
);
1612 if (result
!= ProcessQueryResult::PassToBackend
|| ss
== nullptr) {
1616 unsigned int idOffset
= (ss
->idOffset
++) % ss
->idStates
.size();
1617 IDState
* ids
= &ss
->idStates
[idOffset
];
1619 DOHUnit
* du
= nullptr;
1621 /* that means that the state was in use, possibly with an allocated
1622 DOHUnit that we will need to handle, but we can't touch it before
1623 confirming that we now own this state */
1624 if (ids
->isInUse()) {
1628 /* we atomically replace the value, we now own this state */
1629 if (!ids
->markAsUsed()) {
1630 /* the state was not in use.
1631 we reset 'du' because it might have still been in use when we read it. */
1636 /* we are reusing a state, no change in outstanding but if there was an existing DOHUnit we need
1637 to handle it because it's about to be overwritten. */
1640 ++g_stats
.downstreamTimeouts
;
1641 handleDOHTimeout(du
);
1645 ids
->origFD
= cs
.udpFD
;
1646 ids
->origID
= dh
->id
;
1647 setIDStateFromDNSQuestion(*ids
, dq
, std::move(qname
));
1649 /* If we couldn't harvest the real dest addr, still
1650 write down the listening addr since it will be useful
1651 (especially if it's not an 'any' one).
1652 We need to keep track of which one it is since we may
1653 want to use the real but not the listening addr to reply.
1655 if (dest
.sin4
.sin_family
!= 0) {
1656 ids
->origDest
= dest
;
1657 ids
->destHarvested
= true;
1660 ids
->origDest
= cs
.local
;
1661 ids
->destHarvested
= false;
1666 int fd
= pickBackendSocketForSending(ss
);
1667 ssize_t ret
= udpClientSendRequestToBackend(ss
, fd
, query
, dq
.len
);
1671 ++g_stats
.downstreamSendErrors
;
1674 vinfolog("Got query for %s|%s from %s, relayed to %s", ids
->qname
.toLogString(), QType(ids
->qtype
).getName(), remote
.toStringWithPort(), ss
->getName());
1676 catch(const std::exception
& e
){
1677 vinfolog("Got an error in UDP question thread while parsing a query from %s, id %d: %s", remote
.toStringWithPort(), queryId
, e
.what());
1681 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1682 static void MultipleMessagesUDPClientThread(ClientState
* cs
, LocalHolders
& holders
)
1686 char packet
[s_maxPacketCacheEntrySize
];
1687 ComboAddress remote
;
1690 /* used by HarvestDestinationAddress */
1691 cmsgbuf_aligned cbuf
;
1693 const size_t vectSize
= g_udpVectorSize
;
1694 /* the actual buffer is larger because:
1695 - we may have to add EDNS and/or ECS
1696 - we use it for self-generated responses (from rule or cache)
1697 but we only accept incoming payloads up to that size
1699 static_assert(s_udpIncomingBufferSize
<= sizeof(MMReceiver::packet
), "the incoming buffer size should not be larger than sizeof(MMReceiver::packet)");
1701 auto recvData
= std::unique_ptr
<MMReceiver
[]>(new MMReceiver
[vectSize
]);
1702 auto msgVec
= std::unique_ptr
<struct mmsghdr
[]>(new struct mmsghdr
[vectSize
]);
1703 auto outMsgVec
= std::unique_ptr
<struct mmsghdr
[]>(new struct mmsghdr
[vectSize
]);
1705 /* initialize the structures needed to receive our messages */
1706 for (size_t idx
= 0; idx
< vectSize
; idx
++) {
1707 recvData
[idx
].remote
.sin4
.sin_family
= cs
->local
.sin4
.sin_family
;
1708 fillMSGHdr(&msgVec
[idx
].msg_hdr
, &recvData
[idx
].iov
, &recvData
[idx
].cbuf
, sizeof(recvData
[idx
].cbuf
), recvData
[idx
].packet
, s_udpIncomingBufferSize
, &recvData
[idx
].remote
);
1714 /* reset the IO vector, since it's also used to send the vector of responses
1715 to avoid having to copy the data around */
1716 for (size_t idx
= 0; idx
< vectSize
; idx
++) {
1717 recvData
[idx
].iov
.iov_base
= recvData
[idx
].packet
;
1718 recvData
[idx
].iov
.iov_len
= sizeof(recvData
[idx
].packet
);
1721 /* block until we have at least one message ready, but return
1722 as many as possible to save the syscall costs */
1723 int msgsGot
= recvmmsg(cs
->udpFD
, msgVec
.get(), vectSize
, MSG_WAITFORONE
| MSG_TRUNC
, nullptr);
1726 vinfolog("Getting UDP messages via recvmmsg() failed with: %s", stringerror());
1730 unsigned int msgsToSend
= 0;
1732 /* process the received messages */
1733 for (int msgIdx
= 0; msgIdx
< msgsGot
; msgIdx
++) {
1734 const struct msghdr
* msgh
= &msgVec
[msgIdx
].msg_hdr
;
1735 unsigned int got
= msgVec
[msgIdx
].msg_len
;
1736 const ComboAddress
& remote
= recvData
[msgIdx
].remote
;
1738 if (static_cast<size_t>(got
) < sizeof(struct dnsheader
)) {
1739 ++g_stats
.nonCompliantQueries
;
1743 processUDPQuery(*cs
, holders
, msgh
, remote
, recvData
[msgIdx
].dest
, recvData
[msgIdx
].packet
, static_cast<uint16_t>(got
), sizeof(recvData
[msgIdx
].packet
), outMsgVec
.get(), &msgsToSend
, &recvData
[msgIdx
].iov
, &recvData
[msgIdx
].cbuf
);
1747 /* immediate (not delayed or sent to a backend) responses (mostly from a rule, dynamic block
1748 or the cache) can be sent in batch too */
1750 if (msgsToSend
> 0 && msgsToSend
<= static_cast<unsigned int>(msgsGot
)) {
1751 int sent
= sendmmsg(cs
->udpFD
, outMsgVec
.get(), msgsToSend
, 0);
1753 if (sent
< 0 || static_cast<unsigned int>(sent
) != msgsToSend
) {
1754 vinfolog("Error sending responses with sendmmsg() (%d on %u): %s", sent
, msgsToSend
, stringerror());
1760 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1762 // listens to incoming queries, sends out to downstream servers, noting the intended return path
1763 static void udpClientThread(ClientState
* cs
)
1766 setThreadName("dnsdist/udpClie");
1767 LocalHolders holders
;
1769 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
1770 if (g_udpVectorSize
> 1) {
1771 MultipleMessagesUDPClientThread(cs
, holders
);
1775 #endif /* defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE) */
1777 char packet
[s_maxPacketCacheEntrySize
];
1778 /* the actual buffer is larger because:
1779 - we may have to add EDNS and/or ECS
1780 - we use it for self-generated responses (from rule or cache)
1781 but we only accept incoming payloads up to that size
1783 static_assert(s_udpIncomingBufferSize
<= sizeof(packet
), "the incoming buffer size should not be larger than sizeof(MMReceiver::packet)");
1786 /* used by HarvestDestinationAddress */
1787 cmsgbuf_aligned cbuf
;
1789 ComboAddress remote
;
1791 remote
.sin4
.sin_family
= cs
->local
.sin4
.sin_family
;
1792 fillMSGHdr(&msgh
, &iov
, &cbuf
, sizeof(cbuf
), packet
, s_udpIncomingBufferSize
, &remote
);
1795 ssize_t got
= recvmsg(cs
->udpFD
, &msgh
, 0);
1797 if (got
< 0 || static_cast<size_t>(got
) < sizeof(struct dnsheader
)) {
1798 ++g_stats
.nonCompliantQueries
;
1802 processUDPQuery(*cs
, holders
, &msgh
, remote
, dest
, packet
, static_cast<uint16_t>(got
), sizeof(packet
), nullptr, nullptr, nullptr, nullptr);
1806 catch(const std::exception
&e
)
1808 errlog("UDP client thread died because of exception: %s", e
.what());
1810 catch(const PDNSException
&e
)
1812 errlog("UDP client thread died because of PowerDNS exception: %s", e
.reason
);
1816 errlog("UDP client thread died because of an exception: %s", "unknown");
1819 uint16_t getRandomDNSID()
1821 #ifdef HAVE_LIBSODIUM
1822 return (randombytes_random() % 65536);
1824 return (random() % 65536);
1828 static bool upCheck(const shared_ptr
<DownstreamState
>& ds
)
1831 DNSName checkName
= ds
->checkName
;
1832 uint16_t checkType
= ds
->checkType
.getCode();
1833 uint16_t checkClass
= ds
->checkClass
;
1834 dnsheader checkHeader
;
1835 memset(&checkHeader
, 0, sizeof(checkHeader
));
1837 checkHeader
.qdcount
= htons(1);
1838 checkHeader
.id
= getRandomDNSID();
1840 checkHeader
.rd
= true;
1842 checkHeader
.cd
= true;
1845 if (ds
->checkFunction
) {
1846 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1847 auto ret
= ds
->checkFunction(checkName
, checkType
, checkClass
, &checkHeader
);
1848 checkName
= std::get
<0>(ret
);
1849 checkType
= std::get
<1>(ret
);
1850 checkClass
= std::get
<2>(ret
);
1853 vector
<uint8_t> packet
;
1854 DNSPacketWriter
dpw(packet
, checkName
, checkType
, checkClass
);
1855 dnsheader
* requestHeader
= dpw
.getHeader();
1856 *requestHeader
= checkHeader
;
1858 Socket
sock(ds
->remote
.sin4
.sin_family
, SOCK_DGRAM
);
1859 sock
.setNonBlocking();
1860 if (!IsAnyAddress(ds
->sourceAddr
)) {
1861 sock
.setReuseAddr();
1862 if (!ds
->sourceItfName
.empty()) {
1863 #ifdef SO_BINDTODEVICE
1864 int res
= setsockopt(sock
.getHandle(), SOL_SOCKET
, SO_BINDTODEVICE
, ds
->sourceItfName
.c_str(), ds
->sourceItfName
.length());
1865 if (res
!= 0 && g_verboseHealthChecks
) {
1866 infolog("Error settting SO_BINDTODEVICE on the health check socket for backend '%s': %s", ds
->getNameWithAddr(), stringerror());
1870 sock
.bind(ds
->sourceAddr
);
1872 sock
.connect(ds
->remote
);
1873 ssize_t sent
= udpClientSendRequestToBackend(ds
, sock
.getHandle(), reinterpret_cast<char*>(&packet
[0]), packet
.size(), true);
1876 if (g_verboseHealthChecks
)
1877 infolog("Error while sending a health check query to backend %s: %d", ds
->getNameWithAddr(), ret
);
1881 int ret
= waitForRWData(sock
.getHandle(), true, /* ms to seconds */ ds
->checkTimeout
/ 1000, /* remaining ms to us */ (ds
->checkTimeout
% 1000) * 1000);
1882 if(ret
< 0 || !ret
) { // error, timeout, both are down!
1885 if (g_verboseHealthChecks
)
1886 infolog("Error while waiting for the health check response from backend %s: %d", ds
->getNameWithAddr(), ret
);
1889 if (g_verboseHealthChecks
)
1890 infolog("Timeout while waiting for the health check response from backend %s", ds
->getNameWithAddr());
1897 sock
.recvFrom(reply
, from
);
1899 /* we are using a connected socket but hey.. */
1900 if (from
!= ds
->remote
) {
1901 if (g_verboseHealthChecks
)
1902 infolog("Invalid health check response received from %s, expecting one from %s", from
.toStringWithPort(), ds
->remote
.toStringWithPort());
1906 const dnsheader
* responseHeader
= reinterpret_cast<const dnsheader
*>(reply
.c_str());
1908 if (reply
.size() < sizeof(*responseHeader
)) {
1909 if (g_verboseHealthChecks
)
1910 infolog("Invalid health check response of size %d from backend %s, expecting at least %d", reply
.size(), ds
->getNameWithAddr(), sizeof(*responseHeader
));
1914 if (responseHeader
->id
!= requestHeader
->id
) {
1915 if (g_verboseHealthChecks
)
1916 infolog("Invalid health check response id %d from backend %s, expecting %d", responseHeader
->id
, ds
->getNameWithAddr(), requestHeader
->id
);
1920 if (!responseHeader
->qr
) {
1921 if (g_verboseHealthChecks
)
1922 infolog("Invalid health check response from backend %s, expecting QR to be set", ds
->getNameWithAddr());
1926 if (responseHeader
->rcode
== RCode::ServFail
) {
1927 if (g_verboseHealthChecks
)
1928 infolog("Backend %s responded to health check with ServFail", ds
->getNameWithAddr());
1932 if (ds
->mustResolve
&& (responseHeader
->rcode
== RCode::NXDomain
|| responseHeader
->rcode
== RCode::Refused
)) {
1933 if (g_verboseHealthChecks
)
1934 infolog("Backend %s responded to health check with %s while mustResolve is set", ds
->getNameWithAddr(), responseHeader
->rcode
== RCode::NXDomain
? "NXDomain" : "Refused");
1938 uint16_t receivedType
;
1939 uint16_t receivedClass
;
1940 DNSName
receivedName(reply
.c_str(), reply
.size(), sizeof(dnsheader
), false, &receivedType
, &receivedClass
);
1942 if (receivedName
!= checkName
|| receivedType
!= checkType
|| receivedClass
!= checkClass
) {
1943 if (g_verboseHealthChecks
)
1944 infolog("Backend %s responded to health check with an invalid qname (%s vs %s), qtype (%s vs %s) or qclass (%d vs %d)", ds
->getNameWithAddr(), receivedName
.toLogString(), checkName
.toLogString(), QType(receivedType
).getName(), QType(checkType
).getName(), receivedClass
, checkClass
);
1950 catch(const std::exception
& e
)
1952 if (g_verboseHealthChecks
)
1953 infolog("Error checking the health of backend %s: %s", ds
->getNameWithAddr(), e
.what());
1958 if (g_verboseHealthChecks
)
1959 infolog("Unknown exception while checking the health of backend %s", ds
->getNameWithAddr());
1963 uint64_t g_maxTCPClientThreads
{10};
1964 std::atomic
<uint16_t> g_cacheCleaningDelay
{60};
1965 std::atomic
<uint16_t> g_cacheCleaningPercentage
{100};
1969 setThreadName("dnsdist/main");
1972 int32_t secondsToWaitLog
= 0;
1978 std::lock_guard
<std::mutex
> lock(g_luamutex
);
1979 auto f
= g_lua
.readVariable
<boost::optional
<std::function
<void()> > >("maintenance");
1983 secondsToWaitLog
= 0;
1985 catch(std::exception
&e
) {
1986 if (secondsToWaitLog
<= 0) {
1987 infolog("Error during execution of maintenance function: %s", e
.what());
1988 secondsToWaitLog
= 61;
1990 secondsToWaitLog
-= interval
;
1996 if (counter
>= g_cacheCleaningDelay
) {
1997 /* keep track, for each cache, of whether we should keep
1999 std::map
<std::shared_ptr
<DNSDistPacketCache
>, bool> caches
;
2001 /* gather all caches actually used by at least one pool, and see
2002 if something prevents us from cleaning the expired entries */
2003 auto localPools
= g_pools
.getLocal();
2004 for (const auto& entry
: *localPools
) {
2005 auto& pool
= entry
.second
;
2007 auto packetCache
= pool
->packetCache
;
2012 auto pair
= caches
.insert({packetCache
, false});
2013 auto& iter
= pair
.first
;
2014 /* if we need to keep stale data for this cache (ie, not clear
2015 expired entries when at least one pool using this cache
2016 has all its backends down) */
2017 if (packetCache
->keepStaleData() && iter
->second
== false) {
2018 /* so far all pools had at least one backend up */
2019 if (pool
->countServers(true) == 0) {
2020 iter
->second
= true;
2025 for (auto pair
: caches
) {
2026 /* shall we keep expired entries ? */
2027 if (pair
.second
== true) {
2030 auto& packetCache
= pair
.first
;
2031 size_t upTo
= (packetCache
->getMaxEntries()* (100 - g_cacheCleaningPercentage
)) / 100;
2032 packetCache
->purgeExpired(upTo
);
2037 // ponder pruning g_dynblocks of expired entries here
2041 static void secPollThread()
2043 setThreadName("dnsdist/secpoll");
2047 doSecPoll(g_secPollSuffix
);
2051 sleep(g_secPollInterval
);
2055 static void healthChecksThread()
2057 setThreadName("dnsdist/healthC");
2064 if(g_tcpclientthreads
->getQueuedCount() > 1 && !g_tcpclientthreads
->hasReachedMaxThreads())
2065 g_tcpclientthreads
->addTCPClientThread();
2067 auto states
= g_dstates
.getLocal(); // this points to the actual shared_ptrs!
2068 for(auto& dss
: *states
) {
2069 if(++dss
->lastCheck
< dss
->checkInterval
)
2072 if(dss
->availability
==DownstreamState::Availability::Auto
) {
2073 bool newState
=upCheck(dss
);
2075 /* check succeeded */
2076 dss
->currentCheckFailures
= 0;
2078 if (!dss
->upStatus
) {
2079 /* we were marked as down */
2080 dss
->consecutiveSuccessfulChecks
++;
2081 if (dss
->consecutiveSuccessfulChecks
< dss
->minRiseSuccesses
) {
2082 /* if we need more than one successful check to rise
2083 and we didn't reach the threshold yet,
2091 dss
->consecutiveSuccessfulChecks
= 0;
2093 if (dss
->upStatus
) {
2094 /* we are currently up */
2095 dss
->currentCheckFailures
++;
2096 if (dss
->currentCheckFailures
< dss
->maxCheckFailures
) {
2097 /* we need more than one failure to be marked as down,
2098 and we did not reach the threshold yet, let's stay down */
2104 if(newState
!= dss
->upStatus
) {
2105 warnlog("Marking downstream %s as '%s'", dss
->getNameWithAddr(), newState
? "up" : "down");
2107 if (newState
&& !dss
->connected
) {
2108 newState
= dss
->reconnect();
2110 if (dss
->connected
&& !dss
->threadStarted
.test_and_set()) {
2111 dss
->tid
= thread(responderThread
, dss
);
2115 dss
->upStatus
= newState
;
2116 dss
->currentCheckFailures
= 0;
2117 dss
->consecutiveSuccessfulChecks
= 0;
2118 if (g_snmpAgent
&& g_snmpTrapsEnabled
) {
2119 g_snmpAgent
->sendBackendStatusChangeTrap(dss
);
2124 auto delta
= dss
->sw
.udiffAndSet()/1000000.0;
2125 dss
->queryLoad
= 1.0*(dss
->queries
.load() - dss
->prev
.queries
.load())/delta
;
2126 dss
->dropRate
= 1.0*(dss
->reuseds
.load() - dss
->prev
.reuseds
.load())/delta
;
2127 dss
->prev
.queries
.store(dss
->queries
.load());
2128 dss
->prev
.reuseds
.store(dss
->reuseds
.load());
2130 for(IDState
& ids
: dss
->idStates
) { // timeouts
2131 int64_t usageIndicator
= ids
.usageIndicator
;
2132 if(IDState::isInUse(usageIndicator
) && ids
.age
++ > g_udpTimeout
) {
2133 /* We mark the state as unused as soon as possible
2134 to limit the risk of racing with the
2137 auto oldDU
= ids
.du
;
2139 if (!ids
.tryMarkUnused(usageIndicator
)) {
2140 /* this state has been altered in the meantime,
2141 don't go anywhere near it */
2145 handleDOHTimeout(oldDU
);
2149 ++g_stats
.downstreamTimeouts
; // this is an 'actively' discovered timeout
2150 vinfolog("Had a downstream timeout from %s (%s) for query for %s|%s from %s",
2151 dss
->remote
.toStringWithPort(), dss
->name
,
2152 ids
.qname
.toLogString(), QType(ids
.qtype
).getName(), ids
.origRemote
.toStringWithPort());
2157 struct dnsheader fake
;
2158 memset(&fake
, 0, sizeof(fake
));
2159 fake
.id
= ids
.origID
;
2161 g_rings
.insertResponse(ts
, ids
.origRemote
, ids
.qname
, ids
.qtype
, std::numeric_limits
<unsigned int>::max(), 0, fake
, dss
->remote
);
2168 static void bindAny(int af
, int sock
)
2170 __attribute__((unused
)) int one
= 1;
2173 if (setsockopt(sock
, IPPROTO_IP
, IP_FREEBIND
, &one
, sizeof(one
)) < 0)
2174 warnlog("Warning: IP_FREEBIND setsockopt failed: %s", stringerror());
2179 if (setsockopt(sock
, IPPROTO_IP
, IP_BINDANY
, &one
, sizeof(one
)) < 0)
2180 warnlog("Warning: IP_BINDANY setsockopt failed: %s", stringerror());
2184 if (setsockopt(sock
, IPPROTO_IPV6
, IPV6_BINDANY
, &one
, sizeof(one
)) < 0)
2185 warnlog("Warning: IPV6_BINDANY setsockopt failed: %s", stringerror());
2188 if (setsockopt(sock
, SOL_SOCKET
, SO_BINDANY
, &one
, sizeof(one
)) < 0)
2189 warnlog("Warning: SO_BINDANY setsockopt failed: %s", stringerror());
2193 static void dropGroupPrivs(gid_t gid
)
2196 if (setgid(gid
) == 0) {
2197 if (setgroups(0, NULL
) < 0) {
2198 warnlog("Warning: Unable to drop supplementary gids: %s", stringerror());
2202 warnlog("Warning: Unable to set group ID to %d: %s", gid
, stringerror());
2207 static void dropUserPrivs(uid_t uid
)
2210 if(setuid(uid
) < 0) {
2211 warnlog("Warning: Unable to set user ID to %d: %s", uid
, stringerror());
2216 static void checkFileDescriptorsLimits(size_t udpBindsCount
, size_t tcpBindsCount
)
2218 /* stdin, stdout, stderr */
2219 size_t requiredFDsCount
= 3;
2220 auto backends
= g_dstates
.getLocal();
2221 /* UDP sockets to backends */
2222 size_t backendUDPSocketsCount
= 0;
2223 for (const auto& backend
: *backends
) {
2224 backendUDPSocketsCount
+= backend
->sockets
.size();
2226 requiredFDsCount
+= backendUDPSocketsCount
;
2227 /* TCP sockets to backends */
2228 requiredFDsCount
+= (backends
->size() * g_maxTCPClientThreads
);
2229 /* listening sockets */
2230 requiredFDsCount
+= udpBindsCount
;
2231 requiredFDsCount
+= tcpBindsCount
;
2232 /* max TCP connections currently served */
2233 requiredFDsCount
+= g_maxTCPClientThreads
;
2234 /* max pipes for communicating between TCP acceptors and client threads */
2235 requiredFDsCount
+= (g_maxTCPClientThreads
* 2);
2236 /* max TCP queued connections */
2237 requiredFDsCount
+= g_maxTCPQueuedConnections
;
2238 /* DelayPipe pipe */
2239 requiredFDsCount
+= 2;
2242 /* webserver main socket */
2244 /* console main socket */
2251 getrlimit(RLIMIT_NOFILE
, &rl
);
2252 if (rl
.rlim_cur
<= requiredFDsCount
) {
2253 warnlog("Warning, this configuration can use more than %d file descriptors, web server and console connections not included, and the current limit is %d.", std::to_string(requiredFDsCount
), std::to_string(rl
.rlim_cur
));
2255 warnlog("You can increase this value by using LimitNOFILE= in the systemd unit file or ulimit.");
2257 warnlog("You can increase this value by using ulimit.");
2262 static void setUpLocalBind(std::unique_ptr
<ClientState
>& cs
)
2264 /* skip some warnings if there is an identical UDP context */
2265 bool warn
= cs
->tcp
== false || cs
->tlsFrontend
!= nullptr || cs
->dohFrontend
!= nullptr;
2266 int& fd
= cs
->tcp
== false ? cs
->udpFD
: cs
->tcpFD
;
2269 fd
= SSocket(cs
->local
.sin4
.sin_family
, cs
->tcp
== false ? SOCK_DGRAM
: SOCK_STREAM
, 0);
2272 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEADDR
, 1);
2273 #ifdef TCP_DEFER_ACCEPT
2274 SSetsockopt(fd
, IPPROTO_TCP
, TCP_DEFER_ACCEPT
, 1);
2276 if (cs
->fastOpenQueueSize
> 0) {
2278 SSetsockopt(fd
, IPPROTO_TCP
, TCP_FASTOPEN
, cs
->fastOpenQueueSize
);
2281 warnlog("TCP Fast Open has been configured on local address '%s' but is not supported", cs
->local
.toStringWithPort());
2287 if(cs
->local
.sin4
.sin_family
== AF_INET6
) {
2288 SSetsockopt(fd
, IPPROTO_IPV6
, IPV6_V6ONLY
, 1);
2291 bindAny(cs
->local
.sin4
.sin_family
, fd
);
2293 if(!cs
->tcp
&& IsAnyAddress(cs
->local
)) {
2295 setsockopt(fd
, IPPROTO_IP
, GEN_IP_PKTINFO
, &one
, sizeof(one
)); // linux supports this, so why not - might fail on other systems
2296 #ifdef IPV6_RECVPKTINFO
2297 setsockopt(fd
, IPPROTO_IPV6
, IPV6_RECVPKTINFO
, &one
, sizeof(one
));
2301 if (cs
->reuseport
) {
2303 SSetsockopt(fd
, SOL_SOCKET
, SO_REUSEPORT
, 1);
2306 /* no need to warn again if configured but support is not available, we already did for UDP */
2307 warnlog("SO_REUSEPORT has been configured on local address '%s' but is not supported", cs
->local
.toStringWithPort());
2313 if (cs
->local
.isIPv4()) {
2315 setSocketIgnorePMTU(cs
->udpFD
);
2317 catch(const std::exception
& e
) {
2318 warnlog("Failed to set IP_MTU_DISCOVER on UDP server socket for local address '%s': %s", cs
->local
.toStringWithPort(), e
.what());
2323 const std::string
& itf
= cs
->interface
;
2325 #ifdef SO_BINDTODEVICE
2326 int res
= setsockopt(fd
, SOL_SOCKET
, SO_BINDTODEVICE
, itf
.c_str(), itf
.length());
2328 warnlog("Error setting up the interface on local address '%s': %s", cs
->local
.toStringWithPort(), stringerror());
2332 warnlog("An interface has been configured on local address '%s' but SO_BINDTODEVICE is not supported", cs
->local
.toStringWithPort());
2338 if (g_defaultBPFFilter
) {
2339 cs
->attachFilter(g_defaultBPFFilter
);
2340 vinfolog("Attaching default BPF Filter to %s frontend %s", (!cs
->tcp
? "UDP" : "TCP"), cs
->local
.toStringWithPort());
2342 #endif /* HAVE_EBPF */
2344 if (cs
->tlsFrontend
!= nullptr) {
2345 if (!cs
->tlsFrontend
->setupTLS()) {
2346 errlog("Error while setting up TLS on local address '%s', exiting", cs
->local
.toStringWithPort());
2347 _exit(EXIT_FAILURE
);
2351 if (cs
->dohFrontend
!= nullptr) {
2352 cs
->dohFrontend
->setup();
2355 SBind(fd
, cs
->local
);
2358 SListen(cs
->tcpFD
, SOMAXCONN
);
2359 if (cs
->tlsFrontend
!= nullptr) {
2360 warnlog("Listening on %s for TLS", cs
->local
.toStringWithPort());
2362 else if (cs
->dohFrontend
!= nullptr) {
2363 warnlog("Listening on %s for DoH", cs
->local
.toStringWithPort());
2365 else if (cs
->dnscryptCtx
!= nullptr) {
2366 warnlog("Listening on %s for DNSCrypt", cs
->local
.toStringWithPort());
2369 warnlog("Listening on %s", cs
->local
.toStringWithPort());
2378 vector
<string
> locals
;
2379 vector
<string
> remotes
;
2380 bool checkConfig
{false};
2381 bool beClient
{false};
2382 bool beSupervised
{false};
2389 std::atomic
<bool> g_configurationDone
{false};
2394 cout
<<"Syntax: dnsdist [-C,--config file] [-c,--client [IP[:PORT]]]\n";
2395 cout
<<"[-e,--execute cmd] [-h,--help] [-l,--local addr]\n";
2396 cout
<<"[-v,--verbose] [--check-config] [--version]\n";
2398 cout
<<"-a,--acl netmask Add this netmask to the ACL\n";
2399 cout
<<"-C,--config file Load configuration from 'file'\n";
2400 cout
<<"-c,--client Operate as a client, connect to dnsdist. This reads\n";
2401 cout
<<" controlSocket from your configuration file, but also\n";
2402 cout
<<" accepts an IP:PORT argument\n";
2403 #ifdef HAVE_LIBSODIUM
2404 cout
<<"-k,--setkey KEY Use KEY for encrypted communication to dnsdist. This\n";
2405 cout
<<" is similar to setting setKey in the configuration file.\n";
2406 cout
<<" NOTE: this will leak this key in your shell's history\n";
2407 cout
<<" and in the systems running process list.\n";
2409 cout
<<"--check-config Validate the configuration file and exit. The exit-code\n";
2410 cout
<<" reflects the validation, 0 is OK, 1 means an error.\n";
2411 cout
<<" Any errors are printed as well.\n";
2412 cout
<<"-e,--execute cmd Connect to dnsdist and execute 'cmd'\n";
2413 cout
<<"-g,--gid gid Change the process group ID after binding sockets\n";
2414 cout
<<"-h,--help Display this helpful message\n";
2415 cout
<<"-l,--local address Listen on this local address\n";
2416 cout
<<"--supervised Don't open a console, I'm supervised\n";
2417 cout
<<" (use with e.g. systemd and daemontools)\n";
2418 cout
<<"--disable-syslog Don't log to syslog, only to stdout\n";
2419 cout
<<" (use with e.g. systemd)\n";
2420 cout
<<"-u,--uid uid Change the process user ID after binding sockets\n";
2421 cout
<<"-v,--verbose Enable verbose mode\n";
2422 cout
<<"-V,--version Show dnsdist version information and exit\n";
2425 int main(int argc
, char** argv
)
2428 size_t udpBindsCount
= 0;
2429 size_t tcpBindsCount
= 0;
2430 rl_attempted_completion_function
= my_completion
;
2431 rl_completion_append_character
= 0;
2433 signal(SIGPIPE
, SIG_IGN
);
2434 signal(SIGCHLD
, SIG_IGN
);
2435 openlog("dnsdist", LOG_PID
|LOG_NDELAY
, LOG_DAEMON
);
2437 #ifdef HAVE_LIBSODIUM
2438 if (sodium_init() == -1) {
2439 cerr
<<"Unable to initialize crypto library"<<endl
;
2442 g_hashperturb
=randombytes_uniform(0xffffffff);
2443 srandom(randombytes_uniform(0xffffffff));
2447 gettimeofday(&tv
, 0);
2448 srandom(tv
.tv_sec
^ tv
.tv_usec
^ getpid());
2449 g_hashperturb
=random();
2453 ComboAddress clientAddress
= ComboAddress();
2454 g_cmdLine
.config
=SYSCONFDIR
"/dnsdist.conf";
2455 struct option longopts
[]={
2456 {"acl", required_argument
, 0, 'a'},
2457 {"check-config", no_argument
, 0, 1},
2458 {"client", no_argument
, 0, 'c'},
2459 {"config", required_argument
, 0, 'C'},
2460 {"disable-syslog", no_argument
, 0, 2},
2461 {"execute", required_argument
, 0, 'e'},
2462 {"gid", required_argument
, 0, 'g'},
2463 {"help", no_argument
, 0, 'h'},
2464 {"local", required_argument
, 0, 'l'},
2465 {"setkey", required_argument
, 0, 'k'},
2466 {"supervised", no_argument
, 0, 3},
2467 {"uid", required_argument
, 0, 'u'},
2468 {"verbose", no_argument
, 0, 'v'},
2469 {"version", no_argument
, 0, 'V'},
2475 int c
=getopt_long(argc
, argv
, "a:cC:e:g:hk:l:u:vV", longopts
, &longindex
);
2480 g_cmdLine
.checkConfig
=true;
2486 g_cmdLine
.beSupervised
=true;
2489 g_cmdLine
.config
=optarg
;
2492 g_cmdLine
.beClient
=true;
2495 g_cmdLine
.command
=optarg
;
2498 g_cmdLine
.gid
=optarg
;
2501 cout
<<"dnsdist "<<VERSION
<<endl
;
2508 g_ACL
.modify([optstring
](NetmaskGroup
& nmg
) { nmg
.addMask(optstring
); });
2511 #ifdef HAVE_LIBSODIUM
2512 if (B64Decode(string(optarg
), g_consoleKey
) < 0) {
2513 cerr
<<"Unable to decode key '"<<optarg
<<"'."<<endl
;
2517 cerr
<<"dnsdist has been built without libsodium, -k/--setkey is unsupported."<<endl
;
2522 g_cmdLine
.locals
.push_back(trim_copy(string(optarg
)));
2525 g_cmdLine
.uid
=optarg
;
2531 #ifdef LUAJIT_VERSION
2532 cout
<<"dnsdist "<<VERSION
<<" ("<<LUA_RELEASE
<<" ["<<LUAJIT_VERSION
<<"])"<<endl
;
2534 cout
<<"dnsdist "<<VERSION
<<" ("<<LUA_RELEASE
<<")"<<endl
;
2536 cout
<<"Enabled features: ";
2540 #ifdef HAVE_DNS_OVER_TLS
2541 cout
<<"dns-over-tls(";
2553 #ifdef HAVE_DNS_OVER_HTTPS
2554 cout
<<"dns-over-https(DOH) ";
2556 #ifdef HAVE_DNSCRYPT
2565 #ifdef HAVE_LIBCRYPTO
2568 #ifdef HAVE_LIBSODIUM
2574 #ifdef HAVE_PROTOBUF
2580 #if defined(HAVE_RECVMMSG) && defined(HAVE_SENDMMSG) && defined(MSG_WAITFORONE)
2581 cout
<<"recvmmsg/sendmmsg ";
2583 #ifdef HAVE_NET_SNMP
2593 //getopt_long printed an error message.
2602 for(auto p
= argv
; *p
; ++p
) {
2603 if(g_cmdLine
.beClient
) {
2604 clientAddress
= ComboAddress(*p
, 5199);
2606 g_cmdLine
.remotes
.push_back(*p
);
2610 ServerPolicy leastOutstandingPol
{"leastOutstanding", leastOutstanding
, false};
2612 g_policy
.setState(leastOutstandingPol
);
2613 if(g_cmdLine
.beClient
|| !g_cmdLine
.command
.empty()) {
2614 setupLua(true, g_cmdLine
.config
);
2615 if (clientAddress
!= ComboAddress())
2616 g_serverControl
= clientAddress
;
2617 doClient(g_serverControl
, g_cmdLine
.command
);
2618 _exit(EXIT_SUCCESS
);
2621 auto acl
= g_ACL
.getCopy();
2623 for(auto& addr
: {"127.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "169.254.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "::1/128", "fc00::/7", "fe80::/10"})
2625 g_ACL
.setState(acl
);
2628 auto consoleACL
= g_consoleACL
.getCopy();
2629 for (const auto& mask
: { "127.0.0.1/8", "::1/128" }) {
2630 consoleACL
.addMask(mask
);
2632 g_consoleACL
.setState(consoleACL
);
2634 if (g_cmdLine
.checkConfig
) {
2635 setupLua(true, g_cmdLine
.config
);
2636 // No exception was thrown
2637 infolog("Configuration '%s' OK!", g_cmdLine
.config
);
2638 _exit(EXIT_SUCCESS
);
2641 auto todo
=setupLua(false, g_cmdLine
.config
);
2643 auto localPools
= g_pools
.getCopy();
2645 bool precompute
= false;
2646 if (g_policy
.getLocal()->name
== "chashed") {
2649 for (const auto& entry
: localPools
) {
2650 if (entry
.second
->policy
!= nullptr && entry
.second
->policy
->name
== "chashed") {
2657 vinfolog("Pre-computing hashes for consistent hash load-balancing policy");
2658 // pre compute hashes
2659 auto backends
= g_dstates
.getLocal();
2660 for (auto& backend
: *backends
) {
2666 if (!g_cmdLine
.locals
.empty()) {
2667 for (auto it
= g_frontends
.begin(); it
!= g_frontends
.end(); ) {
2668 /* DoH, DoT and DNSCrypt frontends are separate */
2669 if ((*it
)->dohFrontend
== nullptr && (*it
)->tlsFrontend
== nullptr && (*it
)->dnscryptCtx
== nullptr) {
2670 it
= g_frontends
.erase(it
);
2677 for(const auto& loc
: g_cmdLine
.locals
) {
2679 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress(loc
, 53), false, false, 0, "", {})));
2681 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress(loc
, 53), true, false, 0, "", {})));
2685 if (g_frontends
.empty()) {
2687 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress("127.0.0.1", 53), false, false, 0, "", {})));
2689 g_frontends
.push_back(std::unique_ptr
<ClientState
>(new ClientState(ComboAddress("127.0.0.1", 53), true, false, 0, "", {})));
2692 g_configurationDone
= true;
2694 for(auto& frontend
: g_frontends
) {
2695 setUpLocalBind(frontend
);
2697 if (frontend
->tcp
== false) {
2705 warnlog("dnsdist %s comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it according to the terms of the GPL version 2", VERSION
);
2709 g_ACL
.getLocal()->toStringVector(&vec
);
2710 for(const auto& s
: vec
) {
2715 infolog("ACL allowing queries from: %s", acls
.c_str());
2718 g_consoleACL
.getLocal()->toStringVector(&vec
);
2719 for (const auto& entry
: vec
) {
2720 if (!acls
.empty()) {
2725 infolog("Console ACL allowing connections from: %s", acls
.c_str());
2727 #ifdef HAVE_LIBSODIUM
2728 if (g_consoleEnabled
&& g_consoleKey
.empty()) {
2729 warnlog("Warning, the console has been enabled via 'controlSocket()' but no key has been set with 'setKey()' so all connections will fail until a key has been set");
2736 if(!g_cmdLine
.gid
.empty())
2737 newgid
= strToGID(g_cmdLine
.gid
.c_str());
2739 if(!g_cmdLine
.uid
.empty())
2740 newuid
= strToUID(g_cmdLine
.uid
.c_str());
2742 dropGroupPrivs(newgid
);
2743 dropUserPrivs(newuid
);
2745 /* we might still have capabilities remaining,
2746 for example if we have been started as root
2747 without --uid or --gid (please don't do that)
2748 or as an unprivileged user with ambient
2749 capabilities like CAP_NET_BIND_SERVICE.
2751 dropCapabilities(g_capabilitiesToRetain
);
2753 catch(const std::exception
& e
) {
2754 warnlog("%s", e
.what());
2757 /* this need to be done _after_ dropping privileges */
2758 g_delay
= new DelayPipe
<DelayedPacket
>();
2764 g_tcpclientthreads
= std::unique_ptr
<TCPClientCollection
>(new TCPClientCollection(g_maxTCPClientThreads
, g_useTCPSinglePipe
));
2769 localPools
= g_pools
.getCopy();
2770 /* create the default pool no matter what */
2771 createPoolIfNotExists(localPools
, "");
2772 if(g_cmdLine
.remotes
.size()) {
2773 for(const auto& address
: g_cmdLine
.remotes
) {
2774 auto ret
=std::make_shared
<DownstreamState
>(ComboAddress(address
, 53));
2775 addServerToPool(localPools
, "", ret
);
2776 if (ret
->connected
&& !ret
->threadStarted
.test_and_set()) {
2777 ret
->tid
= thread(responderThread
, ret
);
2779 g_dstates
.modify([ret
](servers_t
& servers
) { servers
.push_back(ret
); });
2782 g_pools
.setState(localPools
);
2784 if(g_dstates
.getLocal()->empty()) {
2785 errlog("No downstream servers defined: all packets will get dropped");
2786 // you might define them later, but you need to know
2789 checkFileDescriptorsLimits(udpBindsCount
, tcpBindsCount
);
2791 for(auto& dss
: g_dstates
.getCopy()) { // it is a copy, but the internal shared_ptrs are the real deal
2792 if(dss
->availability
==DownstreamState::Availability::Auto
) {
2793 bool newState
=upCheck(dss
);
2794 warnlog("Marking downstream %s as '%s'", dss
->getNameWithAddr(), newState
? "up" : "down");
2795 dss
->upStatus
= newState
;
2799 for(auto& cs
: g_frontends
) {
2800 if (cs
->dohFrontend
!= nullptr) {
2801 #ifdef HAVE_DNS_OVER_HTTPS
2802 std::thread
t1(dohThread
, cs
.get());
2803 if (!cs
->cpus
.empty()) {
2804 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2807 #endif /* HAVE_DNS_OVER_HTTPS */
2810 if (cs
->udpFD
>= 0) {
2811 thread
t1(udpClientThread
, cs
.get());
2812 if (!cs
->cpus
.empty()) {
2813 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2817 else if (cs
->tcpFD
>= 0) {
2818 thread
t1(tcpAcceptorThread
, cs
.get());
2819 if (!cs
->cpus
.empty()) {
2820 mapThreadToCPUList(t1
.native_handle(), cs
->cpus
);
2826 thread
carbonthread(carbonDumpThread
);
2827 carbonthread
.detach();
2829 thread
stattid(maintThread
);
2832 thread
healththread(healthChecksThread
);
2834 if (!g_secPollSuffix
.empty()) {
2835 thread
secpollthread(secPollThread
);
2836 secpollthread
.detach();
2839 if(g_cmdLine
.beSupervised
) {
2841 sd_notify(0, "READY=1");
2843 healththread
.join();
2846 healththread
.detach();
2849 _exit(EXIT_SUCCESS
);
2852 catch(const LuaContext::ExecutionErrorException
& e
) {
2854 errlog("Fatal Lua error: %s", e
.what());
2855 std::rethrow_if_nested(e
);
2856 } catch(const std::exception
& ne
) {
2857 errlog("Details: %s", ne
.what());
2859 catch(PDNSException
&ae
)
2861 errlog("Fatal pdns error: %s", ae
.reason
);
2863 _exit(EXIT_FAILURE
);
2865 catch(std::exception
&e
)
2867 errlog("Fatal error: %s", e
.what());
2868 _exit(EXIT_FAILURE
);
2870 catch(PDNSException
&ae
)
2872 errlog("Fatal pdns error: %s", ae
.reason
);
2873 _exit(EXIT_FAILURE
);
2876 uint64_t getLatencyCount(const std::string
&)
2878 return g_stats
.responses
+ g_stats
.selfAnswered
+ g_stats
.cacheHits
;