/* dnsmasq is Copyright (c) 2000-2021 Simon Kelley This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; version 2 dated June, 1991, or (at your option) version 3 dated 29 June, 2007. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ #include "dnsmasq.h" static struct frec *get_new_frec(time_t now, struct server *serv, int force); static struct frec *lookup_frec(unsigned short id, int fd, void *hash, int *firstp, int *lastp); static struct frec *lookup_frec_by_query(void *hash, unsigned int flags, unsigned int flagmask); static unsigned short get_id(void); static void free_frec(struct frec *f); static void query_full(time_t now, char *domain); static void return_reply(time_t now, struct frec *forward, struct dns_header *header, ssize_t n, int status); /* Send a UDP packet with its source address set as "source" unless nowild is true, when we just send it with the kernel default */ int send_from(int fd, int nowild, char *packet, size_t len, union mysockaddr *to, union all_addr *source, unsigned int iface) { struct msghdr msg; struct iovec iov[1]; union { struct cmsghdr align; /* this ensures alignment */ #if defined(HAVE_LINUX_NETWORK) char control[CMSG_SPACE(sizeof(struct in_pktinfo))]; #elif defined(IP_SENDSRCADDR) char control[CMSG_SPACE(sizeof(struct in_addr))]; #endif char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))]; } control_u; iov[0].iov_base = packet; iov[0].iov_len = len; msg.msg_control = NULL; msg.msg_controllen = 0; msg.msg_flags = 0; msg.msg_name = to; msg.msg_namelen = sa_len(to); msg.msg_iov = iov; msg.msg_iovlen = 1; if (!nowild) { struct cmsghdr *cmptr; msg.msg_control = &control_u; msg.msg_controllen = sizeof(control_u); cmptr = CMSG_FIRSTHDR(&msg); if (to->sa.sa_family == AF_INET) { #if defined(HAVE_LINUX_NETWORK) struct in_pktinfo p; p.ipi_ifindex = 0; p.ipi_spec_dst = source->addr4; msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo)); memcpy(CMSG_DATA(cmptr), &p, sizeof(p)); cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); cmptr->cmsg_level = IPPROTO_IP; cmptr->cmsg_type = IP_PKTINFO; #elif defined(IP_SENDSRCADDR) msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); memcpy(CMSG_DATA(cmptr), &(source->addr4), sizeof(source->addr4)); cmptr->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); cmptr->cmsg_level = IPPROTO_IP; cmptr->cmsg_type = IP_SENDSRCADDR; #endif } else { struct in6_pktinfo p; p.ipi6_ifindex = iface; /* Need iface for IPv6 to handle link-local addrs */ p.ipi6_addr = source->addr6; msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); memcpy(CMSG_DATA(cmptr), &p, sizeof(p)); cmptr->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); cmptr->cmsg_type = daemon->v6pktinfo; cmptr->cmsg_level = IPPROTO_IPV6; } } while (retry_send(sendmsg(fd, &msg, 0))); if (errno != 0) { #ifdef HAVE_LINUX_NETWORK /* If interface is still in DAD, EINVAL results - ignore that. */ if (errno != EINVAL) my_syslog(LOG_ERR, _("failed to send packet: %s"), strerror(errno)); #endif return 0; } return 1; } #ifdef HAVE_CONNTRACK static void set_outgoing_mark(struct frec *forward, int fd) { /* Copy connection mark of incoming query to outgoing connection. */ unsigned int mark; if (get_incoming_mark(&forward->frec_src.source, &forward->frec_src.dest, 0, &mark)) setsockopt(fd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); } #endif static void log_query_mysockaddr(unsigned int flags, char *name, union mysockaddr *addr, char *arg) { if (addr->sa.sa_family == AF_INET) log_query(flags | F_IPV4, name, (union all_addr *)&addr->in.sin_addr, arg); else log_query(flags | F_IPV6, name, (union all_addr *)&addr->in6.sin6_addr, arg); } static void server_send(struct server *server, int fd, const void *header, size_t plen, int flags) { while (retry_send(sendto(fd, header, plen, flags, &server->addr.sa, sa_len(&server->addr)))); } #ifdef HAVE_DNSSEC static void server_send_log(struct server *server, int fd, const void *header, size_t plen, int dumpflags, unsigned int logflags, char *name, char *arg) { #ifdef HAVE_DUMPFILE dump_packet(dumpflags, (void *)header, (size_t)plen, NULL, &server->addr); #endif log_query_mysockaddr(logflags, name, &server->addr, arg); server_send(server, fd, header, plen, 0); } #endif static int domain_no_rebind(char *domain) { struct server *serv; int dlen = (int)strlen(domain); for (serv = daemon->no_rebind; serv; serv = serv->next) if (dlen >= serv->domain_len && strcmp(serv->domain, &domain[dlen - serv->domain_len]) == 0) return 1; return 0; } static int forward_query(int udpfd, union mysockaddr *udpaddr, union all_addr *dst_addr, unsigned int dst_iface, struct dns_header *header, size_t plen, char *limit, time_t now, struct frec *forward, int ad_reqd, int do_bit) { unsigned int flags = 0; unsigned int fwd_flags = 0; int is_dnssec = forward && (forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY)); struct server *master; unsigned int gotname = extract_request(header, plen, daemon->namebuff, NULL); void *hash = hash_questions(header, plen, daemon->namebuff); unsigned char *oph = find_pseudoheader(header, plen, NULL, NULL, NULL, NULL); int old_src = 0; int first, last, start = 0; int subnet, cacheable, forwarded = 0; size_t edns0_len; unsigned char *pheader; int ede = EDE_UNSET; (void)do_bit; if (header->hb4 & HB4_CD) fwd_flags |= FREC_CHECKING_DISABLED; if (ad_reqd) fwd_flags |= FREC_AD_QUESTION; if (oph) fwd_flags |= FREC_HAS_PHEADER; #ifdef HAVE_DNSSEC if (do_bit) fwd_flags |= FREC_DO_QUESTION; #endif /* Check for retry on existing query. FREC_DNSKEY and FREC_DS_QUERY are never set in flags, so the test below ensures that no frec created for internal DNSSEC query can be returned here. Similarly FREC_NO_CACHE is never set in flags, so a query which is contigent on a particular source address EDNS0 option will never be matched. */ if (forward) old_src = 1; else if ((forward = lookup_frec_by_query(hash, fwd_flags, FREC_CHECKING_DISABLED | FREC_AD_QUESTION | FREC_DO_QUESTION | FREC_HAS_PHEADER | FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_NO_CACHE))) { struct frec_src *src; for (src = &forward->frec_src; src; src = src->next) if (src->orig_id == ntohs(header->id) && sockaddr_isequal(&src->source, udpaddr)) break; if (src) old_src = 1; else { /* Existing query, but from new source, just add this client to the list that will get the reply.*/ /* Note whine_malloc() zeros memory. */ if (!daemon->free_frec_src && daemon->frec_src_count < daemon->ftabsize && (daemon->free_frec_src = whine_malloc(sizeof(struct frec_src)))) { daemon->frec_src_count++; daemon->free_frec_src->next = NULL; } /* If we've been spammed with many duplicates, return REFUSED. */ if (!daemon->free_frec_src) { query_full(now, NULL); goto reply; } src = daemon->free_frec_src; daemon->free_frec_src = src->next; src->next = forward->frec_src.next; forward->frec_src.next = src; src->orig_id = ntohs(header->id); src->source = *udpaddr; src->dest = *dst_addr; src->log_id = daemon->log_id; src->iface = dst_iface; src->fd = udpfd; /* closely spaced identical queries cannot be a try and a retry, so it's safe to wait for the reply from the first without forwarding the second. */ if (difftime(now, forward->time) < 2) return 0; } } /* new query */ if (!forward) { if (lookup_domain(daemon->namebuff, gotname, &first, &last)) flags = is_local_answer(now, first, daemon->namebuff); else { /* no available server. */ ede = EDE_NOT_READY; flags = 0; } /* don't forward A or AAAA queries for simple names, except the empty name */ if (!flags && option_bool(OPT_NODOTS_LOCAL) && (gotname & (F_IPV4 | F_IPV6)) && !strchr(daemon->namebuff, '.') && strlen(daemon->namebuff) != 0) flags = check_for_local_domain(daemon->namebuff, now) ? F_NOERR : F_NXDOMAIN; /* Configured answer. */ if (flags || ede == EDE_NOT_READY) goto reply; master = daemon->serverarray[first]; if (!(forward = get_new_frec(now, master, 0))) goto reply; /* table full - flags == 0, return REFUSED */ forward->frec_src.source = *udpaddr; forward->frec_src.orig_id = ntohs(header->id); forward->frec_src.dest = *dst_addr; forward->frec_src.iface = dst_iface; forward->frec_src.next = NULL; forward->frec_src.fd = udpfd; forward->new_id = get_id(); memcpy(forward->hash, hash, HASH_SIZE); forward->forwardall = 0; forward->flags = fwd_flags; if (domain_no_rebind(daemon->namebuff)) forward->flags |= FREC_NOREBIND; if (header->hb4 & HB4_CD) forward->flags |= FREC_CHECKING_DISABLED; if (ad_reqd) forward->flags |= FREC_AD_QUESTION; #ifdef HAVE_DNSSEC forward->work_counter = DNSSEC_WORK; if (do_bit) forward->flags |= FREC_DO_QUESTION; #endif start = first; if (option_bool(OPT_ALL_SERVERS)) forward->forwardall = 1; if (!option_bool(OPT_ORDER)) { if (master->forwardcount++ > FORWARD_TEST || difftime(now, master->forwardtime) > FORWARD_TIME || master->last_server == -1) { master->forwardtime = now; master->forwardcount = 0; forward->forwardall = 1; } else start = master->last_server; } } else { /* retry on existing query, from original source. Send to all available servers */ #ifdef HAVE_DNSSEC /* If we've already got an answer to this query, but we're awaiting keys for validation, there's no point retrying the query, retry the key query instead...... */ if (forward->blocking_query) { int is_sign; unsigned char *pheader; while (forward->blocking_query) forward = forward->blocking_query; blockdata_retrieve(forward->stash, forward->stash_len, (void *)header); plen = forward->stash_len; /* get query for logging. */ extract_request(header, plen, daemon->namebuff, NULL); if (find_pseudoheader(header, plen, NULL, &pheader, &is_sign, NULL) && !is_sign) PUTSHORT(SAFE_PKTSZ, pheader); /* Find suitable servers: should never fail. */ if (!filter_servers(forward->sentto->arrayposn, F_DNSSECOK, &first, &last)) return 0; is_dnssec = 1; forward->forwardall = 1; } else #endif { /* retry on existing query, from original source. Send to all available servers */ forward->sentto->failed_queries++; if (!filter_servers(forward->sentto->arrayposn, F_SERVER, &first, &last)) goto reply; master = daemon->serverarray[first]; /* Forward to all available servers on retry of query from same host. */ if (!option_bool(OPT_ORDER) && old_src) forward->forwardall = 1; else { start = forward->sentto->arrayposn; if (option_bool(OPT_ORDER)) { /* In strict order mode, there must be a server later in the list left to send to, otherwise without the forwardall mechanism, code further on will cycle around the list forwever if they all return REFUSED. If at the last, give up. */ if (++start == last) goto reply; } } } /* If we didn't get an answer advertising a maximal packet in EDNS, fall back to 1280, which should work everywhere on IPv6. If that generates an answer, it will become the new default for this server */ forward->flags |= FREC_TEST_PKTSZ; } /* If a query is retried, use the log_id for the retry when logging the answer. */ forward->frec_src.log_id = daemon->log_id; /* We may be resending a DNSSEC query here, for which the below processing is not necessary. */ if (!is_dnssec) { header->id = htons(forward->new_id); plen = add_edns0_config(header, plen, ((unsigned char *)header) + PACKETSZ, &forward->frec_src.source, now, &subnet, &cacheable); if (subnet) forward->flags |= FREC_HAS_SUBNET; if (!cacheable) forward->flags |= FREC_NO_CACHE; #ifdef HAVE_DNSSEC if (option_bool(OPT_DNSSEC_VALID) && (master->flags & SERV_DO_DNSSEC)) { plen = add_do_bit(header, plen, ((unsigned char *) header) + PACKETSZ); /* For debugging, set Checking Disabled, otherwise, have the upstream check too, this allows it to select auth servers when one is returning bad data. */ if (option_bool(OPT_DNSSEC_DEBUG)) header->hb4 |= HB4_CD; } #endif if (find_pseudoheader(header, plen, &edns0_len, &pheader, NULL, NULL)) { /* If there wasn't a PH before, and there is now, we added it. */ if (!oph) forward->flags |= FREC_ADDED_PHEADER; /* If we're sending an EDNS0 with any options, we can't recreate the query from a reply. */ if (edns0_len > 11) forward->flags |= FREC_HAS_EXTRADATA; /* Reduce udp size on retransmits. */ if (forward->flags & FREC_TEST_PKTSZ) PUTSHORT(SAFE_PKTSZ, pheader); } } if (forward->forwardall) start = first; forwarded = 0; /* check for send errors here (no route to host) if we fail to send to all nameservers, send back an error packet straight away (helps modem users when offline) */ while (1) { int fd; struct server *srv = daemon->serverarray[start]; if ((fd = allocate_rfd(&forward->rfds, srv)) != -1) { #ifdef HAVE_CONNTRACK /* Copy connection mark of incoming query to outgoing connection. */ if (option_bool(OPT_CONNTRACK)) set_outgoing_mark(forward, fd); #endif #ifdef HAVE_DNSSEC if (option_bool(OPT_DNSSEC_VALID) && (forward->flags & FREC_ADDED_PHEADER)) { /* Difficult one here. If our client didn't send EDNS0, we will have set the UDP packet size to 512. But that won't provide space for the RRSIGS in many cases. The RRSIGS will be stripped out before the answer goes back, so the packet should shrink again. So, if we added a do-bit, bump the udp packet size to the value known to be OK for this server. We check returned size after stripping and set the truncated bit if it's still too big. */ unsigned char *pheader; int is_sign; if (find_pseudoheader(header, plen, NULL, &pheader, &is_sign, NULL) && !is_sign) PUTSHORT(srv->edns_pktsz, pheader); } #endif if (retry_send(sendto(fd, (char *)header, plen, 0, &srv->addr.sa, sa_len(&srv->addr)))) continue; if (errno == 0) { #ifdef HAVE_DUMPFILE dump_packet(DUMP_UP_QUERY, (void *)header, plen, NULL, &srv->addr); #endif /* Keep info in case we want to re-send this packet */ daemon->srv_save = srv; daemon->packet_len = plen; daemon->fd_save = fd; if (!(forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY))) { if (!gotname) strcpy(daemon->namebuff, "query"); log_query_mysockaddr(F_SERVER | F_FORWARD, daemon->namebuff, &srv->addr, NULL); } #ifdef HAVE_DNSSEC else log_query_mysockaddr(F_NOEXTRA | F_DNSSEC, daemon->namebuff, &srv->addr, querystr("dnssec-retry", (forward->flags & FREC_DNSKEY_QUERY) ? T_DNSKEY : T_DS)); #endif srv->queries++; forwarded = 1; forward->sentto = srv; if (!forward->forwardall) break; forward->forwardall++; } } if (++start == last) break; } if (forwarded || is_dnssec) return 1; /* could not send on, prepare to return */ header->id = htons(forward->frec_src.orig_id); free_frec(forward); /* cancel */ ede = EDE_NETERR; reply: if (udpfd != -1) { if (!(plen = make_local_answer(flags, gotname, plen, header, daemon->namebuff, limit, first, last, ede))) return 0; if (oph) { u16 swap = htons((u16)ede); if (ede != EDE_UNSET) plen = add_pseudoheader(header, plen, (unsigned char *)limit, daemon->edns_pktsz, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0); else plen = add_pseudoheader(header, plen, (unsigned char *)limit, daemon->edns_pktsz, 0, NULL, 0, do_bit, 0); } #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS) if (option_bool(OPT_CMARK_ALST_EN)) { unsigned int mark; int have_mark = get_incoming_mark(udpaddr, dst_addr, /* istcp: */ 0, &mark); if (have_mark && ((u32)mark & daemon->allowlist_mask)) report_addresses(header, plen, mark); } #endif send_from(udpfd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, plen, udpaddr, dst_addr, dst_iface); } return 0; } static size_t process_reply(struct dns_header *header, time_t now, struct server *server, size_t n, int check_rebind, int no_cache, int cache_secure, int bogusanswer, int ad_reqd, int do_bit, int added_pheader, int check_subnet, union mysockaddr *query_source, unsigned char *limit, int ede) { unsigned char *pheader, *sizep; char **sets = 0; int munged = 0, is_sign; unsigned int rcode = RCODE(header); size_t plen; (void)ad_reqd; (void)do_bit; (void)bogusanswer; #ifdef HAVE_IPSET if (daemon->ipsets && extract_request(header, n, daemon->namebuff, NULL)) { /* Similar algorithm to search_servers. */ struct ipsets *ipset_pos; unsigned int namelen = strlen(daemon->namebuff); unsigned int matchlen = 0; for (ipset_pos = daemon->ipsets; ipset_pos; ipset_pos = ipset_pos->next) { unsigned int domainlen = strlen(ipset_pos->domain); char *matchstart = daemon->namebuff + namelen - domainlen; if (namelen >= domainlen && hostname_isequal(matchstart, ipset_pos->domain) && (domainlen == 0 || namelen == domainlen || *(matchstart - 1) == '.' ) && domainlen >= matchlen) { matchlen = domainlen; sets = ipset_pos->sets; } } } #endif if ((pheader = find_pseudoheader(header, n, &plen, &sizep, &is_sign, NULL))) { /* Get extended RCODE. */ rcode |= sizep[2] << 4; if (check_subnet && !check_source(header, plen, pheader, query_source)) { my_syslog(LOG_WARNING, _("discarding DNS reply: subnet option mismatch")); return 0; } if (!is_sign) { if (added_pheader) { /* client didn't send EDNS0, we added one, strip it off before returning answer. */ n = rrfilter(header, n, 0); pheader = NULL; } else { /* If upstream is advertising a larger UDP packet size than we allow, trim it so that we don't get overlarge requests for the client. We can't do this for signed packets. */ unsigned short udpsz; GETSHORT(udpsz, sizep); if (udpsz > daemon->edns_pktsz) { sizep -= 2; PUTSHORT(daemon->edns_pktsz, sizep); } #ifdef HAVE_DNSSEC /* If the client didn't set the do bit, but we did, reset it. */ if (option_bool(OPT_DNSSEC_VALID) && !do_bit) { unsigned short flags; sizep += 2; /* skip RCODE */ GETSHORT(flags, sizep); flags &= ~0x8000; sizep -= 2; PUTSHORT(flags, sizep); } #endif } } } /* RFC 4035 sect 4.6 para 3 */ if (!is_sign && !option_bool(OPT_DNSSEC_PROXY)) header->hb4 &= ~HB4_AD; header->hb4 |= HB4_RA; /* recursion if available */ if (OPCODE(header) != QUERY) return resize_packet(header, n, pheader, plen); if (rcode != NOERROR && rcode != NXDOMAIN) { union all_addr a; a.log.rcode = rcode; a.log.ede = ede; log_query(F_UPSTREAM | F_RCODE, "error", &a, NULL); return resize_packet(header, n, pheader, plen); } /* Complain loudly if the upstream server is non-recursive. */ if (!(header->hb4 & HB4_RA) && rcode == NOERROR && server && !(server->flags & SERV_WARNED_RECURSIVE)) { (void)prettyprint_addr(&server->addr, daemon->namebuff); my_syslog(LOG_WARNING, _("nameserver %s refused to do a recursive query"), daemon->namebuff); if (!option_bool(OPT_LOG)) server->flags |= SERV_WARNED_RECURSIVE; } if (daemon->bogus_addr && rcode != NXDOMAIN && check_for_bogus_wildcard(header, n, daemon->namebuff, now)) { munged = 1; SET_RCODE(header, NXDOMAIN); header->hb3 &= ~HB3_AA; cache_secure = 0; ede = EDE_BLOCKED; } else { int doctored = 0; if (rcode == NXDOMAIN && extract_request(header, n, daemon->namebuff, NULL)) { if (check_for_local_domain(daemon->namebuff, now) || lookup_domain(daemon->namebuff, F_CONFIG, NULL, NULL)) { /* if we forwarded a query for a locally known name (because it was for an unknown type) and the answer is NXDOMAIN, convert that to NODATA, since we know that the domain exists, even if upstream doesn't */ munged = 1; header->hb3 |= HB3_AA; SET_RCODE(header, NOERROR); cache_secure = 0; } } if (extract_addresses(header, n, daemon->namebuff, now, sets, is_sign, check_rebind, no_cache, cache_secure, &doctored)) { my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff); munged = 1; cache_secure = 0; ede = EDE_BLOCKED; } if (doctored) cache_secure = 0; } #ifdef HAVE_DNSSEC if (bogusanswer && !(header->hb4 & HB4_CD) && !option_bool(OPT_DNSSEC_DEBUG)) { /* Bogus reply, turn into SERVFAIL */ SET_RCODE(header, SERVFAIL); munged = 1; } if (option_bool(OPT_DNSSEC_VALID)) { header->hb4 &= ~HB4_AD; if (!(header->hb4 & HB4_CD) && ad_reqd && cache_secure) header->hb4 |= HB4_AD; /* If the requestor didn't set the DO bit, don't return DNSSEC info. */ if (!do_bit) n = rrfilter(header, n, 1); } #endif /* do this after extract_addresses. Ensure NODATA reply and remove nameserver info. */ if (munged) { header->ancount = htons(0); header->nscount = htons(0); header->arcount = htons(0); header->hb3 &= ~HB3_TC; } /* the bogus-nxdomain stuff, doctor and NXDOMAIN->NODATA munging can all elide sections of the packet. Find the new length here and put back pseudoheader if it was removed. */ n = resize_packet(header, n, pheader, plen); if (pheader && ede != EDE_UNSET) { u16 swap = htons((u16)ede); n = add_pseudoheader(header, n, limit, daemon->edns_pktsz, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 1); } return n; } #ifdef HAVE_DNSSEC static void dnssec_validate(struct frec *forward, struct dns_header *header, ssize_t plen, int status, time_t now) { daemon->log_display_id = forward->frec_src.log_id; /* We've had a reply already, which we're validating. Ignore this duplicate */ if (forward->blocking_query) return; /* Truncated answer can't be validated. If this is an answer to a DNSSEC-generated query, we still need to get the client to retry over TCP, so return an answer with the TC bit set, even if the actual answer fits. */ if (header->hb3 & HB3_TC) status = STAT_TRUNCATED; /* If all replies to a query are REFUSED, give up. */ if (RCODE(header) == REFUSED) status = STAT_ABANDONED; /* As soon as anything returns BOGUS, we stop and unwind, to do otherwise would invite infinite loops, since the answers to DNSKEY and DS queries will not be cached, so they'll be repeated. */ if (!STAT_ISEQUAL(status, STAT_BOGUS) && !STAT_ISEQUAL(status, STAT_TRUNCATED) && !STAT_ISEQUAL(status, STAT_ABANDONED)) { if (forward->flags & FREC_DNSKEY_QUERY) status = dnssec_validate_by_ds(now, header, plen, daemon->namebuff, daemon->keyname, forward->class); else if (forward->flags & FREC_DS_QUERY) status = dnssec_validate_ds(now, header, plen, daemon->namebuff, daemon->keyname, forward->class); else status = dnssec_validate_reply(now, header, plen, daemon->namebuff, daemon->keyname, &forward->class, !option_bool(OPT_DNSSEC_IGN_NS) && (forward->sentto->flags & SERV_DO_DNSSEC), NULL, NULL, NULL); #ifdef HAVE_DUMPFILE if (STAT_ISEQUAL(status, STAT_BOGUS)) dump_packet((forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY)) ? DUMP_SEC_BOGUS : DUMP_BOGUS, header, (size_t)plen, &forward->sentto->addr, NULL); #endif } /* Can't validate, as we're missing key data. Put this answer aside, whilst we get that. */ if (STAT_ISEQUAL(status, STAT_NEED_DS) || STAT_ISEQUAL(status, STAT_NEED_KEY)) { struct frec *new = NULL; int serverind; struct blockdata *stash; /* Now save reply pending receipt of key data */ if ((serverind = dnssec_server(forward->sentto, daemon->keyname, NULL, NULL)) != -1 && (stash = blockdata_alloc((char *)header, plen))) { struct server *server = daemon->serverarray[serverind]; struct frec *orig; unsigned int flags; void *hash; size_t nn; /* validate routines leave name of required record in daemon->keyname */ nn = dnssec_generate_query(header, ((unsigned char *) header) + server->edns_pktsz, daemon->keyname, forward->class, STAT_ISEQUAL(status, STAT_NEED_KEY) ? T_DNSKEY : T_DS, server->edns_pktsz); flags = STAT_ISEQUAL(status, STAT_NEED_KEY) ? FREC_DNSKEY_QUERY : FREC_DS_QUERY; hash = hash_questions(header, nn, daemon->namebuff); if ((new = lookup_frec_by_query(hash, flags, FREC_DNSKEY_QUERY | FREC_DS_QUERY))) { forward->next_dependent = new->dependent; new->dependent = forward; /* Make consistent, only replace query copy with unvalidated answer when we set ->blocking_query. */ if (forward->stash) blockdata_free(forward->stash); forward->blocking_query = new; forward->stash_len = plen; forward->stash = stash; return; } /* Find the original query that started it all.... */ for (orig = forward; orig->dependent; orig = orig->dependent); /* Make sure we don't expire and free the orig frec during the allocation of a new one: third arg of get_new_frec() does that. */ if (--orig->work_counter == 0 || !(new = get_new_frec(now, server, 1))) blockdata_free(stash); /* don't leak this on failure. */ else { int fd; struct frec *next = new->next; *new = *forward; /* copy everything, then overwrite */ new->next = next; new->blocking_query = NULL; new->frec_src.log_id = daemon->log_display_id = ++daemon->log_id; new->sentto = server; new->rfds = NULL; new->frec_src.next = NULL; new->flags &= ~(FREC_DNSKEY_QUERY | FREC_DS_QUERY | FREC_HAS_EXTRADATA); new->flags |= flags; new->forwardall = 0; forward->next_dependent = NULL; new->dependent = forward; /* to find query awaiting new one. */ /* Make consistent, only replace query copy with unvalidated answer when we set ->blocking_query. */ forward->blocking_query = new; if (forward->stash) blockdata_free(forward->stash); forward->stash_len = plen; forward->stash = stash; memcpy(new->hash, hash, HASH_SIZE); new->new_id = get_id(); header->id = htons(new->new_id); /* Save query for retransmission */ new->stash = blockdata_alloc((char *)header, nn); new->stash_len = nn; /* Don't resend this. */ daemon->srv_save = NULL; if ((fd = allocate_rfd(&new->rfds, server)) != -1) { #ifdef HAVE_CONNTRACK if (option_bool(OPT_CONNTRACK)) set_outgoing_mark(orig, fd); #endif server_send_log(server, fd, header, nn, DUMP_SEC_QUERY, F_NOEXTRA | F_DNSSEC, daemon->keyname, querystr("dnssec-query", STAT_ISEQUAL(status, STAT_NEED_KEY) ? T_DNSKEY : T_DS)); server->queries++; } return; } } /* sending DNSSEC query failed. */ status = STAT_ABANDONED; } /* Validated original answer, all done. */ if (!forward->dependent) return_reply(now, forward, header, plen, status); else { /* validated subsidiary query/queries, (and cached result) pop that and return to the previous query/queries we were working on. */ struct frec *prev, *nxt = forward->dependent; free_frec(forward); while ((prev = nxt)) { /* ->next_dependent will have changed after return from recursive call below. */ nxt = prev->next_dependent; prev->blocking_query = NULL; /* already gone */ blockdata_retrieve(prev->stash, prev->stash_len, (void *)header); dnssec_validate(prev, header, prev->stash_len, status, now); } } } #endif /* sets new last_server */ void reply_query(int fd, time_t now) { /* packet from peer server, extract data for cache, and send to original requester */ struct dns_header *header; union mysockaddr serveraddr; struct frec *forward; socklen_t addrlen = sizeof(serveraddr); ssize_t n = recvfrom(fd, daemon->packet, daemon->packet_buff_sz, 0, &serveraddr.sa, &addrlen); struct server *server; void *hash; int first, last, c; /* packet buffer overwritten */ daemon->srv_save = NULL; /* Determine the address of the server replying so that we can mark that as good */ if (serveraddr.sa.sa_family == AF_INET6) serveraddr.in6.sin6_flowinfo = 0; header = (struct dns_header *)daemon->packet; if (n < (int)sizeof(struct dns_header) || !(header->hb3 & HB3_QR)) return; hash = hash_questions(header, n, daemon->namebuff); if (!(forward = lookup_frec(ntohs(header->id), fd, hash, &first, &last))) return; /* spoof check: answer must come from known server, also we may have sent the same query to multiple servers from the same local socket, and would like to know which one has answered. */ for (c = first; c != last; c++) if (sockaddr_isequal(&daemon->serverarray[c]->addr, &serveraddr)) break; if (c == last) return; server = daemon->serverarray[c]; if (RCODE(header) != REFUSED) daemon->serverarray[first]->last_server = c; else if (daemon->serverarray[first]->last_server == c) daemon->serverarray[first]->last_server = -1; /* If sufficient time has elapsed, try and expand UDP buffer size again. */ if (difftime(now, server->pktsz_reduced) > UDP_TEST_TIME) server->edns_pktsz = daemon->edns_pktsz; #ifdef HAVE_DUMPFILE dump_packet((forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY)) ? DUMP_SEC_REPLY : DUMP_UP_REPLY, (void *)header, n, &serveraddr, NULL); #endif /* log_query gets called indirectly all over the place, so pass these in global variables - sorry. */ daemon->log_display_id = forward->frec_src.log_id; daemon->log_source_addr = &forward->frec_src.source; if (daemon->ignore_addr && RCODE(header) == NOERROR && check_for_ignored_address(header, n)) return; /* Note: if we send extra options in the EDNS0 header, we can't recreate the query from the reply. */ if ((RCODE(header) == REFUSED || RCODE(header) == SERVFAIL) && forward->forwardall == 0 && !(forward->flags & FREC_HAS_EXTRADATA)) /* for broken servers, attempt to send to another one. */ { unsigned char *pheader, *udpsz; unsigned short udp_size = PACKETSZ; /* default if no EDNS0 */ size_t plen; int is_sign; size_t nn = 0; #ifdef HAVE_DNSSEC /* DNSSEC queries have a copy of the original query stashed. The query MAY have got a good answer, and be awaiting the results of further queries, in which case The Stash contains something else and we don't need to retry anyway. */ if ((forward->flags & (FREC_DNSKEY_QUERY | FREC_DS_QUERY)) && !forward->blocking_query) { blockdata_retrieve(forward->stash, forward->stash_len, (void *)header); nn = forward->stash_len; udp_size = daemon->edns_pktsz; } else #endif { /* recreate query from reply */ if ((pheader = find_pseudoheader(header, (size_t)n, &plen, &udpsz, &is_sign, NULL))) GETSHORT(udp_size, udpsz); /* If the client provides an EDNS0 UDP size, use that to limit our reply. (bounded by the maximum configured). If no EDNS0, then it defaults to 512 */ if (udp_size > daemon->edns_pktsz) udp_size = daemon->edns_pktsz; else if (udp_size < PACKETSZ) udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */ if (!is_sign && (nn = resize_packet(header, (size_t)n, pheader, plen)) && (forward->flags & FREC_DO_QUESTION)) add_do_bit(header, nn, (unsigned char *)pheader + plen); header->ancount = htons(0); header->nscount = htons(0); header->arcount = htons(0); header->hb3 &= ~(HB3_QR | HB3_AA | HB3_TC); header->hb4 &= ~(HB4_RA | HB4_RCODE | HB4_CD | HB4_AD); if (forward->flags & FREC_CHECKING_DISABLED) header->hb4 |= HB4_CD; if (forward->flags & FREC_AD_QUESTION) header->hb4 |= HB4_AD; } if (nn) { forward_query(-1, NULL, NULL, 0, header, nn, ((char *) header) + udp_size, now, forward, forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION); return; } } /* If the answer is an error, keep the forward record in place in case we get a good reply from another server. Kill it when we've had replies from all to avoid filling the forwarding table when everything is broken */ /* decrement count of replies recieved if we sent to more than one server. */ if (forward->forwardall && (--forward->forwardall > 1) && RCODE(header) == REFUSED) return; /* We tried resending to this server with a smaller maximum size and got an answer. Make that permanent. To avoid reduxing the packet size for a single dropped packet, only do this when we get a truncated answer, or one larger than the safe size. */ if (server->edns_pktsz > SAFE_PKTSZ && (forward->flags & FREC_TEST_PKTSZ) && ((header->hb3 & HB3_TC) || n >= SAFE_PKTSZ)) { server->edns_pktsz = SAFE_PKTSZ; server->pktsz_reduced = now; (void)prettyprint_addr(&server->addr, daemon->addrbuff); my_syslog(LOG_WARNING, _("reducing DNS packet size for nameserver %s to %d"), daemon->addrbuff, SAFE_PKTSZ); } forward->sentto = server; #ifdef HAVE_DNSSEC if ((forward->sentto->flags & SERV_DO_DNSSEC) && option_bool(OPT_DNSSEC_VALID) && !(forward->flags & FREC_CHECKING_DISABLED)) dnssec_validate(forward, header, n, STAT_OK, now); else #endif return_reply(now, forward, header, n, STAT_OK); } static void return_reply(time_t now, struct frec *forward, struct dns_header *header, ssize_t n, int status) { int check_rebind = 0, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0; size_t nn; int ede = EDE_UNSET; (void)status; daemon->log_display_id = forward->frec_src.log_id; daemon->log_source_addr = &forward->frec_src.source; /* Don't cache replies where DNSSEC validation was turned off, either the upstream server told us so, or the original query specified it. */ if ((header->hb4 & HB4_CD) || (forward->flags & FREC_CHECKING_DISABLED)) no_cache_dnssec = 1; #ifdef HAVE_DNSSEC if (!STAT_ISEQUAL(status, STAT_OK)) { /* status is STAT_OK when validation not turned on. */ no_cache_dnssec = 0; if (STAT_ISEQUAL(status, STAT_TRUNCATED)) header->hb3 |= HB3_TC; else { char *result, *domain = "result"; union all_addr a; a.log.ede = ede = errflags_to_ede(status); if (STAT_ISEQUAL(status, STAT_ABANDONED)) { result = "ABANDONED"; status = STAT_BOGUS; } else result = (STAT_ISEQUAL(status, STAT_SECURE) ? "SECURE" : (STAT_ISEQUAL(status, STAT_INSECURE) ? "INSECURE" : "BOGUS")); if (STAT_ISEQUAL(status, STAT_SECURE)) cache_secure = 1; else if (STAT_ISEQUAL(status, STAT_BOGUS)) { no_cache_dnssec = 1; bogusanswer = 1; if (extract_request(header, n, daemon->namebuff, NULL)) domain = daemon->namebuff; } log_query(F_SECSTAT, domain, &a, result); } } #endif if (option_bool(OPT_NO_REBIND)) check_rebind = !(forward->flags & FREC_NOREBIND); /* restore CD bit to the value in the query */ if (forward->flags & FREC_CHECKING_DISABLED) header->hb4 |= HB4_CD; else header->hb4 &= ~HB4_CD; /* Never cache answers which are contingent on the source or MAC address EDSN0 option, since the cache is ignorant of such things. */ if (forward->flags & FREC_NO_CACHE) no_cache_dnssec = 1; if ((nn = process_reply(header, now, forward->sentto, (size_t)n, check_rebind, no_cache_dnssec, cache_secure, bogusanswer, forward->flags & FREC_AD_QUESTION, forward->flags & FREC_DO_QUESTION, forward->flags & FREC_ADDED_PHEADER, forward->flags & FREC_HAS_SUBNET, &forward->frec_src.source, ((unsigned char *)header) + daemon->edns_pktsz, ede))) { struct frec_src *src; header->id = htons(forward->frec_src.orig_id); #ifdef HAVE_DNSSEC /* We added an EDNSO header for the purpose of getting DNSSEC RRs, and set the value of the UDP payload size greater than the no-EDNS0-implied 512 to have space for the RRSIGS. If, having stripped them and the EDNS0 header, the answer is still bigger than 512, truncate it and mark it so. The client then retries with TCP. */ if (option_bool(OPT_DNSSEC_VALID) && (forward->flags & FREC_ADDED_PHEADER) && (nn > PACKETSZ)) { header->ancount = htons(0); header->nscount = htons(0); header->arcount = htons(0); header->hb3 |= HB3_TC; nn = resize_packet(header, nn, NULL, 0); } #endif for (src = &forward->frec_src; src; src = src->next) { header->id = htons(src->orig_id); #ifdef HAVE_DUMPFILE dump_packet(DUMP_REPLY, daemon->packet, (size_t)nn, NULL, &src->source); #endif #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS) if (option_bool(OPT_CMARK_ALST_EN)) { unsigned int mark; int have_mark = get_incoming_mark(&src->source, &src->dest, /* istcp: */ 0, &mark); if (have_mark && ((u32)mark & daemon->allowlist_mask)) report_addresses(header, nn, mark); } #endif send_from(src->fd, option_bool(OPT_NOWILD) || option_bool (OPT_CLEVERBIND), daemon->packet, nn, &src->source, &src->dest, src->iface); if (option_bool(OPT_EXTRALOG) && src != &forward->frec_src) { daemon->log_display_id = src->log_id; daemon->log_source_addr = &src->source; log_query(F_UPSTREAM, "query", NULL, "duplicate"); } } } free_frec(forward); /* cancel */ } #ifdef HAVE_CONNTRACK static int is_query_allowed_for_mark(u32 mark, const char *name) { int is_allowable_name, did_validate_name = 0; struct allowlist *allowlists; char **patterns_pos; for (allowlists = daemon->allowlists; allowlists; allowlists = allowlists->next) if (allowlists->mark == (mark & daemon->allowlist_mask & allowlists->mask)) for (patterns_pos = allowlists->patterns; *patterns_pos; patterns_pos++) { if (!strcmp(*patterns_pos, "*")) return 1; if (!did_validate_name) { is_allowable_name = name ? is_valid_dns_name(name) : 0; did_validate_name = 1; } if (is_allowable_name && is_dns_name_matching_pattern(name, *patterns_pos)) return 1; } return 0; } static size_t answer_disallowed(struct dns_header *header, size_t qlen, u32 mark, const char *name) { unsigned char *p; (void)name; (void)mark; #ifdef HAVE_UBUS if (name) ubus_event_bcast_connmark_allowlist_refused(mark, name); #endif setup_reply(header, /* flags: */ 0, EDE_BLOCKED); if (!(p = skip_questions(header, qlen))) return 0; return p - (unsigned char *)header; } #endif void receive_query(struct listener *listen, time_t now) { struct dns_header *header = (struct dns_header *)daemon->packet; union mysockaddr source_addr; unsigned char *pheader; unsigned short type, udp_size = PACKETSZ; /* default if no EDNS0 */ union all_addr dst_addr; struct in_addr netmask, dst_addr_4; size_t m; ssize_t n; int if_index = 0, auth_dns = 0, do_bit = 0, have_pseudoheader = 0; #ifdef HAVE_CONNTRACK unsigned int mark = 0; int have_mark = 0; int is_single_query = 0, allowed = 1; #endif #ifdef HAVE_AUTH int local_auth = 0; #endif struct iovec iov[1]; struct msghdr msg; struct cmsghdr *cmptr; union { struct cmsghdr align; /* this ensures alignment */ char control6[CMSG_SPACE(sizeof(struct in6_pktinfo))]; #if defined(HAVE_LINUX_NETWORK) char control[CMSG_SPACE(sizeof(struct in_pktinfo))]; #elif defined(IP_RECVDSTADDR) && defined(HAVE_SOLARIS_NETWORK) char control[CMSG_SPACE(sizeof(struct in_addr)) + CMSG_SPACE(sizeof(unsigned int))]; #elif defined(IP_RECVDSTADDR) char control[CMSG_SPACE(sizeof(struct in_addr)) + CMSG_SPACE(sizeof(struct sockaddr_dl))]; #endif } control_u; int family = listen->addr.sa.sa_family; /* Can always get recvd interface for IPv6 */ int check_dst = !option_bool(OPT_NOWILD) || family == AF_INET6; /* packet buffer overwritten */ daemon->srv_save = NULL; dst_addr_4.s_addr = dst_addr.addr4.s_addr = 0; netmask.s_addr = 0; if (option_bool(OPT_NOWILD) && listen->iface) { auth_dns = listen->iface->dns_auth; if (family == AF_INET) { dst_addr_4 = dst_addr.addr4 = listen->iface->addr.in.sin_addr; netmask = listen->iface->netmask; } } iov[0].iov_base = daemon->packet; iov[0].iov_len = daemon->edns_pktsz; msg.msg_control = control_u.control; msg.msg_controllen = sizeof(control_u); msg.msg_flags = 0; msg.msg_name = &source_addr; msg.msg_namelen = sizeof(source_addr); msg.msg_iov = iov; msg.msg_iovlen = 1; if ((n = recvmsg(listen->fd, &msg, 0)) == -1) return; if (n < (int)sizeof(struct dns_header) || (msg.msg_flags & MSG_TRUNC) || (header->hb3 & HB3_QR)) return; /* Clear buffer beyond request to avoid risk of information disclosure. */ memset(daemon->packet + n, 0, daemon->edns_pktsz - n); source_addr.sa.sa_family = family; if (family == AF_INET) { /* Source-port == 0 is an error, we can't send back to that. http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */ if (source_addr.in.sin_port == 0) return; } else { /* Source-port == 0 is an error, we can't send back to that. */ if (source_addr.in6.sin6_port == 0) return; source_addr.in6.sin6_flowinfo = 0; } /* We can be configured to only accept queries from at-most-one-hop-away addresses. */ if (option_bool(OPT_LOCAL_SERVICE)) { struct addrlist *addr; if (family == AF_INET6) { for (addr = daemon->interface_addrs; addr; addr = addr->next) if ((addr->flags & ADDRLIST_IPV6) && is_same_net6(&addr->addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen)) break; } else { struct in_addr netmask; for (addr = daemon->interface_addrs; addr; addr = addr->next) { netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen)); if (!(addr->flags & ADDRLIST_IPV6) && is_same_net(addr->addr.addr4, source_addr.in.sin_addr, netmask)) break; } } if (!addr) { static int warned = 0; if (!warned) { my_syslog(LOG_WARNING, _("Ignoring query from non-local network")); warned = 1; } return; } } if (check_dst) { struct ifreq ifr; if (msg.msg_controllen < sizeof(struct cmsghdr)) return; #if defined(HAVE_LINUX_NETWORK) if (family == AF_INET) for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_PKTINFO) { union { unsigned char *c; struct in_pktinfo *p; } p; p.c = CMSG_DATA(cmptr); dst_addr_4 = dst_addr.addr4 = p.p->ipi_spec_dst; if_index = p.p->ipi_ifindex; } #elif defined(IP_RECVDSTADDR) && defined(IP_RECVIF) if (family == AF_INET) { for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) { union { unsigned char *c; unsigned int *i; struct in_addr *a; #ifndef HAVE_SOLARIS_NETWORK struct sockaddr_dl *s; #endif } p; p.c = CMSG_DATA(cmptr); if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVDSTADDR) dst_addr_4 = dst_addr.addr4 = *(p.a); else if (cmptr->cmsg_level == IPPROTO_IP && cmptr->cmsg_type == IP_RECVIF) #ifdef HAVE_SOLARIS_NETWORK if_index = *(p.i); #else if_index = p.s->sdl_index; #endif } } #endif if (family == AF_INET6) { for (cmptr = CMSG_FIRSTHDR(&msg); cmptr; cmptr = CMSG_NXTHDR(&msg, cmptr)) if (cmptr->cmsg_level == IPPROTO_IPV6 && cmptr->cmsg_type == daemon->v6pktinfo) { union { unsigned char *c; struct in6_pktinfo *p; } p; p.c = CMSG_DATA(cmptr); dst_addr.addr6 = p.p->ipi6_addr; if_index = p.p->ipi6_ifindex; } } /* enforce available interface configuration */ if (!indextoname(listen->fd, if_index, ifr.ifr_name)) return; if (!iface_check(family, &dst_addr, ifr.ifr_name, &auth_dns)) { if (!option_bool(OPT_CLEVERBIND)) enumerate_interfaces(0); if (!loopback_exception(listen->fd, family, &dst_addr, ifr.ifr_name) && !label_exception(if_index, family, &dst_addr)) return; } if (family == AF_INET && option_bool(OPT_LOCALISE)) { struct irec *iface; /* get the netmask of the interface which has the address we were sent to. This is no necessarily the interface we arrived on. */ for (iface = daemon->interfaces; iface; iface = iface->next) if (iface->addr.sa.sa_family == AF_INET && iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr) break; /* interface may be new */ if (!iface && !option_bool(OPT_CLEVERBIND)) enumerate_interfaces(0); for (iface = daemon->interfaces; iface; iface = iface->next) if (iface->addr.sa.sa_family == AF_INET && iface->addr.in.sin_addr.s_addr == dst_addr_4.s_addr) break; /* If we failed, abandon localisation */ if (iface) netmask = iface->netmask; else dst_addr_4.s_addr = 0; } } /* log_query gets called indirectly all over the place, so pass these in global variables - sorry. */ daemon->log_display_id = ++daemon->log_id; daemon->log_source_addr = &source_addr; #ifdef HAVE_DUMPFILE dump_packet(DUMP_QUERY, daemon->packet, (size_t)n, &source_addr, NULL); #endif #ifdef HAVE_CONNTRACK if (option_bool(OPT_CMARK_ALST_EN)) have_mark = get_incoming_mark(&source_addr, &dst_addr, /* istcp: */ 0, &mark); #endif if (extract_request(header, (size_t)n, daemon->namebuff, &type)) { #ifdef HAVE_AUTH struct auth_zone *zone; #endif char *types = querystr(auth_dns ? "auth" : "query", type); log_query_mysockaddr(F_QUERY | F_FORWARD, daemon->namebuff, &source_addr, types); #ifdef HAVE_CONNTRACK is_single_query = 1; #endif #ifdef HAVE_AUTH /* find queries for zones we're authoritative for, and answer them directly */ if (!auth_dns && !option_bool(OPT_LOCALISE)) for (zone = daemon->auth_zones; zone; zone = zone->next) if (in_zone(zone, daemon->namebuff, NULL)) { auth_dns = 1; local_auth = 1; break; } #endif #ifdef HAVE_LOOP /* Check for forwarding loop */ if (detect_loop(daemon->namebuff, type)) return; #endif } if (find_pseudoheader(header, (size_t)n, NULL, &pheader, NULL, NULL)) { unsigned short flags; have_pseudoheader = 1; GETSHORT(udp_size, pheader); pheader += 2; /* ext_rcode */ GETSHORT(flags, pheader); if (flags & 0x8000) do_bit = 1;/* do bit */ /* If the client provides an EDNS0 UDP size, use that to limit our reply. (bounded by the maximum configured). If no EDNS0, then it defaults to 512 */ if (udp_size > daemon->edns_pktsz) udp_size = daemon->edns_pktsz; else if (udp_size < PACKETSZ) udp_size = PACKETSZ; /* Sanity check - can't reduce below default. RFC 6891 6.2.3 */ } #ifdef HAVE_CONNTRACK #ifdef HAVE_AUTH if (!auth_dns || local_auth) #endif if (option_bool(OPT_CMARK_ALST_EN) && have_mark && ((u32)mark & daemon->allowlist_mask)) allowed = is_query_allowed_for_mark((u32)mark, is_single_query ? daemon->namebuff : NULL); #endif if (0); #ifdef HAVE_CONNTRACK else if (!allowed) { u16 swap = htons(EDE_BLOCKED); m = answer_disallowed(header, (size_t)n, (u32)mark, is_single_query ? daemon->namebuff : NULL); if (have_pseudoheader && m != 0) m = add_pseudoheader(header, m, ((unsigned char *) header) + udp_size, daemon->edns_pktsz, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0); if (m >= 1) { #ifdef HAVE_DUMPFILE dump_packet(DUMP_REPLY, daemon->packet, m, NULL, &source_addr); #endif send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, m, &source_addr, &dst_addr, if_index); daemon->metrics[METRIC_DNS_LOCAL_ANSWERED]++; } } #endif #ifdef HAVE_AUTH else if (auth_dns) { m = answer_auth(header, ((char *) header) + udp_size, (size_t)n, now, &source_addr, local_auth, do_bit, have_pseudoheader); if (m >= 1) { #ifdef HAVE_DUMPFILE dump_packet(DUMP_REPLY, daemon->packet, m, NULL, &source_addr); #endif #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS) if (local_auth) if (option_bool(OPT_CMARK_ALST_EN) && have_mark && ((u32)mark & daemon->allowlist_mask)) report_addresses(header, m, mark); #endif send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, m, &source_addr, &dst_addr, if_index); daemon->metrics[METRIC_DNS_AUTH_ANSWERED]++; } } #endif else { int ad_reqd = do_bit; /* RFC 6840 5.7 */ if (header->hb4 & HB4_AD) ad_reqd = 1; m = answer_request(header, ((char *) header) + udp_size, (size_t)n, dst_addr_4, netmask, now, ad_reqd, do_bit, have_pseudoheader); if (m >= 1) { #ifdef HAVE_DUMPFILE dump_packet(DUMP_REPLY, daemon->packet, m, NULL, &source_addr); #endif #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS) if (option_bool(OPT_CMARK_ALST_EN) && have_mark && ((u32)mark & daemon->allowlist_mask)) report_addresses(header, m, mark); #endif send_from(listen->fd, option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND), (char *)header, m, &source_addr, &dst_addr, if_index); daemon->metrics[METRIC_DNS_LOCAL_ANSWERED]++; } else if (forward_query(listen->fd, &source_addr, &dst_addr, if_index, header, (size_t)n, ((char *) header) + udp_size, now, NULL, ad_reqd, do_bit)) daemon->metrics[METRIC_DNS_QUERIES_FORWARDED]++; else daemon->metrics[METRIC_DNS_LOCAL_ANSWERED]++; } } /* Send query in packet, qsize to a server determined by first,last,start and get the reply. return reply size. */ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet, size_t qsize, int have_mark, unsigned int mark, struct server **servp) { int firstsendto = -1; u16 *length = (u16 *)packet; unsigned char *payload = &packet[2]; struct dns_header *header = (struct dns_header *)payload; unsigned char c1, c2; unsigned char hash[HASH_SIZE]; unsigned int rsize; (void)mark; (void)have_mark; memcpy(hash, hash_questions(header, (unsigned int)qsize, daemon->namebuff), HASH_SIZE); while (1) { int data_sent = 0; struct server *serv; if (firstsendto == -1) firstsendto = start; else { start++; if (start == last) start = first; if (start == firstsendto) break; } serv = daemon->serverarray[start]; retry: *length = htons(qsize); if (serv->tcpfd == -1) { if ((serv->tcpfd = socket(serv->addr.sa.sa_family, SOCK_STREAM, 0)) == -1) continue; #ifdef HAVE_CONNTRACK /* Copy connection mark of incoming query to outgoing connection. */ if (have_mark) setsockopt(serv->tcpfd, SOL_SOCKET, SO_MARK, &mark, sizeof(unsigned int)); #endif if ((!local_bind(serv->tcpfd, &serv->source_addr, serv->interface, 0, 1))) { close(serv->tcpfd); serv->tcpfd = -1; continue; } #ifdef MSG_FASTOPEN server_send(serv, serv->tcpfd, packet, qsize + sizeof(u16), MSG_FASTOPEN); if (errno == 0) data_sent = 1; #endif if (!data_sent && connect(serv->tcpfd, &serv->addr.sa, sa_len(&serv->addr)) == -1) { close(serv->tcpfd); serv->tcpfd = -1; continue; } daemon->serverarray[first]->last_server = start; serv->flags &= ~SERV_GOT_TCP; } if ((!data_sent && !read_write(serv->tcpfd, packet, qsize + sizeof(u16), 0)) || !read_write(serv->tcpfd, &c1, 1, 1) || !read_write(serv->tcpfd, &c2, 1, 1) || !read_write(serv->tcpfd, payload, (rsize = (c1 << 8) | c2), 1)) { close(serv->tcpfd); serv->tcpfd = -1; /* We get data then EOF, reopen connection to same server, else try next. This avoids DoS from a server which accepts connections and then closes them. */ if (serv->flags & SERV_GOT_TCP) goto retry; else continue; } /* If the hash of the question section doesn't match the crc we sent, then someone might be attempting to insert bogus values into the cache by sending replies containing questions and bogus answers. Try another server, or give up */ if (memcmp(hash, hash_questions(header, rsize, daemon->namebuff), HASH_SIZE) != 0) continue; serv->flags |= SERV_GOT_TCP; *servp = serv; return rsize; } return 0; } #ifdef HAVE_DNSSEC /* Recurse down the key hierarchy */ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, size_t n, int class, char *name, char *keyname, struct server *server, int have_mark, unsigned int mark, int *keycount) { int first, last, start, new_status; unsigned char *packet = NULL; struct dns_header *new_header = NULL; while (1) { size_t m; int log_save; /* limit the amount of work we do, to avoid cycling forever on loops in the DNS */ if (--(*keycount) == 0) new_status = STAT_ABANDONED; else if (STAT_ISEQUAL(status, STAT_NEED_KEY)) new_status = dnssec_validate_by_ds(now, header, n, name, keyname, class); else if (STAT_ISEQUAL(status, STAT_NEED_DS)) new_status = dnssec_validate_ds(now, header, n, name, keyname, class); else new_status = dnssec_validate_reply(now, header, n, name, keyname, &class, !option_bool(OPT_DNSSEC_IGN_NS) && (server->flags & SERV_DO_DNSSEC), NULL, NULL, NULL); if (!STAT_ISEQUAL(new_status, STAT_NEED_DS) && !STAT_ISEQUAL(new_status, STAT_NEED_KEY)) break; /* Can't validate because we need a key/DS whose name now in keyname. Make query for same, and recurse to validate */ if (!packet) { packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16)); new_header = (struct dns_header *)&packet[2]; } if (!packet) { new_status = STAT_ABANDONED; break; } m = dnssec_generate_query(new_header, ((unsigned char *) new_header) + 65536, keyname, class, STAT_ISEQUAL(new_status, STAT_NEED_KEY) ? T_DNSKEY : T_DS, server->edns_pktsz); if ((start = dnssec_server(server, daemon->keyname, &first, &last)) == -1 || (m = tcp_talk(first, last, start, packet, m, have_mark, mark, &server)) == 0) { new_status = STAT_ABANDONED; break; } log_save = daemon->log_display_id; daemon->log_display_id = ++daemon->log_id; log_query_mysockaddr(F_NOEXTRA | F_DNSSEC, keyname, &server->addr, querystr("dnssec-query", STAT_ISEQUAL(new_status, STAT_NEED_KEY) ? T_DNSKEY : T_DS)); new_status = tcp_key_recurse(now, new_status, new_header, m, class, name, keyname, server, have_mark, mark, keycount); daemon->log_display_id = log_save; if (!STAT_ISEQUAL(new_status, STAT_OK)) break; } if (packet) free(packet); return new_status; } #endif /* The daemon forks before calling this: it should deal with one connection, blocking as necessary, and then return. Note, need to be a bit careful about resources for debug mode, when the fork is suppressed: that's done by the caller. */ unsigned char *tcp_request(int confd, time_t now, union mysockaddr *local_addr, struct in_addr netmask, int auth_dns) { size_t size = 0; int norebind; #ifdef HAVE_CONNTRACK int is_single_query = 0, allowed = 1; #endif #ifdef HAVE_AUTH int local_auth = 0; #endif int checking_disabled, do_bit, added_pheader = 0, have_pseudoheader = 0; int check_subnet, cacheable, no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0; size_t m; unsigned short qtype; unsigned int gotname; /* Max TCP packet + slop + size */ unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16)); unsigned char *payload = &packet[2]; unsigned char c1, c2; /* largest field in header is 16-bits, so this is still sufficiently aligned */ struct dns_header *header = (struct dns_header *)payload; u16 *length = (u16 *)packet; struct server *serv; struct in_addr dst_addr_4; union mysockaddr peer_addr; socklen_t peer_len = sizeof(union mysockaddr); int query_count = 0; unsigned char *pheader; unsigned int mark = 0; int have_mark = 0; int first, last; unsigned int flags = 0; if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1) return packet; #ifdef HAVE_CONNTRACK /* Get connection mark of incoming query to set on outgoing connections. */ if (option_bool(OPT_CONNTRACK) || option_bool(OPT_CMARK_ALST_EN)) { union all_addr local; if (local_addr->sa.sa_family == AF_INET6) local.addr6 = local_addr->in6.sin6_addr; else local.addr4 = local_addr->in.sin_addr; have_mark = get_incoming_mark(&peer_addr, &local, 1, &mark); } #endif /* We can be configured to only accept queries from at-most-one-hop-away addresses. */ if (option_bool(OPT_LOCAL_SERVICE)) { struct addrlist *addr; if (peer_addr.sa.sa_family == AF_INET6) { for (addr = daemon->interface_addrs; addr; addr = addr->next) if ((addr->flags & ADDRLIST_IPV6) && is_same_net6(&addr->addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen)) break; } else { struct in_addr netmask; for (addr = daemon->interface_addrs; addr; addr = addr->next) { netmask.s_addr = htonl(~(in_addr_t)0 << (32 - addr->prefixlen)); if (!(addr->flags & ADDRLIST_IPV6) && is_same_net(addr->addr.addr4, peer_addr.in.sin_addr, netmask)) break; } } if (!addr) { my_syslog(LOG_WARNING, _("Ignoring query from non-local network")); return packet; } } while (1) { int ede = EDE_UNSET; if (query_count == TCP_MAX_QUERIES || !packet || !read_write(confd, &c1, 1, 1) || !read_write(confd, &c2, 1, 1) || !(size = c1 << 8 | c2) || !read_write(confd, payload, size, 1)) return packet; if (size < (int)sizeof(struct dns_header)) continue; /* Clear buffer beyond request to avoid risk of information disclosure. */ memset(payload + size, 0, 65536 - size); query_count++; /* log_query gets called indirectly all over the place, so pass these in global variables - sorry. */ daemon->log_display_id = ++daemon->log_id; daemon->log_source_addr = &peer_addr; /* save state of "cd" flag in query */ if ((checking_disabled = header->hb4 & HB4_CD)) no_cache_dnssec = 1; if ((gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype))) { #ifdef HAVE_AUTH struct auth_zone *zone; #endif char *types = querystr(auth_dns ? "auth" : "query", qtype); log_query_mysockaddr(F_QUERY | F_FORWARD, daemon->namebuff, &peer_addr, types); #ifdef HAVE_CONNTRACK is_single_query = 1; #endif #ifdef HAVE_AUTH /* find queries for zones we're authoritative for, and answer them directly */ if (!auth_dns && !option_bool(OPT_LOCALISE)) for (zone = daemon->auth_zones; zone; zone = zone->next) if (in_zone(zone, daemon->namebuff, NULL)) { auth_dns = 1; local_auth = 1; break; } #endif } norebind = domain_no_rebind(daemon->namebuff); if (local_addr->sa.sa_family == AF_INET) dst_addr_4 = local_addr->in.sin_addr; else dst_addr_4.s_addr = 0; do_bit = 0; if (find_pseudoheader(header, (size_t)size, NULL, &pheader, NULL, NULL)) { unsigned short flags; have_pseudoheader = 1; pheader += 4; /* udp_size, ext_rcode */ GETSHORT(flags, pheader); if (flags & 0x8000) do_bit = 1; /* do bit */ } #ifdef HAVE_CONNTRACK #ifdef HAVE_AUTH if (!auth_dns || local_auth) #endif if (option_bool(OPT_CMARK_ALST_EN) && have_mark && ((u32)mark & daemon->allowlist_mask)) allowed = is_query_allowed_for_mark((u32)mark, is_single_query ? daemon->namebuff : NULL); #endif if (0); #ifdef HAVE_CONNTRACK else if (!allowed) { u16 swap = htons(EDE_BLOCKED); m = answer_disallowed(header, size, (u32)mark, is_single_query ? daemon->namebuff : NULL); if (have_pseudoheader && m != 0) m = add_pseudoheader(header, m, ((unsigned char *) header) + 65536, daemon->edns_pktsz, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0); } #endif #ifdef HAVE_AUTH else if (auth_dns) m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth, do_bit, have_pseudoheader); #endif else { int ad_reqd = do_bit; /* RFC 6840 5.7 */ if (header->hb4 & HB4_AD) ad_reqd = 1; /* m > 0 if answered from cache */ m = answer_request(header, ((char *) header) + 65536, (size_t)size, dst_addr_4, netmask, now, ad_reqd, do_bit, have_pseudoheader); /* Do this by steam now we're not in the select() loop */ check_log_writer(1); if (m == 0) { struct server *master; int start; if (lookup_domain(daemon->namebuff, gotname, &first, &last)) flags = is_local_answer(now, first, daemon->namebuff); else { /* No configured servers */ ede = EDE_NOT_READY; flags = 0; } /* don't forward A or AAAA queries for simple names, except the empty name */ if (!flags && option_bool(OPT_NODOTS_LOCAL) && (gotname & (F_IPV4 | F_IPV6)) && !strchr(daemon->namebuff, '.') && strlen(daemon->namebuff) != 0) flags = check_for_local_domain(daemon->namebuff, now) ? F_NOERR : F_NXDOMAIN; if (!flags && ede != EDE_NOT_READY) { master = daemon->serverarray[first]; if (option_bool(OPT_ORDER) || master->last_server == -1) start = first; else start = master->last_server; size = add_edns0_config(header, size, ((unsigned char *) header) + 65536, &peer_addr, now, &check_subnet, &cacheable); #ifdef HAVE_DNSSEC if (option_bool(OPT_DNSSEC_VALID) && (master->flags & SERV_DO_DNSSEC)) { size = add_do_bit(header, size, ((unsigned char *) header) + 65536); /* For debugging, set Checking Disabled, otherwise, have the upstream check too, this allows it to select auth servers when one is returning bad data. */ if (option_bool(OPT_DNSSEC_DEBUG)) header->hb4 |= HB4_CD; } #endif /* Check if we added a pheader on forwarding - may need to strip it from the reply. */ if (!have_pseudoheader && find_pseudoheader(header, size, NULL, NULL, NULL, NULL)) added_pheader = 1; /* Loop round available servers until we succeed in connecting to one. */ if ((m = tcp_talk(first, last, start, packet, size, have_mark, mark, &serv)) == 0) { ede = EDE_NETERR; break; } /* get query name again for logging - may have been overwritten */ if (!(gotname = extract_request(header, (unsigned int)size, daemon->namebuff, &qtype))) strcpy(daemon->namebuff, "query"); log_query_mysockaddr(F_SERVER | F_FORWARD, daemon->namebuff, &serv->addr, NULL); #ifdef HAVE_DNSSEC if (option_bool(OPT_DNSSEC_VALID) && !checking_disabled && (master->flags & SERV_DO_DNSSEC)) { int keycount = DNSSEC_WORK; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */ int status = tcp_key_recurse(now, STAT_OK, header, m, 0, daemon->namebuff, daemon->keyname, serv, have_mark, mark, &keycount); char *result, *domain = "result"; union all_addr a; a.log.ede = ede = errflags_to_ede(status); if (STAT_ISEQUAL(status, STAT_ABANDONED)) { result = "ABANDONED"; status = STAT_BOGUS; } else result = (STAT_ISEQUAL(status, STAT_SECURE) ? "SECURE" : (STAT_ISEQUAL(status, STAT_INSECURE) ? "INSECURE" : "BOGUS")); if (STAT_ISEQUAL(status, STAT_SECURE)) cache_secure = 1; else if (STAT_ISEQUAL(status, STAT_BOGUS)) { no_cache_dnssec = 1; bogusanswer = 1; if (extract_request(header, m, daemon->namebuff, NULL)) domain = daemon->namebuff; } log_query(F_SECSTAT, domain, &a, result); } #endif /* restore CD bit to the value in the query */ if (checking_disabled) header->hb4 |= HB4_CD; else header->hb4 &= ~HB4_CD; /* Never cache answers which are contingent on the source or MAC address EDSN0 option, since the cache is ignorant of such things. */ if (!cacheable) no_cache_dnssec = 1; m = process_reply(header, now, serv, (unsigned int)m, option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec, cache_secure, bogusanswer, ad_reqd, do_bit, added_pheader, check_subnet, &peer_addr, ((unsigned char *)header) + 65536, ede); } } } /* In case of local answer or no connections made. */ if (m == 0) { if (!(m = make_local_answer(flags, gotname, size, header, daemon->namebuff, ((char *) header) + 65536, first, last, ede))) break; if (have_pseudoheader) { u16 swap = htons((u16)ede); if (ede != EDE_UNSET) m = add_pseudoheader(header, m, ((unsigned char *) header) + 65536, daemon->edns_pktsz, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0); else m = add_pseudoheader(header, m, ((unsigned char *) header) + 65536, daemon->edns_pktsz, 0, NULL, 0, do_bit, 0); } } check_log_writer(1); *length = htons(m); #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS) #ifdef HAVE_AUTH if (!auth_dns || local_auth) #endif if (option_bool(OPT_CMARK_ALST_EN) && have_mark && ((u32)mark & daemon->allowlist_mask)) report_addresses(header, m, mark); #endif if (!read_write(confd, packet, m + sizeof(u16), 0)) break; } return packet; } /* return a UDP socket bound to a random port, have to cope with straying into occupied port nos and reserved ones. */ static int random_sock(struct server *s) { int fd; if ((fd = socket(s->source_addr.sa.sa_family, SOCK_DGRAM, 0)) != -1) { if (local_bind(fd, &s->source_addr, s->interface, s->ifindex, 0)) return fd; if (s->interface[0] == 0) (void)prettyprint_addr(&s->source_addr, daemon->namebuff); else strcpy(daemon->namebuff, s->interface); my_syslog(LOG_ERR, _("failed to bind server socket to %s: %s"), daemon->namebuff, strerror(errno)); close(fd); } return -1; } /* compare source addresses and interface, serv2 can be null. */ static int server_isequal(const struct server *serv1, const struct server *serv2) { return (serv2 && serv2->ifindex == serv1->ifindex && sockaddr_isequal(&serv2->source_addr, &serv1->source_addr) && strncmp(serv2->interface, serv1->interface, IF_NAMESIZE) == 0); } /* fdlp points to chain of randomfds already in use by transaction. If there's already a suitable one, return it, else allocate a new one and add it to the list. Not leaking any resources in the face of allocation failures is rather convoluted here. Note that rfd->serv may be NULL, when a server goes away. */ int allocate_rfd(struct randfd_list **fdlp, struct server *serv) { static int finger = 0; int i, j = 0; struct randfd_list *rfl; struct randfd *rfd = NULL; int fd = 0; /* If server has a pre-allocated fd, use that. */ if (serv->sfd) return serv->sfd->fd; /* existing suitable random port socket linked to this transaction? */ for (rfl = *fdlp; rfl; rfl = rfl->next) if (server_isequal(serv, rfl->rfd->serv)) return rfl->rfd->fd; /* No. need new link. */ if ((rfl = daemon->rfl_spare)) daemon->rfl_spare = rfl->next; else if (!(rfl = whine_malloc(sizeof(struct randfd_list)))) return -1; /* limit the number of sockets we have open to avoid starvation of (eg) TFTP. Once we have a reasonable number, randomness should be OK */ for (i = 0; i < daemon->numrrand; i++) if (daemon->randomsocks[i].refcount == 0) { if ((fd = random_sock(serv)) != -1) { rfd = &daemon->randomsocks[i]; rfd->serv = serv; rfd->fd = fd; rfd->refcount = 1; } break; } /* No free ones or cannot get new socket, grab an existing one */ if (!rfd) for (j = 0; j < daemon->numrrand; j++) { i = (j + finger) % daemon->numrrand; if (daemon->randomsocks[i].refcount != 0 && server_isequal(serv, daemon->randomsocks[i].serv) && daemon->randomsocks[i].refcount != 0xfffe) { finger = i + 1; rfd = &daemon->randomsocks[i]; rfd->refcount++; break; } } if (j == daemon->numrrand) { struct randfd_list *rfl_poll; /* there are no free slots, and non with the same parameters we can piggy-back on. We're going to have to allocate a new temporary record, distinguished by refcount == 0xffff. This will exist in the frec randfd list, never be shared, and be freed when no longer in use. It will also be held on the daemon->rfl_poll list so the poll system can find it. */ if ((rfl_poll = daemon->rfl_spare)) daemon->rfl_spare = rfl_poll->next; else rfl_poll = whine_malloc(sizeof(struct randfd_list)); if (!rfl_poll || !(rfd = whine_malloc(sizeof(struct randfd))) || (fd = random_sock(serv)) == -1) { /* Don't leak anything we may already have */ rfl->next = daemon->rfl_spare; daemon->rfl_spare = rfl; if (rfl_poll) { rfl_poll->next = daemon->rfl_spare; daemon->rfl_spare = rfl_poll; } if (rfd) free(rfd); return -1; /* doom */ } /* Note rfd->serv not set here, since it's not reused */ rfd->fd = fd; rfd->refcount = 0xffff; /* marker for temp record */ rfl_poll->rfd = rfd; rfl_poll->next = daemon->rfl_poll; daemon->rfl_poll = rfl_poll; } rfl->rfd = rfd; rfl->next = *fdlp; *fdlp = rfl; return rfl->rfd->fd; } void free_rfds(struct randfd_list **fdlp) { struct randfd_list *tmp, *rfl, *poll, *next, **up; for (rfl = *fdlp; rfl; rfl = tmp) { if (rfl->rfd->refcount == 0xffff || --(rfl->rfd->refcount) == 0) close(rfl->rfd->fd); /* temporary overflow record */ if (rfl->rfd->refcount == 0xffff) { free(rfl->rfd); /* go through the link of all these by steam to delete. This list is expected to be almost always empty. */ for (poll = daemon->rfl_poll, up = &daemon->rfl_poll; poll; poll = next) { next = poll->next; if (poll->rfd == rfl->rfd) { *up = poll->next; poll->next = daemon->rfl_spare; daemon->rfl_spare = poll; } else up = &poll->next; } } tmp = rfl->next; rfl->next = daemon->rfl_spare; daemon->rfl_spare = rfl; } *fdlp = NULL; } static void free_frec(struct frec *f) { struct frec_src *last; /* add back to freelist if not the record builtin to every frec. */ for (last = f->frec_src.next; last && last->next; last = last->next) ; if (last) { last->next = daemon->free_frec_src; daemon->free_frec_src = f->frec_src.next; } f->frec_src.next = NULL; free_rfds(&f->rfds); f->sentto = NULL; f->flags = 0; #ifdef HAVE_DNSSEC if (f->stash) { blockdata_free(f->stash); f->stash = NULL; } /* Anything we're waiting on is pointless now, too */ if (f->blocking_query) { struct frec *n, **up; /* unlink outselves from the blocking query's dependents list. */ for (n = f->blocking_query->dependent, up = &f->blocking_query->dependent; n; n = n->next_dependent) if (n == f) { *up = n->next_dependent; break; } else up = &n->next_dependent; /* If we were the only/last dependent, free the blocking query too. */ if (!f->blocking_query->dependent) free_frec(f->blocking_query); } f->blocking_query = NULL; f->dependent = NULL; f->next_dependent = NULL; #endif } /* Impose an absolute limit of 4*TIMEOUT before we wipe things (for random sockets). If force is set, always return a result, even if we have to allocate above the limit, and don'y free any records. This is set when allocating for DNSSEC to avoid cutting off the branch we are sitting on. */ static struct frec *get_new_frec(time_t now, struct server *master, int force) { struct frec *f, *oldest, *target; int count; /* look for free records, garbage collect old records and count number in use by our server-group. */ for (f = daemon->frec_list, oldest = NULL, target = NULL, count = 0; f; f = f->next) { if (!f->sentto) target = f; else { #ifdef HAVE_DNSSEC /* Don't free DNSSEC sub-queries here, as we may end up with dangling references to them. They'll go when their "real" query is freed. */ if (!f->dependent && !force) #endif { if (difftime(now, f->time) >= 4*TIMEOUT) { free_frec(f); target = f; } else if (!oldest || difftime(f->time, oldest->time) <= 0) oldest = f; } } if (f->sentto && ((int)difftime(now, f->time)) < TIMEOUT && server_samegroup(f->sentto, master)) count++; } if (!force && count >= daemon->ftabsize) { query_full(now, master->domain); return NULL; } if (!target && oldest && ((int)difftime(now, oldest->time)) >= TIMEOUT) { /* can't find empty one, use oldest if there is one and it's older than timeout */ free_frec(oldest); target = oldest; } if (!target && (target = (struct frec *)whine_malloc(sizeof(struct frec)))) { target->next = daemon->frec_list; daemon->frec_list = target; } if (target) target->time = now; return target; } static void query_full(time_t now, char *domain) { static time_t last_log = 0; if ((int)difftime(now, last_log) > 5) { last_log = now; if (!domain || strlen(domain) == 0) my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries reached (max: %d)"), daemon->ftabsize); else my_syslog(LOG_WARNING, _("Maximum number of concurrent DNS queries to %s reached (max: %d)"), domain, daemon->ftabsize); } } static struct frec *lookup_frec(unsigned short id, int fd, void *hash, int *firstp, int *lastp) { struct frec *f; struct server *s; int first, last; struct randfd_list *fdl; for(f = daemon->frec_list; f; f = f->next) if (f->sentto && f->new_id == id && (memcmp(hash, f->hash, HASH_SIZE) == 0)) { filter_servers(f->sentto->arrayposn, F_SERVER, firstp, lastp); /* sent from random port */ for (fdl = f->rfds; fdl; fdl = fdl->next) if (fdl->rfd->fd == fd) return f; /* Sent to upstream from socket associated with a server. Note we have to iterate over all the possible servers, since they may have different bound sockets. */ for (first = *firstp, last = *lastp; first != last; first++) { s = daemon->serverarray[first]; if (s->sfd && s->sfd->fd == fd) return f; } } return NULL; } static struct frec *lookup_frec_by_query(void *hash, unsigned int flags, unsigned int flagmask) { struct frec *f; for(f = daemon->frec_list; f; f = f->next) if (f->sentto && (f->flags & flagmask) == flags && memcmp(hash, f->hash, HASH_SIZE) == 0) return f; return NULL; } /* Send query packet again, if we can. */ void resend_query() { if (daemon->srv_save) server_send(daemon->srv_save, daemon->fd_save, daemon->packet, daemon->packet_len, 0); } /* A server record is going away, remove references to it */ void server_gone(struct server *server) { struct frec *f; int i; for (f = daemon->frec_list; f; f = f->next) if (f->sentto && f->sentto == server) free_frec(f); /* If any random socket refers to this server, NULL the reference. No more references to the socket will be created in the future. */ for (i = 0; i < daemon->numrrand; i++) if (daemon->randomsocks[i].refcount != 0 && daemon->randomsocks[i].serv == server) daemon->randomsocks[i].serv = NULL; if (daemon->srv_save == server) daemon->srv_save = NULL; } /* return unique random ids. */ static unsigned short get_id(void) { unsigned short ret = 0; struct frec *f; while (1) { ret = rand16(); /* ensure id is unique. */ for (f = daemon->frec_list; f; f = f->next) if (f->sentto && f->new_id == ret) break; if (!f) return ret; } }