1 /* 2 * util/data/msgparse.c - parse wireformat DNS messages. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 /** 36 * \file 37 * Routines for message parsing a packet buffer to a descriptive structure. 38 */ 39 #include "config.h" 40 #include "util/data/msgparse.h" 41 #include "util/data/msgreply.h" 42 #include "util/data/dname.h" 43 #include "util/data/packed_rrset.h" 44 #include "util/storage/lookup3.h" 45 #include "util/regional.h" 46 #include "sldns/rrdef.h" 47 #include "sldns/sbuffer.h" 48 #include "sldns/parseutil.h" 49 #include "sldns/wire2str.h" 50 51 /** smart comparison of (compressed, valid) dnames from packet */ 52 static int 53 smart_compare(sldns_buffer* pkt, uint8_t* dnow, 54 uint8_t* dprfirst, uint8_t* dprlast) 55 { 56 if(LABEL_IS_PTR(*dnow)) { 57 /* ptr points to a previous dname */ 58 uint8_t* p; 59 if((size_t)PTR_OFFSET(dnow[0], dnow[1]) 60 >= sldns_buffer_limit(pkt)) 61 return -1; 62 p = sldns_buffer_at(pkt, PTR_OFFSET(dnow[0], dnow[1])); 63 if( p == dprfirst || p == dprlast ) 64 return 0; 65 /* prev dname is also a ptr, both ptrs are the same. */ 66 if(LABEL_IS_PTR(*dprlast) && 67 dprlast[0] == dnow[0] && dprlast[1] == dnow[1]) 68 return 0; 69 } 70 return dname_pkt_compare(pkt, dnow, dprlast); 71 } 72 73 /** 74 * Allocate new rrset in region, fill with data. 75 */ 76 static struct rrset_parse* 77 new_rrset(struct msg_parse* msg, uint8_t* dname, size_t dnamelen, 78 uint16_t type, uint16_t dclass, hashvalue_type hash, 79 uint32_t rrset_flags, sldns_pkt_section section, 80 struct regional* region) 81 { 82 struct rrset_parse* p = regional_alloc(region, sizeof(*p)); 83 if(!p) return NULL; 84 p->rrset_bucket_next = msg->hashtable[hash & (PARSE_TABLE_SIZE-1)]; 85 msg->hashtable[hash & (PARSE_TABLE_SIZE-1)] = p; 86 p->rrset_all_next = 0; 87 if(msg->rrset_last) 88 msg->rrset_last->rrset_all_next = p; 89 else msg->rrset_first = p; 90 msg->rrset_last = p; 91 p->hash = hash; 92 p->section = section; 93 p->dname = dname; 94 p->dname_len = dnamelen; 95 p->type = type; 96 p->rrset_class = dclass; 97 p->flags = rrset_flags; 98 p->rr_count = 0; 99 p->size = 0; 100 p->rr_first = 0; 101 p->rr_last = 0; 102 p->rrsig_count = 0; 103 p->rrsig_first = 0; 104 p->rrsig_last = 0; 105 return p; 106 } 107 108 /** See if next rrset is nsec at zone apex */ 109 static int 110 nsec_at_apex(sldns_buffer* pkt) 111 { 112 /* we are at ttl position in packet. */ 113 size_t pos = sldns_buffer_position(pkt); 114 uint16_t rdatalen; 115 if(sldns_buffer_remaining(pkt) < 7) /* ttl+len+root */ 116 return 0; /* eek! */ 117 sldns_buffer_skip(pkt, 4); /* ttl */; 118 rdatalen = sldns_buffer_read_u16(pkt); 119 if(sldns_buffer_remaining(pkt) < rdatalen) { 120 sldns_buffer_set_position(pkt, pos); 121 return 0; /* parse error happens later */ 122 } 123 /* must validate the nsec next domain name format */ 124 if(pkt_dname_len(pkt) == 0) { 125 sldns_buffer_set_position(pkt, pos); 126 return 0; /* parse error */ 127 } 128 129 /* see if SOA bit is set. */ 130 if(sldns_buffer_position(pkt) < pos+4+rdatalen) { 131 /* nsec type bitmap contains items */ 132 uint8_t win, blen, bits; 133 /* need: windownum, bitmap len, firstbyte */ 134 if(sldns_buffer_position(pkt)+3 > pos+4+rdatalen) { 135 sldns_buffer_set_position(pkt, pos); 136 return 0; /* malformed nsec */ 137 } 138 win = sldns_buffer_read_u8(pkt); 139 blen = sldns_buffer_read_u8(pkt); 140 bits = sldns_buffer_read_u8(pkt); 141 /* 0window always first window. bitlen >=1 or parse 142 error really. bit 0x2 is SOA. */ 143 if(win == 0 && blen >= 1 && (bits & 0x02)) { 144 sldns_buffer_set_position(pkt, pos); 145 return 1; 146 } 147 } 148 149 sldns_buffer_set_position(pkt, pos); 150 return 0; 151 } 152 153 /** Calculate rrset flags */ 154 static uint32_t 155 pkt_rrset_flags(sldns_buffer* pkt, uint16_t type, sldns_pkt_section sec) 156 { 157 uint32_t f = 0; 158 if(type == LDNS_RR_TYPE_NSEC && nsec_at_apex(pkt)) { 159 f |= PACKED_RRSET_NSEC_AT_APEX; 160 } else if(type == LDNS_RR_TYPE_SOA && sec == LDNS_SECTION_AUTHORITY) { 161 f |= PACKED_RRSET_SOA_NEG; 162 } 163 return f; 164 } 165 166 hashvalue_type 167 pkt_hash_rrset(sldns_buffer* pkt, uint8_t* dname, uint16_t type, 168 uint16_t dclass, uint32_t rrset_flags) 169 { 170 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 171 /* this routine handles compressed names */ 172 hashvalue_type h = 0xab; 173 h = dname_pkt_hash(pkt, dname, h); 174 h = hashlittle(&type, sizeof(type), h); /* host order */ 175 h = hashlittle(&dclass, sizeof(dclass), h); /* netw order */ 176 h = hashlittle(&rrset_flags, sizeof(uint32_t), h); 177 return h; 178 } 179 180 /** create partial dname hash for rrset hash */ 181 static hashvalue_type 182 pkt_hash_rrset_first(sldns_buffer* pkt, uint8_t* dname) 183 { 184 /* works together with pkt_hash_rrset_rest */ 185 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 186 /* this routine handles compressed names */ 187 hashvalue_type h = 0xab; 188 h = dname_pkt_hash(pkt, dname, h); 189 return h; 190 } 191 192 /** create a rrset hash from a partial dname hash */ 193 static hashvalue_type 194 pkt_hash_rrset_rest(hashvalue_type dname_h, uint16_t type, uint16_t dclass, 195 uint32_t rrset_flags) 196 { 197 /* works together with pkt_hash_rrset_first */ 198 /* note this MUST be identical to rrset_key_hash in packed_rrset.c */ 199 hashvalue_type h; 200 h = hashlittle(&type, sizeof(type), dname_h); /* host order */ 201 h = hashlittle(&dclass, sizeof(dclass), h); /* netw order */ 202 h = hashlittle(&rrset_flags, sizeof(uint32_t), h); 203 return h; 204 } 205 206 /** compare rrset_parse with data */ 207 static int 208 rrset_parse_equals(struct rrset_parse* p, sldns_buffer* pkt, hashvalue_type h, 209 uint32_t rrset_flags, uint8_t* dname, size_t dnamelen, 210 uint16_t type, uint16_t dclass) 211 { 212 if(p->hash == h && p->dname_len == dnamelen && p->type == type && 213 p->rrset_class == dclass && p->flags == rrset_flags && 214 dname_pkt_compare(pkt, dname, p->dname) == 0) 215 return 1; 216 return 0; 217 } 218 219 220 struct rrset_parse* 221 msgparse_hashtable_lookup(struct msg_parse* msg, sldns_buffer* pkt, 222 hashvalue_type h, uint32_t rrset_flags, uint8_t* dname, 223 size_t dnamelen, uint16_t type, uint16_t dclass) 224 { 225 struct rrset_parse* p = msg->hashtable[h & (PARSE_TABLE_SIZE-1)]; 226 while(p) { 227 if(rrset_parse_equals(p, pkt, h, rrset_flags, dname, dnamelen, 228 type, dclass)) 229 return p; 230 p = p->rrset_bucket_next; 231 } 232 return NULL; 233 } 234 235 /** return type networkformat that rrsig in packet covers */ 236 static int 237 pkt_rrsig_covered(sldns_buffer* pkt, uint8_t* here, uint16_t* type) 238 { 239 size_t pos = sldns_buffer_position(pkt); 240 sldns_buffer_set_position(pkt, (size_t)(here-sldns_buffer_begin(pkt))); 241 /* ttl + len + size of small rrsig(rootlabel, no signature) */ 242 if(sldns_buffer_remaining(pkt) < 4+2+19) 243 return 0; 244 sldns_buffer_skip(pkt, 4); /* ttl */ 245 if(sldns_buffer_read_u16(pkt) < 19) /* too short */ { 246 sldns_buffer_set_position(pkt, pos); 247 return 0; 248 } 249 *type = sldns_buffer_read_u16(pkt); 250 sldns_buffer_set_position(pkt, pos); 251 return 1; 252 } 253 254 /** true if covered type equals prevtype */ 255 static int 256 pkt_rrsig_covered_equals(sldns_buffer* pkt, uint8_t* here, uint16_t type) 257 { 258 uint16_t t; 259 if(pkt_rrsig_covered(pkt, here, &t) && t == type) 260 return 1; 261 return 0; 262 } 263 264 void 265 msgparse_bucket_remove(struct msg_parse* msg, struct rrset_parse* rrset) 266 { 267 struct rrset_parse** p; 268 p = &msg->hashtable[ rrset->hash & (PARSE_TABLE_SIZE-1) ]; 269 while(*p) { 270 if(*p == rrset) { 271 *p = rrset->rrset_bucket_next; 272 return; 273 } 274 p = &( (*p)->rrset_bucket_next ); 275 } 276 } 277 278 /** change section of rrset from previous to current section */ 279 static void 280 change_section(struct msg_parse* msg, struct rrset_parse* rrset, 281 sldns_pkt_section section) 282 { 283 struct rrset_parse *p, *prev; 284 /* remove from list */ 285 if(section == rrset->section) 286 return; 287 p = msg->rrset_first; 288 prev = 0; 289 while(p) { 290 if(p == rrset) { 291 if(prev) prev->rrset_all_next = p->rrset_all_next; 292 else msg->rrset_first = p->rrset_all_next; 293 if(msg->rrset_last == rrset) 294 msg->rrset_last = prev; 295 break; 296 } 297 prev = p; 298 p = p->rrset_all_next; 299 } 300 /* remove from count */ 301 switch(rrset->section) { 302 case LDNS_SECTION_ANSWER: msg->an_rrsets--; break; 303 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break; 304 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break; 305 default: log_assert(0); 306 } 307 /* insert at end of list */ 308 rrset->rrset_all_next = 0; 309 if(msg->rrset_last) 310 msg->rrset_last->rrset_all_next = rrset; 311 else msg->rrset_first = rrset; 312 msg->rrset_last = rrset; 313 /* up count of new section */ 314 switch(section) { 315 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets++; break; 316 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets++; break; 317 default: log_assert(0); 318 } 319 rrset->section = section; 320 } 321 322 /** see if rrset of type RRSIG contains sig over given type */ 323 static int 324 rrset_has_sigover(sldns_buffer* pkt, struct rrset_parse* rrset, uint16_t type, 325 int* hasother) 326 { 327 int res = 0; 328 struct rr_parse* rr = rrset->rr_first; 329 log_assert( rrset->type == LDNS_RR_TYPE_RRSIG ); 330 while(rr) { 331 if(pkt_rrsig_covered_equals(pkt, rr->ttl_data, type)) 332 res = 1; 333 else *hasother = 1; 334 rr = rr->next; 335 } 336 return res; 337 } 338 339 /** move rrsigs from sigset to dataset */ 340 static int 341 moveover_rrsigs(sldns_buffer* pkt, struct regional* region, 342 struct rrset_parse* sigset, struct rrset_parse* dataset, int duplicate) 343 { 344 struct rr_parse* sig = sigset->rr_first; 345 struct rr_parse* prev = NULL; 346 struct rr_parse* insert; 347 struct rr_parse* nextsig; 348 while(sig) { 349 nextsig = sig->next; 350 if(pkt_rrsig_covered_equals(pkt, sig->ttl_data, 351 dataset->type)) { 352 if(duplicate) { 353 /* new */ 354 insert = (struct rr_parse*)regional_alloc( 355 region, sizeof(struct rr_parse)); 356 if(!insert) return 0; 357 insert->outside_packet = 0; 358 insert->ttl_data = sig->ttl_data; 359 insert->size = sig->size; 360 /* prev not used */ 361 } else { 362 /* remove from sigset */ 363 if(prev) prev->next = sig->next; 364 else sigset->rr_first = sig->next; 365 if(sigset->rr_last == sig) 366 sigset->rr_last = prev; 367 sigset->rr_count--; 368 sigset->size -= sig->size; 369 insert = sig; 370 /* prev not changed */ 371 } 372 /* add to dataset */ 373 dataset->rrsig_count++; 374 insert->next = 0; 375 if(dataset->rrsig_last) 376 dataset->rrsig_last->next = insert; 377 else dataset->rrsig_first = insert; 378 dataset->rrsig_last = insert; 379 dataset->size += insert->size; 380 } else { 381 prev = sig; 382 } 383 sig = nextsig; 384 } 385 return 1; 386 } 387 388 /** change an rrsig rrset for use as data rrset */ 389 static struct rrset_parse* 390 change_rrsig_rrset(struct rrset_parse* sigset, struct msg_parse* msg, 391 sldns_buffer* pkt, uint16_t datatype, uint32_t rrset_flags, 392 int hasother, sldns_pkt_section section, struct regional* region) 393 { 394 struct rrset_parse* dataset = sigset; 395 hashvalue_type hash = pkt_hash_rrset(pkt, sigset->dname, datatype, 396 sigset->rrset_class, rrset_flags); 397 log_assert( sigset->type == LDNS_RR_TYPE_RRSIG ); 398 log_assert( datatype != LDNS_RR_TYPE_RRSIG ); 399 if(hasother) { 400 /* need to make new rrset to hold data type */ 401 dataset = new_rrset(msg, sigset->dname, sigset->dname_len, 402 datatype, sigset->rrset_class, hash, rrset_flags, 403 section, region); 404 if(!dataset) 405 return NULL; 406 switch(section) { 407 case LDNS_SECTION_ANSWER: msg->an_rrsets++; break; 408 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets++; break; 409 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets++; break; 410 default: log_assert(0); 411 } 412 if(!moveover_rrsigs(pkt, region, sigset, dataset, 413 msg->qtype == LDNS_RR_TYPE_RRSIG || 414 (msg->qtype == LDNS_RR_TYPE_ANY && 415 section != LDNS_SECTION_ANSWER) )) 416 return NULL; 417 return dataset; 418 } 419 /* changeover the type of the rrset to data set */ 420 msgparse_bucket_remove(msg, dataset); 421 /* insert into new hash bucket */ 422 dataset->rrset_bucket_next = msg->hashtable[hash&(PARSE_TABLE_SIZE-1)]; 423 msg->hashtable[hash&(PARSE_TABLE_SIZE-1)] = dataset; 424 dataset->hash = hash; 425 /* use section of data item for result */ 426 change_section(msg, dataset, section); 427 dataset->type = datatype; 428 dataset->flags = rrset_flags; 429 dataset->rrsig_count += dataset->rr_count; 430 dataset->rr_count = 0; 431 /* move sigs to end of siglist */ 432 if(dataset->rrsig_last) 433 dataset->rrsig_last->next = dataset->rr_first; 434 else dataset->rrsig_first = dataset->rr_first; 435 dataset->rrsig_last = dataset->rr_last; 436 dataset->rr_first = 0; 437 dataset->rr_last = 0; 438 return dataset; 439 } 440 441 /** Find rrset. If equal to previous it is fast. hash if not so. 442 * @param msg: the message with hash table. 443 * @param pkt: the packet in wireformat (needed for compression ptrs). 444 * @param dname: pointer to start of dname (compressed) in packet. 445 * @param dnamelen: uncompressed wirefmt length of dname. 446 * @param type: type of current rr. 447 * @param dclass: class of current rr. 448 * @param hash: hash value is returned if the rrset could not be found. 449 * @param rrset_flags: is returned if the rrset could not be found. 450 * @param prev_dname_first: dname of last seen RR. First seen dname. 451 * @param prev_dname_last: dname of last seen RR. Last seen dname. 452 * @param prev_dnamelen: dname len of last seen RR. 453 * @param prev_type: type of last seen RR. 454 * @param prev_dclass: class of last seen RR. 455 * @param rrset_prev: last seen RRset. 456 * @param section: the current section in the packet. 457 * @param region: used to allocate temporary parsing data. 458 * @return 0 on out of memory. 459 */ 460 static int 461 find_rrset(struct msg_parse* msg, sldns_buffer* pkt, uint8_t* dname, 462 size_t dnamelen, uint16_t type, uint16_t dclass, hashvalue_type* hash, 463 uint32_t* rrset_flags, 464 uint8_t** prev_dname_first, uint8_t** prev_dname_last, 465 size_t* prev_dnamelen, uint16_t* prev_type, 466 uint16_t* prev_dclass, struct rrset_parse** rrset_prev, 467 sldns_pkt_section section, struct regional* region) 468 { 469 hashvalue_type dname_h = pkt_hash_rrset_first(pkt, dname); 470 uint16_t covtype; 471 if(*rrset_prev) { 472 /* check if equal to previous item */ 473 if(type == *prev_type && dclass == *prev_dclass && 474 dnamelen == *prev_dnamelen && 475 smart_compare(pkt, dname, *prev_dname_first, 476 *prev_dname_last) == 0 && 477 type != LDNS_RR_TYPE_RRSIG) { 478 /* same as previous */ 479 *prev_dname_last = dname; 480 return 1; 481 } 482 /* check if rrsig over previous item */ 483 if(type == LDNS_RR_TYPE_RRSIG && dclass == *prev_dclass && 484 pkt_rrsig_covered_equals(pkt, sldns_buffer_current(pkt), 485 *prev_type) && 486 smart_compare(pkt, dname, *prev_dname_first, 487 *prev_dname_last) == 0) { 488 /* covers previous */ 489 *prev_dname_last = dname; 490 return 1; 491 } 492 } 493 /* find by hashing and lookup in hashtable */ 494 *rrset_flags = pkt_rrset_flags(pkt, type, section); 495 496 /* if rrsig - try to lookup matching data set first */ 497 if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt, 498 sldns_buffer_current(pkt), &covtype)) { 499 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 500 *rrset_flags); 501 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 502 *rrset_flags, dname, dnamelen, covtype, dclass); 503 if(!*rrset_prev && covtype == LDNS_RR_TYPE_NSEC) { 504 /* if NSEC try with NSEC apex bit twiddled */ 505 *rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX; 506 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 507 *rrset_flags); 508 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, 509 *hash, *rrset_flags, dname, dnamelen, covtype, 510 dclass); 511 if(!*rrset_prev) /* untwiddle if not found */ 512 *rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX; 513 } 514 if(!*rrset_prev && covtype == LDNS_RR_TYPE_SOA) { 515 /* if SOA try with SOA neg flag twiddled */ 516 *rrset_flags ^= PACKED_RRSET_SOA_NEG; 517 *hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 518 *rrset_flags); 519 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, 520 *hash, *rrset_flags, dname, dnamelen, covtype, 521 dclass); 522 if(!*rrset_prev) /* untwiddle if not found */ 523 *rrset_flags ^= PACKED_RRSET_SOA_NEG; 524 } 525 if(*rrset_prev) { 526 *prev_dname_first = (*rrset_prev)->dname; 527 *prev_dname_last = dname; 528 *prev_dnamelen = dnamelen; 529 *prev_type = covtype; 530 *prev_dclass = dclass; 531 return 1; 532 } 533 } 534 if(type != LDNS_RR_TYPE_RRSIG) { 535 int hasother = 0; 536 /* find matching rrsig */ 537 *hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 538 dclass, 0); 539 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 540 0, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 541 dclass); 542 if(*rrset_prev && rrset_has_sigover(pkt, *rrset_prev, type, 543 &hasother)) { 544 /* yes! */ 545 *prev_dname_first = (*rrset_prev)->dname; 546 *prev_dname_last = dname; 547 *prev_dnamelen = dnamelen; 548 *prev_type = type; 549 *prev_dclass = dclass; 550 *rrset_prev = change_rrsig_rrset(*rrset_prev, msg, 551 pkt, type, *rrset_flags, hasother, section, 552 region); 553 if(!*rrset_prev) return 0; 554 return 1; 555 } 556 } 557 558 *hash = pkt_hash_rrset_rest(dname_h, type, dclass, *rrset_flags); 559 *rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, *rrset_flags, 560 dname, dnamelen, type, dclass); 561 if(*rrset_prev) 562 *prev_dname_first = (*rrset_prev)->dname; 563 else *prev_dname_first = dname; 564 *prev_dname_last = dname; 565 *prev_dnamelen = dnamelen; 566 *prev_type = type; 567 *prev_dclass = dclass; 568 return 1; 569 } 570 571 /** 572 * Parse query section. 573 * @param pkt: packet, position at call must be at start of query section. 574 * at end position is after query section. 575 * @param msg: store results here. 576 * @return: 0 if OK, or rcode on error. 577 */ 578 static int 579 parse_query_section(sldns_buffer* pkt, struct msg_parse* msg) 580 { 581 if(msg->qdcount == 0) 582 return 0; 583 if(msg->qdcount > 1) 584 return LDNS_RCODE_FORMERR; 585 log_assert(msg->qdcount == 1); 586 if(sldns_buffer_remaining(pkt) <= 0) 587 return LDNS_RCODE_FORMERR; 588 msg->qname = sldns_buffer_current(pkt); 589 if((msg->qname_len = pkt_dname_len(pkt)) == 0) 590 return LDNS_RCODE_FORMERR; 591 if(sldns_buffer_remaining(pkt) < sizeof(uint16_t)*2) 592 return LDNS_RCODE_FORMERR; 593 msg->qtype = sldns_buffer_read_u16(pkt); 594 msg->qclass = sldns_buffer_read_u16(pkt); 595 return 0; 596 } 597 598 size_t 599 get_rdf_size(sldns_rdf_type rdf) 600 { 601 switch(rdf) { 602 case LDNS_RDF_TYPE_CLASS: 603 case LDNS_RDF_TYPE_ALG: 604 case LDNS_RDF_TYPE_INT8: 605 return 1; 606 break; 607 case LDNS_RDF_TYPE_INT16: 608 case LDNS_RDF_TYPE_TYPE: 609 case LDNS_RDF_TYPE_CERT_ALG: 610 return 2; 611 break; 612 case LDNS_RDF_TYPE_INT32: 613 case LDNS_RDF_TYPE_TIME: 614 case LDNS_RDF_TYPE_A: 615 case LDNS_RDF_TYPE_PERIOD: 616 return 4; 617 break; 618 case LDNS_RDF_TYPE_TSIGTIME: 619 return 6; 620 break; 621 case LDNS_RDF_TYPE_AAAA: 622 return 16; 623 break; 624 default: 625 log_assert(0); /* add type above */ 626 /* only types that appear before a domain * 627 * name are needed. rest is simply copied. */ 628 } 629 return 0; 630 } 631 632 /** calculate the size of one rr */ 633 static int 634 calc_size(sldns_buffer* pkt, uint16_t type, struct rr_parse* rr) 635 { 636 const sldns_rr_descriptor* desc; 637 uint16_t pkt_len; /* length of rr inside the packet */ 638 rr->size = sizeof(uint16_t); /* the rdatalen */ 639 sldns_buffer_skip(pkt, 4); /* skip ttl */ 640 pkt_len = sldns_buffer_read_u16(pkt); 641 if(sldns_buffer_remaining(pkt) < pkt_len) 642 return 0; 643 desc = sldns_rr_descript(type); 644 if(pkt_len > 0 && desc && desc->_dname_count > 0) { 645 int count = (int)desc->_dname_count; 646 int rdf = 0; 647 size_t len; 648 size_t oldpos; 649 /* skip first part. */ 650 while(pkt_len > 0 && count) { 651 switch(desc->_wireformat[rdf]) { 652 case LDNS_RDF_TYPE_DNAME: 653 /* decompress every domain name */ 654 oldpos = sldns_buffer_position(pkt); 655 if((len = pkt_dname_len(pkt)) == 0) 656 return 0; /* malformed dname */ 657 if(sldns_buffer_position(pkt)-oldpos > pkt_len) 658 return 0; /* dname exceeds rdata */ 659 pkt_len -= sldns_buffer_position(pkt)-oldpos; 660 rr->size += len; 661 count--; 662 len = 0; 663 break; 664 case LDNS_RDF_TYPE_STR: 665 if(pkt_len < 1) { 666 /* NOTREACHED, due to 'while(>0)' */ 667 return 0; /* len byte exceeds rdata */ 668 } 669 len = sldns_buffer_current(pkt)[0] + 1; 670 break; 671 default: 672 len = get_rdf_size(desc->_wireformat[rdf]); 673 } 674 if(len) { 675 if(pkt_len < len) 676 return 0; /* exceeds rdata */ 677 pkt_len -= len; 678 sldns_buffer_skip(pkt, (ssize_t)len); 679 rr->size += len; 680 } 681 rdf++; 682 } 683 } 684 /* remaining rdata */ 685 rr->size += pkt_len; 686 sldns_buffer_skip(pkt, (ssize_t)pkt_len); 687 return 1; 688 } 689 690 /** skip rr ttl and rdata */ 691 static int 692 skip_ttl_rdata(sldns_buffer* pkt) 693 { 694 uint16_t rdatalen; 695 if(sldns_buffer_remaining(pkt) < 6) /* ttl + rdatalen */ 696 return 0; 697 sldns_buffer_skip(pkt, 4); /* ttl */ 698 rdatalen = sldns_buffer_read_u16(pkt); 699 if(sldns_buffer_remaining(pkt) < rdatalen) 700 return 0; 701 sldns_buffer_skip(pkt, (ssize_t)rdatalen); 702 return 1; 703 } 704 705 /** see if RRSIG is a duplicate of another */ 706 static int 707 sig_is_double(sldns_buffer* pkt, struct rrset_parse* rrset, uint8_t* ttldata) 708 { 709 uint16_t rlen, siglen; 710 size_t pos = sldns_buffer_position(pkt); 711 struct rr_parse* sig; 712 if(sldns_buffer_remaining(pkt) < 6) 713 return 0; 714 sldns_buffer_skip(pkt, 4); /* ttl */ 715 rlen = sldns_buffer_read_u16(pkt); 716 if(sldns_buffer_remaining(pkt) < rlen) { 717 sldns_buffer_set_position(pkt, pos); 718 return 0; 719 } 720 sldns_buffer_set_position(pkt, pos); 721 722 sig = rrset->rrsig_first; 723 while(sig) { 724 /* check if rdatalen is same */ 725 memmove(&siglen, sig->ttl_data+4, sizeof(siglen)); 726 siglen = ntohs(siglen); 727 /* checks if data in packet is exactly the same, this means 728 * also dname in rdata is the same, but rrsig is not allowed 729 * to have compressed dnames anyway. If it is compressed anyway 730 * it will lead to duplicate rrs for qtype=RRSIG. (or ANY). 731 * 732 * Cannot use sig->size because size of the other one is not 733 * calculated yet. 734 */ 735 if(siglen == rlen) { 736 if(siglen>0 && memcmp(sig->ttl_data+6, ttldata+6, 737 siglen) == 0) { 738 /* same! */ 739 return 1; 740 } 741 } 742 sig = sig->next; 743 } 744 return 0; 745 } 746 747 /** Add rr (from packet here) to rrset, skips rr */ 748 static int 749 add_rr_to_rrset(struct rrset_parse* rrset, sldns_buffer* pkt, 750 struct msg_parse* msg, struct regional* region, 751 sldns_pkt_section section, uint16_t type) 752 { 753 struct rr_parse* rr; 754 /* check section of rrset. */ 755 if(rrset->section != section && type != LDNS_RR_TYPE_RRSIG && 756 rrset->type != LDNS_RR_TYPE_RRSIG) { 757 /* silently drop it - we drop the last part, since 758 * trust in rr data depends on the section it is in. 759 * the less trustworthy part is discarded. 760 * also the last part is more likely to be incomplete. 761 * RFC 2181: must put RRset only once in response. */ 762 /* 763 verbose(VERB_QUERY, "Packet contains rrset data in " 764 "multiple sections, dropped last part."); 765 log_buf(VERB_QUERY, "packet was", pkt); 766 */ 767 /* forwards */ 768 if(!skip_ttl_rdata(pkt)) 769 return LDNS_RCODE_FORMERR; 770 return 0; 771 } 772 773 if( (msg->qtype == LDNS_RR_TYPE_RRSIG || 774 msg->qtype == LDNS_RR_TYPE_ANY) 775 && sig_is_double(pkt, rrset, sldns_buffer_current(pkt))) { 776 if(!skip_ttl_rdata(pkt)) 777 return LDNS_RCODE_FORMERR; 778 return 0; 779 } 780 781 /* create rr */ 782 if(!(rr = (struct rr_parse*)regional_alloc(region, sizeof(*rr)))) 783 return LDNS_RCODE_SERVFAIL; 784 rr->outside_packet = 0; 785 rr->ttl_data = sldns_buffer_current(pkt); 786 rr->next = 0; 787 if(type == LDNS_RR_TYPE_RRSIG && rrset->type != LDNS_RR_TYPE_RRSIG) { 788 if(rrset->rrsig_last) 789 rrset->rrsig_last->next = rr; 790 else rrset->rrsig_first = rr; 791 rrset->rrsig_last = rr; 792 rrset->rrsig_count++; 793 } else { 794 if(rrset->rr_last) 795 rrset->rr_last->next = rr; 796 else rrset->rr_first = rr; 797 rrset->rr_last = rr; 798 rrset->rr_count++; 799 } 800 801 /* calc decompressed size */ 802 if(!calc_size(pkt, type, rr)) 803 return LDNS_RCODE_FORMERR; 804 rrset->size += rr->size; 805 806 return 0; 807 } 808 809 /** 810 * Parse packet RR section, for answer, authority and additional sections. 811 * @param pkt: packet, position at call must be at start of section. 812 * at end position is after section. 813 * @param msg: store results here. 814 * @param region: how to alloc results. 815 * @param section: section enum. 816 * @param num_rrs: how many rrs are in the section. 817 * @param num_rrsets: returns number of rrsets in the section. 818 * @return: 0 if OK, or rcode on error. 819 */ 820 static int 821 parse_section(sldns_buffer* pkt, struct msg_parse* msg, 822 struct regional* region, sldns_pkt_section section, 823 uint16_t num_rrs, size_t* num_rrsets) 824 { 825 uint16_t i; 826 uint8_t* dname, *prev_dname_f = NULL, *prev_dname_l = NULL; 827 size_t dnamelen, prev_dnamelen = 0; 828 uint16_t type, prev_type = 0; 829 uint16_t dclass, prev_dclass = 0; 830 uint32_t rrset_flags = 0; 831 hashvalue_type hash = 0; 832 struct rrset_parse* rrset = NULL; 833 int r; 834 835 if(num_rrs == 0) 836 return 0; 837 if(sldns_buffer_remaining(pkt) <= 0) 838 return LDNS_RCODE_FORMERR; 839 for(i=0; i<num_rrs; i++) { 840 /* parse this RR. */ 841 dname = sldns_buffer_current(pkt); 842 if((dnamelen = pkt_dname_len(pkt)) == 0) 843 return LDNS_RCODE_FORMERR; 844 if(sldns_buffer_remaining(pkt) < 10) /* type, class, ttl, len */ 845 return LDNS_RCODE_FORMERR; 846 type = sldns_buffer_read_u16(pkt); 847 sldns_buffer_read(pkt, &dclass, sizeof(dclass)); 848 849 if(0) { /* debug show what is being parsed. */ 850 if(type == LDNS_RR_TYPE_RRSIG) { 851 uint16_t t; 852 if(pkt_rrsig_covered(pkt, 853 sldns_buffer_current(pkt), &t)) 854 fprintf(stderr, "parse of %s(%d) [%s(%d)]", 855 sldns_rr_descript(type)? 856 sldns_rr_descript(type)->_name: "??", 857 (int)type, 858 sldns_rr_descript(t)? 859 sldns_rr_descript(t)->_name: "??", 860 (int)t); 861 } else 862 fprintf(stderr, "parse of %s(%d)", 863 sldns_rr_descript(type)? 864 sldns_rr_descript(type)->_name: "??", 865 (int)type); 866 fprintf(stderr, " %s(%d) ", 867 sldns_lookup_by_id(sldns_rr_classes, 868 (int)ntohs(dclass))?sldns_lookup_by_id( 869 sldns_rr_classes, (int)ntohs(dclass))->name: 870 "??", (int)ntohs(dclass)); 871 dname_print(stderr, pkt, dname); 872 fprintf(stderr, "\n"); 873 } 874 875 /* see if it is part of an existing RR set */ 876 if(!find_rrset(msg, pkt, dname, dnamelen, type, dclass, &hash, 877 &rrset_flags, &prev_dname_f, &prev_dname_l, 878 &prev_dnamelen, &prev_type, &prev_dclass, &rrset, 879 section, region)) 880 return LDNS_RCODE_SERVFAIL; 881 if(!rrset) { 882 /* it is a new RR set. hash&flags already calculated.*/ 883 (*num_rrsets)++; 884 rrset = new_rrset(msg, dname, dnamelen, type, dclass, 885 hash, rrset_flags, section, region); 886 if(!rrset) 887 return LDNS_RCODE_SERVFAIL; 888 } 889 else if(0) { 890 fprintf(stderr, "is part of existing: "); 891 dname_print(stderr, pkt, rrset->dname); 892 fprintf(stderr, " type %s(%d)\n", 893 sldns_rr_descript(rrset->type)? 894 sldns_rr_descript(rrset->type)->_name: "??", 895 (int)rrset->type); 896 } 897 /* add to rrset. */ 898 if((r=add_rr_to_rrset(rrset, pkt, msg, region, section, 899 type)) != 0) 900 return r; 901 } 902 return 0; 903 } 904 905 int 906 parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) 907 { 908 int ret; 909 if(sldns_buffer_remaining(pkt) < LDNS_HEADER_SIZE) 910 return LDNS_RCODE_FORMERR; 911 /* read the header */ 912 sldns_buffer_read(pkt, &msg->id, sizeof(uint16_t)); 913 msg->flags = sldns_buffer_read_u16(pkt); 914 msg->qdcount = sldns_buffer_read_u16(pkt); 915 msg->ancount = sldns_buffer_read_u16(pkt); 916 msg->nscount = sldns_buffer_read_u16(pkt); 917 msg->arcount = sldns_buffer_read_u16(pkt); 918 if(msg->qdcount > 1) 919 return LDNS_RCODE_FORMERR; 920 if((ret = parse_query_section(pkt, msg)) != 0) 921 return ret; 922 if((ret = parse_section(pkt, msg, region, LDNS_SECTION_ANSWER, 923 msg->ancount, &msg->an_rrsets)) != 0) 924 return ret; 925 if((ret = parse_section(pkt, msg, region, LDNS_SECTION_AUTHORITY, 926 msg->nscount, &msg->ns_rrsets)) != 0) 927 return ret; 928 if(sldns_buffer_remaining(pkt) == 0 && msg->arcount == 1) { 929 /* BIND accepts leniently that an EDNS record is missing. 930 * so, we do too. */ 931 } else if((ret = parse_section(pkt, msg, region, 932 LDNS_SECTION_ADDITIONAL, msg->arcount, &msg->ar_rrsets)) != 0) 933 return ret; 934 /* if(sldns_buffer_remaining(pkt) > 0) { */ 935 /* there is spurious data at end of packet. ignore */ 936 /* } */ 937 msg->rrset_count = msg->an_rrsets + msg->ns_rrsets + msg->ar_rrsets; 938 return 0; 939 } 940 941 /** parse EDNS options from EDNS wireformat rdata */ 942 static int 943 parse_edns_options(uint8_t* rdata_ptr, size_t rdata_len, 944 struct edns_data* edns, struct regional* region) 945 { 946 /* while still more options, and have code+len to read */ 947 /* ignores partial content (i.e. rdata len 3) */ 948 while(rdata_len >= 4) { 949 uint16_t opt_code = sldns_read_uint16(rdata_ptr); 950 uint16_t opt_len = sldns_read_uint16(rdata_ptr+2); 951 rdata_ptr += 4; 952 rdata_len -= 4; 953 if(opt_len > rdata_len) 954 break; /* option code partial */ 955 if(!edns_opt_append(edns, region, opt_code, opt_len, 956 rdata_ptr)) { 957 log_err("out of memory"); 958 return 0; 959 } 960 rdata_ptr += opt_len; 961 rdata_len -= opt_len; 962 } 963 return 1; 964 } 965 966 int 967 parse_extract_edns(struct msg_parse* msg, struct edns_data* edns, 968 struct regional* region) 969 { 970 struct rrset_parse* rrset = msg->rrset_first; 971 struct rrset_parse* prev = 0; 972 struct rrset_parse* found = 0; 973 struct rrset_parse* found_prev = 0; 974 size_t rdata_len; 975 uint8_t* rdata_ptr; 976 /* since the class encodes the UDP size, we cannot use hash table to 977 * find the EDNS OPT record. Scan the packet. */ 978 while(rrset) { 979 if(rrset->type == LDNS_RR_TYPE_OPT) { 980 /* only one OPT RR allowed. */ 981 if(found) return LDNS_RCODE_FORMERR; 982 /* found it! */ 983 found_prev = prev; 984 found = rrset; 985 } 986 prev = rrset; 987 rrset = rrset->rrset_all_next; 988 } 989 if(!found) { 990 memset(edns, 0, sizeof(*edns)); 991 edns->udp_size = 512; 992 return 0; 993 } 994 /* check the found RRset */ 995 /* most lenient check possible. ignore dname, use last opt */ 996 if(found->section != LDNS_SECTION_ADDITIONAL) 997 return LDNS_RCODE_FORMERR; 998 if(found->rr_count == 0) 999 return LDNS_RCODE_FORMERR; 1000 if(0) { /* strict checking of dname and RRcount */ 1001 if(found->dname_len != 1 || !found->dname 1002 || found->dname[0] != 0) return LDNS_RCODE_FORMERR; 1003 if(found->rr_count != 1) return LDNS_RCODE_FORMERR; 1004 } 1005 log_assert(found->rr_first && found->rr_last); 1006 1007 /* remove from packet */ 1008 if(found_prev) found_prev->rrset_all_next = found->rrset_all_next; 1009 else msg->rrset_first = found->rrset_all_next; 1010 if(found == msg->rrset_last) 1011 msg->rrset_last = found_prev; 1012 msg->arcount --; 1013 msg->ar_rrsets --; 1014 msg->rrset_count --; 1015 1016 /* take the data ! */ 1017 edns->edns_present = 1; 1018 edns->ext_rcode = found->rr_last->ttl_data[0]; 1019 edns->edns_version = found->rr_last->ttl_data[1]; 1020 edns->bits = sldns_read_uint16(&found->rr_last->ttl_data[2]); 1021 edns->udp_size = ntohs(found->rrset_class); 1022 edns->opt_list = NULL; 1023 1024 /* take the options */ 1025 rdata_len = found->rr_first->size-2; 1026 rdata_ptr = found->rr_first->ttl_data+6; 1027 if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) 1028 return 0; 1029 1030 /* ignore rrsigs */ 1031 1032 return 0; 1033 } 1034 1035 /** skip RR in packet */ 1036 static int 1037 skip_pkt_rr(sldns_buffer* pkt) 1038 { 1039 if(sldns_buffer_remaining(pkt) < 1) return 0; 1040 if(!pkt_dname_len(pkt)) 1041 return 0; 1042 if(sldns_buffer_remaining(pkt) < 4) return 0; 1043 sldns_buffer_skip(pkt, 4); /* type and class */ 1044 if(!skip_ttl_rdata(pkt)) 1045 return 0; 1046 return 1; 1047 } 1048 1049 /** skip RRs from packet */ 1050 static int 1051 skip_pkt_rrs(sldns_buffer* pkt, int num) 1052 { 1053 int i; 1054 for(i=0; i<num; i++) { 1055 if(!skip_pkt_rr(pkt)) 1056 return 0; 1057 } 1058 return 1; 1059 } 1060 1061 int 1062 parse_edns_from_pkt(sldns_buffer* pkt, struct edns_data* edns, 1063 struct regional* region) 1064 { 1065 size_t rdata_len; 1066 uint8_t* rdata_ptr; 1067 log_assert(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) == 1); 1068 memset(edns, 0, sizeof(*edns)); 1069 if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0 || 1070 LDNS_NSCOUNT(sldns_buffer_begin(pkt)) != 0) { 1071 if(!skip_pkt_rrs(pkt, ((int)LDNS_ANCOUNT(sldns_buffer_begin(pkt)))+ 1072 ((int)LDNS_NSCOUNT(sldns_buffer_begin(pkt))))) 1073 return LDNS_RCODE_FORMERR; 1074 } 1075 /* check edns section is present */ 1076 if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) { 1077 return LDNS_RCODE_FORMERR; 1078 } 1079 if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) == 0) { 1080 edns->udp_size = 512; 1081 return 0; 1082 } 1083 /* domain name must be the root of length 1. */ 1084 if(pkt_dname_len(pkt) != 1) 1085 return LDNS_RCODE_FORMERR; 1086 if(sldns_buffer_remaining(pkt) < 10) /* type, class, ttl, rdatalen */ 1087 return LDNS_RCODE_FORMERR; 1088 if(sldns_buffer_read_u16(pkt) != LDNS_RR_TYPE_OPT) 1089 return LDNS_RCODE_FORMERR; 1090 edns->edns_present = 1; 1091 edns->udp_size = sldns_buffer_read_u16(pkt); /* class is udp size */ 1092 edns->ext_rcode = sldns_buffer_read_u8(pkt); /* ttl used for bits */ 1093 edns->edns_version = sldns_buffer_read_u8(pkt); 1094 edns->bits = sldns_buffer_read_u16(pkt); 1095 edns->opt_list = NULL; 1096 1097 /* take the options */ 1098 rdata_len = sldns_buffer_read_u16(pkt); 1099 if(sldns_buffer_remaining(pkt) < rdata_len) 1100 return LDNS_RCODE_FORMERR; 1101 rdata_ptr = sldns_buffer_current(pkt); 1102 if(!parse_edns_options(rdata_ptr, rdata_len, edns, region)) 1103 return LDNS_RCODE_SERVFAIL; 1104 1105 /* ignore rrsigs */ 1106 1107 return 0; 1108 } 1109 1110 void 1111 log_edns_opt_list(enum verbosity_value level, const char* info_str, 1112 struct edns_option* list) 1113 { 1114 if(verbosity >= level && list) { 1115 char str[128], *s; 1116 size_t slen; 1117 verbose(level, "%s", info_str); 1118 while(list) { 1119 s = str; 1120 slen = sizeof(str); 1121 (void)sldns_wire2str_edns_option_print(&s, &slen, list->opt_code, 1122 list->opt_data, list->opt_len); 1123 verbose(level, " %s", str); 1124 list = list->next; 1125 } 1126 } 1127 } 1128