1 /* $OpenBSD: frontend.c,v 1.66 2021/01/27 08:30:50 florian Exp $ */ 2 3 /* 4 * Copyright (c) 2018 Florian Obser <florian@openbsd.org> 5 * Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org> 6 * Copyright (c) 2004 Esben Norby <norby@openbsd.org> 7 * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> 8 * 9 * Permission to use, copy, modify, and distribute this software for any 10 * purpose with or without fee is hereby granted, provided that the above 11 * copyright notice and this permission notice appear in all copies. 12 * 13 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 14 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 15 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 16 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 17 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 */ 21 22 #include <sys/types.h> 23 #include <sys/queue.h> 24 #include <sys/socket.h> 25 #include <sys/syslog.h> 26 #include <sys/tree.h> 27 #include <sys/uio.h> 28 29 #include <netinet/in.h> 30 #include <net/if.h> 31 #include <net/route.h> 32 33 #include <errno.h> 34 #include <event.h> 35 #include <ifaddrs.h> 36 #include <imsg.h> 37 #include <netdb.h> 38 #include <pwd.h> 39 #include <signal.h> 40 #include <stdint.h> 41 #include <stdio.h> 42 #include <stdlib.h> 43 #include <string.h> 44 #include <time.h> 45 #include <unistd.h> 46 47 #include "libunbound/config.h" 48 #include "libunbound/sldns/pkthdr.h" 49 #include "libunbound/sldns/sbuffer.h" 50 #include "libunbound/sldns/str2wire.h" 51 #include "libunbound/sldns/wire2str.h" 52 #include "libunbound/util/alloc.h" 53 #include "libunbound/util/net_help.h" 54 #include "libunbound/util/regional.h" 55 #include "libunbound/util/data/dname.h" 56 #include "libunbound/util/data/msgencode.h" 57 #include "libunbound/util/data/msgparse.h" 58 #include "libunbound/util/data/msgreply.h" 59 60 #include "log.h" 61 #include "unwind.h" 62 #include "frontend.h" 63 #include "control.h" 64 #include "dns64_synth.h" 65 66 #define ROUTE_SOCKET_BUF_SIZE 16384 67 68 /* 69 * size of a resource record with name a two octed pointer to qname 70 * 2 octets pointer to qname 71 * 2 octets TYPE 72 * 2 octets CLASS 73 * 4 octets TTL 74 * 2 octets RDLENGTH 75 */ 76 #define COMPRESSED_RR_SIZE 12 77 #define MINIMIZE_ANSWER 1 78 79 #define FD_RESERVE 5 80 #define TCP_TIMEOUT 15 81 #define DEFAULT_TCP_SIZE 512 82 83 struct udp_ev { 84 struct event ev; 85 uint8_t query[65536]; 86 struct msghdr rcvmhdr; 87 struct iovec rcviov[1]; 88 struct sockaddr_storage from; 89 } udp4ev, udp6ev; 90 91 struct tcp_accept_ev { 92 struct event ev; 93 struct event pause; 94 } tcp4ev, tcp6ev; 95 96 struct pending_query { 97 TAILQ_ENTRY(pending_query) entry; 98 struct sockaddr_storage from; 99 struct sldns_buffer *qbuf; 100 struct sldns_buffer *abuf; 101 struct regional *region; 102 struct query_info qinfo; 103 struct msg_parse *qmsg; 104 struct edns_data edns; 105 struct event ev; /* for tcp */ 106 struct event resp_ev; /* for tcp */ 107 struct event tmo_ev; /* for tcp */ 108 uint64_t imsg_id; 109 int fd; 110 int tcp; 111 int dns64_synthesize; 112 }; 113 114 TAILQ_HEAD(, pending_query) pending_queries; 115 116 struct bl_node { 117 RB_ENTRY(bl_node) entry; 118 char *domain; 119 }; 120 121 __dead void frontend_shutdown(void); 122 void frontend_sig_handler(int, short, void *); 123 void frontend_startup(void); 124 void udp_receive(int, short, void *); 125 void handle_query(struct pending_query *); 126 void free_pending_query(struct pending_query *); 127 void tcp_accept(int, short, void *); 128 int accept_reserve(int, struct sockaddr *, socklen_t *); 129 void accept_paused(int, short, void *); 130 void tcp_request(int, short, void *); 131 void tcp_response(int, short, void *); 132 void tcp_timeout(int, short, void *); 133 int check_query(sldns_buffer*); 134 void noerror_answer(struct pending_query *); 135 void synthesize_dns64_answer(struct pending_query *); 136 void resend_dns64_query(struct pending_query *); 137 void chaos_answer(struct pending_query *); 138 void error_answer(struct pending_query *, int rcode); 139 void send_answer(struct pending_query *); 140 void route_receive(int, short, void *); 141 void handle_route_message(struct rt_msghdr *, 142 struct sockaddr **); 143 void get_rtaddrs(int, struct sockaddr *, 144 struct sockaddr **); 145 void rtmget_default(void); 146 struct pending_query *find_pending_query(uint64_t); 147 void parse_trust_anchor(struct trust_anchor_head *, int); 148 void send_trust_anchors(struct trust_anchor_head *); 149 void write_trust_anchors(struct trust_anchor_head *, int); 150 void parse_blocklist(int); 151 int bl_cmp(struct bl_node *, struct bl_node *); 152 void free_bl(void); 153 int pending_query_cnt(void); 154 void check_available_af(void); 155 156 struct uw_conf *frontend_conf; 157 static struct imsgev *iev_main; 158 static struct imsgev *iev_resolver; 159 struct event ev_route; 160 int udp4sock = -1, udp6sock = -1; 161 int tcp4sock = -1, tcp6sock = -1; 162 int ta_fd = -1; 163 164 static struct trust_anchor_head trust_anchors, new_trust_anchors; 165 166 RB_HEAD(bl_tree, bl_node) bl_head = RB_INITIALIZER(&bl_head); 167 RB_PROTOTYPE(bl_tree, bl_node, entry, bl_cmp) 168 RB_GENERATE(bl_tree, bl_node, entry, bl_cmp) 169 170 struct dns64_prefix *dns64_prefixes; 171 int dns64_prefix_count; 172 173 void 174 frontend_sig_handler(int sig, short event, void *bula) 175 { 176 /* 177 * Normal signal handler rules don't apply because libevent 178 * decouples for us. 179 */ 180 181 switch (sig) { 182 case SIGINT: 183 case SIGTERM: 184 frontend_shutdown(); 185 default: 186 fatalx("unexpected signal"); 187 } 188 } 189 190 void 191 frontend(int debug, int verbose) 192 { 193 struct event ev_sigint, ev_sigterm; 194 struct passwd *pw; 195 196 frontend_conf = config_new_empty(); 197 198 log_init(debug, LOG_DAEMON); 199 log_setverbose(verbose); 200 201 if ((pw = getpwnam(UNWIND_USER)) == NULL) 202 fatal("getpwnam"); 203 204 if (chroot(pw->pw_dir) == -1) 205 fatal("chroot"); 206 if (chdir("/") == -1) 207 fatal("chdir(\"/\")"); 208 209 setproctitle("%s", "frontend"); 210 log_procinit("frontend"); 211 212 if (setgroups(1, &pw->pw_gid) || 213 setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) || 214 setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) 215 fatal("can't drop privileges"); 216 217 if (pledge("stdio dns unix recvfd", NULL) == -1) 218 fatal("pledge"); 219 220 event_init(); 221 222 /* Setup signal handler. */ 223 signal_set(&ev_sigint, SIGINT, frontend_sig_handler, NULL); 224 signal_set(&ev_sigterm, SIGTERM, frontend_sig_handler, NULL); 225 signal_add(&ev_sigint, NULL); 226 signal_add(&ev_sigterm, NULL); 227 signal(SIGPIPE, SIG_IGN); 228 signal(SIGHUP, SIG_IGN); 229 230 /* Setup pipe and event handler to the parent process. */ 231 if (iev_main != NULL) 232 fatal("iev_main"); 233 if ((iev_main = malloc(sizeof(struct imsgev))) == NULL) 234 fatal(NULL); 235 imsg_init(&iev_main->ibuf, 3); 236 iev_main->handler = frontend_dispatch_main; 237 iev_main->events = EV_READ; 238 event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events, 239 iev_main->handler, iev_main); 240 event_add(&iev_main->ev, NULL); 241 242 udp4ev.rcviov[0].iov_base = (caddr_t)udp4ev.query; 243 udp4ev.rcviov[0].iov_len = sizeof(udp4ev.query); 244 udp4ev.rcvmhdr.msg_name = (caddr_t)&udp4ev.from; 245 udp4ev.rcvmhdr.msg_namelen = sizeof(udp4ev.from); 246 udp4ev.rcvmhdr.msg_iov = udp4ev.rcviov; 247 udp4ev.rcvmhdr.msg_iovlen = 1; 248 249 udp6ev.rcviov[0].iov_base = (caddr_t)udp6ev.query; 250 udp6ev.rcviov[0].iov_len = sizeof(udp6ev.query); 251 udp6ev.rcvmhdr.msg_name = (caddr_t)&udp6ev.from; 252 udp6ev.rcvmhdr.msg_namelen = sizeof(udp6ev.from); 253 udp6ev.rcvmhdr.msg_iov = udp6ev.rcviov; 254 udp6ev.rcvmhdr.msg_iovlen = 1; 255 256 TAILQ_INIT(&pending_queries); 257 258 TAILQ_INIT(&trust_anchors); 259 TAILQ_INIT(&new_trust_anchors); 260 261 add_new_ta(&trust_anchors, KSK2017); 262 263 event_dispatch(); 264 265 frontend_shutdown(); 266 } 267 268 __dead void 269 frontend_shutdown(void) 270 { 271 /* Close pipes. */ 272 msgbuf_write(&iev_resolver->ibuf.w); 273 msgbuf_clear(&iev_resolver->ibuf.w); 274 close(iev_resolver->ibuf.fd); 275 msgbuf_write(&iev_main->ibuf.w); 276 msgbuf_clear(&iev_main->ibuf.w); 277 close(iev_main->ibuf.fd); 278 279 config_clear(frontend_conf); 280 281 free(iev_resolver); 282 free(iev_main); 283 284 log_info("frontend exiting"); 285 exit(0); 286 } 287 288 int 289 frontend_imsg_compose_main(int type, pid_t pid, void *data, uint16_t datalen) 290 { 291 return (imsg_compose_event(iev_main, type, 0, pid, -1, data, datalen)); 292 } 293 294 int 295 frontend_imsg_compose_resolver(int type, pid_t pid, void *data, 296 uint16_t datalen) 297 { 298 return (imsg_compose_event(iev_resolver, type, 0, pid, -1, data, 299 datalen)); 300 } 301 302 void 303 frontend_dispatch_main(int fd, short event, void *bula) 304 { 305 static struct uw_conf *nconf; 306 struct imsg imsg; 307 struct imsgev *iev = bula; 308 struct imsgbuf *ibuf = &iev->ibuf; 309 int n, shut = 0; 310 311 if (event & EV_READ) { 312 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN) 313 fatal("imsg_read error"); 314 if (n == 0) /* Connection closed. */ 315 shut = 1; 316 } 317 if (event & EV_WRITE) { 318 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN) 319 fatal("msgbuf_write"); 320 if (n == 0) /* Connection closed. */ 321 shut = 1; 322 } 323 324 for (;;) { 325 if ((n = imsg_get(ibuf, &imsg)) == -1) 326 fatal("%s: imsg_get error", __func__); 327 if (n == 0) /* No more messages. */ 328 break; 329 330 switch (imsg.hdr.type) { 331 case IMSG_SOCKET_IPC_RESOLVER: 332 /* 333 * Setup pipe and event handler to the resolver 334 * process. 335 */ 336 if (iev_resolver) { 337 fatalx("%s: received unexpected imsg fd " 338 "to frontend", __func__); 339 break; 340 } 341 if ((fd = imsg.fd) == -1) { 342 fatalx("%s: expected to receive imsg fd to " 343 "frontend but didn't receive any", 344 __func__); 345 break; 346 } 347 348 if (iev_resolver != NULL) 349 fatal("iev_resolver"); 350 iev_resolver = malloc(sizeof(struct imsgev)); 351 if (iev_resolver == NULL) 352 fatal(NULL); 353 354 imsg_init(&iev_resolver->ibuf, fd); 355 iev_resolver->handler = frontend_dispatch_resolver; 356 iev_resolver->events = EV_READ; 357 358 event_set(&iev_resolver->ev, iev_resolver->ibuf.fd, 359 iev_resolver->events, iev_resolver->handler, 360 iev_resolver); 361 event_add(&iev_resolver->ev, NULL); 362 break; 363 case IMSG_RECONF_CONF: 364 case IMSG_RECONF_BLOCKLIST_FILE: 365 case IMSG_RECONF_FORWARDER: 366 case IMSG_RECONF_DOT_FORWARDER: 367 case IMSG_RECONF_FORCE: 368 imsg_receive_config(&imsg, &nconf); 369 break; 370 case IMSG_RECONF_END: 371 if (nconf == NULL) 372 fatalx("%s: IMSG_RECONF_END without " 373 "IMSG_RECONF_CONF", __func__); 374 merge_config(frontend_conf, nconf); 375 if (frontend_conf->blocklist_file == NULL) 376 free_bl(); 377 nconf = NULL; 378 break; 379 case IMSG_UDP6SOCK: 380 if (udp6sock != -1) 381 fatalx("%s: received unexpected udp6sock", 382 __func__); 383 if ((udp6sock = imsg.fd) == -1) 384 fatalx("%s: expected to receive imsg " 385 "UDP6 fd but didn't receive any", __func__); 386 event_set(&udp6ev.ev, udp6sock, EV_READ | EV_PERSIST, 387 udp_receive, &udp6ev); 388 event_add(&udp6ev.ev, NULL); 389 break; 390 case IMSG_UDP4SOCK: 391 if (udp4sock != -1) 392 fatalx("%s: received unexpected udp4sock", 393 __func__); 394 if ((udp4sock = imsg.fd) == -1) 395 fatalx("%s: expected to receive imsg " 396 "UDP4 fd but didn't receive any", __func__); 397 event_set(&udp4ev.ev, udp4sock, EV_READ | EV_PERSIST, 398 udp_receive, &udp4ev); 399 event_add(&udp4ev.ev, NULL); 400 break; 401 case IMSG_TCP4SOCK: 402 if (tcp4sock != -1) 403 fatalx("%s: received unexpected tcp4sock", 404 __func__); 405 if ((tcp4sock = imsg.fd) == -1) 406 fatalx("%s: expected to receive imsg " 407 "TCP4 fd but didn't receive any", __func__); 408 event_set(&tcp4ev.ev, tcp4sock, EV_READ | EV_PERSIST, 409 tcp_accept, &tcp4ev); 410 event_add(&tcp4ev.ev, NULL); 411 evtimer_set(&tcp4ev.pause, accept_paused, &tcp4ev); 412 break; 413 case IMSG_TCP6SOCK: 414 if (tcp6sock != -1) 415 fatalx("%s: received unexpected tcp6sock", 416 __func__); 417 if ((tcp6sock = imsg.fd) == -1) 418 fatalx("%s: expected to receive imsg " 419 "TCP6 fd but didn't receive any", __func__); 420 event_set(&tcp6ev.ev, tcp6sock, EV_READ | EV_PERSIST, 421 tcp_accept, &tcp6ev); 422 event_add(&tcp6ev.ev, NULL); 423 evtimer_set(&tcp6ev.pause, accept_paused, &tcp6ev); 424 break; 425 case IMSG_ROUTESOCK: { 426 static int routesock = -1; 427 428 if (routesock != -1) 429 fatalx("%s: received unexpected routesock", 430 __func__); 431 if ((fd = imsg.fd) == -1) 432 fatalx("%s: expected to receive imsg " 433 "routesocket fd but didn't receive any", 434 __func__); 435 routesock = fd; 436 event_set(&ev_route, fd, EV_READ | EV_PERSIST, 437 route_receive, NULL); 438 break; 439 } 440 case IMSG_STARTUP: 441 frontend_startup(); 442 break; 443 case IMSG_CONTROLFD: 444 if ((fd = imsg.fd) == -1) 445 fatalx("%s: expected to receive imsg control " 446 "fd but didn't receive any", __func__); 447 /* Listen on control socket. */ 448 control_listen(fd); 449 break; 450 case IMSG_TAFD: 451 if ((ta_fd = imsg.fd) != -1) 452 parse_trust_anchor(&trust_anchors, ta_fd); 453 if (!TAILQ_EMPTY(&trust_anchors)) 454 send_trust_anchors(&trust_anchors); 455 break; 456 case IMSG_BLFD: 457 if ((fd = imsg.fd) == -1) 458 fatalx("%s: expected to receive imsg block " 459 "list fd but didn't receive any", __func__); 460 parse_blocklist(fd); 461 break; 462 default: 463 log_debug("%s: error handling imsg %d", __func__, 464 imsg.hdr.type); 465 break; 466 } 467 imsg_free(&imsg); 468 } 469 if (!shut) 470 imsg_event_add(iev); 471 else { 472 /* This pipe is dead. Remove its event handler. */ 473 event_del(&iev->ev); 474 event_loopexit(NULL); 475 } 476 } 477 478 void 479 frontend_dispatch_resolver(int fd, short event, void *bula) 480 { 481 static struct dns64_prefix *new_dns64_prefixes = NULL; 482 static int new_dns64_prefix_count = 0; 483 static int new_dns64_prefix_pos = 0; 484 struct pending_query *pq; 485 struct imsgev *iev = bula; 486 struct imsgbuf *ibuf = &iev->ibuf; 487 struct imsg imsg; 488 int n, shut = 0, chg; 489 490 if (event & EV_READ) { 491 if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN) 492 fatal("imsg_read error"); 493 if (n == 0) /* Connection closed. */ 494 shut = 1; 495 } 496 if (event & EV_WRITE) { 497 if ((n = msgbuf_write(&ibuf->w)) == -1 && errno != EAGAIN) 498 fatal("msgbuf_write"); 499 if (n == 0) /* Connection closed. */ 500 shut = 1; 501 } 502 503 for (;;) { 504 if ((n = imsg_get(ibuf, &imsg)) == -1) 505 fatal("%s: imsg_get error", __func__); 506 if (n == 0) /* No more messages. */ 507 break; 508 509 switch (imsg.hdr.type) { 510 case IMSG_ANSWER: { 511 struct answer_header *answer_header; 512 int data_len; 513 uint8_t *data; 514 515 if (IMSG_DATA_SIZE(imsg) < sizeof(*answer_header)) 516 fatalx("%s: IMSG_ANSWER wrong length: " 517 "%lu", __func__, IMSG_DATA_SIZE(imsg)); 518 answer_header = (struct answer_header *)imsg.data; 519 data = (uint8_t *)imsg.data + sizeof(*answer_header); 520 if (answer_header->answer_len > UINT16_MAX) 521 fatalx("%s: IMSG_ANSWER answer too big: %d", 522 __func__, answer_header->answer_len); 523 data_len = IMSG_DATA_SIZE(imsg) - 524 sizeof(*answer_header); 525 526 if ((pq = find_pending_query(answer_header->id)) == 527 NULL) { 528 log_warnx("%s: cannot find pending query %llu", 529 __func__, answer_header->id); 530 break; 531 } 532 533 if (answer_header->srvfail) { 534 error_answer(pq, LDNS_RCODE_SERVFAIL); 535 send_answer(pq); 536 break; 537 } 538 539 if (answer_header->bogus && !(pq->qmsg->flags & 540 BIT_CD)) { 541 error_answer(pq, LDNS_RCODE_SERVFAIL); 542 send_answer(pq); 543 break; 544 } 545 546 if (sldns_buffer_position(pq->abuf) == 0 && 547 !sldns_buffer_set_capacity(pq->abuf, 548 answer_header->answer_len)) { 549 error_answer(pq, LDNS_RCODE_SERVFAIL); 550 send_answer(pq); 551 break; 552 } 553 554 if (sldns_buffer_position(pq->abuf) + data_len > 555 sldns_buffer_capacity(pq->abuf)) 556 fatalx("%s: IMSG_ANSWER answer too big: %d", 557 __func__, data_len); 558 sldns_buffer_write(pq->abuf, data, data_len); 559 560 if (sldns_buffer_position(pq->abuf) == 561 sldns_buffer_capacity(pq->abuf)) { 562 sldns_buffer_flip(pq->abuf); 563 if (pq->dns64_synthesize) { 564 synthesize_dns64_answer(pq); 565 send_answer(pq); 566 } else { 567 noerror_answer(pq); 568 if (pq->dns64_synthesize) 569 /* we did not find a answer */ 570 resend_dns64_query(pq); 571 else 572 send_answer(pq); 573 } 574 } 575 break; 576 } 577 case IMSG_CTL_RESOLVER_INFO: 578 case IMSG_CTL_AUTOCONF_RESOLVER_INFO: 579 case IMSG_CTL_MEM_INFO: 580 case IMSG_CTL_END: 581 control_imsg_relay(&imsg); 582 break; 583 case IMSG_NEW_TA: 584 /* make sure this is a string */ 585 ((char *)imsg.data)[IMSG_DATA_SIZE(imsg) - 1] = '\0'; 586 add_new_ta(&new_trust_anchors, imsg.data); 587 break; 588 case IMSG_NEW_TAS_ABORT: 589 free_tas(&new_trust_anchors); 590 break; 591 case IMSG_NEW_TAS_DONE: 592 chg = merge_tas(&new_trust_anchors, &trust_anchors); 593 if (chg) 594 send_trust_anchors(&trust_anchors); 595 596 /* 597 * always write trust anchors, the modify date on 598 * the file is an indication when we made progress 599 */ 600 if (ta_fd != -1) 601 write_trust_anchors(&trust_anchors, ta_fd); 602 break; 603 case IMSG_NEW_DNS64_PREFIXES_START: 604 if (IMSG_DATA_SIZE(imsg) != 605 sizeof(new_dns64_prefix_count)) 606 fatalx("%s: IMSG_NEW_DNS64_PREFIXES_START " 607 "wrong length: %lu", __func__, 608 IMSG_DATA_SIZE(imsg)); 609 memcpy(&new_dns64_prefix_count, imsg.data, 610 sizeof(new_dns64_prefix_count)); 611 free(new_dns64_prefixes); 612 new_dns64_prefixes = NULL; 613 if (new_dns64_prefix_count > 0) 614 new_dns64_prefixes = 615 calloc(new_dns64_prefix_count, 616 sizeof(struct dns64_prefix)); 617 new_dns64_prefix_pos = 0; 618 break; 619 case IMSG_NEW_DNS64_PREFIX: { 620 if (IMSG_DATA_SIZE(imsg) != sizeof(struct dns64_prefix)) 621 fatalx("%s: IMSG_NEW_DNS64_PREFIX wrong " 622 "length: %lu", __func__, 623 IMSG_DATA_SIZE(imsg)); 624 if (new_dns64_prefixes == NULL) 625 break; 626 if (new_dns64_prefix_pos >= new_dns64_prefix_count) 627 fatalx("%s: IMSG_NEW_DNS64_PREFIX: too many " 628 "prefixes", __func__); 629 memcpy(&new_dns64_prefixes[new_dns64_prefix_pos++], 630 imsg.data, sizeof(struct dns64_prefix)); 631 break; 632 } 633 case IMSG_NEW_DNS64_PREFIXES_DONE: 634 free(dns64_prefixes); 635 dns64_prefixes = new_dns64_prefixes; 636 dns64_prefix_count = new_dns64_prefix_count; 637 new_dns64_prefixes = NULL; 638 break; 639 default: 640 log_debug("%s: error handling imsg %d", __func__, 641 imsg.hdr.type); 642 break; 643 } 644 imsg_free(&imsg); 645 } 646 if (!shut) 647 imsg_event_add(iev); 648 else { 649 /* This pipe is dead. Remove its event handler. */ 650 event_del(&iev->ev); 651 event_loopexit(NULL); 652 } 653 } 654 655 void 656 frontend_startup(void) 657 { 658 if (!event_initialized(&ev_route)) 659 fatalx("%s: did not receive a route socket from the main " 660 "process", __func__); 661 662 event_add(&ev_route, NULL); 663 664 frontend_imsg_compose_main(IMSG_STARTUP_DONE, 0, NULL, 0); 665 check_available_af(); 666 } 667 668 void 669 free_pending_query(struct pending_query *pq) 670 { 671 if (!pq) 672 return; 673 674 TAILQ_REMOVE(&pending_queries, pq, entry); 675 regional_destroy(pq->region); 676 sldns_buffer_free(pq->qbuf); 677 sldns_buffer_free(pq->abuf); 678 if (pq->tcp) { 679 if (event_initialized(&pq->ev)) 680 event_del(&pq->ev); 681 if (event_initialized(&pq->resp_ev)) 682 event_del(&pq->resp_ev); 683 if (event_initialized(&pq->tmo_ev)) 684 event_del(&pq->tmo_ev); 685 if (pq->fd != -1) 686 close(pq->fd); 687 } 688 free(pq); 689 } 690 691 void 692 udp_receive(int fd, short events, void *arg) 693 { 694 struct udp_ev *udpev = (struct udp_ev *)arg; 695 struct pending_query *pq = NULL; 696 ssize_t len; 697 698 if ((len = recvmsg(fd, &udpev->rcvmhdr, 0)) == -1) { 699 log_warn("recvmsg"); 700 return; 701 } 702 703 if ((pq = calloc(1, sizeof(*pq))) == NULL) { 704 log_warn(NULL); 705 return; 706 } 707 708 do { 709 arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id)); 710 } while(find_pending_query(pq->imsg_id) != NULL); 711 712 TAILQ_INSERT_TAIL(&pending_queries, pq, entry); 713 714 pq->from = udpev->from; 715 pq->fd = fd; 716 pq->qbuf = sldns_buffer_new(len); 717 pq->abuf = sldns_buffer_new(len); /* make sure we can send errors */ 718 pq->region = regional_create(); 719 pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg)); 720 721 if (!pq->qbuf || !pq->abuf || !pq->region || !pq->qmsg) { 722 log_warnx("out of memory"); 723 free_pending_query(pq); 724 return; 725 } 726 727 memset(pq->qmsg, 0, sizeof(*pq->qmsg)); 728 sldns_buffer_write(pq->qbuf, udpev->query, len); 729 sldns_buffer_flip(pq->qbuf); 730 handle_query(pq); 731 } 732 733 void 734 handle_query(struct pending_query *pq) 735 { 736 struct query_imsg query_imsg; 737 struct bl_node find; 738 int rcode; 739 char *str; 740 char dname[LDNS_MAX_DOMAINLEN + 1]; 741 char qclass_buf[16]; 742 char qtype_buf[16]; 743 744 if (log_getverbose() & OPT_VERBOSE2 && (str = 745 sldns_wire2str_pkt(sldns_buffer_begin(pq->qbuf), 746 sldns_buffer_limit(pq->qbuf))) != NULL) { 747 log_debug("from: %s\n%s", ip_port((struct sockaddr *) 748 &pq->from), str); 749 free(str); 750 } 751 752 if (!query_info_parse(&pq->qinfo, pq->qbuf)) { 753 log_warnx("query_info_parse failed"); 754 goto drop; 755 } 756 757 sldns_buffer_rewind(pq->qbuf); 758 759 if (parse_packet(pq->qbuf, pq->qmsg, pq->region) != 760 LDNS_RCODE_NOERROR) { 761 log_warnx("parse_packet failed"); 762 goto drop; 763 } 764 765 rcode = check_query(pq->qbuf); 766 switch (rcode) { 767 case LDNS_RCODE_NOERROR: 768 break; 769 case -1: 770 goto drop; 771 default: 772 error_answer(pq, rcode); 773 goto send_answer; 774 } 775 776 rcode = parse_extract_edns(pq->qmsg, &pq->edns, pq->region); 777 if (rcode != LDNS_RCODE_NOERROR) { 778 error_answer(pq, rcode); 779 goto send_answer; 780 } 781 782 if (!dname_valid(pq->qinfo.qname, pq->qinfo.qname_len)) { 783 error_answer(pq, LDNS_RCODE_FORMERR); 784 goto send_answer; 785 } 786 dname_str(pq->qinfo.qname, dname); 787 788 sldns_wire2str_class_buf(pq->qinfo.qclass, qclass_buf, 789 sizeof(qclass_buf)); 790 sldns_wire2str_type_buf(pq->qinfo.qtype, qtype_buf, sizeof(qtype_buf)); 791 log_debug("%s: %s %s %s ?", ip_port((struct sockaddr *)&pq->from), 792 dname, qclass_buf, qtype_buf); 793 794 find.domain = dname; 795 if (RB_FIND(bl_tree, &bl_head, &find) != NULL) { 796 if (frontend_conf->blocklist_log) 797 log_info("blocking %s", dname); 798 error_answer(pq, LDNS_RCODE_REFUSED); 799 goto send_answer; 800 } 801 802 if (pq->qinfo.qtype == LDNS_RR_TYPE_AXFR || pq->qinfo.qtype == 803 LDNS_RR_TYPE_IXFR) { 804 error_answer(pq, LDNS_RCODE_REFUSED); 805 goto send_answer; 806 } 807 808 if(pq->qinfo.qtype == LDNS_RR_TYPE_OPT || 809 pq->qinfo.qtype == LDNS_RR_TYPE_TSIG || 810 pq->qinfo.qtype == LDNS_RR_TYPE_TKEY || 811 pq->qinfo.qtype == LDNS_RR_TYPE_MAILA || 812 pq->qinfo.qtype == LDNS_RR_TYPE_MAILB || 813 (pq->qinfo.qtype >= 128 && pq->qinfo.qtype <= 248)) { 814 error_answer(pq, LDNS_RCODE_FORMERR); 815 goto send_answer; 816 } 817 818 if (pq->qinfo.qclass == LDNS_RR_CLASS_CH) { 819 if (strcasecmp(dname, "version.server.") == 0 || 820 strcasecmp(dname, "version.bind.") == 0) { 821 chaos_answer(pq); 822 } else 823 error_answer(pq, LDNS_RCODE_REFUSED); 824 goto send_answer; 825 } 826 827 if (strlcpy(query_imsg.qname, dname, sizeof(query_imsg.qname)) >= 828 sizeof(query_imsg.qname)) { 829 log_warnx("qname too long"); 830 error_answer(pq, LDNS_RCODE_FORMERR); 831 goto send_answer; 832 } 833 query_imsg.id = pq->imsg_id; 834 query_imsg.t = pq->qinfo.qtype; 835 query_imsg.c = pq->qinfo.qclass; 836 837 if (frontend_imsg_compose_resolver(IMSG_QUERY, 0, &query_imsg, 838 sizeof(query_imsg)) == -1) { 839 error_answer(pq, LDNS_RCODE_SERVFAIL); 840 goto send_answer; 841 } 842 return; 843 844 send_answer: 845 send_answer(pq); 846 return; 847 848 drop: 849 free_pending_query(pq); 850 } 851 852 void 853 noerror_answer(struct pending_query *pq) 854 { 855 struct query_info skip, qinfo; 856 struct reply_info *rinfo = NULL; 857 struct alloc_cache alloc; 858 struct edns_data edns; 859 struct ub_packed_rrset_key *an_rrset = NULL; 860 struct packed_rrset_data *an_rrset_data = NULL; 861 862 alloc_init(&alloc, NULL, 0); 863 memset(&qinfo, 0, sizeof(qinfo)); 864 /* read past query section, no memory is allocated */ 865 if (!query_info_parse(&skip, pq->abuf)) 866 goto srvfail; 867 868 if (reply_info_parse(pq->abuf, &alloc, &qinfo, &rinfo, pq->region, 869 &edns) != 0) 870 goto srvfail; 871 872 if ((an_rrset = reply_find_answer_rrset(&qinfo, rinfo)) != NULL) 873 an_rrset_data = (struct packed_rrset_data*)an_rrset->entry.data; 874 875 /* reply_info_parse() allocates memory */ 876 query_info_clear(&qinfo); 877 878 /* XXX check that there a no AAAA records in answer section? */ 879 if ((an_rrset_data == NULL || an_rrset_data->count == 0) && 880 !pq->dns64_synthesize && pq->qinfo.qtype == LDNS_RR_TYPE_AAAA && 881 pq->qinfo.qclass == LDNS_RR_CLASS_IN && dns64_prefix_count > 0) { 882 pq->dns64_synthesize = 1; 883 return; 884 } 885 886 sldns_buffer_clear(pq->abuf); 887 if (reply_info_encode(&pq->qinfo, rinfo, pq->qmsg->id, rinfo->flags, 888 pq->abuf, 0, pq->region, pq->tcp ? UINT16_MAX : pq->edns.udp_size, 889 pq->edns.bits & EDNS_DO, MINIMIZE_ANSWER) == 0) 890 goto srvfail; 891 892 reply_info_parsedelete(rinfo, &alloc); 893 alloc_clear(&alloc); 894 return; 895 896 srvfail: 897 reply_info_parsedelete(rinfo, &alloc); 898 alloc_clear(&alloc); 899 error_answer(pq, LDNS_RCODE_SERVFAIL); 900 } 901 902 void 903 synthesize_dns64_answer(struct pending_query *pq) 904 { 905 struct query_info skip, qinfo; 906 struct reply_info *rinfo = NULL, *synth_rinfo = NULL; 907 struct alloc_cache alloc; 908 struct edns_data edns; 909 size_t i; 910 911 pq->dns64_synthesize = 0; 912 913 alloc_init(&alloc, NULL, 0); 914 memset(&qinfo, 0, sizeof(qinfo)); 915 /* read past query section, no memory is allocated */ 916 if (!query_info_parse(&skip, pq->abuf)) 917 goto srvfail; 918 919 if (reply_info_parse(pq->abuf, &alloc, &qinfo, &rinfo, pq->region, 920 &edns) != 0) 921 goto srvfail; 922 923 /* reply_info_parse() allocates memory */ 924 query_info_clear(&qinfo); 925 926 synth_rinfo = construct_reply_info_base(pq->region, rinfo->flags, 927 rinfo->qdcount, rinfo->ttl, rinfo->prefetch_ttl, 928 rinfo->serve_expired_ttl, rinfo->an_numrrsets, 929 rinfo->ns_numrrsets, rinfo->ar_numrrsets, rinfo->rrset_count, 930 rinfo->security); 931 932 if (!synth_rinfo) 933 goto srvfail; 934 935 if(!reply_info_alloc_rrset_keys(synth_rinfo, NULL, pq->region)) 936 goto srvfail; 937 938 for (i = 0; i < synth_rinfo->rrset_count; i++) { 939 struct ub_packed_rrset_key *src_rrset_key, *dst_rrset_key; 940 struct packed_rrset_data *src_rrset_data; 941 struct packed_rrset_data *dst_rrset_data; 942 943 src_rrset_key = rinfo->rrsets[i]; 944 src_rrset_data = 945 (struct packed_rrset_data *)src_rrset_key->entry.data; 946 dst_rrset_key = synth_rinfo->rrsets[i]; 947 948 dst_rrset_key->id = src_rrset_key->id; 949 dst_rrset_key->rk = src_rrset_key->rk; 950 951 if (i < rinfo->an_numrrsets && src_rrset_key->rk.type == 952 htons(LDNS_RR_TYPE_A)) { 953 dns64_synth_aaaa_data(src_rrset_key, src_rrset_data, 954 dst_rrset_key, &dst_rrset_data, pq->region); 955 if (dst_rrset_data == NULL) 956 goto srvfail; 957 } else { 958 dst_rrset_key->entry.hash = src_rrset_key->entry.hash; 959 dst_rrset_key->rk.dname = regional_alloc_init( 960 pq->region, src_rrset_key->rk.dname, 961 src_rrset_key->rk.dname_len); 962 if (dst_rrset_key->rk.dname == NULL) 963 goto srvfail; 964 965 dst_rrset_data = regional_alloc_init(pq->region, 966 src_rrset_data, 967 packed_rrset_sizeof(src_rrset_data)); 968 if (dst_rrset_data == NULL) 969 goto srvfail; 970 } 971 972 packed_rrset_ptr_fixup(dst_rrset_data); 973 dst_rrset_key->entry.data = dst_rrset_data; 974 } 975 976 if (!sldns_buffer_set_capacity(pq->abuf, pq->tcp ? UINT16_MAX : 977 pq->edns.udp_size)) 978 goto srvfail; 979 980 sldns_buffer_clear(pq->abuf); 981 982 if (reply_info_encode(&pq->qinfo, synth_rinfo, pq->qmsg->id, 983 synth_rinfo->flags, pq->abuf, 0, pq->region, 984 pq->tcp ? UINT16_MAX : pq->edns.udp_size, 985 pq->edns.bits & EDNS_DO, MINIMIZE_ANSWER) == 0) 986 goto srvfail; 987 988 reply_info_parsedelete(rinfo, &alloc); 989 alloc_clear(&alloc); 990 return; 991 992 srvfail: 993 reply_info_parsedelete(rinfo, &alloc); 994 alloc_clear(&alloc); 995 error_answer(pq, LDNS_RCODE_SERVFAIL); 996 } 997 998 void 999 resend_dns64_query(struct pending_query *opq) { 1000 struct pending_query *pq; 1001 struct query_imsg query_imsg; 1002 int rcode; 1003 char dname[LDNS_MAX_DOMAINLEN + 1]; 1004 1005 if ((pq = calloc(1, sizeof(*pq))) == NULL) { 1006 log_warn(NULL); 1007 return; 1008 } 1009 1010 do { 1011 arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id)); 1012 } while(find_pending_query(pq->imsg_id) != NULL); 1013 1014 TAILQ_INSERT_TAIL(&pending_queries, pq, entry); 1015 1016 pq->from = opq->from; 1017 pq->fd = opq->fd; 1018 opq->fd = -1; 1019 pq->tcp = opq->tcp; 1020 pq->qbuf = sldns_buffer_new(sldns_buffer_capacity(opq->qbuf)); 1021 pq->abuf = sldns_buffer_new(sldns_buffer_capacity(opq->abuf)); 1022 pq->region = regional_create(); 1023 pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg)); 1024 1025 if (!pq->qbuf || !pq->abuf || !pq->region || !pq->qmsg) { 1026 log_warnx("out of memory"); 1027 free_pending_query(pq); 1028 free_pending_query(opq); 1029 return; 1030 } 1031 1032 sldns_buffer_rewind(opq->qbuf); 1033 sldns_buffer_write(pq->qbuf, sldns_buffer_current(opq->qbuf), 1034 sldns_buffer_remaining(opq->qbuf)); 1035 sldns_buffer_flip(pq->qbuf); 1036 memset(pq->qmsg, 0, sizeof(*pq->qmsg)); 1037 1038 if (pq->tcp) { 1039 struct timeval timeout = {TCP_TIMEOUT, 0}; 1040 1041 event_set(&pq->ev, pq->fd, EV_READ | EV_PERSIST, tcp_request, 1042 pq); 1043 event_set(&pq->resp_ev, pq->fd, EV_WRITE | EV_PERSIST, 1044 tcp_response, pq); 1045 evtimer_set(&pq->tmo_ev, tcp_timeout, pq); 1046 evtimer_add(&pq->tmo_ev, &timeout); 1047 } 1048 1049 if (!query_info_parse(&pq->qinfo, pq->qbuf)) { 1050 log_warnx("query_info_parse failed"); 1051 goto drop; 1052 } 1053 1054 sldns_buffer_rewind(pq->qbuf); 1055 1056 if (parse_packet(pq->qbuf, pq->qmsg, pq->region) != 1057 LDNS_RCODE_NOERROR) { 1058 log_warnx("parse_packet failed"); 1059 goto drop; 1060 } 1061 1062 rcode = parse_extract_edns(pq->qmsg, &pq->edns, pq->region); 1063 if (rcode != LDNS_RCODE_NOERROR) { 1064 error_answer(pq, rcode); 1065 goto send_answer; 1066 } 1067 1068 dname_str(pq->qinfo.qname, dname); 1069 strlcpy(query_imsg.qname, dname, sizeof(query_imsg.qname)); 1070 query_imsg.id = pq->imsg_id; 1071 query_imsg.t = LDNS_RR_TYPE_A; 1072 query_imsg.c = pq->qinfo.qclass; 1073 1074 pq->dns64_synthesize = 1; 1075 1076 if (frontend_imsg_compose_resolver(IMSG_QUERY, 0, &query_imsg, 1077 sizeof(query_imsg)) == -1) { 1078 error_answer(pq, LDNS_RCODE_SERVFAIL); 1079 goto send_answer; 1080 } 1081 1082 free_pending_query(opq); 1083 return; 1084 1085 send_answer: 1086 free_pending_query(opq); 1087 send_answer(pq); 1088 return; 1089 1090 drop: 1091 free_pending_query(opq); 1092 free_pending_query(pq); 1093 } 1094 1095 void 1096 chaos_answer(struct pending_query *pq) 1097 { 1098 size_t len; 1099 const char *name = "unwind"; 1100 1101 len = strlen(name); 1102 if (!sldns_buffer_set_capacity(pq->abuf, 1103 sldns_buffer_capacity(pq->qbuf) + COMPRESSED_RR_SIZE + 1 + len)) { 1104 error_answer(pq, LDNS_RCODE_SERVFAIL); 1105 return; 1106 } 1107 1108 sldns_buffer_copy(pq->abuf, pq->qbuf); 1109 1110 sldns_buffer_clear(pq->abuf); 1111 1112 sldns_buffer_skip(pq->abuf, sizeof(uint16_t)); /* skip id */ 1113 sldns_buffer_write_u16(pq->abuf, 0); /* clear flags */ 1114 LDNS_QR_SET(sldns_buffer_begin(pq->abuf)); 1115 LDNS_RA_SET(sldns_buffer_begin(pq->abuf)); 1116 if (LDNS_RD_WIRE(sldns_buffer_begin(pq->qbuf))) 1117 LDNS_RD_SET(sldns_buffer_begin(pq->abuf)); 1118 if (LDNS_CD_WIRE(sldns_buffer_begin(pq->qbuf))) 1119 LDNS_CD_SET(sldns_buffer_begin(pq->abuf)); 1120 LDNS_RCODE_SET(sldns_buffer_begin(pq->abuf), LDNS_RCODE_NOERROR); 1121 sldns_buffer_write_u16(pq->abuf, 1); /* qdcount */ 1122 sldns_buffer_write_u16(pq->abuf, 1); /* ancount */ 1123 sldns_buffer_write_u16(pq->abuf, 0); /* nscount */ 1124 sldns_buffer_write_u16(pq->abuf, 0); /* arcount */ 1125 (void)query_dname_len(pq->abuf); /* skip qname */ 1126 sldns_buffer_skip(pq->abuf, sizeof(uint16_t)); /* skip qtype */ 1127 sldns_buffer_skip(pq->abuf, sizeof(uint16_t)); /* skip qclass */ 1128 1129 sldns_buffer_write_u16(pq->abuf, 0xc00c); /* ptr to query */ 1130 sldns_buffer_write_u16(pq->abuf, LDNS_RR_TYPE_TXT); 1131 sldns_buffer_write_u16(pq->abuf, LDNS_RR_CLASS_CH); 1132 sldns_buffer_write_u32(pq->abuf, 0); /* TTL */ 1133 sldns_buffer_write_u16(pq->abuf, 1 + len); /* RDLENGTH */ 1134 sldns_buffer_write_u8(pq->abuf, len); /* length octed */ 1135 sldns_buffer_write(pq->abuf, name, len); 1136 sldns_buffer_flip(pq->abuf); 1137 } 1138 1139 void 1140 error_answer(struct pending_query *pq, int rcode) 1141 { 1142 sldns_buffer_clear(pq->abuf); 1143 error_encode(pq->abuf, rcode, &pq->qinfo, pq->qmsg->id, 1144 pq->qmsg->flags, pq->edns.edns_present ? &pq->edns : NULL); 1145 } 1146 1147 int 1148 check_query(sldns_buffer* pkt) 1149 { 1150 if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) { 1151 log_warnx("bad query: too short, dropped"); 1152 return -1; 1153 } 1154 if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) { 1155 log_warnx("bad query: QR set, dropped"); 1156 return -1; 1157 } 1158 if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) { 1159 LDNS_TC_CLR(sldns_buffer_begin(pkt)); 1160 log_warnx("bad query: TC set"); 1161 return (LDNS_RCODE_FORMERR); 1162 } 1163 if(!(LDNS_RD_WIRE(sldns_buffer_begin(pkt)))) { 1164 log_warnx("bad query: RD not set"); 1165 return (LDNS_RCODE_REFUSED); 1166 } 1167 if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) { 1168 log_warnx("bad query: unknown opcode %d", 1169 LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt))); 1170 return (LDNS_RCODE_NOTIMPL); 1171 } 1172 1173 if (LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1 && 1174 LDNS_ANCOUNT(sldns_buffer_begin(pkt))!= 0 && 1175 LDNS_NSCOUNT(sldns_buffer_begin(pkt))!= 0 && 1176 LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) { 1177 log_warnx("bad query: qdcount: %d, ancount: %d " 1178 "nscount: %d, arcount: %d", 1179 LDNS_QDCOUNT(sldns_buffer_begin(pkt)), 1180 LDNS_ANCOUNT(sldns_buffer_begin(pkt)), 1181 LDNS_NSCOUNT(sldns_buffer_begin(pkt)), 1182 LDNS_ARCOUNT(sldns_buffer_begin(pkt))); 1183 return (LDNS_RCODE_FORMERR); 1184 } 1185 return 0; 1186 } 1187 1188 void 1189 send_answer(struct pending_query *pq) 1190 { 1191 char *str; 1192 1193 if (log_getverbose() & OPT_VERBOSE2 && (str = 1194 sldns_wire2str_pkt(sldns_buffer_begin(pq->abuf), 1195 sldns_buffer_limit(pq->abuf))) != NULL) { 1196 log_debug("from: %s\n%s", ip_port((struct sockaddr *) 1197 &pq->from), str); 1198 free(str); 1199 } 1200 1201 if (!pq->tcp) { 1202 if(sendto(pq->fd, sldns_buffer_current(pq->abuf), 1203 sldns_buffer_remaining(pq->abuf), 0, 1204 (struct sockaddr *)&pq->from, pq->from.ss_len) == -1) 1205 log_warn("sendto"); 1206 free_pending_query(pq); 1207 } else { 1208 struct sldns_buffer *tmp; 1209 1210 tmp = sldns_buffer_new(sldns_buffer_limit(pq->abuf) + 2); 1211 1212 if (!tmp) { 1213 free_pending_query(pq); 1214 return; 1215 } 1216 1217 sldns_buffer_write_u16(tmp, sldns_buffer_limit(pq->abuf)); 1218 sldns_buffer_write(tmp, sldns_buffer_current(pq->abuf), 1219 sldns_buffer_remaining(pq->abuf)); 1220 sldns_buffer_flip(tmp); 1221 sldns_buffer_free(pq->abuf); 1222 pq->abuf = tmp; 1223 event_add(&pq->resp_ev, NULL); 1224 } 1225 } 1226 1227 char* 1228 ip_port(struct sockaddr *sa) 1229 { 1230 static char hbuf[NI_MAXHOST], buf[NI_MAXHOST]; 1231 1232 if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL, 0, 1233 NI_NUMERICHOST) != 0) { 1234 snprintf(buf, sizeof(buf), "%s", "(unknown)"); 1235 return buf; 1236 } 1237 1238 if (sa->sa_family == AF_INET6) 1239 snprintf(buf, sizeof(buf), "[%s]:%d", hbuf, ntohs( 1240 ((struct sockaddr_in6 *)sa)->sin6_port)); 1241 if (sa->sa_family == AF_INET) 1242 snprintf(buf, sizeof(buf), "[%s]:%d", hbuf, ntohs( 1243 ((struct sockaddr_in *)sa)->sin_port)); 1244 1245 return buf; 1246 } 1247 1248 struct pending_query* 1249 find_pending_query(uint64_t id) 1250 { 1251 struct pending_query *pq; 1252 1253 TAILQ_FOREACH(pq, &pending_queries, entry) 1254 if (pq->imsg_id == id) 1255 return pq; 1256 return NULL; 1257 } 1258 1259 void 1260 route_receive(int fd, short events, void *arg) 1261 { 1262 static uint8_t *buf; 1263 1264 struct rt_msghdr *rtm; 1265 struct sockaddr *sa, *rti_info[RTAX_MAX]; 1266 ssize_t n; 1267 1268 if (buf == NULL) { 1269 buf = malloc(ROUTE_SOCKET_BUF_SIZE); 1270 if (buf == NULL) 1271 fatal("malloc"); 1272 } 1273 rtm = (struct rt_msghdr *)buf; 1274 if ((n = read(fd, buf, ROUTE_SOCKET_BUF_SIZE)) == -1) { 1275 if (errno == EAGAIN || errno == EINTR) 1276 return; 1277 log_warn("dispatch_rtmsg: read error"); 1278 return; 1279 } 1280 1281 if (n == 0) 1282 fatal("routing socket closed"); 1283 1284 if (n < (ssize_t)sizeof(rtm->rtm_msglen) || n < rtm->rtm_msglen) { 1285 log_warnx("partial rtm of %zd in buffer", n); 1286 return; 1287 } 1288 1289 if (rtm->rtm_version != RTM_VERSION) 1290 return; 1291 1292 sa = (struct sockaddr *)(buf + rtm->rtm_hdrlen); 1293 get_rtaddrs(rtm->rtm_addrs, sa, rti_info); 1294 1295 handle_route_message(rtm, rti_info); 1296 } 1297 1298 #define ROUNDUP(a) \ 1299 ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long)) 1300 1301 void 1302 get_rtaddrs(int addrs, struct sockaddr *sa, struct sockaddr **rti_info) 1303 { 1304 int i; 1305 1306 for (i = 0; i < RTAX_MAX; i++) { 1307 if (addrs & (1 << i)) { 1308 rti_info[i] = sa; 1309 sa = (struct sockaddr *)((char *)(sa) + 1310 ROUNDUP(sa->sa_len)); 1311 } else 1312 rti_info[i] = NULL; 1313 } 1314 } 1315 1316 void 1317 handle_route_message(struct rt_msghdr *rtm, struct sockaddr **rti_info) 1318 { 1319 struct imsg_rdns_proposal rdns_proposal; 1320 struct sockaddr_rtdns *rtdns; 1321 struct if_announcemsghdr *ifan; 1322 1323 switch (rtm->rtm_type) { 1324 case RTM_IFANNOUNCE: 1325 ifan = (struct if_announcemsghdr *)rtm; 1326 if (ifan->ifan_what == IFAN_ARRIVAL) 1327 break; 1328 rdns_proposal.if_index = ifan->ifan_index; 1329 rdns_proposal.src = 0; 1330 rdns_proposal.rtdns.sr_family = AF_INET; 1331 rdns_proposal.rtdns.sr_len = offsetof(struct sockaddr_rtdns, 1332 sr_dns); 1333 frontend_imsg_compose_resolver(IMSG_REPLACE_DNS, 0, 1334 &rdns_proposal, sizeof(rdns_proposal)); 1335 break; 1336 case RTM_IFINFO: 1337 frontend_imsg_compose_resolver(IMSG_NETWORK_CHANGED, 0, NULL, 1338 0); 1339 break; 1340 case RTM_PROPOSAL: 1341 if (!(rtm->rtm_addrs & RTA_DNS)) 1342 break; 1343 1344 rtdns = (struct sockaddr_rtdns*)rti_info[RTAX_DNS]; 1345 switch (rtdns->sr_family) { 1346 case AF_INET: 1347 if ((rtdns->sr_len - 2) % sizeof(struct in_addr) != 0) { 1348 log_warnx("ignoring invalid RTM_PROPOSAL"); 1349 return; 1350 } 1351 break; 1352 case AF_INET6: 1353 if ((rtdns->sr_len - 2) % sizeof(struct in6_addr) != 0) { 1354 log_warnx("ignoring invalid RTM_PROPOSAL"); 1355 return; 1356 } 1357 break; 1358 default: 1359 log_warnx("ignoring invalid RTM_PROPOSAL"); 1360 return; 1361 } 1362 rdns_proposal.if_index = rtm->rtm_index; 1363 rdns_proposal.src = rtm->rtm_priority; 1364 memcpy(&rdns_proposal.rtdns, rtdns, sizeof(rdns_proposal.rtdns)); 1365 frontend_imsg_compose_resolver(IMSG_REPLACE_DNS, 0, 1366 &rdns_proposal, sizeof(rdns_proposal)); 1367 break; 1368 case RTM_NEWADDR: 1369 case RTM_DELADDR: 1370 case RTM_DESYNC: 1371 check_available_af(); 1372 break; 1373 default: 1374 break; 1375 } 1376 } 1377 1378 void 1379 add_new_ta(struct trust_anchor_head *tah, char *val) 1380 { 1381 struct trust_anchor *ta, *i; 1382 int cmp; 1383 1384 if ((ta = malloc(sizeof(*ta))) == NULL) 1385 fatal("%s", __func__); 1386 if ((ta->ta = strdup(val)) == NULL) 1387 fatal("%s", __func__); 1388 1389 /* keep the list sorted to prevent churn if the order changes in DNS */ 1390 TAILQ_FOREACH(i, tah, entry) { 1391 cmp = strcmp(i->ta, ta->ta); 1392 if ( cmp == 0) { 1393 /* duplicate */ 1394 free(ta->ta); 1395 free(ta); 1396 return; 1397 } else if (cmp > 0) { 1398 TAILQ_INSERT_BEFORE(i, ta, entry); 1399 return; 1400 } 1401 } 1402 TAILQ_INSERT_TAIL(tah, ta, entry); 1403 } 1404 1405 void 1406 free_tas(struct trust_anchor_head *tah) 1407 { 1408 struct trust_anchor *ta; 1409 1410 while ((ta = TAILQ_FIRST(tah))) { 1411 TAILQ_REMOVE(tah, ta, entry); 1412 free(ta->ta); 1413 free(ta); 1414 } 1415 } 1416 1417 int 1418 merge_tas(struct trust_anchor_head *newh, struct trust_anchor_head *oldh) 1419 { 1420 struct trust_anchor *i, *j; 1421 int chg = 0; 1422 1423 j = TAILQ_FIRST(oldh); 1424 1425 TAILQ_FOREACH(i, newh, entry) { 1426 if (j == NULL || strcmp(i->ta, j->ta) != 0) { 1427 chg = 1; 1428 break; 1429 } 1430 j = TAILQ_NEXT(j, entry); 1431 } 1432 if (j != NULL) 1433 chg = 1; 1434 1435 if (chg) { 1436 free_tas(oldh); 1437 TAILQ_CONCAT(oldh, newh, entry); 1438 } else { 1439 free_tas(newh); 1440 } 1441 return (chg); 1442 } 1443 1444 void 1445 parse_trust_anchor(struct trust_anchor_head *tah, int fd) 1446 { 1447 size_t len, dname_len; 1448 ssize_t n, sz; 1449 uint8_t rr[LDNS_RR_BUF_SIZE]; 1450 char *str, *p, buf[512], *line; 1451 1452 sz = 0; 1453 str = NULL; 1454 1455 while ((n = read(fd, buf, sizeof(buf))) > 0) { 1456 p = recallocarray(str, sz, sz + n, 1); 1457 if (p == NULL) { 1458 log_warn("%s", __func__); 1459 goto out; 1460 } 1461 str = p; 1462 memcpy(str + sz, buf, n); 1463 sz += n; 1464 } 1465 1466 if (n == -1) { 1467 log_warn("%s", __func__); 1468 goto out; 1469 } 1470 1471 /* make it a string */ 1472 p = recallocarray(str, sz, sz + 1, 1); 1473 if (p == NULL) { 1474 log_warn("%s", __func__); 1475 goto out; 1476 } 1477 str = p; 1478 sz++; 1479 1480 len = sizeof(rr); 1481 1482 while ((line = strsep(&p, "\n")) != NULL) { 1483 if (sldns_str2wire_rr_buf(line, rr, &len, &dname_len, 1484 ROOT_DNSKEY_TTL, NULL, 0, NULL, 0) != 0) 1485 continue; 1486 if (sldns_wirerr_get_type(rr, len, dname_len) == 1487 LDNS_RR_TYPE_DNSKEY) 1488 add_new_ta(tah, line); 1489 } 1490 1491 out: 1492 free(str); 1493 return; 1494 } 1495 1496 void 1497 send_trust_anchors(struct trust_anchor_head *tah) 1498 { 1499 struct trust_anchor *ta; 1500 1501 TAILQ_FOREACH(ta, tah, entry) 1502 frontend_imsg_compose_resolver(IMSG_NEW_TA, 0, ta->ta, 1503 strlen(ta->ta) + 1); 1504 frontend_imsg_compose_resolver(IMSG_NEW_TAS_DONE, 0, NULL, 0); 1505 } 1506 1507 void 1508 write_trust_anchors(struct trust_anchor_head *tah, int fd) 1509 { 1510 struct trust_anchor *ta; 1511 size_t len = 0; 1512 ssize_t n; 1513 char *str; 1514 1515 if (lseek(fd, 0, SEEK_SET) == -1) { 1516 log_warn("%s", __func__); 1517 goto out; 1518 } 1519 1520 TAILQ_FOREACH(ta, tah, entry) { 1521 if ((n = asprintf(&str, "%s\n", ta->ta)) == -1) { 1522 log_warn("%s", __func__); 1523 len = 0; 1524 goto out; 1525 } 1526 len += n; 1527 if (write(fd, str, n) != n) { 1528 log_warn("%s", __func__); 1529 free(str); 1530 len = 0; 1531 goto out; 1532 } 1533 free(str); 1534 } 1535 out: 1536 ftruncate(fd, len); 1537 fsync(fd); 1538 } 1539 1540 void 1541 parse_blocklist(int fd) 1542 { 1543 FILE *f; 1544 struct bl_node *bl_node; 1545 char *line = NULL; 1546 size_t linesize = 0; 1547 ssize_t linelen; 1548 1549 if((f = fdopen(fd, "r")) == NULL) { 1550 log_warn("cannot read block list"); 1551 close(fd); 1552 return; 1553 } 1554 1555 free_bl(); 1556 1557 while ((linelen = getline(&line, &linesize, f)) != -1) { 1558 if (line[linelen - 1] == '\n') { 1559 if (linelen >= 2 && line[linelen - 2] != '.') 1560 line[linelen - 1] = '.'; 1561 else 1562 line[linelen - 1] = '\0'; 1563 } 1564 1565 bl_node = malloc(sizeof *bl_node); 1566 if (bl_node == NULL) 1567 fatal("%s: malloc", __func__); 1568 if ((bl_node->domain = strdup(line)) == NULL) 1569 fatal("%s: strdup", __func__); 1570 if (RB_INSERT(bl_tree, &bl_head, bl_node) != NULL) { 1571 log_warnx("duplicate blocked domain \"%s\"", line); 1572 free(bl_node->domain); 1573 free(bl_node); 1574 } 1575 } 1576 free(line); 1577 if (ferror(f)) 1578 log_warn("getline"); 1579 fclose(f); 1580 } 1581 1582 int 1583 bl_cmp(struct bl_node *e1, struct bl_node *e2) { 1584 return (strcasecmp(e1->domain, e2->domain)); 1585 } 1586 1587 void 1588 free_bl(void) 1589 { 1590 struct bl_node *n, *nxt; 1591 1592 RB_FOREACH_SAFE(n, bl_tree, &bl_head, nxt) { 1593 RB_REMOVE(bl_tree, &bl_head, n); 1594 free(n->domain); 1595 free(n); 1596 } 1597 } 1598 1599 int 1600 pending_query_cnt(void) 1601 { 1602 struct pending_query *e; 1603 int cnt = 0; 1604 1605 TAILQ_FOREACH(e, &pending_queries, entry) 1606 cnt++; 1607 return cnt; 1608 } 1609 1610 void 1611 accept_paused(int fd, short events, void *arg) 1612 { 1613 struct tcp_accept_ev *tcpev = arg; 1614 event_add(&tcpev->ev, NULL); 1615 } 1616 1617 int 1618 accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen) 1619 { 1620 if (getdtablecount() + FD_RESERVE >= getdtablesize()) { 1621 log_debug("%s: inflight fds exceeded", __func__); 1622 errno = EMFILE; 1623 return -1; 1624 } 1625 return accept4(sockfd, addr, addrlen, SOCK_NONBLOCK | SOCK_CLOEXEC); 1626 } 1627 1628 void 1629 tcp_accept(int fd, short events, void *arg) 1630 { 1631 static struct timeval timeout = {TCP_TIMEOUT, 0}; 1632 static struct timeval backoff = {1, 0}; 1633 struct pending_query *pq; 1634 struct tcp_accept_ev *tcpev; 1635 struct sockaddr_storage ss; 1636 socklen_t len; 1637 int s; 1638 1639 tcpev = arg; 1640 len = sizeof(ss); 1641 1642 if ((s = accept_reserve(fd, (struct sockaddr *)&ss, &len)) == -1) { 1643 switch (errno) { 1644 case EINTR: 1645 case EWOULDBLOCK: 1646 case ECONNABORTED: 1647 return; 1648 case EMFILE: 1649 case ENFILE: 1650 event_del(&tcpev->ev); 1651 evtimer_add(&tcpev->pause, &backoff); 1652 return; 1653 default: 1654 fatal("accept"); 1655 } 1656 } 1657 1658 if ((pq = calloc(1, sizeof(*pq))) == NULL) { 1659 log_warn(NULL); 1660 close(s); 1661 return; 1662 } 1663 1664 do { 1665 arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id)); 1666 } while(find_pending_query(pq->imsg_id) != NULL); 1667 1668 TAILQ_INSERT_TAIL(&pending_queries, pq, entry); 1669 1670 pq->from = ss; 1671 pq->fd = s; 1672 pq->tcp = 1; 1673 pq->qbuf = sldns_buffer_new(DEFAULT_TCP_SIZE); 1674 pq->region = regional_create(); 1675 pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg)); 1676 1677 if (!pq->qbuf || !pq->region || !pq->qmsg) { 1678 free_pending_query(pq); 1679 return; 1680 } 1681 1682 memset(pq->qmsg, 0, sizeof(*pq->qmsg)); 1683 1684 event_set(&pq->ev, s, EV_READ | EV_PERSIST, tcp_request, pq); 1685 event_add(&pq->ev, NULL); 1686 event_set(&pq->resp_ev, s, EV_WRITE | EV_PERSIST, tcp_response, pq); 1687 1688 evtimer_set(&pq->tmo_ev, tcp_timeout, pq); 1689 evtimer_add(&pq->tmo_ev, &timeout); 1690 } 1691 1692 void 1693 tcp_request(int fd, short events, void *arg) 1694 { 1695 struct pending_query *pq; 1696 ssize_t n; 1697 1698 pq = arg; 1699 1700 n = read(fd, sldns_buffer_current(pq->qbuf), 1701 sldns_buffer_remaining(pq->qbuf)); 1702 1703 switch (n) { 1704 case -1: 1705 switch (errno) { 1706 case EINTR: 1707 case EAGAIN: 1708 return; 1709 default: 1710 goto fail; 1711 } 1712 break; 1713 case 0: 1714 log_debug("closed connection"); 1715 goto fail; 1716 default: 1717 break; 1718 } 1719 1720 sldns_buffer_skip(pq->qbuf, n); 1721 1722 if (sldns_buffer_position(pq->qbuf) >= 2 && !pq->abuf) { 1723 struct sldns_buffer *tmp; 1724 uint16_t len; 1725 1726 sldns_buffer_flip(pq->qbuf); 1727 len = sldns_buffer_read_u16(pq->qbuf); 1728 tmp = sldns_buffer_new(len); 1729 pq->abuf = sldns_buffer_new(len); 1730 1731 if (!tmp || !pq->abuf) 1732 goto fail; 1733 1734 sldns_buffer_write(tmp, sldns_buffer_current(pq->qbuf), 1735 sldns_buffer_remaining(pq->qbuf)); 1736 sldns_buffer_free(pq->qbuf); 1737 pq->qbuf = tmp; 1738 } 1739 if (sldns_buffer_remaining(pq->qbuf) == 0) { 1740 sldns_buffer_flip(pq->qbuf); 1741 shutdown(fd, SHUT_RD); 1742 event_del(&pq->ev); 1743 handle_query(pq); 1744 } 1745 return; 1746 fail: 1747 free_pending_query(pq); 1748 } 1749 1750 void 1751 tcp_response(int fd, short events, void *arg) 1752 { 1753 struct pending_query *pq; 1754 ssize_t n; 1755 1756 pq = arg; 1757 1758 n = write(fd, sldns_buffer_current(pq->abuf), 1759 sldns_buffer_remaining(pq->abuf)); 1760 1761 if (n == -1) { 1762 if (errno == EAGAIN || errno == EINTR) 1763 return; 1764 free_pending_query(pq); 1765 } 1766 sldns_buffer_skip(pq->abuf, n); 1767 if (sldns_buffer_remaining(pq->abuf) == 0) 1768 free_pending_query(pq); 1769 } 1770 1771 void 1772 tcp_timeout(int fd, short events, void *arg) 1773 { 1774 free_pending_query(arg); 1775 } 1776 1777 void 1778 check_available_af() 1779 { 1780 static int available_af = HAVE_IPV4 | HAVE_IPV6; 1781 static int rtable = -1; 1782 struct ifaddrs *ifap, *ifa; 1783 struct if_data *ifa_data; 1784 struct sockaddr_in *sin4; 1785 struct sockaddr_in6 *sin6; 1786 int new_available_af = 0, ifa_rtable = -1; 1787 1788 if (rtable == -1) 1789 rtable = getrtable(); 1790 1791 if (getifaddrs(&ifap) != 0) { 1792 log_warn("getifaddrs"); 1793 return; 1794 } 1795 1796 for (ifa = ifap; ifa != NULL; ifa = ifa->ifa_next) { 1797 if (ifa->ifa_addr == NULL) 1798 continue; 1799 switch(ifa->ifa_addr->sa_family) { 1800 case AF_LINK: 1801 /* AF_LINK comes before inet / inet6 on an interface */ 1802 ifa_data = (struct if_data *)ifa->ifa_data; 1803 ifa_rtable = ifa_data->ifi_rdomain; 1804 break; 1805 case AF_INET: 1806 if (ifa_rtable != rtable) 1807 continue; 1808 1809 sin4 = (struct sockaddr_in *)ifa->ifa_addr; 1810 if ((ntohl(sin4->sin_addr.s_addr) >> 24) == 1811 IN_LOOPBACKNET) 1812 continue; 1813 new_available_af |= HAVE_IPV4; 1814 break; 1815 case AF_INET6: 1816 if (ifa_rtable != rtable) 1817 continue; 1818 1819 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr; 1820 if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) || 1821 IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) || 1822 IN6_IS_ADDR_MC_LINKLOCAL(&sin6->sin6_addr) || 1823 IN6_IS_ADDR_MC_INTFACELOCAL(&sin6->sin6_addr)) 1824 continue; 1825 new_available_af |= HAVE_IPV6; 1826 break; 1827 default: 1828 break; 1829 } 1830 if (new_available_af == (HAVE_IPV4 | HAVE_IPV6)) 1831 break; 1832 } 1833 freeifaddrs(ifap); 1834 if (new_available_af != available_af) { 1835 available_af = new_available_af; 1836 frontend_imsg_compose_resolver(IMSG_CHANGE_AFS, 0, 1837 &available_af, sizeof(available_af)); 1838 } 1839 } 1840