1ae8c6e27Sflorian /* 2ae8c6e27Sflorian * iterator/iterator.c - iterative resolver DNS query response module 3ae8c6e27Sflorian * 4ae8c6e27Sflorian * Copyright (c) 2007, NLnet Labs. All rights reserved. 5ae8c6e27Sflorian * 6ae8c6e27Sflorian * This software is open source. 7ae8c6e27Sflorian * 8ae8c6e27Sflorian * Redistribution and use in source and binary forms, with or without 9ae8c6e27Sflorian * modification, are permitted provided that the following conditions 10ae8c6e27Sflorian * are met: 11ae8c6e27Sflorian * 12ae8c6e27Sflorian * Redistributions of source code must retain the above copyright notice, 13ae8c6e27Sflorian * this list of conditions and the following disclaimer. 14ae8c6e27Sflorian * 15ae8c6e27Sflorian * Redistributions in binary form must reproduce the above copyright notice, 16ae8c6e27Sflorian * this list of conditions and the following disclaimer in the documentation 17ae8c6e27Sflorian * and/or other materials provided with the distribution. 18ae8c6e27Sflorian * 19ae8c6e27Sflorian * Neither the name of the NLNET LABS nor the names of its contributors may 20ae8c6e27Sflorian * be used to endorse or promote products derived from this software without 21ae8c6e27Sflorian * specific prior written permission. 22ae8c6e27Sflorian * 23ae8c6e27Sflorian * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24ae8c6e27Sflorian * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25ae8c6e27Sflorian * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26ae8c6e27Sflorian * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27ae8c6e27Sflorian * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28ae8c6e27Sflorian * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29ae8c6e27Sflorian * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30ae8c6e27Sflorian * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31ae8c6e27Sflorian * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32ae8c6e27Sflorian * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33ae8c6e27Sflorian * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34ae8c6e27Sflorian */ 35ae8c6e27Sflorian 36ae8c6e27Sflorian /** 37ae8c6e27Sflorian * \file 38ae8c6e27Sflorian * 39ae8c6e27Sflorian * This file contains a module that performs recursive iterative DNS query 40ae8c6e27Sflorian * processing. 41ae8c6e27Sflorian */ 42ae8c6e27Sflorian 43ae8c6e27Sflorian #include "config.h" 44ae8c6e27Sflorian #include "iterator/iterator.h" 45ae8c6e27Sflorian #include "iterator/iter_utils.h" 46ae8c6e27Sflorian #include "iterator/iter_hints.h" 47ae8c6e27Sflorian #include "iterator/iter_fwd.h" 48ae8c6e27Sflorian #include "iterator/iter_donotq.h" 49ae8c6e27Sflorian #include "iterator/iter_delegpt.h" 50ae8c6e27Sflorian #include "iterator/iter_resptype.h" 51ae8c6e27Sflorian #include "iterator/iter_scrub.h" 52ae8c6e27Sflorian #include "iterator/iter_priv.h" 53ae8c6e27Sflorian #include "validator/val_neg.h" 54ae8c6e27Sflorian #include "services/cache/dns.h" 55ae8c6e27Sflorian #include "services/cache/infra.h" 56ae8c6e27Sflorian #include "services/authzone.h" 57ae8c6e27Sflorian #include "util/module.h" 58ae8c6e27Sflorian #include "util/netevent.h" 59ae8c6e27Sflorian #include "util/net_help.h" 60ae8c6e27Sflorian #include "util/regional.h" 61ae8c6e27Sflorian #include "util/data/dname.h" 62ae8c6e27Sflorian #include "util/data/msgencode.h" 63ae8c6e27Sflorian #include "util/fptr_wlist.h" 64ae8c6e27Sflorian #include "util/config_file.h" 65ae8c6e27Sflorian #include "util/random.h" 66ae8c6e27Sflorian #include "sldns/rrdef.h" 67ae8c6e27Sflorian #include "sldns/wire2str.h" 68ae8c6e27Sflorian #include "sldns/str2wire.h" 69ae8c6e27Sflorian #include "sldns/parseutil.h" 70ae8c6e27Sflorian #include "sldns/sbuffer.h" 71ae8c6e27Sflorian 72ae8c6e27Sflorian /* in msec */ 73ae8c6e27Sflorian int UNKNOWN_SERVER_NICENESS = 376; 746d08cb1bSflorian /* in msec */ 756d08cb1bSflorian int USEFUL_SERVER_TOP_TIMEOUT = 120000; 766d08cb1bSflorian /* Equals USEFUL_SERVER_TOP_TIMEOUT*4 */ 776d08cb1bSflorian int BLACKLIST_PENALTY = (120000*4); 78ae8c6e27Sflorian 795a7d75e6Ssthen static void target_count_increase_nx(struct iter_qstate* iq, int num); 805a7d75e6Ssthen 81ae8c6e27Sflorian int 82ae8c6e27Sflorian iter_init(struct module_env* env, int id) 83ae8c6e27Sflorian { 84ae8c6e27Sflorian struct iter_env* iter_env = (struct iter_env*)calloc(1, 85ae8c6e27Sflorian sizeof(struct iter_env)); 86ae8c6e27Sflorian if(!iter_env) { 87ae8c6e27Sflorian log_err("malloc failure"); 88ae8c6e27Sflorian return 0; 89ae8c6e27Sflorian } 90ae8c6e27Sflorian env->modinfo[id] = (void*)iter_env; 91ae8c6e27Sflorian 92ae8c6e27Sflorian lock_basic_init(&iter_env->queries_ratelimit_lock); 93ae8c6e27Sflorian lock_protect(&iter_env->queries_ratelimit_lock, 94ae8c6e27Sflorian &iter_env->num_queries_ratelimited, 95ae8c6e27Sflorian sizeof(iter_env->num_queries_ratelimited)); 96ae8c6e27Sflorian 97ae8c6e27Sflorian if(!iter_apply_cfg(iter_env, env->cfg)) { 98ae8c6e27Sflorian log_err("iterator: could not apply configuration settings."); 99ae8c6e27Sflorian return 0; 100ae8c6e27Sflorian } 101ae8c6e27Sflorian 102ae8c6e27Sflorian return 1; 103ae8c6e27Sflorian } 104ae8c6e27Sflorian 105ae8c6e27Sflorian /** delete caps_whitelist element */ 106ae8c6e27Sflorian static void 107ae8c6e27Sflorian caps_free(struct rbnode_type* n, void* ATTR_UNUSED(d)) 108ae8c6e27Sflorian { 109ae8c6e27Sflorian if(n) { 110ae8c6e27Sflorian free(((struct name_tree_node*)n)->name); 111ae8c6e27Sflorian free(n); 112ae8c6e27Sflorian } 113ae8c6e27Sflorian } 114ae8c6e27Sflorian 115ae8c6e27Sflorian void 116ae8c6e27Sflorian iter_deinit(struct module_env* env, int id) 117ae8c6e27Sflorian { 118ae8c6e27Sflorian struct iter_env* iter_env; 119ae8c6e27Sflorian if(!env || !env->modinfo[id]) 120ae8c6e27Sflorian return; 121ae8c6e27Sflorian iter_env = (struct iter_env*)env->modinfo[id]; 122ae8c6e27Sflorian lock_basic_destroy(&iter_env->queries_ratelimit_lock); 123ae8c6e27Sflorian free(iter_env->target_fetch_policy); 124ae8c6e27Sflorian priv_delete(iter_env->priv); 125ae8c6e27Sflorian donotq_delete(iter_env->donotq); 126ae8c6e27Sflorian if(iter_env->caps_white) { 127ae8c6e27Sflorian traverse_postorder(iter_env->caps_white, caps_free, NULL); 128ae8c6e27Sflorian free(iter_env->caps_white); 129ae8c6e27Sflorian } 130ae8c6e27Sflorian free(iter_env); 131ae8c6e27Sflorian env->modinfo[id] = NULL; 132ae8c6e27Sflorian } 133ae8c6e27Sflorian 134ae8c6e27Sflorian /** new query for iterator */ 135ae8c6e27Sflorian static int 136ae8c6e27Sflorian iter_new(struct module_qstate* qstate, int id) 137ae8c6e27Sflorian { 138ae8c6e27Sflorian struct iter_qstate* iq = (struct iter_qstate*)regional_alloc( 139ae8c6e27Sflorian qstate->region, sizeof(struct iter_qstate)); 140ae8c6e27Sflorian qstate->minfo[id] = iq; 141ae8c6e27Sflorian if(!iq) 142ae8c6e27Sflorian return 0; 143ae8c6e27Sflorian memset(iq, 0, sizeof(*iq)); 144ae8c6e27Sflorian iq->state = INIT_REQUEST_STATE; 145ae8c6e27Sflorian iq->final_state = FINISHED_STATE; 146ae8c6e27Sflorian iq->an_prepend_list = NULL; 147ae8c6e27Sflorian iq->an_prepend_last = NULL; 148ae8c6e27Sflorian iq->ns_prepend_list = NULL; 149ae8c6e27Sflorian iq->ns_prepend_last = NULL; 150ae8c6e27Sflorian iq->dp = NULL; 151ae8c6e27Sflorian iq->depth = 0; 152ae8c6e27Sflorian iq->num_target_queries = 0; 153ae8c6e27Sflorian iq->num_current_queries = 0; 154ae8c6e27Sflorian iq->query_restart_count = 0; 155ae8c6e27Sflorian iq->referral_count = 0; 156ae8c6e27Sflorian iq->sent_count = 0; 157ae8c6e27Sflorian iq->ratelimit_ok = 0; 158ae8c6e27Sflorian iq->target_count = NULL; 1595a7d75e6Ssthen iq->dp_target_count = 0; 160ae8c6e27Sflorian iq->wait_priming_stub = 0; 161ae8c6e27Sflorian iq->refetch_glue = 0; 162ae8c6e27Sflorian iq->dnssec_expected = 0; 163ae8c6e27Sflorian iq->dnssec_lame_query = 0; 164ae8c6e27Sflorian iq->chase_flags = qstate->query_flags; 165ae8c6e27Sflorian /* Start with the (current) qname. */ 166ae8c6e27Sflorian iq->qchase = qstate->qinfo; 167ae8c6e27Sflorian outbound_list_init(&iq->outlist); 168ae8c6e27Sflorian iq->minimise_count = 0; 169e47fef9eSflorian iq->timeout_count = 0; 170ae8c6e27Sflorian if (qstate->env->cfg->qname_minimisation) 171ae8c6e27Sflorian iq->minimisation_state = INIT_MINIMISE_STATE; 172ae8c6e27Sflorian else 173ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 174ae8c6e27Sflorian 175ae8c6e27Sflorian memset(&iq->qinfo_out, 0, sizeof(struct query_info)); 176ae8c6e27Sflorian return 1; 177ae8c6e27Sflorian } 178ae8c6e27Sflorian 179ae8c6e27Sflorian /** 180ae8c6e27Sflorian * Transition to the next state. This can be used to advance a currently 181ae8c6e27Sflorian * processing event. It cannot be used to reactivate a forEvent. 182ae8c6e27Sflorian * 183ae8c6e27Sflorian * @param iq: iterator query state 184ae8c6e27Sflorian * @param nextstate The state to transition to. 185ae8c6e27Sflorian * @return true. This is so this can be called as the return value for the 186ae8c6e27Sflorian * actual process*State() methods. (Transitioning to the next state 187ae8c6e27Sflorian * implies further processing). 188ae8c6e27Sflorian */ 189ae8c6e27Sflorian static int 190ae8c6e27Sflorian next_state(struct iter_qstate* iq, enum iter_state nextstate) 191ae8c6e27Sflorian { 192ae8c6e27Sflorian /* If transitioning to a "response" state, make sure that there is a 193ae8c6e27Sflorian * response */ 194ae8c6e27Sflorian if(iter_state_is_responsestate(nextstate)) { 195ae8c6e27Sflorian if(iq->response == NULL) { 196ae8c6e27Sflorian log_err("transitioning to response state sans " 197ae8c6e27Sflorian "response."); 198ae8c6e27Sflorian } 199ae8c6e27Sflorian } 200ae8c6e27Sflorian iq->state = nextstate; 201ae8c6e27Sflorian return 1; 202ae8c6e27Sflorian } 203ae8c6e27Sflorian 204ae8c6e27Sflorian /** 205ae8c6e27Sflorian * Transition an event to its final state. Final states always either return 206ae8c6e27Sflorian * a result up the module chain, or reactivate a dependent event. Which 207ae8c6e27Sflorian * final state to transition to is set in the module state for the event when 208ae8c6e27Sflorian * it was created, and depends on the original purpose of the event. 209ae8c6e27Sflorian * 210ae8c6e27Sflorian * The response is stored in the qstate->buf buffer. 211ae8c6e27Sflorian * 212ae8c6e27Sflorian * @param iq: iterator query state 213ae8c6e27Sflorian * @return false. This is so this method can be used as the return value for 214ae8c6e27Sflorian * the processState methods. (Transitioning to the final state 215ae8c6e27Sflorian */ 216ae8c6e27Sflorian static int 217ae8c6e27Sflorian final_state(struct iter_qstate* iq) 218ae8c6e27Sflorian { 219ae8c6e27Sflorian return next_state(iq, iq->final_state); 220ae8c6e27Sflorian } 221ae8c6e27Sflorian 222ae8c6e27Sflorian /** 223ae8c6e27Sflorian * Callback routine to handle errors in parent query states 224ae8c6e27Sflorian * @param qstate: query state that failed. 225ae8c6e27Sflorian * @param id: module id. 226ae8c6e27Sflorian * @param super: super state. 227ae8c6e27Sflorian */ 228ae8c6e27Sflorian static void 229ae8c6e27Sflorian error_supers(struct module_qstate* qstate, int id, struct module_qstate* super) 230ae8c6e27Sflorian { 2315a7d75e6Ssthen struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 232ae8c6e27Sflorian struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id]; 233ae8c6e27Sflorian 234ae8c6e27Sflorian if(qstate->qinfo.qtype == LDNS_RR_TYPE_A || 235ae8c6e27Sflorian qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA) { 236ae8c6e27Sflorian /* mark address as failed. */ 237ae8c6e27Sflorian struct delegpt_ns* dpns = NULL; 238ae8c6e27Sflorian super_iq->num_target_queries--; 239ae8c6e27Sflorian if(super_iq->dp) 240ae8c6e27Sflorian dpns = delegpt_find_ns(super_iq->dp, 241ae8c6e27Sflorian qstate->qinfo.qname, qstate->qinfo.qname_len); 242ae8c6e27Sflorian if(!dpns) { 243ae8c6e27Sflorian /* not interested */ 244ae8c6e27Sflorian /* this can happen, for eg. qname minimisation asked 245ae8c6e27Sflorian * for an NXDOMAIN to be validated, and used qtype 246ae8c6e27Sflorian * A for that, and the error of that, the name, is 247ae8c6e27Sflorian * not listed in super_iq->dp */ 248ae8c6e27Sflorian verbose(VERB_ALGO, "subq error, but not interested"); 249ae8c6e27Sflorian log_query_info(VERB_ALGO, "superq", &super->qinfo); 250ae8c6e27Sflorian return; 251ae8c6e27Sflorian } else { 252ae8c6e27Sflorian /* see if the failure did get (parent-lame) info */ 253ae8c6e27Sflorian if(!cache_fill_missing(super->env, super_iq->qchase.qclass, 254ae8c6e27Sflorian super->region, super_iq->dp)) 255ae8c6e27Sflorian log_err("out of memory adding missing"); 256ae8c6e27Sflorian } 2575a7d75e6Ssthen delegpt_mark_neg(dpns, qstate->qinfo.qtype); 2585a7d75e6Ssthen if((dpns->got4 == 2 || !ie->supports_ipv4) && 2596d08cb1bSflorian (dpns->got6 == 2 || !ie->supports_ipv6)) { 260*5c45b740Sflorian dpns->resolved = 1; /* mark as failed */ 2615a7d75e6Ssthen target_count_increase_nx(super_iq, 1); 262ae8c6e27Sflorian } 2636d08cb1bSflorian } 264ae8c6e27Sflorian if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) { 265ae8c6e27Sflorian /* prime failed to get delegation */ 266ae8c6e27Sflorian super_iq->dp = NULL; 267ae8c6e27Sflorian } 268ae8c6e27Sflorian /* evaluate targets again */ 269ae8c6e27Sflorian super_iq->state = QUERYTARGETS_STATE; 270ae8c6e27Sflorian /* super becomes runnable, and will process this change */ 271ae8c6e27Sflorian } 272ae8c6e27Sflorian 273ae8c6e27Sflorian /** 274ae8c6e27Sflorian * Return an error to the client 275ae8c6e27Sflorian * @param qstate: our query state 276ae8c6e27Sflorian * @param id: module id 277ae8c6e27Sflorian * @param rcode: error code (DNS errcode). 278ae8c6e27Sflorian * @return: 0 for use by caller, to make notation easy, like: 279ae8c6e27Sflorian * return error_response(..). 280ae8c6e27Sflorian */ 281ae8c6e27Sflorian static int 282ae8c6e27Sflorian error_response(struct module_qstate* qstate, int id, int rcode) 283ae8c6e27Sflorian { 284ae8c6e27Sflorian verbose(VERB_QUERY, "return error response %s", 285ae8c6e27Sflorian sldns_lookup_by_id(sldns_rcodes, rcode)? 286ae8c6e27Sflorian sldns_lookup_by_id(sldns_rcodes, rcode)->name:"??"); 287ae8c6e27Sflorian qstate->return_rcode = rcode; 288ae8c6e27Sflorian qstate->return_msg = NULL; 289ae8c6e27Sflorian qstate->ext_state[id] = module_finished; 290ae8c6e27Sflorian return 0; 291ae8c6e27Sflorian } 292ae8c6e27Sflorian 293ae8c6e27Sflorian /** 294ae8c6e27Sflorian * Return an error to the client and cache the error code in the 295ae8c6e27Sflorian * message cache (so per qname, qtype, qclass). 296ae8c6e27Sflorian * @param qstate: our query state 297ae8c6e27Sflorian * @param id: module id 298ae8c6e27Sflorian * @param rcode: error code (DNS errcode). 299ae8c6e27Sflorian * @return: 0 for use by caller, to make notation easy, like: 300ae8c6e27Sflorian * return error_response(..). 301ae8c6e27Sflorian */ 302ae8c6e27Sflorian static int 303ae8c6e27Sflorian error_response_cache(struct module_qstate* qstate, int id, int rcode) 304ae8c6e27Sflorian { 305ae8c6e27Sflorian if(!qstate->no_cache_store) { 306ae8c6e27Sflorian /* store in cache */ 307ae8c6e27Sflorian struct reply_info err; 308ae8c6e27Sflorian if(qstate->prefetch_leeway > NORR_TTL) { 309ae8c6e27Sflorian verbose(VERB_ALGO, "error response for prefetch in cache"); 310ae8c6e27Sflorian /* attempt to adjust the cache entry prefetch */ 311ae8c6e27Sflorian if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, 312ae8c6e27Sflorian NORR_TTL, qstate->query_flags)) 313ae8c6e27Sflorian return error_response(qstate, id, rcode); 314ae8c6e27Sflorian /* if that fails (not in cache), fall through to store err */ 315ae8c6e27Sflorian } 316ae8c6e27Sflorian if(qstate->env->cfg->serve_expired) { 317ae8c6e27Sflorian /* if serving expired contents, and such content is 318ae8c6e27Sflorian * already available, don't overwrite this servfail */ 319ae8c6e27Sflorian struct msgreply_entry* msg; 320ae8c6e27Sflorian if((msg=msg_cache_lookup(qstate->env, 321ae8c6e27Sflorian qstate->qinfo.qname, qstate->qinfo.qname_len, 322ae8c6e27Sflorian qstate->qinfo.qtype, qstate->qinfo.qclass, 323ae8c6e27Sflorian qstate->query_flags, 0, 324ae8c6e27Sflorian qstate->env->cfg->serve_expired_ttl_reset)) 325ae8c6e27Sflorian != NULL) { 326ae8c6e27Sflorian if(qstate->env->cfg->serve_expired_ttl_reset) { 327ae8c6e27Sflorian struct reply_info* rep = 328ae8c6e27Sflorian (struct reply_info*)msg->entry.data; 329ae8c6e27Sflorian if(rep && *qstate->env->now + 330ae8c6e27Sflorian qstate->env->cfg->serve_expired_ttl > 331ae8c6e27Sflorian rep->serve_expired_ttl) { 332ae8c6e27Sflorian rep->serve_expired_ttl = 333ae8c6e27Sflorian *qstate->env->now + 334ae8c6e27Sflorian qstate->env->cfg->serve_expired_ttl; 335ae8c6e27Sflorian } 336ae8c6e27Sflorian } 337ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 338ae8c6e27Sflorian return error_response(qstate, id, rcode); 339ae8c6e27Sflorian } 340ae8c6e27Sflorian /* serving expired contents, but nothing is cached 341ae8c6e27Sflorian * at all, so the servfail cache entry is useful 342ae8c6e27Sflorian * (stops waste of time on this servfail NORR_TTL) */ 343ae8c6e27Sflorian } else { 344ae8c6e27Sflorian /* don't overwrite existing (non-expired) data in 345ae8c6e27Sflorian * cache with a servfail */ 346ae8c6e27Sflorian struct msgreply_entry* msg; 347ae8c6e27Sflorian if((msg=msg_cache_lookup(qstate->env, 348ae8c6e27Sflorian qstate->qinfo.qname, qstate->qinfo.qname_len, 349ae8c6e27Sflorian qstate->qinfo.qtype, qstate->qinfo.qclass, 350ae8c6e27Sflorian qstate->query_flags, *qstate->env->now, 0)) 351ae8c6e27Sflorian != NULL) { 352ae8c6e27Sflorian struct reply_info* rep = (struct reply_info*) 353ae8c6e27Sflorian msg->entry.data; 354ae8c6e27Sflorian if(FLAGS_GET_RCODE(rep->flags) == 355ae8c6e27Sflorian LDNS_RCODE_NOERROR || 356ae8c6e27Sflorian FLAGS_GET_RCODE(rep->flags) == 357ae8c6e27Sflorian LDNS_RCODE_NXDOMAIN) { 358ae8c6e27Sflorian /* we have a good entry, 359ae8c6e27Sflorian * don't overwrite */ 360ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 361ae8c6e27Sflorian return error_response(qstate, id, rcode); 362ae8c6e27Sflorian } 363ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 364ae8c6e27Sflorian } 365ae8c6e27Sflorian 366ae8c6e27Sflorian } 367ae8c6e27Sflorian memset(&err, 0, sizeof(err)); 368ae8c6e27Sflorian err.flags = (uint16_t)(BIT_QR | BIT_RA); 369ae8c6e27Sflorian FLAGS_SET_RCODE(err.flags, rcode); 370ae8c6e27Sflorian err.qdcount = 1; 371ae8c6e27Sflorian err.ttl = NORR_TTL; 372ae8c6e27Sflorian err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); 373ae8c6e27Sflorian err.serve_expired_ttl = NORR_TTL; 374ae8c6e27Sflorian /* do not waste time trying to validate this servfail */ 375ae8c6e27Sflorian err.security = sec_status_indeterminate; 376ae8c6e27Sflorian verbose(VERB_ALGO, "store error response in message cache"); 377ae8c6e27Sflorian iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, 3786d08cb1bSflorian qstate->query_flags, qstate->qstarttime); 379ae8c6e27Sflorian } 380ae8c6e27Sflorian return error_response(qstate, id, rcode); 381ae8c6e27Sflorian } 382ae8c6e27Sflorian 383ae8c6e27Sflorian /** check if prepend item is duplicate item */ 384ae8c6e27Sflorian static int 385ae8c6e27Sflorian prepend_is_duplicate(struct ub_packed_rrset_key** sets, size_t to, 386ae8c6e27Sflorian struct ub_packed_rrset_key* dup) 387ae8c6e27Sflorian { 388ae8c6e27Sflorian size_t i; 389ae8c6e27Sflorian for(i=0; i<to; i++) { 390ae8c6e27Sflorian if(sets[i]->rk.type == dup->rk.type && 391ae8c6e27Sflorian sets[i]->rk.rrset_class == dup->rk.rrset_class && 392ae8c6e27Sflorian sets[i]->rk.dname_len == dup->rk.dname_len && 393ae8c6e27Sflorian query_dname_compare(sets[i]->rk.dname, dup->rk.dname) 394ae8c6e27Sflorian == 0) 395ae8c6e27Sflorian return 1; 396ae8c6e27Sflorian } 397ae8c6e27Sflorian return 0; 398ae8c6e27Sflorian } 399ae8c6e27Sflorian 400ae8c6e27Sflorian /** prepend the prepend list in the answer and authority section of dns_msg */ 401ae8c6e27Sflorian static int 402ae8c6e27Sflorian iter_prepend(struct iter_qstate* iq, struct dns_msg* msg, 403ae8c6e27Sflorian struct regional* region) 404ae8c6e27Sflorian { 405ae8c6e27Sflorian struct iter_prep_list* p; 406ae8c6e27Sflorian struct ub_packed_rrset_key** sets; 407ae8c6e27Sflorian size_t num_an = 0, num_ns = 0;; 408ae8c6e27Sflorian for(p = iq->an_prepend_list; p; p = p->next) 409ae8c6e27Sflorian num_an++; 410ae8c6e27Sflorian for(p = iq->ns_prepend_list; p; p = p->next) 411ae8c6e27Sflorian num_ns++; 412ae8c6e27Sflorian if(num_an + num_ns == 0) 413ae8c6e27Sflorian return 1; 414ae8c6e27Sflorian verbose(VERB_ALGO, "prepending %d rrsets", (int)num_an + (int)num_ns); 415ae8c6e27Sflorian if(num_an > RR_COUNT_MAX || num_ns > RR_COUNT_MAX || 416ae8c6e27Sflorian msg->rep->rrset_count > RR_COUNT_MAX) return 0; /* overflow */ 417ae8c6e27Sflorian sets = regional_alloc(region, (num_an+num_ns+msg->rep->rrset_count) * 418ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key*)); 419ae8c6e27Sflorian if(!sets) 420ae8c6e27Sflorian return 0; 421ae8c6e27Sflorian /* ANSWER section */ 422ae8c6e27Sflorian num_an = 0; 423ae8c6e27Sflorian for(p = iq->an_prepend_list; p; p = p->next) { 424ae8c6e27Sflorian sets[num_an++] = p->rrset; 42557403691Sflorian if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) 42657403691Sflorian msg->rep->ttl = ub_packed_rrset_ttl(p->rrset); 427ae8c6e27Sflorian } 428ae8c6e27Sflorian memcpy(sets+num_an, msg->rep->rrsets, msg->rep->an_numrrsets * 429ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key*)); 430ae8c6e27Sflorian /* AUTH section */ 431ae8c6e27Sflorian num_ns = 0; 432ae8c6e27Sflorian for(p = iq->ns_prepend_list; p; p = p->next) { 433ae8c6e27Sflorian if(prepend_is_duplicate(sets+msg->rep->an_numrrsets+num_an, 434ae8c6e27Sflorian num_ns, p->rrset) || prepend_is_duplicate( 435ae8c6e27Sflorian msg->rep->rrsets+msg->rep->an_numrrsets, 436ae8c6e27Sflorian msg->rep->ns_numrrsets, p->rrset)) 437ae8c6e27Sflorian continue; 438ae8c6e27Sflorian sets[msg->rep->an_numrrsets + num_an + num_ns++] = p->rrset; 43957403691Sflorian if(ub_packed_rrset_ttl(p->rrset) < msg->rep->ttl) 44057403691Sflorian msg->rep->ttl = ub_packed_rrset_ttl(p->rrset); 441ae8c6e27Sflorian } 442ae8c6e27Sflorian memcpy(sets + num_an + msg->rep->an_numrrsets + num_ns, 443ae8c6e27Sflorian msg->rep->rrsets + msg->rep->an_numrrsets, 444ae8c6e27Sflorian (msg->rep->ns_numrrsets + msg->rep->ar_numrrsets) * 445ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key*)); 446ae8c6e27Sflorian 447ae8c6e27Sflorian /* NXDOMAIN rcode can stay if we prepended DNAME/CNAMEs, because 448ae8c6e27Sflorian * this is what recursors should give. */ 449ae8c6e27Sflorian msg->rep->rrset_count += num_an + num_ns; 450ae8c6e27Sflorian msg->rep->an_numrrsets += num_an; 451ae8c6e27Sflorian msg->rep->ns_numrrsets += num_ns; 452ae8c6e27Sflorian msg->rep->rrsets = sets; 453ae8c6e27Sflorian return 1; 454ae8c6e27Sflorian } 455ae8c6e27Sflorian 456ae8c6e27Sflorian /** 457ae8c6e27Sflorian * Find rrset in ANSWER prepend list. 458ae8c6e27Sflorian * to avoid duplicate DNAMEs when a DNAME is traversed twice. 459ae8c6e27Sflorian * @param iq: iterator query state. 460ae8c6e27Sflorian * @param rrset: rrset to add. 461ae8c6e27Sflorian * @return false if not found 462ae8c6e27Sflorian */ 463ae8c6e27Sflorian static int 464ae8c6e27Sflorian iter_find_rrset_in_prepend_answer(struct iter_qstate* iq, 465ae8c6e27Sflorian struct ub_packed_rrset_key* rrset) 466ae8c6e27Sflorian { 467ae8c6e27Sflorian struct iter_prep_list* p = iq->an_prepend_list; 468ae8c6e27Sflorian while(p) { 469ae8c6e27Sflorian if(ub_rrset_compare(p->rrset, rrset) == 0 && 470ae8c6e27Sflorian rrsetdata_equal((struct packed_rrset_data*)p->rrset 471ae8c6e27Sflorian ->entry.data, (struct packed_rrset_data*)rrset 472ae8c6e27Sflorian ->entry.data)) 473ae8c6e27Sflorian return 1; 474ae8c6e27Sflorian p = p->next; 475ae8c6e27Sflorian } 476ae8c6e27Sflorian return 0; 477ae8c6e27Sflorian } 478ae8c6e27Sflorian 479ae8c6e27Sflorian /** 480ae8c6e27Sflorian * Add rrset to ANSWER prepend list 481ae8c6e27Sflorian * @param qstate: query state. 482ae8c6e27Sflorian * @param iq: iterator query state. 483ae8c6e27Sflorian * @param rrset: rrset to add. 484ae8c6e27Sflorian * @return false on failure (malloc). 485ae8c6e27Sflorian */ 486ae8c6e27Sflorian static int 487ae8c6e27Sflorian iter_add_prepend_answer(struct module_qstate* qstate, struct iter_qstate* iq, 488ae8c6e27Sflorian struct ub_packed_rrset_key* rrset) 489ae8c6e27Sflorian { 490ae8c6e27Sflorian struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc( 491ae8c6e27Sflorian qstate->region, sizeof(struct iter_prep_list)); 492ae8c6e27Sflorian if(!p) 493ae8c6e27Sflorian return 0; 494ae8c6e27Sflorian p->rrset = rrset; 495ae8c6e27Sflorian p->next = NULL; 496ae8c6e27Sflorian /* add at end */ 497ae8c6e27Sflorian if(iq->an_prepend_last) 498ae8c6e27Sflorian iq->an_prepend_last->next = p; 499ae8c6e27Sflorian else iq->an_prepend_list = p; 500ae8c6e27Sflorian iq->an_prepend_last = p; 501ae8c6e27Sflorian return 1; 502ae8c6e27Sflorian } 503ae8c6e27Sflorian 504ae8c6e27Sflorian /** 505ae8c6e27Sflorian * Add rrset to AUTHORITY prepend list 506ae8c6e27Sflorian * @param qstate: query state. 507ae8c6e27Sflorian * @param iq: iterator query state. 508ae8c6e27Sflorian * @param rrset: rrset to add. 509ae8c6e27Sflorian * @return false on failure (malloc). 510ae8c6e27Sflorian */ 511ae8c6e27Sflorian static int 512ae8c6e27Sflorian iter_add_prepend_auth(struct module_qstate* qstate, struct iter_qstate* iq, 513ae8c6e27Sflorian struct ub_packed_rrset_key* rrset) 514ae8c6e27Sflorian { 515ae8c6e27Sflorian struct iter_prep_list* p = (struct iter_prep_list*)regional_alloc( 516ae8c6e27Sflorian qstate->region, sizeof(struct iter_prep_list)); 517ae8c6e27Sflorian if(!p) 518ae8c6e27Sflorian return 0; 519ae8c6e27Sflorian p->rrset = rrset; 520ae8c6e27Sflorian p->next = NULL; 521ae8c6e27Sflorian /* add at end */ 522ae8c6e27Sflorian if(iq->ns_prepend_last) 523ae8c6e27Sflorian iq->ns_prepend_last->next = p; 524ae8c6e27Sflorian else iq->ns_prepend_list = p; 525ae8c6e27Sflorian iq->ns_prepend_last = p; 526ae8c6e27Sflorian return 1; 527ae8c6e27Sflorian } 528ae8c6e27Sflorian 529ae8c6e27Sflorian /** 530ae8c6e27Sflorian * Given a CNAME response (defined as a response containing a CNAME or DNAME 531ae8c6e27Sflorian * that does not answer the request), process the response, modifying the 532ae8c6e27Sflorian * state as necessary. This follows the CNAME/DNAME chain and returns the 533ae8c6e27Sflorian * final query name. 534ae8c6e27Sflorian * 535ae8c6e27Sflorian * sets the new query name, after following the CNAME/DNAME chain. 536ae8c6e27Sflorian * @param qstate: query state. 537ae8c6e27Sflorian * @param iq: iterator query state. 538ae8c6e27Sflorian * @param msg: the response. 539ae8c6e27Sflorian * @param mname: returned target new query name. 540ae8c6e27Sflorian * @param mname_len: length of mname. 541ae8c6e27Sflorian * @return false on (malloc) error. 542ae8c6e27Sflorian */ 543ae8c6e27Sflorian static int 544ae8c6e27Sflorian handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq, 545ae8c6e27Sflorian struct dns_msg* msg, uint8_t** mname, size_t* mname_len) 546ae8c6e27Sflorian { 547ae8c6e27Sflorian size_t i; 548ae8c6e27Sflorian /* Start with the (current) qname. */ 549ae8c6e27Sflorian *mname = iq->qchase.qname; 550ae8c6e27Sflorian *mname_len = iq->qchase.qname_len; 551ae8c6e27Sflorian 552ae8c6e27Sflorian /* Iterate over the ANSWER rrsets in order, looking for CNAMEs and 553ae8c6e27Sflorian * DNAMES. */ 554ae8c6e27Sflorian for(i=0; i<msg->rep->an_numrrsets; i++) { 555ae8c6e27Sflorian struct ub_packed_rrset_key* r = msg->rep->rrsets[i]; 556ae8c6e27Sflorian /* If there is a (relevant) DNAME, add it to the list. 557ae8c6e27Sflorian * We always expect there to be CNAME that was generated 558ae8c6e27Sflorian * by this DNAME following, so we don't process the DNAME 559ae8c6e27Sflorian * directly. */ 560ae8c6e27Sflorian if(ntohs(r->rk.type) == LDNS_RR_TYPE_DNAME && 561ae8c6e27Sflorian dname_strict_subdomain_c(*mname, r->rk.dname) && 562ae8c6e27Sflorian !iter_find_rrset_in_prepend_answer(iq, r)) { 563ae8c6e27Sflorian if(!iter_add_prepend_answer(qstate, iq, r)) 564ae8c6e27Sflorian return 0; 565ae8c6e27Sflorian continue; 566ae8c6e27Sflorian } 567ae8c6e27Sflorian 568ae8c6e27Sflorian if(ntohs(r->rk.type) == LDNS_RR_TYPE_CNAME && 569ae8c6e27Sflorian query_dname_compare(*mname, r->rk.dname) == 0 && 570ae8c6e27Sflorian !iter_find_rrset_in_prepend_answer(iq, r)) { 571ae8c6e27Sflorian /* Add this relevant CNAME rrset to the prepend list.*/ 572ae8c6e27Sflorian if(!iter_add_prepend_answer(qstate, iq, r)) 573ae8c6e27Sflorian return 0; 574ae8c6e27Sflorian get_cname_target(r, mname, mname_len); 575ae8c6e27Sflorian } 576ae8c6e27Sflorian 577ae8c6e27Sflorian /* Other rrsets in the section are ignored. */ 578ae8c6e27Sflorian } 579ae8c6e27Sflorian /* add authority rrsets to authority prepend, for wildcarded CNAMEs */ 580ae8c6e27Sflorian for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets + 581ae8c6e27Sflorian msg->rep->ns_numrrsets; i++) { 582ae8c6e27Sflorian struct ub_packed_rrset_key* r = msg->rep->rrsets[i]; 583ae8c6e27Sflorian /* only add NSEC/NSEC3, as they may be needed for validation */ 584ae8c6e27Sflorian if(ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC || 585ae8c6e27Sflorian ntohs(r->rk.type) == LDNS_RR_TYPE_NSEC3) { 586ae8c6e27Sflorian if(!iter_add_prepend_auth(qstate, iq, r)) 587ae8c6e27Sflorian return 0; 588ae8c6e27Sflorian } 589ae8c6e27Sflorian } 590ae8c6e27Sflorian return 1; 591ae8c6e27Sflorian } 592ae8c6e27Sflorian 593411c5950Sflorian /** add response specific error information for log servfail */ 594411c5950Sflorian static void 595411c5950Sflorian errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq) 596411c5950Sflorian { 597411c5950Sflorian if(qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) 598411c5950Sflorian return; 599*5c45b740Sflorian if((qstate->reply && qstate->reply->remote_addrlen != 0) || 600*5c45b740Sflorian (iq->fail_reply && iq->fail_reply->remote_addrlen != 0)) { 601411c5950Sflorian char from[256], frm[512]; 602*5c45b740Sflorian if(qstate->reply && qstate->reply->remote_addrlen != 0) 603*5c45b740Sflorian addr_to_str(&qstate->reply->remote_addr, 604*5c45b740Sflorian qstate->reply->remote_addrlen, from, 605*5c45b740Sflorian sizeof(from)); 606411c5950Sflorian else 607*5c45b740Sflorian addr_to_str(&iq->fail_reply->remote_addr, 608*5c45b740Sflorian iq->fail_reply->remote_addrlen, from, 609*5c45b740Sflorian sizeof(from)); 610411c5950Sflorian snprintf(frm, sizeof(frm), "from %s", from); 611411c5950Sflorian errinf(qstate, frm); 612411c5950Sflorian } 613411c5950Sflorian if(iq->scrub_failures || iq->parse_failures) { 614411c5950Sflorian if(iq->scrub_failures) 615411c5950Sflorian errinf(qstate, "upstream response failed scrub"); 616411c5950Sflorian if(iq->parse_failures) 617411c5950Sflorian errinf(qstate, "could not parse upstream response"); 618411c5950Sflorian } else if(iq->response == NULL && iq->timeout_count != 0) { 619411c5950Sflorian errinf(qstate, "upstream server timeout"); 620411c5950Sflorian } else if(iq->response == NULL) { 621411c5950Sflorian errinf(qstate, "no server to query"); 622411c5950Sflorian if(iq->dp) { 623411c5950Sflorian if(iq->dp->target_list == NULL) 624411c5950Sflorian errinf(qstate, "no addresses for nameservers"); 625411c5950Sflorian else errinf(qstate, "nameserver addresses not usable"); 626411c5950Sflorian if(iq->dp->nslist == NULL) 627411c5950Sflorian errinf(qstate, "have no nameserver names"); 628411c5950Sflorian if(iq->dp->bogus) 629411c5950Sflorian errinf(qstate, "NS record was dnssec bogus"); 630411c5950Sflorian } 631411c5950Sflorian } 632411c5950Sflorian if(iq->response && iq->response->rep) { 633411c5950Sflorian if(FLAGS_GET_RCODE(iq->response->rep->flags) != 0) { 634411c5950Sflorian char rcode[256], rc[32]; 635411c5950Sflorian (void)sldns_wire2str_rcode_buf( 636411c5950Sflorian FLAGS_GET_RCODE(iq->response->rep->flags), 637411c5950Sflorian rc, sizeof(rc)); 638411c5950Sflorian snprintf(rcode, sizeof(rcode), "got %s", rc); 639411c5950Sflorian errinf(qstate, rcode); 640411c5950Sflorian } else { 641411c5950Sflorian /* rcode NOERROR */ 642411c5950Sflorian if(iq->response->rep->an_numrrsets == 0) { 643411c5950Sflorian errinf(qstate, "nodata answer"); 644411c5950Sflorian } 645411c5950Sflorian } 646411c5950Sflorian } 647411c5950Sflorian } 648411c5950Sflorian 649ae8c6e27Sflorian /** see if last resort is possible - does config allow queries to parent */ 650ae8c6e27Sflorian static int 651ae8c6e27Sflorian can_have_last_resort(struct module_env* env, uint8_t* nm, size_t nmlen, 652ae8c6e27Sflorian uint16_t qclass, struct delegpt** retdp) 653ae8c6e27Sflorian { 654ae8c6e27Sflorian struct delegpt* fwddp; 655ae8c6e27Sflorian struct iter_hints_stub* stub; 656ae8c6e27Sflorian int labs = dname_count_labels(nm); 657ae8c6e27Sflorian /* do not process a last resort (the parent side) if a stub 658ae8c6e27Sflorian * or forward is configured, because we do not want to go 'above' 659ae8c6e27Sflorian * the configured servers */ 660ae8c6e27Sflorian if(!dname_is_root(nm) && (stub = (struct iter_hints_stub*) 661ae8c6e27Sflorian name_tree_find(&env->hints->tree, nm, nmlen, labs, qclass)) && 662ae8c6e27Sflorian /* has_parent side is turned off for stub_first, where we 663ae8c6e27Sflorian * are allowed to go to the parent */ 664ae8c6e27Sflorian stub->dp->has_parent_side_NS) { 665ae8c6e27Sflorian if(retdp) *retdp = stub->dp; 666ae8c6e27Sflorian return 0; 667ae8c6e27Sflorian } 668ae8c6e27Sflorian if((fwddp = forwards_find(env->fwds, nm, qclass)) && 669ae8c6e27Sflorian /* has_parent_side is turned off for forward_first, where 670ae8c6e27Sflorian * we are allowed to go to the parent */ 671ae8c6e27Sflorian fwddp->has_parent_side_NS) { 672ae8c6e27Sflorian if(retdp) *retdp = fwddp; 673ae8c6e27Sflorian return 0; 674ae8c6e27Sflorian } 675ae8c6e27Sflorian return 1; 676ae8c6e27Sflorian } 677ae8c6e27Sflorian 678ae8c6e27Sflorian /** see if target name is caps-for-id whitelisted */ 679ae8c6e27Sflorian static int 680ae8c6e27Sflorian is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq) 681ae8c6e27Sflorian { 682ae8c6e27Sflorian if(!ie->caps_white) return 0; /* no whitelist, or no capsforid */ 683ae8c6e27Sflorian return name_tree_lookup(ie->caps_white, iq->qchase.qname, 684ae8c6e27Sflorian iq->qchase.qname_len, dname_count_labels(iq->qchase.qname), 685ae8c6e27Sflorian iq->qchase.qclass) != NULL; 686ae8c6e27Sflorian } 687ae8c6e27Sflorian 6886d08cb1bSflorian /** 6896d08cb1bSflorian * Create target count structure for this query. This is always explicitly 6906d08cb1bSflorian * created for the parent query. 6916d08cb1bSflorian */ 692ae8c6e27Sflorian static void 693ae8c6e27Sflorian target_count_create(struct iter_qstate* iq) 694ae8c6e27Sflorian { 695ae8c6e27Sflorian if(!iq->target_count) { 6966d08cb1bSflorian iq->target_count = (int*)calloc(TARGET_COUNT_MAX, sizeof(int)); 697ae8c6e27Sflorian /* if calloc fails we simply do not track this number */ 6986d08cb1bSflorian if(iq->target_count) { 6996d08cb1bSflorian iq->target_count[TARGET_COUNT_REF] = 1; 7006d08cb1bSflorian iq->nxns_dp = (uint8_t**)calloc(1, sizeof(uint8_t*)); 7016d08cb1bSflorian } 702ae8c6e27Sflorian } 703ae8c6e27Sflorian } 704ae8c6e27Sflorian 705ae8c6e27Sflorian static void 706ae8c6e27Sflorian target_count_increase(struct iter_qstate* iq, int num) 707ae8c6e27Sflorian { 708ae8c6e27Sflorian target_count_create(iq); 709ae8c6e27Sflorian if(iq->target_count) 7106d08cb1bSflorian iq->target_count[TARGET_COUNT_QUERIES] += num; 7115a7d75e6Ssthen iq->dp_target_count++; 7125a7d75e6Ssthen } 7135a7d75e6Ssthen 7145a7d75e6Ssthen static void 7155a7d75e6Ssthen target_count_increase_nx(struct iter_qstate* iq, int num) 7165a7d75e6Ssthen { 7175a7d75e6Ssthen target_count_create(iq); 7185a7d75e6Ssthen if(iq->target_count) 7196d08cb1bSflorian iq->target_count[TARGET_COUNT_NX] += num; 720ae8c6e27Sflorian } 721ae8c6e27Sflorian 722ae8c6e27Sflorian /** 723ae8c6e27Sflorian * Generate a subrequest. 724ae8c6e27Sflorian * Generate a local request event. Local events are tied to this module, and 725ae8c6e27Sflorian * have a corresponding (first tier) event that is waiting for this event to 726ae8c6e27Sflorian * resolve to continue. 727ae8c6e27Sflorian * 728ae8c6e27Sflorian * @param qname The query name for this request. 729ae8c6e27Sflorian * @param qnamelen length of qname 730ae8c6e27Sflorian * @param qtype The query type for this request. 731ae8c6e27Sflorian * @param qclass The query class for this request. 732ae8c6e27Sflorian * @param qstate The event that is generating this event. 733ae8c6e27Sflorian * @param id: module id. 734ae8c6e27Sflorian * @param iq: The iterator state that is generating this event. 735ae8c6e27Sflorian * @param initial_state The initial response state (normally this 736ae8c6e27Sflorian * is QUERY_RESP_STATE, unless it is known that the request won't 737ae8c6e27Sflorian * need iterative processing 738ae8c6e27Sflorian * @param finalstate The final state for the response to this request. 739ae8c6e27Sflorian * @param subq_ret: if newly allocated, the subquerystate, or NULL if it does 740ae8c6e27Sflorian * not need initialisation. 741ae8c6e27Sflorian * @param v: if true, validation is done on the subquery. 7425a7d75e6Ssthen * @param detached: true if this qstate should not attach to the subquery 743ae8c6e27Sflorian * @return false on error (malloc). 744ae8c6e27Sflorian */ 745ae8c6e27Sflorian static int 746ae8c6e27Sflorian generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype, 747ae8c6e27Sflorian uint16_t qclass, struct module_qstate* qstate, int id, 748ae8c6e27Sflorian struct iter_qstate* iq, enum iter_state initial_state, 7495a7d75e6Ssthen enum iter_state finalstate, struct module_qstate** subq_ret, int v, 7505a7d75e6Ssthen int detached) 751ae8c6e27Sflorian { 752ae8c6e27Sflorian struct module_qstate* subq = NULL; 753ae8c6e27Sflorian struct iter_qstate* subiq = NULL; 754ae8c6e27Sflorian uint16_t qflags = 0; /* OPCODE QUERY, no flags */ 755ae8c6e27Sflorian struct query_info qinf; 756ae8c6e27Sflorian int prime = (finalstate == PRIME_RESP_STATE)?1:0; 757ae8c6e27Sflorian int valrec = 0; 758ae8c6e27Sflorian qinf.qname = qname; 759ae8c6e27Sflorian qinf.qname_len = qnamelen; 760ae8c6e27Sflorian qinf.qtype = qtype; 761ae8c6e27Sflorian qinf.qclass = qclass; 762ae8c6e27Sflorian qinf.local_alias = NULL; 763ae8c6e27Sflorian 764ae8c6e27Sflorian /* RD should be set only when sending the query back through the INIT 765ae8c6e27Sflorian * state. */ 766ae8c6e27Sflorian if(initial_state == INIT_REQUEST_STATE) 767ae8c6e27Sflorian qflags |= BIT_RD; 768ae8c6e27Sflorian /* We set the CD flag so we can send this through the "head" of 769ae8c6e27Sflorian * the resolution chain, which might have a validator. We are 770ae8c6e27Sflorian * uninterested in validating things not on the direct resolution 771ae8c6e27Sflorian * path. */ 772ae8c6e27Sflorian if(!v) { 773ae8c6e27Sflorian qflags |= BIT_CD; 774ae8c6e27Sflorian valrec = 1; 775ae8c6e27Sflorian } 776ae8c6e27Sflorian 7775a7d75e6Ssthen if(detached) { 7785a7d75e6Ssthen struct mesh_state* sub = NULL; 7795a7d75e6Ssthen fptr_ok(fptr_whitelist_modenv_add_sub( 7805a7d75e6Ssthen qstate->env->add_sub)); 7815a7d75e6Ssthen if(!(*qstate->env->add_sub)(qstate, &qinf, 7825a7d75e6Ssthen qflags, prime, valrec, &subq, &sub)){ 783ae8c6e27Sflorian return 0; 784ae8c6e27Sflorian } 7855a7d75e6Ssthen } 7865a7d75e6Ssthen else { 7875a7d75e6Ssthen /* attach subquery, lookup existing or make a new one */ 7885a7d75e6Ssthen fptr_ok(fptr_whitelist_modenv_attach_sub( 7895a7d75e6Ssthen qstate->env->attach_sub)); 7905a7d75e6Ssthen if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, 7915a7d75e6Ssthen valrec, &subq)) { 7925a7d75e6Ssthen return 0; 7935a7d75e6Ssthen } 7945a7d75e6Ssthen } 795ae8c6e27Sflorian *subq_ret = subq; 796ae8c6e27Sflorian if(subq) { 797ae8c6e27Sflorian /* initialise the new subquery */ 798ae8c6e27Sflorian subq->curmod = id; 799ae8c6e27Sflorian subq->ext_state[id] = module_state_initial; 800ae8c6e27Sflorian subq->minfo[id] = regional_alloc(subq->region, 801ae8c6e27Sflorian sizeof(struct iter_qstate)); 802ae8c6e27Sflorian if(!subq->minfo[id]) { 803ae8c6e27Sflorian log_err("init subq: out of memory"); 804ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_kill_sub( 805ae8c6e27Sflorian qstate->env->kill_sub)); 806ae8c6e27Sflorian (*qstate->env->kill_sub)(subq); 807ae8c6e27Sflorian return 0; 808ae8c6e27Sflorian } 809ae8c6e27Sflorian subiq = (struct iter_qstate*)subq->minfo[id]; 810ae8c6e27Sflorian memset(subiq, 0, sizeof(*subiq)); 811ae8c6e27Sflorian subiq->num_target_queries = 0; 812ae8c6e27Sflorian target_count_create(iq); 813ae8c6e27Sflorian subiq->target_count = iq->target_count; 8146d08cb1bSflorian if(iq->target_count) { 8156d08cb1bSflorian iq->target_count[TARGET_COUNT_REF] ++; /* extra reference */ 8166d08cb1bSflorian subiq->nxns_dp = iq->nxns_dp; 8176d08cb1bSflorian } 8185a7d75e6Ssthen subiq->dp_target_count = 0; 819ae8c6e27Sflorian subiq->num_current_queries = 0; 820ae8c6e27Sflorian subiq->depth = iq->depth+1; 821ae8c6e27Sflorian outbound_list_init(&subiq->outlist); 822ae8c6e27Sflorian subiq->state = initial_state; 823ae8c6e27Sflorian subiq->final_state = finalstate; 824ae8c6e27Sflorian subiq->qchase = subq->qinfo; 825ae8c6e27Sflorian subiq->chase_flags = subq->query_flags; 826ae8c6e27Sflorian subiq->refetch_glue = 0; 827ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) 828ae8c6e27Sflorian subiq->minimisation_state = INIT_MINIMISE_STATE; 829ae8c6e27Sflorian else 830ae8c6e27Sflorian subiq->minimisation_state = DONOT_MINIMISE_STATE; 831ae8c6e27Sflorian memset(&subiq->qinfo_out, 0, sizeof(struct query_info)); 832ae8c6e27Sflorian } 833ae8c6e27Sflorian return 1; 834ae8c6e27Sflorian } 835ae8c6e27Sflorian 836ae8c6e27Sflorian /** 837ae8c6e27Sflorian * Generate and send a root priming request. 838ae8c6e27Sflorian * @param qstate: the qtstate that triggered the need to prime. 839ae8c6e27Sflorian * @param iq: iterator query state. 840ae8c6e27Sflorian * @param id: module id. 841ae8c6e27Sflorian * @param qclass: the class to prime. 842ae8c6e27Sflorian * @return 0 on failure 843ae8c6e27Sflorian */ 844ae8c6e27Sflorian static int 845ae8c6e27Sflorian prime_root(struct module_qstate* qstate, struct iter_qstate* iq, int id, 846ae8c6e27Sflorian uint16_t qclass) 847ae8c6e27Sflorian { 848ae8c6e27Sflorian struct delegpt* dp; 849ae8c6e27Sflorian struct module_qstate* subq; 850ae8c6e27Sflorian verbose(VERB_DETAIL, "priming . %s NS", 851ae8c6e27Sflorian sldns_lookup_by_id(sldns_rr_classes, (int)qclass)? 852ae8c6e27Sflorian sldns_lookup_by_id(sldns_rr_classes, (int)qclass)->name:"??"); 853ae8c6e27Sflorian dp = hints_lookup_root(qstate->env->hints, qclass); 854ae8c6e27Sflorian if(!dp) { 855ae8c6e27Sflorian verbose(VERB_ALGO, "Cannot prime due to lack of hints"); 856ae8c6e27Sflorian return 0; 857ae8c6e27Sflorian } 858ae8c6e27Sflorian /* Priming requests start at the QUERYTARGETS state, skipping 859ae8c6e27Sflorian * the normal INIT state logic (which would cause an infloop). */ 860ae8c6e27Sflorian if(!generate_sub_request((uint8_t*)"\000", 1, LDNS_RR_TYPE_NS, 861ae8c6e27Sflorian qclass, qstate, id, iq, QUERYTARGETS_STATE, PRIME_RESP_STATE, 8625a7d75e6Ssthen &subq, 0, 0)) { 863ae8c6e27Sflorian verbose(VERB_ALGO, "could not prime root"); 864ae8c6e27Sflorian return 0; 865ae8c6e27Sflorian } 866ae8c6e27Sflorian if(subq) { 867ae8c6e27Sflorian struct iter_qstate* subiq = 868ae8c6e27Sflorian (struct iter_qstate*)subq->minfo[id]; 869ae8c6e27Sflorian /* Set the initial delegation point to the hint. 870ae8c6e27Sflorian * copy dp, it is now part of the root prime query. 871ae8c6e27Sflorian * dp was part of in the fixed hints structure. */ 872ae8c6e27Sflorian subiq->dp = delegpt_copy(dp, subq->region); 873ae8c6e27Sflorian if(!subiq->dp) { 874ae8c6e27Sflorian log_err("out of memory priming root, copydp"); 875ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_kill_sub( 876ae8c6e27Sflorian qstate->env->kill_sub)); 877ae8c6e27Sflorian (*qstate->env->kill_sub)(subq); 878ae8c6e27Sflorian return 0; 879ae8c6e27Sflorian } 880ae8c6e27Sflorian /* there should not be any target queries. */ 881ae8c6e27Sflorian subiq->num_target_queries = 0; 882ae8c6e27Sflorian subiq->dnssec_expected = iter_indicates_dnssec( 883ae8c6e27Sflorian qstate->env, subiq->dp, NULL, subq->qinfo.qclass); 884ae8c6e27Sflorian } 885ae8c6e27Sflorian 886ae8c6e27Sflorian /* this module stops, our submodule starts, and does the query. */ 887ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 888ae8c6e27Sflorian return 1; 889ae8c6e27Sflorian } 890ae8c6e27Sflorian 891ae8c6e27Sflorian /** 892ae8c6e27Sflorian * Generate and process a stub priming request. This method tests for the 893ae8c6e27Sflorian * need to prime a stub zone, so it is safe to call for every request. 894ae8c6e27Sflorian * 895ae8c6e27Sflorian * @param qstate: the qtstate that triggered the need to prime. 896ae8c6e27Sflorian * @param iq: iterator query state. 897ae8c6e27Sflorian * @param id: module id. 898ae8c6e27Sflorian * @param qname: request name. 899ae8c6e27Sflorian * @param qclass: request class. 900ae8c6e27Sflorian * @return true if a priming subrequest was made, false if not. The will only 901ae8c6e27Sflorian * issue a priming request if it detects an unprimed stub. 902ae8c6e27Sflorian * Uses value of 2 to signal during stub-prime in root-prime situation 903ae8c6e27Sflorian * that a noprime-stub is available and resolution can continue. 904ae8c6e27Sflorian */ 905ae8c6e27Sflorian static int 906ae8c6e27Sflorian prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, int id, 907ae8c6e27Sflorian uint8_t* qname, uint16_t qclass) 908ae8c6e27Sflorian { 909ae8c6e27Sflorian /* Lookup the stub hint. This will return null if the stub doesn't 910ae8c6e27Sflorian * need to be re-primed. */ 911ae8c6e27Sflorian struct iter_hints_stub* stub; 912ae8c6e27Sflorian struct delegpt* stub_dp; 913ae8c6e27Sflorian struct module_qstate* subq; 914ae8c6e27Sflorian 915ae8c6e27Sflorian if(!qname) return 0; 916ae8c6e27Sflorian stub = hints_lookup_stub(qstate->env->hints, qname, qclass, iq->dp); 917ae8c6e27Sflorian /* The stub (if there is one) does not need priming. */ 918ae8c6e27Sflorian if(!stub) 919ae8c6e27Sflorian return 0; 920ae8c6e27Sflorian stub_dp = stub->dp; 921ae8c6e27Sflorian /* if we have an auth_zone dp, and stub is equal, don't prime stub 922ae8c6e27Sflorian * yet, unless we want to fallback and avoid the auth_zone */ 923ae8c6e27Sflorian if(!iq->auth_zone_avoid && iq->dp && iq->dp->auth_dp && 924ae8c6e27Sflorian query_dname_compare(iq->dp->name, stub_dp->name) == 0) 925ae8c6e27Sflorian return 0; 926ae8c6e27Sflorian 927ae8c6e27Sflorian /* is it a noprime stub (always use) */ 928ae8c6e27Sflorian if(stub->noprime) { 929ae8c6e27Sflorian int r = 0; 930ae8c6e27Sflorian if(iq->dp == NULL) r = 2; 931ae8c6e27Sflorian /* copy the dp out of the fixed hints structure, so that 932ae8c6e27Sflorian * it can be changed when servicing this query */ 933ae8c6e27Sflorian iq->dp = delegpt_copy(stub_dp, qstate->region); 934ae8c6e27Sflorian if(!iq->dp) { 935ae8c6e27Sflorian log_err("out of memory priming stub"); 936ae8c6e27Sflorian errinf(qstate, "malloc failure, priming stub"); 937ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 938ae8c6e27Sflorian return 1; /* return 1 to make module stop, with error */ 939ae8c6e27Sflorian } 940ae8c6e27Sflorian log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 941ae8c6e27Sflorian LDNS_RR_TYPE_NS, qclass); 942ae8c6e27Sflorian return r; 943ae8c6e27Sflorian } 944ae8c6e27Sflorian 945ae8c6e27Sflorian /* Otherwise, we need to (re)prime the stub. */ 946ae8c6e27Sflorian log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name, 947ae8c6e27Sflorian LDNS_RR_TYPE_NS, qclass); 948ae8c6e27Sflorian 949ae8c6e27Sflorian /* Stub priming events start at the QUERYTARGETS state to avoid the 950ae8c6e27Sflorian * redundant INIT state processing. */ 951ae8c6e27Sflorian if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 952ae8c6e27Sflorian LDNS_RR_TYPE_NS, qclass, qstate, id, iq, 9535a7d75e6Ssthen QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0, 0)) { 954ae8c6e27Sflorian verbose(VERB_ALGO, "could not prime stub"); 955ae8c6e27Sflorian errinf(qstate, "could not generate lookup for stub prime"); 956ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 957ae8c6e27Sflorian return 1; /* return 1 to make module stop, with error */ 958ae8c6e27Sflorian } 959ae8c6e27Sflorian if(subq) { 960ae8c6e27Sflorian struct iter_qstate* subiq = 961ae8c6e27Sflorian (struct iter_qstate*)subq->minfo[id]; 962ae8c6e27Sflorian 963ae8c6e27Sflorian /* Set the initial delegation point to the hint. */ 964ae8c6e27Sflorian /* make copy to avoid use of stub dp by different qs/threads */ 965ae8c6e27Sflorian subiq->dp = delegpt_copy(stub_dp, subq->region); 966ae8c6e27Sflorian if(!subiq->dp) { 967ae8c6e27Sflorian log_err("out of memory priming stub, copydp"); 968ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_kill_sub( 969ae8c6e27Sflorian qstate->env->kill_sub)); 970ae8c6e27Sflorian (*qstate->env->kill_sub)(subq); 971ae8c6e27Sflorian errinf(qstate, "malloc failure, in stub prime"); 972ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 973ae8c6e27Sflorian return 1; /* return 1 to make module stop, with error */ 974ae8c6e27Sflorian } 975ae8c6e27Sflorian /* there should not be any target queries -- although there 976ae8c6e27Sflorian * wouldn't be anyway, since stub hints never have 977ae8c6e27Sflorian * missing targets. */ 978ae8c6e27Sflorian subiq->num_target_queries = 0; 979ae8c6e27Sflorian subiq->wait_priming_stub = 1; 980ae8c6e27Sflorian subiq->dnssec_expected = iter_indicates_dnssec( 981ae8c6e27Sflorian qstate->env, subiq->dp, NULL, subq->qinfo.qclass); 982ae8c6e27Sflorian } 983ae8c6e27Sflorian 984ae8c6e27Sflorian /* this module stops, our submodule starts, and does the query. */ 985ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 986ae8c6e27Sflorian return 1; 987ae8c6e27Sflorian } 988ae8c6e27Sflorian 989ae8c6e27Sflorian /** 990ae8c6e27Sflorian * Generate a delegation point for an auth zone (unless cached dp is better) 991ae8c6e27Sflorian * false on alloc failure. 992ae8c6e27Sflorian */ 993ae8c6e27Sflorian static int 994ae8c6e27Sflorian auth_zone_delegpt(struct module_qstate* qstate, struct iter_qstate* iq, 995ae8c6e27Sflorian uint8_t* delname, size_t delnamelen) 996ae8c6e27Sflorian { 997ae8c6e27Sflorian struct auth_zone* z; 998ae8c6e27Sflorian if(iq->auth_zone_avoid) 999ae8c6e27Sflorian return 1; 1000ae8c6e27Sflorian if(!delname) { 1001ae8c6e27Sflorian delname = iq->qchase.qname; 1002ae8c6e27Sflorian delnamelen = iq->qchase.qname_len; 1003ae8c6e27Sflorian } 1004ae8c6e27Sflorian lock_rw_rdlock(&qstate->env->auth_zones->lock); 1005ae8c6e27Sflorian z = auth_zones_find_zone(qstate->env->auth_zones, delname, delnamelen, 1006ae8c6e27Sflorian qstate->qinfo.qclass); 1007ae8c6e27Sflorian if(!z) { 1008ae8c6e27Sflorian lock_rw_unlock(&qstate->env->auth_zones->lock); 1009ae8c6e27Sflorian return 1; 1010ae8c6e27Sflorian } 1011ae8c6e27Sflorian lock_rw_rdlock(&z->lock); 1012ae8c6e27Sflorian lock_rw_unlock(&qstate->env->auth_zones->lock); 1013ae8c6e27Sflorian if(z->for_upstream) { 1014ae8c6e27Sflorian if(iq->dp && query_dname_compare(z->name, iq->dp->name) == 0 1015ae8c6e27Sflorian && iq->dp->auth_dp && qstate->blacklist && 1016ae8c6e27Sflorian z->fallback_enabled) { 1017ae8c6e27Sflorian /* cache is blacklisted and fallback, and we 1018ae8c6e27Sflorian * already have an auth_zone dp */ 1019ae8c6e27Sflorian if(verbosity>=VERB_ALGO) { 1020ae8c6e27Sflorian char buf[255+1]; 1021ae8c6e27Sflorian dname_str(z->name, buf); 1022ae8c6e27Sflorian verbose(VERB_ALGO, "auth_zone %s " 1023ae8c6e27Sflorian "fallback because cache blacklisted", 1024ae8c6e27Sflorian buf); 1025ae8c6e27Sflorian } 1026ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1027ae8c6e27Sflorian iq->dp = NULL; 1028ae8c6e27Sflorian return 1; 1029ae8c6e27Sflorian } 1030ae8c6e27Sflorian if(iq->dp==NULL || dname_subdomain_c(z->name, iq->dp->name)) { 1031ae8c6e27Sflorian struct delegpt* dp; 1032ae8c6e27Sflorian if(qstate->blacklist && z->fallback_enabled) { 1033ae8c6e27Sflorian /* cache is blacklisted because of a DNSSEC 1034ae8c6e27Sflorian * validation failure, and the zone allows 1035ae8c6e27Sflorian * fallback to the internet, query there. */ 1036ae8c6e27Sflorian if(verbosity>=VERB_ALGO) { 1037ae8c6e27Sflorian char buf[255+1]; 1038ae8c6e27Sflorian dname_str(z->name, buf); 1039ae8c6e27Sflorian verbose(VERB_ALGO, "auth_zone %s " 1040ae8c6e27Sflorian "fallback because cache blacklisted", 1041ae8c6e27Sflorian buf); 1042ae8c6e27Sflorian } 1043ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1044ae8c6e27Sflorian return 1; 1045ae8c6e27Sflorian } 1046ae8c6e27Sflorian dp = (struct delegpt*)regional_alloc_zero( 1047ae8c6e27Sflorian qstate->region, sizeof(*dp)); 1048ae8c6e27Sflorian if(!dp) { 1049ae8c6e27Sflorian log_err("alloc failure"); 1050ae8c6e27Sflorian if(z->fallback_enabled) { 1051ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1052ae8c6e27Sflorian return 1; /* just fallback */ 1053ae8c6e27Sflorian } 1054ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1055ae8c6e27Sflorian errinf(qstate, "malloc failure"); 1056ae8c6e27Sflorian return 0; 1057ae8c6e27Sflorian } 1058ae8c6e27Sflorian dp->name = regional_alloc_init(qstate->region, 1059ae8c6e27Sflorian z->name, z->namelen); 1060ae8c6e27Sflorian if(!dp->name) { 1061ae8c6e27Sflorian log_err("alloc failure"); 1062ae8c6e27Sflorian if(z->fallback_enabled) { 1063ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1064ae8c6e27Sflorian return 1; /* just fallback */ 1065ae8c6e27Sflorian } 1066ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1067ae8c6e27Sflorian errinf(qstate, "malloc failure"); 1068ae8c6e27Sflorian return 0; 1069ae8c6e27Sflorian } 1070ae8c6e27Sflorian dp->namelen = z->namelen; 1071ae8c6e27Sflorian dp->namelabs = z->namelabs; 1072ae8c6e27Sflorian dp->auth_dp = 1; 1073ae8c6e27Sflorian iq->dp = dp; 1074ae8c6e27Sflorian } 1075ae8c6e27Sflorian } 1076ae8c6e27Sflorian 1077ae8c6e27Sflorian lock_rw_unlock(&z->lock); 1078ae8c6e27Sflorian return 1; 1079ae8c6e27Sflorian } 1080ae8c6e27Sflorian 1081ae8c6e27Sflorian /** 1082ae8c6e27Sflorian * Generate A and AAAA checks for glue that is in-zone for the referral 1083ae8c6e27Sflorian * we just got to obtain authoritative information on the addresses. 1084ae8c6e27Sflorian * 1085ae8c6e27Sflorian * @param qstate: the qtstate that triggered the need to prime. 1086ae8c6e27Sflorian * @param iq: iterator query state. 1087ae8c6e27Sflorian * @param id: module id. 1088ae8c6e27Sflorian */ 1089ae8c6e27Sflorian static void 1090ae8c6e27Sflorian generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, 1091ae8c6e27Sflorian int id) 1092ae8c6e27Sflorian { 1093ae8c6e27Sflorian struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 1094ae8c6e27Sflorian struct module_qstate* subq; 1095ae8c6e27Sflorian size_t i; 1096ae8c6e27Sflorian struct reply_info* rep = iq->response->rep; 1097ae8c6e27Sflorian struct ub_packed_rrset_key* s; 1098ae8c6e27Sflorian log_assert(iq->dp); 1099ae8c6e27Sflorian 1100ae8c6e27Sflorian if(iq->depth == ie->max_dependency_depth) 1101ae8c6e27Sflorian return; 1102ae8c6e27Sflorian /* walk through additional, and check if in-zone, 1103ae8c6e27Sflorian * only relevant A, AAAA are left after scrub anyway */ 1104ae8c6e27Sflorian for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) { 1105ae8c6e27Sflorian s = rep->rrsets[i]; 1106ae8c6e27Sflorian /* check *ALL* addresses that are transmitted in additional*/ 1107ae8c6e27Sflorian /* is it an address ? */ 1108ae8c6e27Sflorian if( !(ntohs(s->rk.type)==LDNS_RR_TYPE_A || 1109ae8c6e27Sflorian ntohs(s->rk.type)==LDNS_RR_TYPE_AAAA)) { 1110ae8c6e27Sflorian continue; 1111ae8c6e27Sflorian } 1112ae8c6e27Sflorian /* is this query the same as the A/AAAA check for it */ 1113ae8c6e27Sflorian if(qstate->qinfo.qtype == ntohs(s->rk.type) && 1114ae8c6e27Sflorian qstate->qinfo.qclass == ntohs(s->rk.rrset_class) && 1115ae8c6e27Sflorian query_dname_compare(qstate->qinfo.qname, 1116ae8c6e27Sflorian s->rk.dname)==0 && 1117ae8c6e27Sflorian (qstate->query_flags&BIT_RD) && 1118ae8c6e27Sflorian !(qstate->query_flags&BIT_CD)) 1119ae8c6e27Sflorian continue; 1120ae8c6e27Sflorian 1121ae8c6e27Sflorian /* generate subrequest for it */ 1122ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "schedule addr fetch", 1123ae8c6e27Sflorian s->rk.dname, ntohs(s->rk.type), 1124ae8c6e27Sflorian ntohs(s->rk.rrset_class)); 1125ae8c6e27Sflorian if(!generate_sub_request(s->rk.dname, s->rk.dname_len, 1126ae8c6e27Sflorian ntohs(s->rk.type), ntohs(s->rk.rrset_class), 1127ae8c6e27Sflorian qstate, id, iq, 11285a7d75e6Ssthen INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) { 1129ae8c6e27Sflorian verbose(VERB_ALGO, "could not generate addr check"); 1130ae8c6e27Sflorian return; 1131ae8c6e27Sflorian } 1132ae8c6e27Sflorian /* ignore subq - not need for more init */ 1133ae8c6e27Sflorian } 1134ae8c6e27Sflorian } 1135ae8c6e27Sflorian 1136ae8c6e27Sflorian /** 1137ae8c6e27Sflorian * Generate a NS check request to obtain authoritative information 1138ae8c6e27Sflorian * on an NS rrset. 1139ae8c6e27Sflorian * 1140ae8c6e27Sflorian * @param qstate: the qtstate that triggered the need to prime. 1141ae8c6e27Sflorian * @param iq: iterator query state. 1142ae8c6e27Sflorian * @param id: module id. 1143ae8c6e27Sflorian */ 1144ae8c6e27Sflorian static void 1145ae8c6e27Sflorian generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id) 1146ae8c6e27Sflorian { 1147ae8c6e27Sflorian struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 1148ae8c6e27Sflorian struct module_qstate* subq; 1149ae8c6e27Sflorian log_assert(iq->dp); 1150ae8c6e27Sflorian 1151ae8c6e27Sflorian if(iq->depth == ie->max_dependency_depth) 1152ae8c6e27Sflorian return; 1153ae8c6e27Sflorian if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, 1154ae8c6e27Sflorian iq->qchase.qclass, NULL)) 1155ae8c6e27Sflorian return; 1156ae8c6e27Sflorian /* is this query the same as the nscheck? */ 1157ae8c6e27Sflorian if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS && 1158ae8c6e27Sflorian query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 && 1159ae8c6e27Sflorian (qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){ 1160ae8c6e27Sflorian /* spawn off A, AAAA queries for in-zone glue to check */ 1161ae8c6e27Sflorian generate_a_aaaa_check(qstate, iq, id); 1162ae8c6e27Sflorian return; 1163ae8c6e27Sflorian } 1164ae8c6e27Sflorian /* no need to get the NS record for DS, it is above the zonecut */ 1165ae8c6e27Sflorian if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) 1166ae8c6e27Sflorian return; 1167ae8c6e27Sflorian 1168ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "schedule ns fetch", 1169ae8c6e27Sflorian iq->dp->name, LDNS_RR_TYPE_NS, iq->qchase.qclass); 1170ae8c6e27Sflorian if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 1171ae8c6e27Sflorian LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq, 11725a7d75e6Ssthen INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) { 1173ae8c6e27Sflorian verbose(VERB_ALGO, "could not generate ns check"); 1174ae8c6e27Sflorian return; 1175ae8c6e27Sflorian } 1176ae8c6e27Sflorian if(subq) { 1177ae8c6e27Sflorian struct iter_qstate* subiq = 1178ae8c6e27Sflorian (struct iter_qstate*)subq->minfo[id]; 1179ae8c6e27Sflorian 1180ae8c6e27Sflorian /* make copy to avoid use of stub dp by different qs/threads */ 1181ae8c6e27Sflorian /* refetch glue to start higher up the tree */ 1182ae8c6e27Sflorian subiq->refetch_glue = 1; 1183ae8c6e27Sflorian subiq->dp = delegpt_copy(iq->dp, subq->region); 1184ae8c6e27Sflorian if(!subiq->dp) { 1185ae8c6e27Sflorian log_err("out of memory generating ns check, copydp"); 1186ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_kill_sub( 1187ae8c6e27Sflorian qstate->env->kill_sub)); 1188ae8c6e27Sflorian (*qstate->env->kill_sub)(subq); 1189ae8c6e27Sflorian return; 1190ae8c6e27Sflorian } 1191ae8c6e27Sflorian } 1192ae8c6e27Sflorian } 1193ae8c6e27Sflorian 1194ae8c6e27Sflorian /** 1195ae8c6e27Sflorian * Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we 1196ae8c6e27Sflorian * just got in a referral (where we have dnssec_expected, thus have trust 1197ae8c6e27Sflorian * anchors above it). Note that right after calling this routine the 1198ae8c6e27Sflorian * iterator detached subqueries (because of following the referral), and thus 1199ae8c6e27Sflorian * the DNSKEY query becomes detached, its return stored in the cache for 1200ae8c6e27Sflorian * later lookup by the validator. This cache lookup by the validator avoids 1201ae8c6e27Sflorian * the roundtrip incurred by the DNSKEY query. The DNSKEY query is now 1202ae8c6e27Sflorian * performed at about the same time the original query is sent to the domain, 1203ae8c6e27Sflorian * thus the two answers are likely to be returned at about the same time, 1204ae8c6e27Sflorian * saving a roundtrip from the validated lookup. 1205ae8c6e27Sflorian * 1206ae8c6e27Sflorian * @param qstate: the qtstate that triggered the need to prime. 1207ae8c6e27Sflorian * @param iq: iterator query state. 1208ae8c6e27Sflorian * @param id: module id. 1209ae8c6e27Sflorian */ 1210ae8c6e27Sflorian static void 1211ae8c6e27Sflorian generate_dnskey_prefetch(struct module_qstate* qstate, 1212ae8c6e27Sflorian struct iter_qstate* iq, int id) 1213ae8c6e27Sflorian { 1214ae8c6e27Sflorian struct module_qstate* subq; 1215ae8c6e27Sflorian log_assert(iq->dp); 1216ae8c6e27Sflorian 1217ae8c6e27Sflorian /* is this query the same as the prefetch? */ 1218ae8c6e27Sflorian if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY && 1219ae8c6e27Sflorian query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 && 1220ae8c6e27Sflorian (qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){ 1221ae8c6e27Sflorian return; 1222ae8c6e27Sflorian } 1223ab256815Sflorian /* we do not generate this prefetch when the query list is full, 1224ab256815Sflorian * the query is fetched, if needed, when the validator wants it. 1225ab256815Sflorian * At that time the validator waits for it, after spawning it. 1226ab256815Sflorian * This means there is one state that uses cpu and a socket, the 1227ab256815Sflorian * spawned while this one waits, and not several at the same time, 1228ab256815Sflorian * if we had created the lookup here. And this helps to keep 1229ab256815Sflorian * the total load down, but the query still succeeds to resolve. */ 1230ab256815Sflorian if(mesh_jostle_exceeded(qstate->env->mesh)) 1231ab256815Sflorian return; 1232ae8c6e27Sflorian 1233ae8c6e27Sflorian /* if the DNSKEY is in the cache this lookup will stop quickly */ 1234ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 1235ae8c6e27Sflorian iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass); 1236ae8c6e27Sflorian if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 1237ae8c6e27Sflorian LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq, 12385a7d75e6Ssthen INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) { 1239ae8c6e27Sflorian /* we'll be slower, but it'll work */ 1240ae8c6e27Sflorian verbose(VERB_ALGO, "could not generate dnskey prefetch"); 1241ae8c6e27Sflorian return; 1242ae8c6e27Sflorian } 1243ae8c6e27Sflorian if(subq) { 1244ae8c6e27Sflorian struct iter_qstate* subiq = 1245ae8c6e27Sflorian (struct iter_qstate*)subq->minfo[id]; 1246ae8c6e27Sflorian /* this qstate has the right delegation for the dnskey lookup*/ 1247ae8c6e27Sflorian /* make copy to avoid use of stub dp by different qs/threads */ 1248ae8c6e27Sflorian subiq->dp = delegpt_copy(iq->dp, subq->region); 1249ae8c6e27Sflorian /* if !subiq->dp, it'll start from the cache, no problem */ 1250ae8c6e27Sflorian } 1251ae8c6e27Sflorian } 1252ae8c6e27Sflorian 1253ae8c6e27Sflorian /** 1254ae8c6e27Sflorian * See if the query needs forwarding. 1255ae8c6e27Sflorian * 1256ae8c6e27Sflorian * @param qstate: query state. 1257ae8c6e27Sflorian * @param iq: iterator query state. 1258ae8c6e27Sflorian * @return true if the request is forwarded, false if not. 1259ae8c6e27Sflorian * If returns true but, iq->dp is NULL then a malloc failure occurred. 1260ae8c6e27Sflorian */ 1261ae8c6e27Sflorian static int 1262ae8c6e27Sflorian forward_request(struct module_qstate* qstate, struct iter_qstate* iq) 1263ae8c6e27Sflorian { 1264ae8c6e27Sflorian struct delegpt* dp; 1265ae8c6e27Sflorian uint8_t* delname = iq->qchase.qname; 1266ae8c6e27Sflorian size_t delnamelen = iq->qchase.qname_len; 1267ae8c6e27Sflorian if(iq->refetch_glue && iq->dp) { 1268ae8c6e27Sflorian delname = iq->dp->name; 1269ae8c6e27Sflorian delnamelen = iq->dp->namelen; 1270ae8c6e27Sflorian } 1271ae8c6e27Sflorian /* strip one label off of DS query to lookup higher for it */ 1272ae8c6e27Sflorian if( (iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) 1273ae8c6e27Sflorian && !dname_is_root(iq->qchase.qname)) 1274ae8c6e27Sflorian dname_remove_label(&delname, &delnamelen); 1275ae8c6e27Sflorian dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass); 1276ae8c6e27Sflorian if(!dp) 1277ae8c6e27Sflorian return 0; 1278ae8c6e27Sflorian /* send recursion desired to forward addr */ 1279ae8c6e27Sflorian iq->chase_flags |= BIT_RD; 1280ae8c6e27Sflorian iq->dp = delegpt_copy(dp, qstate->region); 1281ae8c6e27Sflorian /* iq->dp checked by caller */ 1282ae8c6e27Sflorian verbose(VERB_ALGO, "forwarding request"); 1283ae8c6e27Sflorian return 1; 1284ae8c6e27Sflorian } 1285ae8c6e27Sflorian 1286ae8c6e27Sflorian /** 1287ae8c6e27Sflorian * Process the initial part of the request handling. This state roughly 1288ae8c6e27Sflorian * corresponds to resolver algorithms steps 1 (find answer in cache) and 2 1289ae8c6e27Sflorian * (find the best servers to ask). 1290ae8c6e27Sflorian * 1291ae8c6e27Sflorian * Note that all requests start here, and query restarts revisit this state. 1292ae8c6e27Sflorian * 1293ae8c6e27Sflorian * This state either generates: 1) a response, from cache or error, 2) a 1294ae8c6e27Sflorian * priming event, or 3) forwards the request to the next state (init2, 1295ae8c6e27Sflorian * generally). 1296ae8c6e27Sflorian * 1297ae8c6e27Sflorian * @param qstate: query state. 1298ae8c6e27Sflorian * @param iq: iterator query state. 1299ae8c6e27Sflorian * @param ie: iterator shared global environment. 1300ae8c6e27Sflorian * @param id: module id. 1301ae8c6e27Sflorian * @return true if the event needs more request processing immediately, 1302ae8c6e27Sflorian * false if not. 1303ae8c6e27Sflorian */ 1304ae8c6e27Sflorian static int 1305ae8c6e27Sflorian processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, 1306ae8c6e27Sflorian struct iter_env* ie, int id) 1307ae8c6e27Sflorian { 1308411c5950Sflorian uint8_t* delname, *dpname=NULL; 1309411c5950Sflorian size_t delnamelen, dpnamelen=0; 1310ae8c6e27Sflorian struct dns_msg* msg = NULL; 1311ae8c6e27Sflorian 1312ae8c6e27Sflorian log_query_info(VERB_DETAIL, "resolving", &qstate->qinfo); 1313ae8c6e27Sflorian /* check effort */ 1314ae8c6e27Sflorian 1315ae8c6e27Sflorian /* We enforce a maximum number of query restarts. This is primarily a 1316ae8c6e27Sflorian * cheap way to prevent CNAME loops. */ 1317ae8c6e27Sflorian if(iq->query_restart_count > MAX_RESTART_COUNT) { 1318ae8c6e27Sflorian verbose(VERB_QUERY, "request has exceeded the maximum number" 1319ae8c6e27Sflorian " of query restarts with %d", iq->query_restart_count); 1320ae8c6e27Sflorian errinf(qstate, "request has exceeded the maximum number " 1321ae8c6e27Sflorian "restarts (eg. indirections)"); 1322ae8c6e27Sflorian if(iq->qchase.qname) 1323ae8c6e27Sflorian errinf_dname(qstate, "stop at", iq->qchase.qname); 1324ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1325ae8c6e27Sflorian } 1326ae8c6e27Sflorian 1327ae8c6e27Sflorian /* We enforce a maximum recursion/dependency depth -- in general, 1328ae8c6e27Sflorian * this is unnecessary for dependency loops (although it will 1329ae8c6e27Sflorian * catch those), but it provides a sensible limit to the amount 1330ae8c6e27Sflorian * of work required to answer a given query. */ 1331ae8c6e27Sflorian verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth); 1332ae8c6e27Sflorian if(iq->depth > ie->max_dependency_depth) { 1333ae8c6e27Sflorian verbose(VERB_QUERY, "request has exceeded the maximum " 1334ae8c6e27Sflorian "dependency depth with depth of %d", iq->depth); 1335ae8c6e27Sflorian errinf(qstate, "request has exceeded the maximum dependency " 1336ae8c6e27Sflorian "depth (eg. nameserver lookup recursion)"); 1337ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1338ae8c6e27Sflorian } 1339ae8c6e27Sflorian 1340ae8c6e27Sflorian /* If the request is qclass=ANY, setup to generate each class */ 1341ae8c6e27Sflorian if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) { 1342ae8c6e27Sflorian iq->qchase.qclass = 0; 1343ae8c6e27Sflorian return next_state(iq, COLLECT_CLASS_STATE); 1344ae8c6e27Sflorian } 1345ae8c6e27Sflorian 1346ae8c6e27Sflorian /* 1347ae8c6e27Sflorian * If we are restricted by a forward-zone or a stub-zone, we 1348ae8c6e27Sflorian * can't re-fetch glue for this delegation point. 1349ae8c6e27Sflorian * we won’t try to re-fetch glue if the iq->dp is null. 1350ae8c6e27Sflorian */ 1351ae8c6e27Sflorian if (iq->refetch_glue && 1352ae8c6e27Sflorian iq->dp && 1353ae8c6e27Sflorian !can_have_last_resort(qstate->env, iq->dp->name, 1354ae8c6e27Sflorian iq->dp->namelen, iq->qchase.qclass, NULL)) { 1355ae8c6e27Sflorian iq->refetch_glue = 0; 1356ae8c6e27Sflorian } 1357ae8c6e27Sflorian 1358ae8c6e27Sflorian /* Resolver Algorithm Step 1 -- Look for the answer in local data. */ 1359ae8c6e27Sflorian 1360ae8c6e27Sflorian /* This either results in a query restart (CNAME cache response), a 1361ae8c6e27Sflorian * terminating response (ANSWER), or a cache miss (null). */ 1362ae8c6e27Sflorian 1363411c5950Sflorian if (iter_stub_fwd_no_cache(qstate, &iq->qchase, &dpname, &dpnamelen)) { 1364ae8c6e27Sflorian /* Asked to not query cache. */ 1365ae8c6e27Sflorian verbose(VERB_ALGO, "no-cache set, going to the network"); 1366ae8c6e27Sflorian qstate->no_cache_lookup = 1; 1367ae8c6e27Sflorian qstate->no_cache_store = 1; 1368ae8c6e27Sflorian msg = NULL; 1369ae8c6e27Sflorian } else if(qstate->blacklist) { 1370ae8c6e27Sflorian /* if cache, or anything else, was blacklisted then 1371ae8c6e27Sflorian * getting older results from cache is a bad idea, no cache */ 1372ae8c6e27Sflorian verbose(VERB_ALGO, "cache blacklisted, going to the network"); 1373ae8c6e27Sflorian msg = NULL; 1374ae8c6e27Sflorian } else if(!qstate->no_cache_lookup) { 1375ae8c6e27Sflorian msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 1376ae8c6e27Sflorian iq->qchase.qname_len, iq->qchase.qtype, 1377ae8c6e27Sflorian iq->qchase.qclass, qstate->query_flags, 1378411c5950Sflorian qstate->region, qstate->env->scratch, 0, dpname, 1379411c5950Sflorian dpnamelen); 1380ae8c6e27Sflorian if(!msg && qstate->env->neg_cache && 1381ae8c6e27Sflorian iter_qname_indicates_dnssec(qstate->env, &iq->qchase)) { 1382ae8c6e27Sflorian /* lookup in negative cache; may result in 1383ae8c6e27Sflorian * NOERROR/NODATA or NXDOMAIN answers that need validation */ 1384ae8c6e27Sflorian msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase, 1385ae8c6e27Sflorian qstate->region, qstate->env->rrset_cache, 1386ae8c6e27Sflorian qstate->env->scratch_buffer, 1387ae8c6e27Sflorian *qstate->env->now, 1/*add SOA*/, NULL, 1388ae8c6e27Sflorian qstate->env->cfg); 1389ae8c6e27Sflorian } 1390ae8c6e27Sflorian /* item taken from cache does not match our query name, thus 1391ae8c6e27Sflorian * security needs to be re-examined later */ 1392ae8c6e27Sflorian if(msg && query_dname_compare(qstate->qinfo.qname, 1393ae8c6e27Sflorian iq->qchase.qname) != 0) 1394ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 1395ae8c6e27Sflorian } 1396ae8c6e27Sflorian if(msg) { 1397ae8c6e27Sflorian /* handle positive cache response */ 1398ae8c6e27Sflorian enum response_type type = response_type_from_cache(msg, 1399ae8c6e27Sflorian &iq->qchase); 1400ae8c6e27Sflorian if(verbosity >= VERB_ALGO) { 1401ae8c6e27Sflorian log_dns_msg("msg from cache lookup", &msg->qinfo, 1402ae8c6e27Sflorian msg->rep); 1403ae8c6e27Sflorian verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d", 1404ae8c6e27Sflorian (int)msg->rep->ttl, 1405ae8c6e27Sflorian (int)msg->rep->prefetch_ttl); 1406ae8c6e27Sflorian } 1407ae8c6e27Sflorian 1408ae8c6e27Sflorian if(type == RESPONSE_TYPE_CNAME) { 1409ae8c6e27Sflorian uint8_t* sname = 0; 1410ae8c6e27Sflorian size_t slen = 0; 1411ae8c6e27Sflorian verbose(VERB_ALGO, "returning CNAME response from " 1412ae8c6e27Sflorian "cache"); 1413ae8c6e27Sflorian if(!handle_cname_response(qstate, iq, msg, 1414ae8c6e27Sflorian &sname, &slen)) { 1415ae8c6e27Sflorian errinf(qstate, "failed to prepend CNAME " 1416ae8c6e27Sflorian "components, malloc failure"); 1417ae8c6e27Sflorian return error_response(qstate, id, 1418ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1419ae8c6e27Sflorian } 1420ae8c6e27Sflorian iq->qchase.qname = sname; 1421ae8c6e27Sflorian iq->qchase.qname_len = slen; 1422ae8c6e27Sflorian /* This *is* a query restart, even if it is a cheap 1423ae8c6e27Sflorian * one. */ 1424ae8c6e27Sflorian iq->dp = NULL; 1425ae8c6e27Sflorian iq->refetch_glue = 0; 1426ae8c6e27Sflorian iq->query_restart_count++; 1427ae8c6e27Sflorian iq->sent_count = 0; 14285a7d75e6Ssthen iq->dp_target_count = 0; 1429ae8c6e27Sflorian sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1430ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) 1431ae8c6e27Sflorian iq->minimisation_state = INIT_MINIMISE_STATE; 1432ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_STATE); 1433ae8c6e27Sflorian } 1434ae8c6e27Sflorian 1435ae8c6e27Sflorian /* if from cache, NULL, else insert 'cache IP' len=0 */ 1436ae8c6e27Sflorian if(qstate->reply_origin) 1437ae8c6e27Sflorian sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1438ae8c6e27Sflorian if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_SERVFAIL) 1439ae8c6e27Sflorian errinf(qstate, "SERVFAIL in cache"); 1440ae8c6e27Sflorian /* it is an answer, response, to final state */ 1441ae8c6e27Sflorian verbose(VERB_ALGO, "returning answer from cache."); 1442ae8c6e27Sflorian iq->response = msg; 1443ae8c6e27Sflorian return final_state(iq); 1444ae8c6e27Sflorian } 1445ae8c6e27Sflorian 1446ae8c6e27Sflorian /* attempt to forward the request */ 1447ae8c6e27Sflorian if(forward_request(qstate, iq)) 1448ae8c6e27Sflorian { 1449ae8c6e27Sflorian if(!iq->dp) { 1450ae8c6e27Sflorian log_err("alloc failure for forward dp"); 1451ae8c6e27Sflorian errinf(qstate, "malloc failure for forward zone"); 1452ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1453ae8c6e27Sflorian } 1454ae8c6e27Sflorian iq->refetch_glue = 0; 1455ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 1456ae8c6e27Sflorian /* the request has been forwarded. 1457ae8c6e27Sflorian * forwarded requests need to be immediately sent to the 1458ae8c6e27Sflorian * next state, QUERYTARGETS. */ 1459ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 1460ae8c6e27Sflorian } 1461ae8c6e27Sflorian 1462ae8c6e27Sflorian /* Resolver Algorithm Step 2 -- find the "best" servers. */ 1463ae8c6e27Sflorian 1464ae8c6e27Sflorian /* first, adjust for DS queries. To avoid the grandparent problem, 1465ae8c6e27Sflorian * we just look for the closest set of server to the parent of qname. 1466ae8c6e27Sflorian * When re-fetching glue we also need to ask the parent. 1467ae8c6e27Sflorian */ 1468ae8c6e27Sflorian if(iq->refetch_glue) { 1469ae8c6e27Sflorian if(!iq->dp) { 1470ae8c6e27Sflorian log_err("internal or malloc fail: no dp for refetch"); 1471ae8c6e27Sflorian errinf(qstate, "malloc failure, for delegation info"); 1472ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1473ae8c6e27Sflorian } 1474ae8c6e27Sflorian delname = iq->dp->name; 1475ae8c6e27Sflorian delnamelen = iq->dp->namelen; 1476ae8c6e27Sflorian } else { 1477ae8c6e27Sflorian delname = iq->qchase.qname; 1478ae8c6e27Sflorian delnamelen = iq->qchase.qname_len; 1479ae8c6e27Sflorian } 1480ae8c6e27Sflorian if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue || 1481ae8c6e27Sflorian (iq->qchase.qtype == LDNS_RR_TYPE_NS && qstate->prefetch_leeway 1482ae8c6e27Sflorian && can_have_last_resort(qstate->env, delname, delnamelen, iq->qchase.qclass, NULL))) { 1483ae8c6e27Sflorian /* remove first label from delname, root goes to hints, 1484ae8c6e27Sflorian * but only to fetch glue, not for qtype=DS. */ 1485ae8c6e27Sflorian /* also when prefetching an NS record, fetch it again from 1486ae8c6e27Sflorian * its parent, just as if it expired, so that you do not 1487ae8c6e27Sflorian * get stuck on an older nameserver that gives old NSrecords */ 1488ae8c6e27Sflorian if(dname_is_root(delname) && (iq->refetch_glue || 1489ae8c6e27Sflorian (iq->qchase.qtype == LDNS_RR_TYPE_NS && 1490ae8c6e27Sflorian qstate->prefetch_leeway))) 1491ae8c6e27Sflorian delname = NULL; /* go to root priming */ 1492ae8c6e27Sflorian else dname_remove_label(&delname, &delnamelen); 1493ae8c6e27Sflorian } 1494ae8c6e27Sflorian /* delname is the name to lookup a delegation for. If NULL rootprime */ 1495ae8c6e27Sflorian while(1) { 1496ae8c6e27Sflorian 1497ae8c6e27Sflorian /* Lookup the delegation in the cache. If null, then the 1498ae8c6e27Sflorian * cache needs to be primed for the qclass. */ 1499ae8c6e27Sflorian if(delname) 1500ae8c6e27Sflorian iq->dp = dns_cache_find_delegation(qstate->env, delname, 1501ae8c6e27Sflorian delnamelen, iq->qchase.qtype, iq->qchase.qclass, 1502ae8c6e27Sflorian qstate->region, &iq->deleg_msg, 15036d08cb1bSflorian *qstate->env->now+qstate->prefetch_leeway, 1, 15046d08cb1bSflorian dpname, dpnamelen); 1505ae8c6e27Sflorian else iq->dp = NULL; 1506ae8c6e27Sflorian 1507ae8c6e27Sflorian /* If the cache has returned nothing, then we have a 1508ae8c6e27Sflorian * root priming situation. */ 1509ae8c6e27Sflorian if(iq->dp == NULL) { 1510ae8c6e27Sflorian int r; 1511ae8c6e27Sflorian /* if under auth zone, no prime needed */ 1512ae8c6e27Sflorian if(!auth_zone_delegpt(qstate, iq, delname, delnamelen)) 1513ae8c6e27Sflorian return error_response(qstate, id, 1514ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1515ae8c6e27Sflorian if(iq->dp) /* use auth zone dp */ 1516ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_2_STATE); 1517ae8c6e27Sflorian /* if there is a stub, then no root prime needed */ 1518ae8c6e27Sflorian r = prime_stub(qstate, iq, id, delname, 1519ae8c6e27Sflorian iq->qchase.qclass); 1520ae8c6e27Sflorian if(r == 2) 1521ae8c6e27Sflorian break; /* got noprime-stub-zone, continue */ 1522ae8c6e27Sflorian else if(r) 1523ae8c6e27Sflorian return 0; /* stub prime request made */ 1524ae8c6e27Sflorian if(forwards_lookup_root(qstate->env->fwds, 1525ae8c6e27Sflorian iq->qchase.qclass)) { 1526ae8c6e27Sflorian /* forward zone root, no root prime needed */ 1527ae8c6e27Sflorian /* fill in some dp - safety belt */ 1528ae8c6e27Sflorian iq->dp = hints_lookup_root(qstate->env->hints, 1529ae8c6e27Sflorian iq->qchase.qclass); 1530ae8c6e27Sflorian if(!iq->dp) { 1531ae8c6e27Sflorian log_err("internal error: no hints dp"); 1532ae8c6e27Sflorian errinf(qstate, "no hints for this class"); 1533ae8c6e27Sflorian return error_response(qstate, id, 1534ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1535ae8c6e27Sflorian } 1536ae8c6e27Sflorian iq->dp = delegpt_copy(iq->dp, qstate->region); 1537ae8c6e27Sflorian if(!iq->dp) { 1538ae8c6e27Sflorian log_err("out of memory in safety belt"); 1539ae8c6e27Sflorian errinf(qstate, "malloc failure, in safety belt"); 1540ae8c6e27Sflorian return error_response(qstate, id, 1541ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1542ae8c6e27Sflorian } 1543ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_2_STATE); 1544ae8c6e27Sflorian } 1545ae8c6e27Sflorian /* Note that the result of this will set a new 1546ae8c6e27Sflorian * DelegationPoint based on the result of priming. */ 1547ae8c6e27Sflorian if(!prime_root(qstate, iq, id, iq->qchase.qclass)) 1548ae8c6e27Sflorian return error_response(qstate, id, 1549ae8c6e27Sflorian LDNS_RCODE_REFUSED); 1550ae8c6e27Sflorian 1551ae8c6e27Sflorian /* priming creates and sends a subordinate query, with 1552ae8c6e27Sflorian * this query as the parent. So further processing for 1553ae8c6e27Sflorian * this event will stop until reactivated by the 1554ae8c6e27Sflorian * results of priming. */ 1555ae8c6e27Sflorian return 0; 1556ae8c6e27Sflorian } 1557ae8c6e27Sflorian if(!iq->ratelimit_ok && qstate->prefetch_leeway) 1558ae8c6e27Sflorian iq->ratelimit_ok = 1; /* allow prefetches, this keeps 1559ae8c6e27Sflorian otherwise valid data in the cache */ 1560ae8c6e27Sflorian 1561ae8c6e27Sflorian /* see if this dp not useless. 1562ae8c6e27Sflorian * It is useless if: 1563ae8c6e27Sflorian * o all NS items are required glue. 1564ae8c6e27Sflorian * or the query is for NS item that is required glue. 1565ae8c6e27Sflorian * o no addresses are provided. 1566ae8c6e27Sflorian * o RD qflag is on. 1567ae8c6e27Sflorian * Instead, go up one level, and try to get even further 1568ae8c6e27Sflorian * If the root was useless, use safety belt information. 1569ae8c6e27Sflorian * Only check cache returns, because replies for servers 1570ae8c6e27Sflorian * could be useless but lead to loops (bumping into the 1571ae8c6e27Sflorian * same server reply) if useless-checked. 1572ae8c6e27Sflorian */ 1573ae8c6e27Sflorian if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, 15747a05b9dfSflorian iq->dp, ie->supports_ipv4, ie->supports_ipv6)) { 1575ae8c6e27Sflorian struct delegpt* retdp = NULL; 1576ae8c6e27Sflorian if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) { 1577ae8c6e27Sflorian if(retdp) { 1578ae8c6e27Sflorian verbose(VERB_QUERY, "cache has stub " 1579ae8c6e27Sflorian "or fwd but no addresses, " 1580ae8c6e27Sflorian "fallback to config"); 1581ae8c6e27Sflorian iq->dp = delegpt_copy(retdp, 1582ae8c6e27Sflorian qstate->region); 1583ae8c6e27Sflorian if(!iq->dp) { 1584ae8c6e27Sflorian log_err("out of memory in " 1585ae8c6e27Sflorian "stub/fwd fallback"); 1586ae8c6e27Sflorian errinf(qstate, "malloc failure, for fallback to config"); 1587ae8c6e27Sflorian return error_response(qstate, 1588ae8c6e27Sflorian id, LDNS_RCODE_SERVFAIL); 1589ae8c6e27Sflorian } 1590ae8c6e27Sflorian break; 1591ae8c6e27Sflorian } 1592ae8c6e27Sflorian verbose(VERB_ALGO, "useless dp " 1593ae8c6e27Sflorian "but cannot go up, servfail"); 1594ae8c6e27Sflorian delegpt_log(VERB_ALGO, iq->dp); 1595ae8c6e27Sflorian errinf(qstate, "no useful nameservers, " 1596ae8c6e27Sflorian "and cannot go up"); 1597ae8c6e27Sflorian errinf_dname(qstate, "for zone", iq->dp->name); 1598ae8c6e27Sflorian return error_response(qstate, id, 1599ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1600ae8c6e27Sflorian } 1601ae8c6e27Sflorian if(dname_is_root(iq->dp->name)) { 1602ae8c6e27Sflorian /* use safety belt */ 1603ae8c6e27Sflorian verbose(VERB_QUERY, "Cache has root NS but " 1604ae8c6e27Sflorian "no addresses. Fallback to the safety belt."); 1605ae8c6e27Sflorian iq->dp = hints_lookup_root(qstate->env->hints, 1606ae8c6e27Sflorian iq->qchase.qclass); 1607ae8c6e27Sflorian /* note deleg_msg is from previous lookup, 1608ae8c6e27Sflorian * but RD is on, so it is not used */ 1609ae8c6e27Sflorian if(!iq->dp) { 1610ae8c6e27Sflorian log_err("internal error: no hints dp"); 1611ae8c6e27Sflorian return error_response(qstate, id, 1612ae8c6e27Sflorian LDNS_RCODE_REFUSED); 1613ae8c6e27Sflorian } 1614ae8c6e27Sflorian iq->dp = delegpt_copy(iq->dp, qstate->region); 1615ae8c6e27Sflorian if(!iq->dp) { 1616ae8c6e27Sflorian log_err("out of memory in safety belt"); 1617ae8c6e27Sflorian errinf(qstate, "malloc failure, in safety belt, for root"); 1618ae8c6e27Sflorian return error_response(qstate, id, 1619ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 1620ae8c6e27Sflorian } 1621ae8c6e27Sflorian break; 1622ae8c6e27Sflorian } else { 1623ae8c6e27Sflorian verbose(VERB_ALGO, 1624ae8c6e27Sflorian "cache delegation was useless:"); 1625ae8c6e27Sflorian delegpt_log(VERB_ALGO, iq->dp); 1626ae8c6e27Sflorian /* go up */ 1627ae8c6e27Sflorian delname = iq->dp->name; 1628ae8c6e27Sflorian delnamelen = iq->dp->namelen; 1629ae8c6e27Sflorian dname_remove_label(&delname, &delnamelen); 1630ae8c6e27Sflorian } 1631ae8c6e27Sflorian } else break; 1632ae8c6e27Sflorian } 1633ae8c6e27Sflorian 1634ae8c6e27Sflorian verbose(VERB_ALGO, "cache delegation returns delegpt"); 1635ae8c6e27Sflorian delegpt_log(VERB_ALGO, iq->dp); 1636ae8c6e27Sflorian 1637ae8c6e27Sflorian /* Otherwise, set the current delegation point and move on to the 1638ae8c6e27Sflorian * next state. */ 1639ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_2_STATE); 1640ae8c6e27Sflorian } 1641ae8c6e27Sflorian 1642ae8c6e27Sflorian /** 1643ae8c6e27Sflorian * Process the second part of the initial request handling. This state 1644ae8c6e27Sflorian * basically exists so that queries that generate root priming events have 1645ae8c6e27Sflorian * the same init processing as ones that do not. Request events that reach 1646ae8c6e27Sflorian * this state must have a valid currentDelegationPoint set. 1647ae8c6e27Sflorian * 1648ae8c6e27Sflorian * This part is primarily handling stub zone priming. Events that reach this 1649ae8c6e27Sflorian * state must have a current delegation point. 1650ae8c6e27Sflorian * 1651ae8c6e27Sflorian * @param qstate: query state. 1652ae8c6e27Sflorian * @param iq: iterator query state. 1653ae8c6e27Sflorian * @param id: module id. 1654ae8c6e27Sflorian * @return true if the event needs more request processing immediately, 1655ae8c6e27Sflorian * false if not. 1656ae8c6e27Sflorian */ 1657ae8c6e27Sflorian static int 1658ae8c6e27Sflorian processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq, 1659ae8c6e27Sflorian int id) 1660ae8c6e27Sflorian { 1661ae8c6e27Sflorian uint8_t* delname; 1662ae8c6e27Sflorian size_t delnamelen; 1663ae8c6e27Sflorian log_query_info(VERB_QUERY, "resolving (init part 2): ", 1664ae8c6e27Sflorian &qstate->qinfo); 1665ae8c6e27Sflorian 1666ae8c6e27Sflorian delname = iq->qchase.qname; 1667ae8c6e27Sflorian delnamelen = iq->qchase.qname_len; 1668ae8c6e27Sflorian if(iq->refetch_glue) { 1669ae8c6e27Sflorian struct iter_hints_stub* stub; 1670ae8c6e27Sflorian if(!iq->dp) { 1671ae8c6e27Sflorian log_err("internal or malloc fail: no dp for refetch"); 1672ae8c6e27Sflorian errinf(qstate, "malloc failure, no delegation info"); 1673ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1674ae8c6e27Sflorian } 1675ae8c6e27Sflorian /* Do not send queries above stub, do not set delname to dp if 1676ae8c6e27Sflorian * this is above stub without stub-first. */ 1677ae8c6e27Sflorian stub = hints_lookup_stub( 1678ae8c6e27Sflorian qstate->env->hints, iq->qchase.qname, iq->qchase.qclass, 1679ae8c6e27Sflorian iq->dp); 1680ae8c6e27Sflorian if(!stub || !stub->dp->has_parent_side_NS || 1681ae8c6e27Sflorian dname_subdomain_c(iq->dp->name, stub->dp->name)) { 1682ae8c6e27Sflorian delname = iq->dp->name; 1683ae8c6e27Sflorian delnamelen = iq->dp->namelen; 1684ae8c6e27Sflorian } 1685ae8c6e27Sflorian } 1686ae8c6e27Sflorian if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) { 1687ae8c6e27Sflorian if(!dname_is_root(delname)) 1688ae8c6e27Sflorian dname_remove_label(&delname, &delnamelen); 1689ae8c6e27Sflorian iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */ 1690ae8c6e27Sflorian } 1691ae8c6e27Sflorian 1692ae8c6e27Sflorian /* see if we have an auth zone to answer from, improves dp from cache 1693ae8c6e27Sflorian * (if any dp from cache) with auth zone dp, if that is lower */ 1694ae8c6e27Sflorian if(!auth_zone_delegpt(qstate, iq, delname, delnamelen)) 1695ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 1696ae8c6e27Sflorian 1697ae8c6e27Sflorian /* Check to see if we need to prime a stub zone. */ 1698ae8c6e27Sflorian if(prime_stub(qstate, iq, id, delname, iq->qchase.qclass)) { 1699ae8c6e27Sflorian /* A priming sub request was made */ 1700ae8c6e27Sflorian return 0; 1701ae8c6e27Sflorian } 1702ae8c6e27Sflorian 1703ae8c6e27Sflorian /* most events just get forwarded to the next state. */ 1704ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_3_STATE); 1705ae8c6e27Sflorian } 1706ae8c6e27Sflorian 1707ae8c6e27Sflorian /** 1708ae8c6e27Sflorian * Process the third part of the initial request handling. This state exists 1709ae8c6e27Sflorian * as a separate state so that queries that generate stub priming events 1710ae8c6e27Sflorian * will get the tail end of the init process but not repeat the stub priming 1711ae8c6e27Sflorian * check. 1712ae8c6e27Sflorian * 1713ae8c6e27Sflorian * @param qstate: query state. 1714ae8c6e27Sflorian * @param iq: iterator query state. 1715ae8c6e27Sflorian * @param id: module id. 1716ae8c6e27Sflorian * @return true, advancing the event to the QUERYTARGETS_STATE. 1717ae8c6e27Sflorian */ 1718ae8c6e27Sflorian static int 1719ae8c6e27Sflorian processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq, 1720ae8c6e27Sflorian int id) 1721ae8c6e27Sflorian { 1722ae8c6e27Sflorian log_query_info(VERB_QUERY, "resolving (init part 3): ", 1723ae8c6e27Sflorian &qstate->qinfo); 1724ae8c6e27Sflorian /* if the cache reply dp equals a validation anchor or msg has DS, 1725ae8c6e27Sflorian * then DNSSEC RRSIGs are expected in the reply */ 1726ae8c6e27Sflorian iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 1727ae8c6e27Sflorian iq->deleg_msg, iq->qchase.qclass); 1728ae8c6e27Sflorian 1729ae8c6e27Sflorian /* If the RD flag wasn't set, then we just finish with the 1730ae8c6e27Sflorian * cached referral as the response. */ 1731ae8c6e27Sflorian if(!(qstate->query_flags & BIT_RD) && iq->deleg_msg) { 1732ae8c6e27Sflorian iq->response = iq->deleg_msg; 1733ae8c6e27Sflorian if(verbosity >= VERB_ALGO && iq->response) 1734ae8c6e27Sflorian log_dns_msg("no RD requested, using delegation msg", 1735ae8c6e27Sflorian &iq->response->qinfo, iq->response->rep); 1736ae8c6e27Sflorian if(qstate->reply_origin) 1737ae8c6e27Sflorian sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region); 1738ae8c6e27Sflorian return final_state(iq); 1739ae8c6e27Sflorian } 1740ae8c6e27Sflorian /* After this point, unset the RD flag -- this query is going to 1741ae8c6e27Sflorian * be sent to an auth. server. */ 1742ae8c6e27Sflorian iq->chase_flags &= ~BIT_RD; 1743ae8c6e27Sflorian 1744ae8c6e27Sflorian /* if dnssec expected, fetch key for the trust-anchor or cached-DS */ 1745ae8c6e27Sflorian if(iq->dnssec_expected && qstate->env->cfg->prefetch_key && 1746ae8c6e27Sflorian !(qstate->query_flags&BIT_CD)) { 1747ae8c6e27Sflorian generate_dnskey_prefetch(qstate, iq, id); 1748ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 1749ae8c6e27Sflorian qstate->env->detach_subs)); 1750ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 1751ae8c6e27Sflorian } 1752ae8c6e27Sflorian 1753ae8c6e27Sflorian /* Jump to the next state. */ 1754ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 1755ae8c6e27Sflorian } 1756ae8c6e27Sflorian 1757ae8c6e27Sflorian /** 1758ae8c6e27Sflorian * Given a basic query, generate a parent-side "target" query. 1759ae8c6e27Sflorian * These are subordinate queries for missing delegation point target addresses, 1760ae8c6e27Sflorian * for which only the parent of the delegation provides correct IP addresses. 1761ae8c6e27Sflorian * 1762ae8c6e27Sflorian * @param qstate: query state. 1763ae8c6e27Sflorian * @param iq: iterator query state. 1764ae8c6e27Sflorian * @param id: module id. 1765ae8c6e27Sflorian * @param name: target qname. 1766ae8c6e27Sflorian * @param namelen: target qname length. 1767ae8c6e27Sflorian * @param qtype: target qtype (either A or AAAA). 1768ae8c6e27Sflorian * @param qclass: target qclass. 1769ae8c6e27Sflorian * @return true on success, false on failure. 1770ae8c6e27Sflorian */ 1771ae8c6e27Sflorian static int 1772ae8c6e27Sflorian generate_parentside_target_query(struct module_qstate* qstate, 1773ae8c6e27Sflorian struct iter_qstate* iq, int id, uint8_t* name, size_t namelen, 1774ae8c6e27Sflorian uint16_t qtype, uint16_t qclass) 1775ae8c6e27Sflorian { 1776ae8c6e27Sflorian struct module_qstate* subq; 1777ae8c6e27Sflorian if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 17785a7d75e6Ssthen id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) 1779ae8c6e27Sflorian return 0; 1780ae8c6e27Sflorian if(subq) { 1781ae8c6e27Sflorian struct iter_qstate* subiq = 1782ae8c6e27Sflorian (struct iter_qstate*)subq->minfo[id]; 1783ae8c6e27Sflorian /* blacklist the cache - we want to fetch parent stuff */ 1784ae8c6e27Sflorian sock_list_insert(&subq->blacklist, NULL, 0, subq->region); 1785ae8c6e27Sflorian subiq->query_for_pside_glue = 1; 1786ae8c6e27Sflorian if(dname_subdomain_c(name, iq->dp->name)) { 1787ae8c6e27Sflorian subiq->dp = delegpt_copy(iq->dp, subq->region); 1788ae8c6e27Sflorian subiq->dnssec_expected = iter_indicates_dnssec( 1789ae8c6e27Sflorian qstate->env, subiq->dp, NULL, 1790ae8c6e27Sflorian subq->qinfo.qclass); 1791ae8c6e27Sflorian subiq->refetch_glue = 1; 1792ae8c6e27Sflorian } else { 1793ae8c6e27Sflorian subiq->dp = dns_cache_find_delegation(qstate->env, 1794ae8c6e27Sflorian name, namelen, qtype, qclass, subq->region, 1795ae8c6e27Sflorian &subiq->deleg_msg, 17966d08cb1bSflorian *qstate->env->now+subq->prefetch_leeway, 17976d08cb1bSflorian 1, NULL, 0); 1798ae8c6e27Sflorian /* if no dp, then it's from root, refetch unneeded */ 1799ae8c6e27Sflorian if(subiq->dp) { 1800ae8c6e27Sflorian subiq->dnssec_expected = iter_indicates_dnssec( 1801ae8c6e27Sflorian qstate->env, subiq->dp, NULL, 1802ae8c6e27Sflorian subq->qinfo.qclass); 1803ae8c6e27Sflorian subiq->refetch_glue = 1; 1804ae8c6e27Sflorian } 1805ae8c6e27Sflorian } 1806ae8c6e27Sflorian } 1807ae8c6e27Sflorian log_nametypeclass(VERB_QUERY, "new pside target", name, qtype, qclass); 1808ae8c6e27Sflorian return 1; 1809ae8c6e27Sflorian } 1810ae8c6e27Sflorian 1811ae8c6e27Sflorian /** 1812ae8c6e27Sflorian * Given a basic query, generate a "target" query. These are subordinate 1813ae8c6e27Sflorian * queries for missing delegation point target addresses. 1814ae8c6e27Sflorian * 1815ae8c6e27Sflorian * @param qstate: query state. 1816ae8c6e27Sflorian * @param iq: iterator query state. 1817ae8c6e27Sflorian * @param id: module id. 1818ae8c6e27Sflorian * @param name: target qname. 1819ae8c6e27Sflorian * @param namelen: target qname length. 1820ae8c6e27Sflorian * @param qtype: target qtype (either A or AAAA). 1821ae8c6e27Sflorian * @param qclass: target qclass. 1822ae8c6e27Sflorian * @return true on success, false on failure. 1823ae8c6e27Sflorian */ 1824ae8c6e27Sflorian static int 1825ae8c6e27Sflorian generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq, 1826ae8c6e27Sflorian int id, uint8_t* name, size_t namelen, uint16_t qtype, uint16_t qclass) 1827ae8c6e27Sflorian { 1828ae8c6e27Sflorian struct module_qstate* subq; 1829ae8c6e27Sflorian if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 18305a7d75e6Ssthen id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) 1831ae8c6e27Sflorian return 0; 1832ae8c6e27Sflorian log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass); 1833ae8c6e27Sflorian return 1; 1834ae8c6e27Sflorian } 1835ae8c6e27Sflorian 1836ae8c6e27Sflorian /** 1837ae8c6e27Sflorian * Given an event at a certain state, generate zero or more target queries 1838ae8c6e27Sflorian * for it's current delegation point. 1839ae8c6e27Sflorian * 1840ae8c6e27Sflorian * @param qstate: query state. 1841ae8c6e27Sflorian * @param iq: iterator query state. 1842ae8c6e27Sflorian * @param ie: iterator shared global environment. 1843ae8c6e27Sflorian * @param id: module id. 1844ae8c6e27Sflorian * @param maxtargets: The maximum number of targets to query for. 1845ae8c6e27Sflorian * if it is negative, there is no maximum number of targets. 1846ae8c6e27Sflorian * @param num: returns the number of queries generated and processed, 1847ae8c6e27Sflorian * which may be zero if there were no missing targets. 1848ae8c6e27Sflorian * @return false on error. 1849ae8c6e27Sflorian */ 1850ae8c6e27Sflorian static int 1851ae8c6e27Sflorian query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq, 1852ae8c6e27Sflorian struct iter_env* ie, int id, int maxtargets, int* num) 1853ae8c6e27Sflorian { 1854ae8c6e27Sflorian int query_count = 0; 1855ae8c6e27Sflorian struct delegpt_ns* ns; 1856ae8c6e27Sflorian int missing; 1857ae8c6e27Sflorian int toget = 0; 1858ae8c6e27Sflorian 18597a05b9dfSflorian iter_mark_cycle_targets(qstate, iq->dp); 18606d08cb1bSflorian missing = (int)delegpt_count_missing_targets(iq->dp, NULL); 18617a05b9dfSflorian log_assert(maxtargets != 0); /* that would not be useful */ 18627a05b9dfSflorian 18637a05b9dfSflorian /* Generate target requests. Basically, any missing targets 18647a05b9dfSflorian * are queried for here, regardless if it is necessary to do 18657a05b9dfSflorian * so to continue processing. */ 18667a05b9dfSflorian if(maxtargets < 0 || maxtargets > missing) 18677a05b9dfSflorian toget = missing; 18687a05b9dfSflorian else toget = maxtargets; 18697a05b9dfSflorian if(toget == 0) { 18707a05b9dfSflorian *num = 0; 18717a05b9dfSflorian return 1; 18727a05b9dfSflorian } 18737a05b9dfSflorian 18747a05b9dfSflorian /* now that we are sure that a target query is going to be made, 18757a05b9dfSflorian * check the limits. */ 1876ae8c6e27Sflorian if(iq->depth == ie->max_dependency_depth) 1877ae8c6e27Sflorian return 0; 1878ae8c6e27Sflorian if(iq->depth > 0 && iq->target_count && 18796d08cb1bSflorian iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) { 1880ae8c6e27Sflorian char s[LDNS_MAX_DOMAINLEN+1]; 1881ae8c6e27Sflorian dname_str(qstate->qinfo.qname, s); 1882ae8c6e27Sflorian verbose(VERB_QUERY, "request %s has exceeded the maximum " 18836d08cb1bSflorian "number of glue fetches %d", s, 18846d08cb1bSflorian iq->target_count[TARGET_COUNT_QUERIES]); 1885ae8c6e27Sflorian return 0; 1886ae8c6e27Sflorian } 18875a7d75e6Ssthen if(iq->dp_target_count > MAX_DP_TARGET_COUNT) { 18885a7d75e6Ssthen char s[LDNS_MAX_DOMAINLEN+1]; 18895a7d75e6Ssthen dname_str(qstate->qinfo.qname, s); 18905a7d75e6Ssthen verbose(VERB_QUERY, "request %s has exceeded the maximum " 18915a7d75e6Ssthen "number of glue fetches %d to a single delegation point", 18925a7d75e6Ssthen s, iq->dp_target_count); 18935a7d75e6Ssthen return 0; 18945a7d75e6Ssthen } 1895ae8c6e27Sflorian 1896ae8c6e27Sflorian /* select 'toget' items from the total of 'missing' items */ 1897ae8c6e27Sflorian log_assert(toget <= missing); 1898ae8c6e27Sflorian 1899ae8c6e27Sflorian /* loop over missing targets */ 1900ae8c6e27Sflorian for(ns = iq->dp->nslist; ns; ns = ns->next) { 1901ae8c6e27Sflorian if(ns->resolved) 1902ae8c6e27Sflorian continue; 1903ae8c6e27Sflorian 1904ae8c6e27Sflorian /* randomly select this item with probability toget/missing */ 1905ae8c6e27Sflorian if(!iter_ns_probability(qstate->env->rnd, toget, missing)) { 1906ae8c6e27Sflorian /* do not select this one, next; select toget number 1907ae8c6e27Sflorian * of items from a list one less in size */ 1908ae8c6e27Sflorian missing --; 1909ae8c6e27Sflorian continue; 1910ae8c6e27Sflorian } 1911ae8c6e27Sflorian 19126d08cb1bSflorian if(ie->supports_ipv6 && 19136d08cb1bSflorian ((ns->lame && !ns->done_pside6) || 19146d08cb1bSflorian (!ns->lame && !ns->got6))) { 1915ae8c6e27Sflorian /* Send the AAAA request. */ 1916ae8c6e27Sflorian if(!generate_target_query(qstate, iq, id, 1917ae8c6e27Sflorian ns->name, ns->namelen, 1918ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) { 1919ae8c6e27Sflorian *num = query_count; 1920ae8c6e27Sflorian if(query_count > 0) 1921ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 1922ae8c6e27Sflorian return 0; 1923ae8c6e27Sflorian } 1924ae8c6e27Sflorian query_count++; 1925ab256815Sflorian /* If the mesh query list is full, exit the loop here. 1926ab256815Sflorian * This makes the routine spawn one query at a time, 1927ab256815Sflorian * and this means there is no query state load 1928ab256815Sflorian * increase, because the spawned state uses cpu and a 1929ab256815Sflorian * socket while this state waits for that spawned 1930ab256815Sflorian * state. Next time we can look up further targets */ 1931ab256815Sflorian if(mesh_jostle_exceeded(qstate->env->mesh)) 1932ab256815Sflorian break; 1933ae8c6e27Sflorian } 1934ae8c6e27Sflorian /* Send the A request. */ 19356d08cb1bSflorian if(ie->supports_ipv4 && 19366d08cb1bSflorian ((ns->lame && !ns->done_pside4) || 19376d08cb1bSflorian (!ns->lame && !ns->got4))) { 1938ae8c6e27Sflorian if(!generate_target_query(qstate, iq, id, 1939ae8c6e27Sflorian ns->name, ns->namelen, 1940ae8c6e27Sflorian LDNS_RR_TYPE_A, iq->qchase.qclass)) { 1941ae8c6e27Sflorian *num = query_count; 1942ae8c6e27Sflorian if(query_count > 0) 1943ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 1944ae8c6e27Sflorian return 0; 1945ae8c6e27Sflorian } 1946ae8c6e27Sflorian query_count++; 1947ab256815Sflorian /* If the mesh query list is full, exit the loop. */ 1948ab256815Sflorian if(mesh_jostle_exceeded(qstate->env->mesh)) 1949ab256815Sflorian break; 1950ae8c6e27Sflorian } 1951ae8c6e27Sflorian 1952ae8c6e27Sflorian /* mark this target as in progress. */ 1953ae8c6e27Sflorian ns->resolved = 1; 1954ae8c6e27Sflorian missing--; 1955ae8c6e27Sflorian toget--; 1956ae8c6e27Sflorian if(toget == 0) 1957ae8c6e27Sflorian break; 1958ae8c6e27Sflorian } 1959ae8c6e27Sflorian *num = query_count; 1960ae8c6e27Sflorian if(query_count > 0) 1961ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 1962ae8c6e27Sflorian 1963ae8c6e27Sflorian return 1; 1964ae8c6e27Sflorian } 1965ae8c6e27Sflorian 1966ae8c6e27Sflorian /** 1967ae8c6e27Sflorian * Called by processQueryTargets when it would like extra targets to query 1968ae8c6e27Sflorian * but it seems to be out of options. At last resort some less appealing 1969ae8c6e27Sflorian * options are explored. If there are no more options, the result is SERVFAIL 1970ae8c6e27Sflorian * 1971ae8c6e27Sflorian * @param qstate: query state. 1972ae8c6e27Sflorian * @param iq: iterator query state. 1973ae8c6e27Sflorian * @param ie: iterator shared global environment. 1974ae8c6e27Sflorian * @param id: module id. 1975ae8c6e27Sflorian * @return true if the event requires more request processing immediately, 1976ae8c6e27Sflorian * false if not. 1977ae8c6e27Sflorian */ 1978ae8c6e27Sflorian static int 1979ae8c6e27Sflorian processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, 1980ae8c6e27Sflorian struct iter_env* ie, int id) 1981ae8c6e27Sflorian { 1982ae8c6e27Sflorian struct delegpt_ns* ns; 1983ae8c6e27Sflorian int query_count = 0; 1984ae8c6e27Sflorian verbose(VERB_ALGO, "No more query targets, attempting last resort"); 1985ae8c6e27Sflorian log_assert(iq->dp); 1986ae8c6e27Sflorian 1987ae8c6e27Sflorian if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, 1988ae8c6e27Sflorian iq->qchase.qclass, NULL)) { 1989ae8c6e27Sflorian /* fail -- no more targets, no more hope of targets, no hope 1990ae8c6e27Sflorian * of a response. */ 1991ae8c6e27Sflorian errinf(qstate, "all the configured stub or forward servers failed,"); 1992ae8c6e27Sflorian errinf_dname(qstate, "at zone", iq->dp->name); 1993411c5950Sflorian errinf_reply(qstate, iq); 1994ae8c6e27Sflorian verbose(VERB_QUERY, "configured stub or forward servers failed -- returning SERVFAIL"); 1995ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 1996ae8c6e27Sflorian } 1997ae8c6e27Sflorian if(!iq->dp->has_parent_side_NS && dname_is_root(iq->dp->name)) { 1998ae8c6e27Sflorian struct delegpt* p = hints_lookup_root(qstate->env->hints, 1999ae8c6e27Sflorian iq->qchase.qclass); 2000ae8c6e27Sflorian if(p) { 2001ae8c6e27Sflorian struct delegpt_addr* a; 2002ae8c6e27Sflorian iq->chase_flags &= ~BIT_RD; /* go to authorities */ 2003ae8c6e27Sflorian for(ns = p->nslist; ns; ns=ns->next) { 2004ae8c6e27Sflorian (void)delegpt_add_ns(iq->dp, qstate->region, 2005a1a7ba80Sflorian ns->name, ns->lame, ns->tls_auth_name, 2006a1a7ba80Sflorian ns->port); 2007ae8c6e27Sflorian } 2008ae8c6e27Sflorian for(a = p->target_list; a; a=a->next_target) { 2009ae8c6e27Sflorian (void)delegpt_add_addr(iq->dp, qstate->region, 2010ae8c6e27Sflorian &a->addr, a->addrlen, a->bogus, 2011a1a7ba80Sflorian a->lame, a->tls_auth_name, -1, NULL); 2012ae8c6e27Sflorian } 2013ae8c6e27Sflorian } 2014ae8c6e27Sflorian iq->dp->has_parent_side_NS = 1; 2015ae8c6e27Sflorian } else if(!iq->dp->has_parent_side_NS) { 2016ae8c6e27Sflorian if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp, 2017ae8c6e27Sflorian qstate->region, &qstate->qinfo) 2018ae8c6e27Sflorian || !iq->dp->has_parent_side_NS) { 2019ae8c6e27Sflorian /* if: malloc failure in lookup go up to try */ 2020ae8c6e27Sflorian /* if: no parent NS in cache - go up one level */ 2021ae8c6e27Sflorian verbose(VERB_ALGO, "try to grab parent NS"); 2022ae8c6e27Sflorian iq->store_parent_NS = iq->dp; 2023ae8c6e27Sflorian iq->chase_flags &= ~BIT_RD; /* go to authorities */ 2024ae8c6e27Sflorian iq->deleg_msg = NULL; 2025ae8c6e27Sflorian iq->refetch_glue = 1; 2026ae8c6e27Sflorian iq->query_restart_count++; 2027ae8c6e27Sflorian iq->sent_count = 0; 20285a7d75e6Ssthen iq->dp_target_count = 0; 2029ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) 2030ae8c6e27Sflorian iq->minimisation_state = INIT_MINIMISE_STATE; 2031ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_STATE); 2032ae8c6e27Sflorian } 2033ae8c6e27Sflorian } 2034ae8c6e27Sflorian /* see if that makes new names available */ 2035ae8c6e27Sflorian if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 2036ae8c6e27Sflorian qstate->region, iq->dp)) 2037ae8c6e27Sflorian log_err("out of memory in cache_fill_missing"); 2038ae8c6e27Sflorian if(iq->dp->usable_list) { 2039ae8c6e27Sflorian verbose(VERB_ALGO, "try parent-side-name, w. glue from cache"); 2040ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 2041ae8c6e27Sflorian } 2042ae8c6e27Sflorian /* try to fill out parent glue from cache */ 2043ae8c6e27Sflorian if(iter_lookup_parent_glue_from_cache(qstate->env, iq->dp, 2044ae8c6e27Sflorian qstate->region, &qstate->qinfo)) { 2045ae8c6e27Sflorian /* got parent stuff from cache, see if we can continue */ 2046ae8c6e27Sflorian verbose(VERB_ALGO, "try parent-side glue from cache"); 2047ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 2048ae8c6e27Sflorian } 2049ae8c6e27Sflorian /* query for an extra name added by the parent-NS record */ 20506d08cb1bSflorian if(delegpt_count_missing_targets(iq->dp, NULL) > 0) { 2051ae8c6e27Sflorian int qs = 0; 2052ae8c6e27Sflorian verbose(VERB_ALGO, "try parent-side target name"); 2053ae8c6e27Sflorian if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) { 2054ae8c6e27Sflorian errinf(qstate, "could not fetch nameserver"); 2055ae8c6e27Sflorian errinf_dname(qstate, "at zone", iq->dp->name); 2056ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2057ae8c6e27Sflorian } 2058ae8c6e27Sflorian iq->num_target_queries += qs; 2059ae8c6e27Sflorian target_count_increase(iq, qs); 2060ae8c6e27Sflorian if(qs != 0) { 2061ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 2062ae8c6e27Sflorian return 0; /* and wait for them */ 2063ae8c6e27Sflorian } 2064ae8c6e27Sflorian } 2065ae8c6e27Sflorian if(iq->depth == ie->max_dependency_depth) { 2066ae8c6e27Sflorian verbose(VERB_QUERY, "maxdepth and need more nameservers, fail"); 2067ae8c6e27Sflorian errinf(qstate, "cannot fetch more nameservers because at max dependency depth"); 2068ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 2069ae8c6e27Sflorian } 2070ae8c6e27Sflorian if(iq->depth > 0 && iq->target_count && 20716d08cb1bSflorian iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) { 2072ae8c6e27Sflorian char s[LDNS_MAX_DOMAINLEN+1]; 2073ae8c6e27Sflorian dname_str(qstate->qinfo.qname, s); 2074ae8c6e27Sflorian verbose(VERB_QUERY, "request %s has exceeded the maximum " 20756d08cb1bSflorian "number of glue fetches %d", s, 20766d08cb1bSflorian iq->target_count[TARGET_COUNT_QUERIES]); 2077ae8c6e27Sflorian errinf(qstate, "exceeded the maximum number of glue fetches"); 2078ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 2079ae8c6e27Sflorian } 2080ae8c6e27Sflorian /* mark cycle targets for parent-side lookups */ 2081ae8c6e27Sflorian iter_mark_pside_cycle_targets(qstate, iq->dp); 2082ae8c6e27Sflorian /* see if we can issue queries to get nameserver addresses */ 2083ae8c6e27Sflorian /* this lookup is not randomized, but sequential. */ 2084ae8c6e27Sflorian for(ns = iq->dp->nslist; ns; ns = ns->next) { 2085ae8c6e27Sflorian /* if this nameserver is at a delegation point, but that 2086ae8c6e27Sflorian * delegation point is a stub and we cannot go higher, skip*/ 2087ae8c6e27Sflorian if( ((ie->supports_ipv6 && !ns->done_pside6) || 2088ae8c6e27Sflorian (ie->supports_ipv4 && !ns->done_pside4)) && 2089ae8c6e27Sflorian !can_have_last_resort(qstate->env, ns->name, ns->namelen, 2090ae8c6e27Sflorian iq->qchase.qclass, NULL)) { 2091ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "cannot pside lookup ns " 2092ae8c6e27Sflorian "because it is also a stub/forward,", 2093ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass); 2094ae8c6e27Sflorian if(ie->supports_ipv6) ns->done_pside6 = 1; 2095ae8c6e27Sflorian if(ie->supports_ipv4) ns->done_pside4 = 1; 2096ae8c6e27Sflorian continue; 2097ae8c6e27Sflorian } 2098ae8c6e27Sflorian /* query for parent-side A and AAAA for nameservers */ 2099ae8c6e27Sflorian if(ie->supports_ipv6 && !ns->done_pside6) { 2100ae8c6e27Sflorian /* Send the AAAA request. */ 2101ae8c6e27Sflorian if(!generate_parentside_target_query(qstate, iq, id, 2102ae8c6e27Sflorian ns->name, ns->namelen, 2103ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) { 2104ae8c6e27Sflorian errinf_dname(qstate, "could not generate nameserver AAAA lookup for", ns->name); 2105ae8c6e27Sflorian return error_response(qstate, id, 2106ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 2107ae8c6e27Sflorian } 2108ae8c6e27Sflorian ns->done_pside6 = 1; 2109ae8c6e27Sflorian query_count++; 2110ab256815Sflorian if(mesh_jostle_exceeded(qstate->env->mesh)) { 2111ab256815Sflorian /* Wait for the lookup; do not spawn multiple 2112ab256815Sflorian * lookups at a time. */ 2113ab256815Sflorian verbose(VERB_ALGO, "try parent-side glue lookup"); 2114ab256815Sflorian iq->num_target_queries += query_count; 2115ab256815Sflorian target_count_increase(iq, query_count); 2116ab256815Sflorian qstate->ext_state[id] = module_wait_subquery; 2117ab256815Sflorian return 0; 2118ab256815Sflorian } 2119ae8c6e27Sflorian } 2120ae8c6e27Sflorian if(ie->supports_ipv4 && !ns->done_pside4) { 2121ae8c6e27Sflorian /* Send the A request. */ 2122ae8c6e27Sflorian if(!generate_parentside_target_query(qstate, iq, id, 2123ae8c6e27Sflorian ns->name, ns->namelen, 2124ae8c6e27Sflorian LDNS_RR_TYPE_A, iq->qchase.qclass)) { 2125ae8c6e27Sflorian errinf_dname(qstate, "could not generate nameserver A lookup for", ns->name); 2126ae8c6e27Sflorian return error_response(qstate, id, 2127ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 2128ae8c6e27Sflorian } 2129ae8c6e27Sflorian ns->done_pside4 = 1; 2130ae8c6e27Sflorian query_count++; 2131ae8c6e27Sflorian } 2132ae8c6e27Sflorian if(query_count != 0) { /* suspend to await results */ 2133ae8c6e27Sflorian verbose(VERB_ALGO, "try parent-side glue lookup"); 2134ae8c6e27Sflorian iq->num_target_queries += query_count; 2135ae8c6e27Sflorian target_count_increase(iq, query_count); 2136ae8c6e27Sflorian qstate->ext_state[id] = module_wait_subquery; 2137ae8c6e27Sflorian return 0; 2138ae8c6e27Sflorian } 2139ae8c6e27Sflorian } 2140ae8c6e27Sflorian 2141ae8c6e27Sflorian /* if this was a parent-side glue query itself, then store that 2142ae8c6e27Sflorian * failure in cache. */ 2143ae8c6e27Sflorian if(!qstate->no_cache_store && iq->query_for_pside_glue 2144ae8c6e27Sflorian && !iq->pside_glue) 2145ae8c6e27Sflorian iter_store_parentside_neg(qstate->env, &qstate->qinfo, 2146ae8c6e27Sflorian iq->deleg_msg?iq->deleg_msg->rep: 2147ae8c6e27Sflorian (iq->response?iq->response->rep:NULL)); 2148ae8c6e27Sflorian 2149ae8c6e27Sflorian errinf(qstate, "all servers for this domain failed,"); 2150ae8c6e27Sflorian errinf_dname(qstate, "at zone", iq->dp->name); 2151411c5950Sflorian errinf_reply(qstate, iq); 2152ae8c6e27Sflorian verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL"); 2153ae8c6e27Sflorian /* fail -- no more targets, no more hope of targets, no hope 2154ae8c6e27Sflorian * of a response. */ 2155ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 2156ae8c6e27Sflorian } 2157ae8c6e27Sflorian 2158ae8c6e27Sflorian /** 2159ae8c6e27Sflorian * Try to find the NS record set that will resolve a qtype DS query. Due 2160ae8c6e27Sflorian * to grandparent/grandchild reasons we did not get a proper lookup right 2161ae8c6e27Sflorian * away. We need to create type NS queries until we get the right parent 2162ae8c6e27Sflorian * for this lookup. We remove labels from the query to find the right point. 2163ae8c6e27Sflorian * If we end up at the old dp name, then there is no solution. 2164ae8c6e27Sflorian * 2165ae8c6e27Sflorian * @param qstate: query state. 2166ae8c6e27Sflorian * @param iq: iterator query state. 2167ae8c6e27Sflorian * @param id: module id. 2168ae8c6e27Sflorian * @return true if the event requires more immediate processing, false if 2169ae8c6e27Sflorian * not. This is generally only true when forwarding the request to 2170ae8c6e27Sflorian * the final state (i.e., on answer). 2171ae8c6e27Sflorian */ 2172ae8c6e27Sflorian static int 2173ae8c6e27Sflorian processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id) 2174ae8c6e27Sflorian { 2175ae8c6e27Sflorian struct module_qstate* subq = NULL; 2176ae8c6e27Sflorian verbose(VERB_ALGO, "processDSNSFind"); 2177ae8c6e27Sflorian 2178ae8c6e27Sflorian if(!iq->dsns_point) { 2179ae8c6e27Sflorian /* initialize */ 2180ae8c6e27Sflorian iq->dsns_point = iq->qchase.qname; 2181ae8c6e27Sflorian iq->dsns_point_len = iq->qchase.qname_len; 2182ae8c6e27Sflorian } 2183ae8c6e27Sflorian /* robustcheck for internal error: we are not underneath the dp */ 2184ae8c6e27Sflorian if(!dname_subdomain_c(iq->dsns_point, iq->dp->name)) { 2185ae8c6e27Sflorian errinf_dname(qstate, "for DS query parent-child nameserver search the query is not under the zone", iq->dp->name); 2186ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 2187ae8c6e27Sflorian } 2188ae8c6e27Sflorian 2189ae8c6e27Sflorian /* go up one (more) step, until we hit the dp, if so, end */ 2190ae8c6e27Sflorian dname_remove_label(&iq->dsns_point, &iq->dsns_point_len); 2191ae8c6e27Sflorian if(query_dname_compare(iq->dsns_point, iq->dp->name) == 0) { 2192ae8c6e27Sflorian /* there was no inbetween nameserver, use the old delegation 2193ae8c6e27Sflorian * point again. And this time, because dsns_point is nonNULL 2194ae8c6e27Sflorian * we are going to accept the (bad) result */ 2195ae8c6e27Sflorian iq->state = QUERYTARGETS_STATE; 2196ae8c6e27Sflorian return 1; 2197ae8c6e27Sflorian } 2198ae8c6e27Sflorian iq->state = DSNS_FIND_STATE; 2199ae8c6e27Sflorian 2200ae8c6e27Sflorian /* spawn NS lookup (validation not needed, this is for DS lookup) */ 2201ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "fetch nameservers", 2202ae8c6e27Sflorian iq->dsns_point, LDNS_RR_TYPE_NS, iq->qchase.qclass); 2203ae8c6e27Sflorian if(!generate_sub_request(iq->dsns_point, iq->dsns_point_len, 2204ae8c6e27Sflorian LDNS_RR_TYPE_NS, iq->qchase.qclass, qstate, id, iq, 22055a7d75e6Ssthen INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0, 0)) { 2206ae8c6e27Sflorian errinf_dname(qstate, "for DS query parent-child nameserver search, could not generate NS lookup for", iq->dsns_point); 2207ae8c6e27Sflorian return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL); 2208ae8c6e27Sflorian } 2209ae8c6e27Sflorian 2210ae8c6e27Sflorian return 0; 2211ae8c6e27Sflorian } 2212ae8c6e27Sflorian 2213ae8c6e27Sflorian /** 22146d08cb1bSflorian * Check if we wait responses for sent queries and update the iterator's 22156d08cb1bSflorian * external state. 22166d08cb1bSflorian */ 22176d08cb1bSflorian static void 22186d08cb1bSflorian check_waiting_queries(struct iter_qstate* iq, struct module_qstate* qstate, 22196d08cb1bSflorian int id) 22206d08cb1bSflorian { 22216d08cb1bSflorian if(iq->num_target_queries>0 && iq->num_current_queries>0) { 22226d08cb1bSflorian verbose(VERB_ALGO, "waiting for %d targets to " 22236d08cb1bSflorian "resolve or %d outstanding queries to " 22246d08cb1bSflorian "respond", iq->num_target_queries, 22256d08cb1bSflorian iq->num_current_queries); 22266d08cb1bSflorian qstate->ext_state[id] = module_wait_reply; 22276d08cb1bSflorian } else if(iq->num_target_queries>0) { 22286d08cb1bSflorian verbose(VERB_ALGO, "waiting for %d targets to " 22296d08cb1bSflorian "resolve", iq->num_target_queries); 22306d08cb1bSflorian qstate->ext_state[id] = module_wait_subquery; 22316d08cb1bSflorian } else { 22326d08cb1bSflorian verbose(VERB_ALGO, "waiting for %d " 22336d08cb1bSflorian "outstanding queries to respond", 22346d08cb1bSflorian iq->num_current_queries); 22356d08cb1bSflorian qstate->ext_state[id] = module_wait_reply; 22366d08cb1bSflorian } 22376d08cb1bSflorian } 22386d08cb1bSflorian 22396d08cb1bSflorian /** 2240ae8c6e27Sflorian * This is the request event state where the request will be sent to one of 2241ae8c6e27Sflorian * its current query targets. This state also handles issuing target lookup 2242ae8c6e27Sflorian * queries for missing target IP addresses. Queries typically iterate on 2243ae8c6e27Sflorian * this state, both when they are just trying different targets for a given 2244ae8c6e27Sflorian * delegation point, and when they change delegation points. This state 2245ae8c6e27Sflorian * roughly corresponds to RFC 1034 algorithm steps 3 and 4. 2246ae8c6e27Sflorian * 2247ae8c6e27Sflorian * @param qstate: query state. 2248ae8c6e27Sflorian * @param iq: iterator query state. 2249ae8c6e27Sflorian * @param ie: iterator shared global environment. 2250ae8c6e27Sflorian * @param id: module id. 2251ae8c6e27Sflorian * @return true if the event requires more request processing immediately, 2252ae8c6e27Sflorian * false if not. This state only returns true when it is generating 2253ae8c6e27Sflorian * a SERVFAIL response because the query has hit a dead end. 2254ae8c6e27Sflorian */ 2255ae8c6e27Sflorian static int 2256ae8c6e27Sflorian processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, 2257ae8c6e27Sflorian struct iter_env* ie, int id) 2258ae8c6e27Sflorian { 2259ae8c6e27Sflorian int tf_policy; 2260ae8c6e27Sflorian struct delegpt_addr* target; 2261ae8c6e27Sflorian struct outbound_entry* outq; 2262ae8c6e27Sflorian int auth_fallback = 0; 2263988ebc2dSflorian uint8_t* qout_orig = NULL; 2264988ebc2dSflorian size_t qout_orig_len = 0; 2265a1a7ba80Sflorian int sq_check_ratelimit = 1; 2266a1a7ba80Sflorian int sq_was_ratelimited = 0; 2267*5c45b740Sflorian int can_do_promisc = 0; 2268ae8c6e27Sflorian 2269ae8c6e27Sflorian /* NOTE: a request will encounter this state for each target it 2270ae8c6e27Sflorian * needs to send a query to. That is, at least one per referral, 2271ae8c6e27Sflorian * more if some targets timeout or return throwaway answers. */ 2272ae8c6e27Sflorian 2273ae8c6e27Sflorian log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo); 2274ae8c6e27Sflorian verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, " 2275ae8c6e27Sflorian "currentqueries %d sentcount %d", iq->num_target_queries, 2276ae8c6e27Sflorian iq->num_current_queries, iq->sent_count); 2277ae8c6e27Sflorian 2278ae8c6e27Sflorian /* Make sure that we haven't run away */ 2279ae8c6e27Sflorian /* FIXME: is this check even necessary? */ 2280ae8c6e27Sflorian if(iq->referral_count > MAX_REFERRAL_COUNT) { 2281ae8c6e27Sflorian verbose(VERB_QUERY, "request has exceeded the maximum " 2282ae8c6e27Sflorian "number of referrrals with %d", iq->referral_count); 2283ae8c6e27Sflorian errinf(qstate, "exceeded the maximum of referrals"); 2284ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2285ae8c6e27Sflorian } 2286ae8c6e27Sflorian if(iq->sent_count > MAX_SENT_COUNT) { 2287ae8c6e27Sflorian verbose(VERB_QUERY, "request has exceeded the maximum " 2288ae8c6e27Sflorian "number of sends with %d", iq->sent_count); 2289ae8c6e27Sflorian errinf(qstate, "exceeded the maximum number of sends"); 2290ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2291ae8c6e27Sflorian } 22926d08cb1bSflorian 22936d08cb1bSflorian /* Check if we reached MAX_TARGET_NX limit without a fallback activation. */ 22946d08cb1bSflorian if(iq->target_count && !*iq->nxns_dp && 22956d08cb1bSflorian iq->target_count[TARGET_COUNT_NX] > MAX_TARGET_NX) { 22966d08cb1bSflorian struct delegpt_ns* ns; 22976d08cb1bSflorian /* If we can wait for resolution, do so. */ 22986d08cb1bSflorian if(iq->num_target_queries>0 || iq->num_current_queries>0) { 22996d08cb1bSflorian check_waiting_queries(iq, qstate, id); 23006d08cb1bSflorian return 0; 23016d08cb1bSflorian } 23026d08cb1bSflorian verbose(VERB_ALGO, "request has exceeded the maximum " 23036d08cb1bSflorian "number of nxdomain nameserver lookups (%d) with %d", 23046d08cb1bSflorian MAX_TARGET_NX, iq->target_count[TARGET_COUNT_NX]); 23056d08cb1bSflorian /* Check for dp because we require one below */ 23066d08cb1bSflorian if(!iq->dp) { 23076d08cb1bSflorian verbose(VERB_QUERY, "Failed to get a delegation, " 23086d08cb1bSflorian "giving up"); 23096d08cb1bSflorian errinf(qstate, "failed to get a delegation (eg. prime " 23106d08cb1bSflorian "failure)"); 23116d08cb1bSflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 23126d08cb1bSflorian } 23136d08cb1bSflorian /* We reached the limit but we already have parent side 23146d08cb1bSflorian * information; stop resolution */ 23156d08cb1bSflorian if(iq->dp->has_parent_side_NS) { 23166d08cb1bSflorian verbose(VERB_ALGO, "parent-side information is " 23176d08cb1bSflorian "already present for the delegation point, no " 23186d08cb1bSflorian "fallback possible"); 23195a7d75e6Ssthen errinf(qstate, "exceeded the maximum nameserver nxdomains"); 23205a7d75e6Ssthen return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 23215a7d75e6Ssthen } 23226d08cb1bSflorian verbose(VERB_ALGO, "initiating parent-side fallback for " 23236d08cb1bSflorian "nxdomain nameserver lookups"); 23246d08cb1bSflorian /* Mark all the current NSes as resolved to allow for parent 23256d08cb1bSflorian * fallback */ 23266d08cb1bSflorian for(ns=iq->dp->nslist; ns; ns=ns->next) { 23276d08cb1bSflorian ns->resolved = 1; 23286d08cb1bSflorian } 23296d08cb1bSflorian /* Note the delegation point that triggered the NXNS fallback; 23306d08cb1bSflorian * no reason for shared queries to keep trying there. 23316d08cb1bSflorian * This also marks the fallback activation. */ 23326d08cb1bSflorian *iq->nxns_dp = malloc(iq->dp->namelen); 23336d08cb1bSflorian if(!*iq->nxns_dp) { 23346d08cb1bSflorian verbose(VERB_ALGO, "out of memory while initiating " 23356d08cb1bSflorian "fallback"); 23366d08cb1bSflorian errinf(qstate, "exceeded the maximum nameserver " 23376d08cb1bSflorian "nxdomains (malloc)"); 23386d08cb1bSflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 23396d08cb1bSflorian } 23406d08cb1bSflorian memcpy(*iq->nxns_dp, iq->dp->name, iq->dp->namelen); 23416d08cb1bSflorian } else if(iq->target_count && *iq->nxns_dp) { 23426d08cb1bSflorian /* Handle the NXNS fallback case. */ 23436d08cb1bSflorian /* If we can wait for resolution, do so. */ 23446d08cb1bSflorian if(iq->num_target_queries>0 || iq->num_current_queries>0) { 23456d08cb1bSflorian check_waiting_queries(iq, qstate, id); 23466d08cb1bSflorian return 0; 23476d08cb1bSflorian } 23486d08cb1bSflorian /* Check for dp because we require one below */ 23496d08cb1bSflorian if(!iq->dp) { 23506d08cb1bSflorian verbose(VERB_QUERY, "Failed to get a delegation, " 23516d08cb1bSflorian "giving up"); 23526d08cb1bSflorian errinf(qstate, "failed to get a delegation (eg. prime " 23536d08cb1bSflorian "failure)"); 23546d08cb1bSflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 23556d08cb1bSflorian } 23566d08cb1bSflorian 23576d08cb1bSflorian if(iq->target_count[TARGET_COUNT_NX] > MAX_TARGET_NX_FALLBACK) { 23586d08cb1bSflorian verbose(VERB_ALGO, "request has exceeded the maximum " 23596d08cb1bSflorian "number of fallback nxdomain nameserver " 23606d08cb1bSflorian "lookups (%d) with %d", MAX_TARGET_NX_FALLBACK, 23616d08cb1bSflorian iq->target_count[TARGET_COUNT_NX]); 23626d08cb1bSflorian errinf(qstate, "exceeded the maximum nameserver nxdomains"); 23636d08cb1bSflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 23646d08cb1bSflorian } 23656d08cb1bSflorian 23666d08cb1bSflorian if(!iq->dp->has_parent_side_NS) { 23676d08cb1bSflorian struct delegpt_ns* ns; 23686d08cb1bSflorian if(!dname_canonical_compare(*iq->nxns_dp, iq->dp->name)) { 23696d08cb1bSflorian verbose(VERB_ALGO, "this delegation point " 23706d08cb1bSflorian "initiated the fallback, marking the " 23716d08cb1bSflorian "nslist as resolved"); 23726d08cb1bSflorian for(ns=iq->dp->nslist; ns; ns=ns->next) { 23736d08cb1bSflorian ns->resolved = 1; 23746d08cb1bSflorian } 23756d08cb1bSflorian } 23766d08cb1bSflorian } 23776d08cb1bSflorian } 2378ae8c6e27Sflorian 2379ae8c6e27Sflorian /* Make sure we have a delegation point, otherwise priming failed 2380ae8c6e27Sflorian * or another failure occurred */ 2381ae8c6e27Sflorian if(!iq->dp) { 2382ae8c6e27Sflorian verbose(VERB_QUERY, "Failed to get a delegation, giving up"); 2383ae8c6e27Sflorian errinf(qstate, "failed to get a delegation (eg. prime failure)"); 2384ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2385ae8c6e27Sflorian } 2386ae8c6e27Sflorian if(!ie->supports_ipv6) 2387ae8c6e27Sflorian delegpt_no_ipv6(iq->dp); 2388ae8c6e27Sflorian if(!ie->supports_ipv4) 2389ae8c6e27Sflorian delegpt_no_ipv4(iq->dp); 2390ae8c6e27Sflorian delegpt_log(VERB_ALGO, iq->dp); 2391ae8c6e27Sflorian 2392ae8c6e27Sflorian if(iq->num_current_queries>0) { 2393ae8c6e27Sflorian /* already busy answering a query, this restart is because 2394ae8c6e27Sflorian * more delegpt addrs became available, wait for existing 2395ae8c6e27Sflorian * query. */ 2396ae8c6e27Sflorian verbose(VERB_ALGO, "woke up, but wait for outstanding query"); 2397ae8c6e27Sflorian qstate->ext_state[id] = module_wait_reply; 2398ae8c6e27Sflorian return 0; 2399ae8c6e27Sflorian } 2400ae8c6e27Sflorian 2401ae8c6e27Sflorian if(iq->minimisation_state == INIT_MINIMISE_STATE 2402ae8c6e27Sflorian && !(iq->chase_flags & BIT_RD)) { 2403ae8c6e27Sflorian /* (Re)set qinfo_out to (new) delegation point, except when 2404ae8c6e27Sflorian * qinfo_out is already a subdomain of dp. This happens when 2405ae8c6e27Sflorian * increasing by more than one label at once (QNAMEs with more 2406ae8c6e27Sflorian * than MAX_MINIMISE_COUNT labels). */ 2407ae8c6e27Sflorian if(!(iq->qinfo_out.qname_len 2408ae8c6e27Sflorian && dname_subdomain_c(iq->qchase.qname, 2409ae8c6e27Sflorian iq->qinfo_out.qname) 2410ae8c6e27Sflorian && dname_subdomain_c(iq->qinfo_out.qname, 2411ae8c6e27Sflorian iq->dp->name))) { 2412ae8c6e27Sflorian iq->qinfo_out.qname = iq->dp->name; 2413ae8c6e27Sflorian iq->qinfo_out.qname_len = iq->dp->namelen; 2414ae8c6e27Sflorian iq->qinfo_out.qtype = LDNS_RR_TYPE_A; 2415ae8c6e27Sflorian iq->qinfo_out.qclass = iq->qchase.qclass; 2416ae8c6e27Sflorian iq->qinfo_out.local_alias = NULL; 2417ae8c6e27Sflorian iq->minimise_count = 0; 2418ae8c6e27Sflorian } 2419ae8c6e27Sflorian 2420ae8c6e27Sflorian iq->minimisation_state = MINIMISE_STATE; 2421ae8c6e27Sflorian } 2422ae8c6e27Sflorian if(iq->minimisation_state == MINIMISE_STATE) { 2423ae8c6e27Sflorian int qchaselabs = dname_count_labels(iq->qchase.qname); 2424ae8c6e27Sflorian int labdiff = qchaselabs - 2425ae8c6e27Sflorian dname_count_labels(iq->qinfo_out.qname); 2426ae8c6e27Sflorian 2427988ebc2dSflorian qout_orig = iq->qinfo_out.qname; 2428988ebc2dSflorian qout_orig_len = iq->qinfo_out.qname_len; 2429ae8c6e27Sflorian iq->qinfo_out.qname = iq->qchase.qname; 2430ae8c6e27Sflorian iq->qinfo_out.qname_len = iq->qchase.qname_len; 2431ae8c6e27Sflorian iq->minimise_count++; 2432e47fef9eSflorian iq->timeout_count = 0; 2433ae8c6e27Sflorian 2434a1a7ba80Sflorian iter_dec_attempts(iq->dp, 1, ie->outbound_msg_retry); 2435ae8c6e27Sflorian 2436ae8c6e27Sflorian /* Limit number of iterations for QNAMEs with more 2437ae8c6e27Sflorian * than MAX_MINIMISE_COUNT labels. Send first MINIMISE_ONE_LAB 2438ae8c6e27Sflorian * labels of QNAME always individually. 2439ae8c6e27Sflorian */ 2440ae8c6e27Sflorian if(qchaselabs > MAX_MINIMISE_COUNT && labdiff > 1 && 2441ae8c6e27Sflorian iq->minimise_count > MINIMISE_ONE_LAB) { 2442ae8c6e27Sflorian if(iq->minimise_count < MAX_MINIMISE_COUNT) { 2443ae8c6e27Sflorian int multilabs = qchaselabs - 1 - 2444ae8c6e27Sflorian MINIMISE_ONE_LAB; 2445ae8c6e27Sflorian int extralabs = multilabs / 2446ae8c6e27Sflorian MINIMISE_MULTIPLE_LABS; 2447ae8c6e27Sflorian 2448ae8c6e27Sflorian if (MAX_MINIMISE_COUNT - iq->minimise_count >= 2449ae8c6e27Sflorian multilabs % MINIMISE_MULTIPLE_LABS) 2450ae8c6e27Sflorian /* Default behaviour is to add 1 label 2451ae8c6e27Sflorian * every iteration. Therefore, decrement 2452ae8c6e27Sflorian * the extralabs by 1 */ 2453ae8c6e27Sflorian extralabs--; 2454ae8c6e27Sflorian if (extralabs < labdiff) 2455ae8c6e27Sflorian labdiff -= extralabs; 2456ae8c6e27Sflorian else 2457ae8c6e27Sflorian labdiff = 1; 2458ae8c6e27Sflorian } 2459ae8c6e27Sflorian /* Last minimised iteration, send all labels with 2460ae8c6e27Sflorian * QTYPE=NS */ 2461ae8c6e27Sflorian else 2462ae8c6e27Sflorian labdiff = 1; 2463ae8c6e27Sflorian } 2464ae8c6e27Sflorian 2465ae8c6e27Sflorian if(labdiff > 1) { 2466ae8c6e27Sflorian verbose(VERB_QUERY, "removing %d labels", labdiff-1); 2467ae8c6e27Sflorian dname_remove_labels(&iq->qinfo_out.qname, 2468ae8c6e27Sflorian &iq->qinfo_out.qname_len, 2469ae8c6e27Sflorian labdiff-1); 2470ae8c6e27Sflorian } 2471ae8c6e27Sflorian if(labdiff < 1 || (labdiff < 2 2472ae8c6e27Sflorian && (iq->qchase.qtype == LDNS_RR_TYPE_DS 2473ae8c6e27Sflorian || iq->qchase.qtype == LDNS_RR_TYPE_A))) 2474ae8c6e27Sflorian /* Stop minimising this query, resolve "as usual" */ 2475ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 2476ae8c6e27Sflorian else if(!qstate->no_cache_lookup) { 2477ae8c6e27Sflorian struct dns_msg* msg = dns_cache_lookup(qstate->env, 2478ae8c6e27Sflorian iq->qinfo_out.qname, iq->qinfo_out.qname_len, 2479ae8c6e27Sflorian iq->qinfo_out.qtype, iq->qinfo_out.qclass, 2480ae8c6e27Sflorian qstate->query_flags, qstate->region, 2481411c5950Sflorian qstate->env->scratch, 0, iq->dp->name, 2482411c5950Sflorian iq->dp->namelen); 24835a7d75e6Ssthen if(msg && FLAGS_GET_RCODE(msg->rep->flags) == 2484ae8c6e27Sflorian LDNS_RCODE_NOERROR) 2485ae8c6e27Sflorian /* no need to send query if it is already 24865a7d75e6Ssthen * cached as NOERROR */ 2487ae8c6e27Sflorian return 1; 24885a7d75e6Ssthen if(msg && FLAGS_GET_RCODE(msg->rep->flags) == 24895a7d75e6Ssthen LDNS_RCODE_NXDOMAIN && 24905a7d75e6Ssthen qstate->env->need_to_validate && 24915a7d75e6Ssthen qstate->env->cfg->harden_below_nxdomain) { 24925a7d75e6Ssthen if(msg->rep->security == sec_status_secure) { 24935a7d75e6Ssthen iq->response = msg; 24945a7d75e6Ssthen return final_state(iq); 24955a7d75e6Ssthen } 24965a7d75e6Ssthen if(msg->rep->security == sec_status_unchecked) { 24975a7d75e6Ssthen struct module_qstate* subq = NULL; 24985a7d75e6Ssthen if(!generate_sub_request( 24995a7d75e6Ssthen iq->qinfo_out.qname, 25005a7d75e6Ssthen iq->qinfo_out.qname_len, 25015a7d75e6Ssthen iq->qinfo_out.qtype, 25025a7d75e6Ssthen iq->qinfo_out.qclass, 25035a7d75e6Ssthen qstate, id, iq, 25045a7d75e6Ssthen INIT_REQUEST_STATE, 25055a7d75e6Ssthen FINISHED_STATE, &subq, 1, 1)) 25065a7d75e6Ssthen verbose(VERB_ALGO, 25075a7d75e6Ssthen "could not validate NXDOMAIN " 25085a7d75e6Ssthen "response"); 25095a7d75e6Ssthen } 25105a7d75e6Ssthen } 25115a7d75e6Ssthen if(msg && FLAGS_GET_RCODE(msg->rep->flags) == 25125a7d75e6Ssthen LDNS_RCODE_NXDOMAIN) { 25135a7d75e6Ssthen /* return and add a label in the next 25145a7d75e6Ssthen * minimisation iteration. 25155a7d75e6Ssthen */ 25165a7d75e6Ssthen return 1; 25175a7d75e6Ssthen } 2518ae8c6e27Sflorian } 2519ae8c6e27Sflorian } 2520ae8c6e27Sflorian if(iq->minimisation_state == SKIP_MINIMISE_STATE) { 2521e47fef9eSflorian if(iq->timeout_count < MAX_MINIMISE_TIMEOUT_COUNT) 2522ae8c6e27Sflorian /* Do not increment qname, continue incrementing next 2523ae8c6e27Sflorian * iteration */ 2524ae8c6e27Sflorian iq->minimisation_state = MINIMISE_STATE; 2525ae8c6e27Sflorian else if(!qstate->env->cfg->qname_minimisation_strict) 2526ae8c6e27Sflorian /* Too many time-outs detected for this QNAME and QTYPE. 2527ae8c6e27Sflorian * We give up, disable QNAME minimisation. */ 2528ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 2529ae8c6e27Sflorian } 2530ae8c6e27Sflorian if(iq->minimisation_state == DONOT_MINIMISE_STATE) 2531ae8c6e27Sflorian iq->qinfo_out = iq->qchase; 2532ae8c6e27Sflorian 2533ae8c6e27Sflorian /* now find an answer to this query */ 2534ae8c6e27Sflorian /* see if authority zones have an answer */ 2535ae8c6e27Sflorian /* now we know the dp, we can check the auth zone for locally hosted 2536ae8c6e27Sflorian * contents */ 2537ae8c6e27Sflorian if(!iq->auth_zone_avoid && qstate->blacklist) { 2538ae8c6e27Sflorian if(auth_zones_can_fallback(qstate->env->auth_zones, 2539ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, iq->qinfo_out.qclass)) { 2540ae8c6e27Sflorian /* if cache is blacklisted and this zone allows us 2541ae8c6e27Sflorian * to fallback to the internet, then do so, and 2542ae8c6e27Sflorian * fetch results from the internet servers */ 2543ae8c6e27Sflorian iq->auth_zone_avoid = 1; 2544ae8c6e27Sflorian } 2545ae8c6e27Sflorian } 2546ae8c6e27Sflorian if(iq->auth_zone_avoid) { 2547ae8c6e27Sflorian iq->auth_zone_avoid = 0; 2548ae8c6e27Sflorian auth_fallback = 1; 2549ae8c6e27Sflorian } else if(auth_zones_lookup(qstate->env->auth_zones, &iq->qinfo_out, 2550ae8c6e27Sflorian qstate->region, &iq->response, &auth_fallback, iq->dp->name, 2551ae8c6e27Sflorian iq->dp->namelen)) { 2552ae8c6e27Sflorian /* use this as a response to be processed by the iterator */ 2553ae8c6e27Sflorian if(verbosity >= VERB_ALGO) { 2554ae8c6e27Sflorian log_dns_msg("msg from auth zone", 2555ae8c6e27Sflorian &iq->response->qinfo, iq->response->rep); 2556ae8c6e27Sflorian } 2557ae8c6e27Sflorian if((iq->chase_flags&BIT_RD) && !(iq->response->rep->flags&BIT_AA)) { 2558ae8c6e27Sflorian verbose(VERB_ALGO, "forwarder, ignoring referral from auth zone"); 2559ae8c6e27Sflorian } else { 2560ae8c6e27Sflorian lock_rw_wrlock(&qstate->env->auth_zones->lock); 2561ae8c6e27Sflorian qstate->env->auth_zones->num_query_up++; 2562ae8c6e27Sflorian lock_rw_unlock(&qstate->env->auth_zones->lock); 2563ae8c6e27Sflorian iq->num_current_queries++; 2564ae8c6e27Sflorian iq->chase_to_rd = 0; 2565ae8c6e27Sflorian iq->dnssec_lame_query = 0; 2566ae8c6e27Sflorian iq->auth_zone_response = 1; 2567ae8c6e27Sflorian return next_state(iq, QUERY_RESP_STATE); 2568ae8c6e27Sflorian } 2569ae8c6e27Sflorian } 2570ae8c6e27Sflorian iq->auth_zone_response = 0; 2571ae8c6e27Sflorian if(auth_fallback == 0) { 2572ae8c6e27Sflorian /* like we got servfail from the auth zone lookup, and 2573ae8c6e27Sflorian * no internet fallback */ 2574ae8c6e27Sflorian verbose(VERB_ALGO, "auth zone lookup failed, no fallback," 2575ae8c6e27Sflorian " servfail"); 2576ae8c6e27Sflorian errinf(qstate, "auth zone lookup failed, fallback is off"); 2577ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2578ae8c6e27Sflorian } 2579e97c6e54Ssthen if(iq->dp->auth_dp) { 2580ae8c6e27Sflorian /* we wanted to fallback, but had no delegpt, only the 2581ae8c6e27Sflorian * auth zone generated delegpt, create an actual one */ 2582ae8c6e27Sflorian iq->auth_zone_avoid = 1; 2583ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_STATE); 2584ae8c6e27Sflorian } 2585ae8c6e27Sflorian /* but mostly, fallback==1 (like, when no such auth zone exists) 2586ae8c6e27Sflorian * and we continue with lookups */ 2587ae8c6e27Sflorian 2588ae8c6e27Sflorian tf_policy = 0; 2589ae8c6e27Sflorian /* < not <=, because although the array is large enough for <=, the 2590ae8c6e27Sflorian * generated query will immediately be discarded due to depth and 2591ae8c6e27Sflorian * that servfail is cached, which is not good as opportunism goes. */ 2592ae8c6e27Sflorian if(iq->depth < ie->max_dependency_depth 25935a7d75e6Ssthen && iq->num_target_queries == 0 25946d08cb1bSflorian && (!iq->target_count || iq->target_count[TARGET_COUNT_NX]==0) 2595*5c45b740Sflorian && iq->sent_count < TARGET_FETCH_STOP) { 2596*5c45b740Sflorian can_do_promisc = 1; 2597*5c45b740Sflorian } 2598*5c45b740Sflorian /* if the mesh query list is full, then do not waste cpu and sockets to 2599*5c45b740Sflorian * fetch promiscuous targets. They can be looked up when needed. */ 2600*5c45b740Sflorian if(can_do_promisc && !mesh_jostle_exceeded(qstate->env->mesh)) { 2601ae8c6e27Sflorian tf_policy = ie->target_fetch_policy[iq->depth]; 2602ae8c6e27Sflorian } 2603ae8c6e27Sflorian 2604ae8c6e27Sflorian /* if in 0x20 fallback get as many targets as possible */ 2605ae8c6e27Sflorian if(iq->caps_fallback) { 2606ae8c6e27Sflorian int extra = 0; 2607ae8c6e27Sflorian size_t naddr, nres, navail; 2608ae8c6e27Sflorian if(!query_for_targets(qstate, iq, ie, id, -1, &extra)) { 2609ae8c6e27Sflorian errinf(qstate, "could not fetch nameservers for 0x20 fallback"); 2610ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2611ae8c6e27Sflorian } 2612ae8c6e27Sflorian iq->num_target_queries += extra; 2613ae8c6e27Sflorian target_count_increase(iq, extra); 2614ae8c6e27Sflorian if(iq->num_target_queries > 0) { 2615ae8c6e27Sflorian /* wait to get all targets, we want to try em */ 2616ae8c6e27Sflorian verbose(VERB_ALGO, "wait for all targets for fallback"); 2617ae8c6e27Sflorian qstate->ext_state[id] = module_wait_reply; 2618988ebc2dSflorian /* undo qname minimise step because we'll get back here 2619988ebc2dSflorian * to do it again */ 2620988ebc2dSflorian if(qout_orig && iq->minimise_count > 0) { 2621988ebc2dSflorian iq->minimise_count--; 2622988ebc2dSflorian iq->qinfo_out.qname = qout_orig; 2623988ebc2dSflorian iq->qinfo_out.qname_len = qout_orig_len; 2624988ebc2dSflorian } 2625ae8c6e27Sflorian return 0; 2626ae8c6e27Sflorian } 2627ae8c6e27Sflorian /* did we do enough fallback queries already? */ 2628ae8c6e27Sflorian delegpt_count_addr(iq->dp, &naddr, &nres, &navail); 2629ae8c6e27Sflorian /* the current caps_server is the number of fallbacks sent. 2630ae8c6e27Sflorian * the original query is one that matched too, so we have 2631ae8c6e27Sflorian * caps_server+1 number of matching queries now */ 2632ae8c6e27Sflorian if(iq->caps_server+1 >= naddr*3 || 2633ae8c6e27Sflorian iq->caps_server*2+2 >= MAX_SENT_COUNT) { 2634ae8c6e27Sflorian /* *2 on sentcount check because ipv6 may fail */ 2635ae8c6e27Sflorian /* we're done, process the response */ 2636ae8c6e27Sflorian verbose(VERB_ALGO, "0x20 fallback had %d responses " 2637ae8c6e27Sflorian "match for %d wanted, done.", 2638ae8c6e27Sflorian (int)iq->caps_server+1, (int)naddr*3); 2639ae8c6e27Sflorian iq->response = iq->caps_response; 2640ae8c6e27Sflorian iq->caps_fallback = 0; 2641a1a7ba80Sflorian iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */ 2642ae8c6e27Sflorian iq->num_current_queries++; /* RespState decrements it*/ 2643ae8c6e27Sflorian iq->referral_count++; /* make sure we don't loop */ 2644ae8c6e27Sflorian iq->sent_count = 0; 26455a7d75e6Ssthen iq->dp_target_count = 0; 2646ae8c6e27Sflorian iq->state = QUERY_RESP_STATE; 2647ae8c6e27Sflorian return 1; 2648ae8c6e27Sflorian } 2649ae8c6e27Sflorian verbose(VERB_ALGO, "0x20 fallback number %d", 2650ae8c6e27Sflorian (int)iq->caps_server); 2651ae8c6e27Sflorian 2652ae8c6e27Sflorian /* if there is a policy to fetch missing targets 2653ae8c6e27Sflorian * opportunistically, do it. we rely on the fact that once a 2654ae8c6e27Sflorian * query (or queries) for a missing name have been issued, 2655ae8c6e27Sflorian * they will not show up again. */ 2656ae8c6e27Sflorian } else if(tf_policy != 0) { 2657ae8c6e27Sflorian int extra = 0; 2658ae8c6e27Sflorian verbose(VERB_ALGO, "attempt to get extra %d targets", 2659ae8c6e27Sflorian tf_policy); 2660ae8c6e27Sflorian (void)query_for_targets(qstate, iq, ie, id, tf_policy, &extra); 2661ae8c6e27Sflorian /* errors ignored, these targets are not strictly necessary for 2662ae8c6e27Sflorian * this result, we do not have to reply with SERVFAIL */ 2663ae8c6e27Sflorian iq->num_target_queries += extra; 2664ae8c6e27Sflorian target_count_increase(iq, extra); 2665ae8c6e27Sflorian } 2666ae8c6e27Sflorian 2667ae8c6e27Sflorian /* Add the current set of unused targets to our queue. */ 2668ae8c6e27Sflorian delegpt_add_unused_targets(iq->dp); 2669ae8c6e27Sflorian 2670a1a7ba80Sflorian if(qstate->env->auth_zones) { 2671a1a7ba80Sflorian /* apply rpz triggers at query time */ 2672a1a7ba80Sflorian struct dns_msg* forged_response = rpz_callback_from_iterator_module(qstate, iq); 2673a1a7ba80Sflorian if(forged_response != NULL) { 2674a1a7ba80Sflorian qstate->ext_state[id] = module_finished; 2675a1a7ba80Sflorian qstate->return_rcode = LDNS_RCODE_NOERROR; 2676a1a7ba80Sflorian qstate->return_msg = forged_response; 2677a1a7ba80Sflorian iq->response = forged_response; 2678a1a7ba80Sflorian next_state(iq, FINISHED_STATE); 2679a1a7ba80Sflorian if(!iter_prepend(iq, qstate->return_msg, qstate->region)) { 26807a05b9dfSflorian log_err("rpz: prepend rrsets: out of memory"); 2681a1a7ba80Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2682a1a7ba80Sflorian } 2683a1a7ba80Sflorian return 0; 2684a1a7ba80Sflorian } 2685a1a7ba80Sflorian } 2686a1a7ba80Sflorian 2687ae8c6e27Sflorian /* Select the next usable target, filtering out unsuitable targets. */ 2688ae8c6e27Sflorian target = iter_server_selection(ie, qstate->env, iq->dp, 2689ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, iq->qchase.qtype, 2690ae8c6e27Sflorian &iq->dnssec_lame_query, &iq->chase_to_rd, 2691ae8c6e27Sflorian iq->num_target_queries, qstate->blacklist, 2692ae8c6e27Sflorian qstate->prefetch_leeway); 2693ae8c6e27Sflorian 2694ae8c6e27Sflorian /* If no usable target was selected... */ 2695ae8c6e27Sflorian if(!target) { 2696ae8c6e27Sflorian /* Here we distinguish between three states: generate a new 2697ae8c6e27Sflorian * target query, just wait, or quit (with a SERVFAIL). 2698ae8c6e27Sflorian * We have the following information: number of active 2699ae8c6e27Sflorian * target queries, number of active current queries, 2700ae8c6e27Sflorian * the presence of missing targets at this delegation 2701ae8c6e27Sflorian * point, and the given query target policy. */ 2702ae8c6e27Sflorian 2703ae8c6e27Sflorian /* Check for the wait condition. If this is true, then 2704ae8c6e27Sflorian * an action must be taken. */ 2705ae8c6e27Sflorian if(iq->num_target_queries==0 && iq->num_current_queries==0) { 2706ae8c6e27Sflorian /* If there is nothing to wait for, then we need 2707ae8c6e27Sflorian * to distinguish between generating (a) new target 2708ae8c6e27Sflorian * query, or failing. */ 27096d08cb1bSflorian if(delegpt_count_missing_targets(iq->dp, NULL) > 0) { 2710ae8c6e27Sflorian int qs = 0; 2711ae8c6e27Sflorian verbose(VERB_ALGO, "querying for next " 2712ae8c6e27Sflorian "missing target"); 2713ae8c6e27Sflorian if(!query_for_targets(qstate, iq, ie, id, 2714ae8c6e27Sflorian 1, &qs)) { 2715ae8c6e27Sflorian errinf(qstate, "could not fetch nameserver"); 2716ae8c6e27Sflorian errinf_dname(qstate, "at zone", iq->dp->name); 2717ae8c6e27Sflorian return error_response(qstate, id, 2718ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 2719ae8c6e27Sflorian } 2720ae8c6e27Sflorian if(qs == 0 && 27216d08cb1bSflorian delegpt_count_missing_targets(iq->dp, NULL) == 0){ 2722ae8c6e27Sflorian /* it looked like there were missing 2723ae8c6e27Sflorian * targets, but they did not turn up. 2724ae8c6e27Sflorian * Try the bad choices again (if any), 2725ae8c6e27Sflorian * when we get back here missing==0, 2726ae8c6e27Sflorian * so this is not a loop. */ 2727ae8c6e27Sflorian return 1; 2728ae8c6e27Sflorian } 2729ae8c6e27Sflorian iq->num_target_queries += qs; 2730ae8c6e27Sflorian target_count_increase(iq, qs); 2731ae8c6e27Sflorian } 2732ae8c6e27Sflorian /* Since a target query might have been made, we 2733ae8c6e27Sflorian * need to check again. */ 2734ae8c6e27Sflorian if(iq->num_target_queries == 0) { 2735ae8c6e27Sflorian /* if in capsforid fallback, instead of last 2736ae8c6e27Sflorian * resort, we agree with the current reply 2737ae8c6e27Sflorian * we have (if any) (our count of addrs bad)*/ 2738ae8c6e27Sflorian if(iq->caps_fallback && iq->caps_reply) { 2739ae8c6e27Sflorian /* we're done, process the response */ 2740ae8c6e27Sflorian verbose(VERB_ALGO, "0x20 fallback had %d responses, " 2741ae8c6e27Sflorian "but no more servers except " 2742ae8c6e27Sflorian "last resort, done.", 2743ae8c6e27Sflorian (int)iq->caps_server+1); 2744ae8c6e27Sflorian iq->response = iq->caps_response; 2745ae8c6e27Sflorian iq->caps_fallback = 0; 2746a1a7ba80Sflorian iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); /* space for fallback */ 2747ae8c6e27Sflorian iq->num_current_queries++; /* RespState decrements it*/ 2748ae8c6e27Sflorian iq->referral_count++; /* make sure we don't loop */ 2749ae8c6e27Sflorian iq->sent_count = 0; 27505a7d75e6Ssthen iq->dp_target_count = 0; 2751ae8c6e27Sflorian iq->state = QUERY_RESP_STATE; 2752ae8c6e27Sflorian return 1; 2753ae8c6e27Sflorian } 2754ae8c6e27Sflorian return processLastResort(qstate, iq, ie, id); 2755ae8c6e27Sflorian } 2756ae8c6e27Sflorian } 2757ae8c6e27Sflorian 2758ae8c6e27Sflorian /* otherwise, we have no current targets, so submerge 2759ae8c6e27Sflorian * until one of the target or direct queries return. */ 27606d08cb1bSflorian verbose(VERB_ALGO, "no current targets"); 27616d08cb1bSflorian check_waiting_queries(iq, qstate, id); 2762988ebc2dSflorian /* undo qname minimise step because we'll get back here 2763988ebc2dSflorian * to do it again */ 2764988ebc2dSflorian if(qout_orig && iq->minimise_count > 0) { 2765988ebc2dSflorian iq->minimise_count--; 2766988ebc2dSflorian iq->qinfo_out.qname = qout_orig; 2767988ebc2dSflorian iq->qinfo_out.qname_len = qout_orig_len; 2768988ebc2dSflorian } 2769ae8c6e27Sflorian return 0; 2770ae8c6e27Sflorian } 2771ae8c6e27Sflorian 2772*5c45b740Sflorian /* We have a target. We could have created promiscuous target 2773*5c45b740Sflorian * queries but we are currently under pressure (mesh_jostle_exceeded). 2774*5c45b740Sflorian * If we are configured to allow promiscuous target queries and haven't 2775*5c45b740Sflorian * gone out to the network for a target query for this delegation, then 2776*5c45b740Sflorian * it is possible to slip in a promiscuous one with a 1/10 chance. */ 2777*5c45b740Sflorian if(can_do_promisc && tf_policy == 0 && iq->depth == 0 2778*5c45b740Sflorian && iq->depth < ie->max_dependency_depth 2779*5c45b740Sflorian && ie->target_fetch_policy[iq->depth] != 0 2780*5c45b740Sflorian && iq->dp_target_count == 0 2781*5c45b740Sflorian && !ub_random_max(qstate->env->rnd, 10)) { 2782*5c45b740Sflorian int extra = 0; 2783*5c45b740Sflorian verbose(VERB_ALGO, "available target exists in cache but " 2784*5c45b740Sflorian "attempt to get extra 1 target"); 2785*5c45b740Sflorian (void)query_for_targets(qstate, iq, ie, id, 1, &extra); 2786*5c45b740Sflorian /* errors ignored, these targets are not strictly necessary for 2787*5c45b740Sflorian * this result, we do not have to reply with SERVFAIL */ 2788*5c45b740Sflorian if(extra > 0) { 2789*5c45b740Sflorian iq->num_target_queries += extra; 2790*5c45b740Sflorian target_count_increase(iq, extra); 2791*5c45b740Sflorian check_waiting_queries(iq, qstate, id); 2792*5c45b740Sflorian /* undo qname minimise step because we'll get back here 2793*5c45b740Sflorian * to do it again */ 2794*5c45b740Sflorian if(qout_orig && iq->minimise_count > 0) { 2795*5c45b740Sflorian iq->minimise_count--; 2796*5c45b740Sflorian iq->qinfo_out.qname = qout_orig; 2797*5c45b740Sflorian iq->qinfo_out.qname_len = qout_orig_len; 2798*5c45b740Sflorian } 2799*5c45b740Sflorian return 0; 2800*5c45b740Sflorian } 2801*5c45b740Sflorian } 2802*5c45b740Sflorian 2803a1a7ba80Sflorian /* Do not check ratelimit for forwarding queries or if we already got a 2804a1a7ba80Sflorian * pass. */ 2805a1a7ba80Sflorian sq_check_ratelimit = (!(iq->chase_flags & BIT_RD) && !iq->ratelimit_ok); 2806ae8c6e27Sflorian /* We have a valid target. */ 2807ae8c6e27Sflorian if(verbosity >= VERB_QUERY) { 2808ae8c6e27Sflorian log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out); 2809ae8c6e27Sflorian log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 2810ae8c6e27Sflorian &target->addr, target->addrlen); 2811ae8c6e27Sflorian verbose(VERB_ALGO, "dnssec status: %s%s", 2812ae8c6e27Sflorian iq->dnssec_expected?"expected": "not expected", 2813ae8c6e27Sflorian iq->dnssec_lame_query?" but lame_query anyway": ""); 2814ae8c6e27Sflorian } 2815ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query)); 2816ae8c6e27Sflorian outq = (*qstate->env->send_query)(&iq->qinfo_out, 2817ae8c6e27Sflorian iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), 2818ae8c6e27Sflorian /* unset CD if to forwarder(RD set) and not dnssec retry 2819ae8c6e27Sflorian * (blacklist nonempty) and no trust-anchors are configured 2820ae8c6e27Sflorian * above the qname or on the first attempt when dnssec is on */ 2821ae8c6e27Sflorian EDNS_DO| ((iq->chase_to_rd||(iq->chase_flags&BIT_RD)!=0)&& 2822ae8c6e27Sflorian !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env, 2823ae8c6e27Sflorian &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), 2824ae8c6e27Sflorian iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted( 2825a1a7ba80Sflorian ie, iq), sq_check_ratelimit, &target->addr, target->addrlen, 2826ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, 2827a1a7ba80Sflorian (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream), 2828ae8c6e27Sflorian (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), 2829a1a7ba80Sflorian target->tls_auth_name, qstate, &sq_was_ratelimited); 2830ae8c6e27Sflorian if(!outq) { 2831a1a7ba80Sflorian if(sq_was_ratelimited) { 2832a1a7ba80Sflorian lock_basic_lock(&ie->queries_ratelimit_lock); 2833a1a7ba80Sflorian ie->num_queries_ratelimited++; 2834a1a7ba80Sflorian lock_basic_unlock(&ie->queries_ratelimit_lock); 2835a1a7ba80Sflorian verbose(VERB_ALGO, "query exceeded ratelimits"); 2836a1a7ba80Sflorian qstate->was_ratelimited = 1; 2837a1a7ba80Sflorian errinf_dname(qstate, "exceeded ratelimit for zone", 2838a1a7ba80Sflorian iq->dp->name); 2839a1a7ba80Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 2840a1a7ba80Sflorian } 2841411c5950Sflorian log_addr(VERB_QUERY, "error sending query to auth server", 2842ae8c6e27Sflorian &target->addr, target->addrlen); 2843ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) 2844ae8c6e27Sflorian iq->minimisation_state = SKIP_MINIMISE_STATE; 2845ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 2846ae8c6e27Sflorian } 2847ae8c6e27Sflorian outbound_list_insert(&iq->outlist, outq); 2848ae8c6e27Sflorian iq->num_current_queries++; 2849ae8c6e27Sflorian iq->sent_count++; 2850ae8c6e27Sflorian qstate->ext_state[id] = module_wait_reply; 2851ae8c6e27Sflorian 2852ae8c6e27Sflorian return 0; 2853ae8c6e27Sflorian } 2854ae8c6e27Sflorian 2855ae8c6e27Sflorian /** find NS rrset in given list */ 2856ae8c6e27Sflorian static struct ub_packed_rrset_key* 2857ae8c6e27Sflorian find_NS(struct reply_info* rep, size_t from, size_t to) 2858ae8c6e27Sflorian { 2859ae8c6e27Sflorian size_t i; 2860ae8c6e27Sflorian for(i=from; i<to; i++) { 2861ae8c6e27Sflorian if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS) 2862ae8c6e27Sflorian return rep->rrsets[i]; 2863ae8c6e27Sflorian } 2864ae8c6e27Sflorian return NULL; 2865ae8c6e27Sflorian } 2866ae8c6e27Sflorian 2867ae8c6e27Sflorian 2868ae8c6e27Sflorian /** 2869ae8c6e27Sflorian * Process the query response. All queries end up at this state first. This 2870ae8c6e27Sflorian * process generally consists of analyzing the response and routing the 2871ae8c6e27Sflorian * event to the next state (either bouncing it back to a request state, or 2872ae8c6e27Sflorian * terminating the processing for this event). 2873ae8c6e27Sflorian * 2874ae8c6e27Sflorian * @param qstate: query state. 2875ae8c6e27Sflorian * @param iq: iterator query state. 2876a1a7ba80Sflorian * @param ie: iterator shared global environment. 2877ae8c6e27Sflorian * @param id: module id. 2878ae8c6e27Sflorian * @return true if the event requires more immediate processing, false if 2879ae8c6e27Sflorian * not. This is generally only true when forwarding the request to 2880ae8c6e27Sflorian * the final state (i.e., on answer). 2881ae8c6e27Sflorian */ 2882ae8c6e27Sflorian static int 2883ae8c6e27Sflorian processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, 2884a1a7ba80Sflorian struct iter_env* ie, int id) 2885ae8c6e27Sflorian { 2886ae8c6e27Sflorian int dnsseclame = 0; 2887ae8c6e27Sflorian enum response_type type; 2888a1a7ba80Sflorian 2889ae8c6e27Sflorian iq->num_current_queries--; 2890ae8c6e27Sflorian 2891ae8c6e27Sflorian if(!inplace_cb_query_response_call(qstate->env, qstate, iq->response)) 2892ae8c6e27Sflorian log_err("unable to call query_response callback"); 2893ae8c6e27Sflorian 2894ae8c6e27Sflorian if(iq->response == NULL) { 2895ae8c6e27Sflorian /* Don't increment qname when QNAME minimisation is enabled */ 2896ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) { 2897ae8c6e27Sflorian iq->minimisation_state = SKIP_MINIMISE_STATE; 2898ae8c6e27Sflorian } 2899e47fef9eSflorian iq->timeout_count++; 2900ae8c6e27Sflorian iq->chase_to_rd = 0; 2901ae8c6e27Sflorian iq->dnssec_lame_query = 0; 2902ae8c6e27Sflorian verbose(VERB_ALGO, "query response was timeout"); 2903ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 2904ae8c6e27Sflorian } 2905e47fef9eSflorian iq->timeout_count = 0; 2906ae8c6e27Sflorian type = response_type_from_server( 2907ae8c6e27Sflorian (int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 2908ae8c6e27Sflorian iq->response, &iq->qinfo_out, iq->dp); 2909ae8c6e27Sflorian iq->chase_to_rd = 0; 2910*5c45b740Sflorian /* remove TC flag, if this is erroneously set by TCP upstream */ 2911*5c45b740Sflorian iq->response->rep->flags &= ~BIT_TC; 2912ae8c6e27Sflorian if(type == RESPONSE_TYPE_REFERRAL && (iq->chase_flags&BIT_RD) && 2913ae8c6e27Sflorian !iq->auth_zone_response) { 2914ae8c6e27Sflorian /* When forwarding (RD bit is set), we handle referrals 2915ae8c6e27Sflorian * differently. No queries should be sent elsewhere */ 2916ae8c6e27Sflorian type = RESPONSE_TYPE_ANSWER; 2917ae8c6e27Sflorian } 2918ae8c6e27Sflorian if(!qstate->env->cfg->disable_dnssec_lame_check && iq->dnssec_expected 2919ae8c6e27Sflorian && !iq->dnssec_lame_query && 2920ae8c6e27Sflorian !(iq->chase_flags&BIT_RD) 2921ae8c6e27Sflorian && iq->sent_count < DNSSEC_LAME_DETECT_COUNT 2922ae8c6e27Sflorian && type != RESPONSE_TYPE_LAME 2923ae8c6e27Sflorian && type != RESPONSE_TYPE_REC_LAME 2924ae8c6e27Sflorian && type != RESPONSE_TYPE_THROWAWAY 2925ae8c6e27Sflorian && type != RESPONSE_TYPE_UNTYPED) { 2926ae8c6e27Sflorian /* a possible answer, see if it is missing DNSSEC */ 2927ae8c6e27Sflorian /* but not when forwarding, so we dont mark fwder lame */ 2928ae8c6e27Sflorian if(!iter_msg_has_dnssec(iq->response)) { 2929ae8c6e27Sflorian /* Mark this address as dnsseclame in this dp, 2930ae8c6e27Sflorian * because that will make serverselection disprefer 2931ae8c6e27Sflorian * it, but also, once it is the only final option, 2932ae8c6e27Sflorian * use dnssec-lame-bypass if it needs to query there.*/ 2933ae8c6e27Sflorian if(qstate->reply) { 2934ae8c6e27Sflorian struct delegpt_addr* a = delegpt_find_addr( 2935*5c45b740Sflorian iq->dp, &qstate->reply->remote_addr, 2936*5c45b740Sflorian qstate->reply->remote_addrlen); 2937ae8c6e27Sflorian if(a) a->dnsseclame = 1; 2938ae8c6e27Sflorian } 2939ae8c6e27Sflorian /* test the answer is from the zone we expected, 2940ae8c6e27Sflorian * otherwise, (due to parent,child on same server), we 2941ae8c6e27Sflorian * might mark the server,zone lame inappropriately */ 2942ae8c6e27Sflorian if(!iter_msg_from_zone(iq->response, iq->dp, type, 2943ae8c6e27Sflorian iq->qchase.qclass)) 2944ae8c6e27Sflorian qstate->reply = NULL; 2945ae8c6e27Sflorian type = RESPONSE_TYPE_LAME; 2946ae8c6e27Sflorian dnsseclame = 1; 2947ae8c6e27Sflorian } 2948ae8c6e27Sflorian } else iq->dnssec_lame_query = 0; 2949ae8c6e27Sflorian /* see if referral brings us close to the target */ 2950ae8c6e27Sflorian if(type == RESPONSE_TYPE_REFERRAL) { 2951ae8c6e27Sflorian struct ub_packed_rrset_key* ns = find_NS( 2952ae8c6e27Sflorian iq->response->rep, iq->response->rep->an_numrrsets, 2953ae8c6e27Sflorian iq->response->rep->an_numrrsets 2954ae8c6e27Sflorian + iq->response->rep->ns_numrrsets); 2955ae8c6e27Sflorian if(!ns) ns = find_NS(iq->response->rep, 0, 2956ae8c6e27Sflorian iq->response->rep->an_numrrsets); 2957ae8c6e27Sflorian if(!ns || !dname_strict_subdomain_c(ns->rk.dname, iq->dp->name) 2958ae8c6e27Sflorian || !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){ 2959ae8c6e27Sflorian verbose(VERB_ALGO, "bad referral, throwaway"); 2960ae8c6e27Sflorian type = RESPONSE_TYPE_THROWAWAY; 2961ae8c6e27Sflorian } else 2962ae8c6e27Sflorian iter_scrub_ds(iq->response, ns, iq->dp->name); 2963ae8c6e27Sflorian } else iter_scrub_ds(iq->response, NULL, NULL); 2964ae8c6e27Sflorian if(type == RESPONSE_TYPE_THROWAWAY && 2965ae8c6e27Sflorian FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) { 2966ae8c6e27Sflorian /* YXDOMAIN is a permanent error, no need to retry */ 2967ae8c6e27Sflorian type = RESPONSE_TYPE_ANSWER; 2968ae8c6e27Sflorian } 2969ae8c6e27Sflorian if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1 2970ae8c6e27Sflorian && ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) { 2971ae8c6e27Sflorian uint8_t* sname = NULL; 2972ae8c6e27Sflorian size_t snamelen = 0; 2973ae8c6e27Sflorian get_cname_target(iq->response->rep->rrsets[0], &sname, 2974ae8c6e27Sflorian &snamelen); 2975ae8c6e27Sflorian if(snamelen && dname_subdomain_c(sname, iq->response->rep->rrsets[0]->rk.dname)) { 2976ae8c6e27Sflorian /* DNAME to a subdomain loop; do not recurse */ 2977ae8c6e27Sflorian type = RESPONSE_TYPE_ANSWER; 2978ae8c6e27Sflorian } 2979ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_CNAME && 2980ae8c6e27Sflorian iq->qchase.qtype == LDNS_RR_TYPE_CNAME && 2981ae8c6e27Sflorian iq->minimisation_state == MINIMISE_STATE && 2982ae8c6e27Sflorian query_dname_compare(iq->qchase.qname, iq->qinfo_out.qname) == 0) { 2983ae8c6e27Sflorian /* The minimised query for full QTYPE and hidden QTYPE can be 2984ae8c6e27Sflorian * classified as CNAME response type, even when the original 2985ae8c6e27Sflorian * QTYPE=CNAME. This should be treated as answer response type. 2986ae8c6e27Sflorian */ 2987ae8c6e27Sflorian type = RESPONSE_TYPE_ANSWER; 2988ae8c6e27Sflorian } 2989ae8c6e27Sflorian 2990ae8c6e27Sflorian /* handle each of the type cases */ 2991ae8c6e27Sflorian if(type == RESPONSE_TYPE_ANSWER) { 2992ae8c6e27Sflorian /* ANSWER type responses terminate the query algorithm, 2993ae8c6e27Sflorian * so they sent on their */ 2994ae8c6e27Sflorian if(verbosity >= VERB_DETAIL) { 2995ae8c6e27Sflorian verbose(VERB_DETAIL, "query response was %s", 2996ae8c6e27Sflorian FLAGS_GET_RCODE(iq->response->rep->flags) 2997ae8c6e27Sflorian ==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER": 2998ae8c6e27Sflorian (iq->response->rep->an_numrrsets?"ANSWER": 2999ae8c6e27Sflorian "nodata ANSWER")); 3000ae8c6e27Sflorian } 3001ae8c6e27Sflorian /* if qtype is DS, check we have the right level of answer, 3002ae8c6e27Sflorian * like grandchild answer but we need the middle, reject it */ 3003ae8c6e27Sflorian if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point 3004ae8c6e27Sflorian && !(iq->chase_flags&BIT_RD) 3005ae8c6e27Sflorian && iter_ds_toolow(iq->response, iq->dp) 3006ae8c6e27Sflorian && iter_dp_cangodown(&iq->qchase, iq->dp)) { 3007ae8c6e27Sflorian /* close down outstanding requests to be discarded */ 3008ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 3009ae8c6e27Sflorian iq->num_current_queries = 0; 3010ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 3011ae8c6e27Sflorian qstate->env->detach_subs)); 3012ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 3013ae8c6e27Sflorian iq->num_target_queries = 0; 3014ae8c6e27Sflorian return processDSNSFind(qstate, iq, id); 3015ae8c6e27Sflorian } 3016ae8c6e27Sflorian if(!qstate->no_cache_store) 3017ae8c6e27Sflorian iter_dns_store(qstate->env, &iq->response->qinfo, 30187a05b9dfSflorian iq->response->rep, 30197a05b9dfSflorian iq->qchase.qtype != iq->response->qinfo.qtype, 30207a05b9dfSflorian qstate->prefetch_leeway, 3021ae8c6e27Sflorian iq->dp&&iq->dp->has_parent_side_NS, 30226d08cb1bSflorian qstate->region, qstate->query_flags, 30236d08cb1bSflorian qstate->qstarttime); 3024ae8c6e27Sflorian /* close down outstanding requests to be discarded */ 3025ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 3026ae8c6e27Sflorian iq->num_current_queries = 0; 3027ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 3028ae8c6e27Sflorian qstate->env->detach_subs)); 3029ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 3030ae8c6e27Sflorian iq->num_target_queries = 0; 3031ae8c6e27Sflorian if(qstate->reply) 3032ae8c6e27Sflorian sock_list_insert(&qstate->reply_origin, 3033*5c45b740Sflorian &qstate->reply->remote_addr, 3034*5c45b740Sflorian qstate->reply->remote_addrlen, qstate->region); 3035ae8c6e27Sflorian if(iq->minimisation_state != DONOT_MINIMISE_STATE 3036ae8c6e27Sflorian && !(iq->chase_flags & BIT_RD)) { 3037ae8c6e27Sflorian if(FLAGS_GET_RCODE(iq->response->rep->flags) != 3038ae8c6e27Sflorian LDNS_RCODE_NOERROR) { 30399b465e50Sflorian if(qstate->env->cfg->qname_minimisation_strict) { 30409b465e50Sflorian if(FLAGS_GET_RCODE(iq->response->rep->flags) == 30419b465e50Sflorian LDNS_RCODE_NXDOMAIN) { 30429b465e50Sflorian iter_scrub_nxdomain(iq->response); 3043ae8c6e27Sflorian return final_state(iq); 30449b465e50Sflorian } 30459b465e50Sflorian return error_response(qstate, id, 30469b465e50Sflorian LDNS_RCODE_SERVFAIL); 30479b465e50Sflorian } 3048ae8c6e27Sflorian /* Best effort qname-minimisation. 3049ae8c6e27Sflorian * Stop minimising and send full query when 3050ae8c6e27Sflorian * RCODE is not NOERROR. */ 3051ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 3052ae8c6e27Sflorian } 3053ae8c6e27Sflorian if(FLAGS_GET_RCODE(iq->response->rep->flags) == 3054ae8c6e27Sflorian LDNS_RCODE_NXDOMAIN) { 3055ae8c6e27Sflorian /* Stop resolving when NXDOMAIN is DNSSEC 3056ae8c6e27Sflorian * signed. Based on assumption that nameservers 3057ae8c6e27Sflorian * serving signed zones do not return NXDOMAIN 3058ae8c6e27Sflorian * for empty-non-terminals. */ 3059ae8c6e27Sflorian if(iq->dnssec_expected) 3060ae8c6e27Sflorian return final_state(iq); 3061ae8c6e27Sflorian /* Make subrequest to validate intermediate 3062ae8c6e27Sflorian * NXDOMAIN if harden-below-nxdomain is 3063ae8c6e27Sflorian * enabled. */ 30645a7d75e6Ssthen if(qstate->env->cfg->harden_below_nxdomain && 30655a7d75e6Ssthen qstate->env->need_to_validate) { 3066ae8c6e27Sflorian struct module_qstate* subq = NULL; 3067ae8c6e27Sflorian log_query_info(VERB_QUERY, 3068ae8c6e27Sflorian "schedule NXDOMAIN validation:", 3069ae8c6e27Sflorian &iq->response->qinfo); 3070ae8c6e27Sflorian if(!generate_sub_request( 3071ae8c6e27Sflorian iq->response->qinfo.qname, 3072ae8c6e27Sflorian iq->response->qinfo.qname_len, 3073ae8c6e27Sflorian iq->response->qinfo.qtype, 3074ae8c6e27Sflorian iq->response->qinfo.qclass, 3075ae8c6e27Sflorian qstate, id, iq, 3076ae8c6e27Sflorian INIT_REQUEST_STATE, 30775a7d75e6Ssthen FINISHED_STATE, &subq, 1, 1)) 3078ae8c6e27Sflorian verbose(VERB_ALGO, 3079ae8c6e27Sflorian "could not validate NXDOMAIN " 3080ae8c6e27Sflorian "response"); 3081ae8c6e27Sflorian } 3082ae8c6e27Sflorian } 3083ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 3084ae8c6e27Sflorian } 3085ae8c6e27Sflorian return final_state(iq); 3086ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_REFERRAL) { 3087ae8c6e27Sflorian /* REFERRAL type responses get a reset of the 3088ae8c6e27Sflorian * delegation point, and back to the QUERYTARGETS_STATE. */ 3089ae8c6e27Sflorian verbose(VERB_DETAIL, "query response was REFERRAL"); 3090ae8c6e27Sflorian 3091ae8c6e27Sflorian /* if hardened, only store referral if we asked for it */ 3092ae8c6e27Sflorian if(!qstate->no_cache_store && 3093ae8c6e27Sflorian (!qstate->env->cfg->harden_referral_path || 3094ae8c6e27Sflorian ( qstate->qinfo.qtype == LDNS_RR_TYPE_NS 3095ae8c6e27Sflorian && (qstate->query_flags&BIT_RD) 3096ae8c6e27Sflorian && !(qstate->query_flags&BIT_CD) 3097ae8c6e27Sflorian /* we know that all other NS rrsets are scrubbed 3098ae8c6e27Sflorian * away, thus on referral only one is left. 3099ae8c6e27Sflorian * see if that equals the query name... */ 3100ae8c6e27Sflorian && ( /* auth section, but sometimes in answer section*/ 3101ae8c6e27Sflorian reply_find_rrset_section_ns(iq->response->rep, 3102ae8c6e27Sflorian iq->qchase.qname, iq->qchase.qname_len, 3103ae8c6e27Sflorian LDNS_RR_TYPE_NS, iq->qchase.qclass) 3104ae8c6e27Sflorian || reply_find_rrset_section_an(iq->response->rep, 3105ae8c6e27Sflorian iq->qchase.qname, iq->qchase.qname_len, 3106ae8c6e27Sflorian LDNS_RR_TYPE_NS, iq->qchase.qclass) 3107ae8c6e27Sflorian ) 3108ae8c6e27Sflorian ))) { 3109ae8c6e27Sflorian /* Store the referral under the current query */ 3110ae8c6e27Sflorian /* no prefetch-leeway, since its not the answer */ 3111ae8c6e27Sflorian iter_dns_store(qstate->env, &iq->response->qinfo, 31126d08cb1bSflorian iq->response->rep, 1, 0, 0, NULL, 0, 31136d08cb1bSflorian qstate->qstarttime); 3114ae8c6e27Sflorian if(iq->store_parent_NS) 3115ae8c6e27Sflorian iter_store_parentside_NS(qstate->env, 3116ae8c6e27Sflorian iq->response->rep); 3117ae8c6e27Sflorian if(qstate->env->neg_cache) 3118ae8c6e27Sflorian val_neg_addreferral(qstate->env->neg_cache, 3119ae8c6e27Sflorian iq->response->rep, iq->dp->name); 3120ae8c6e27Sflorian } 3121ae8c6e27Sflorian /* store parent-side-in-zone-glue, if directly queried for */ 3122ae8c6e27Sflorian if(!qstate->no_cache_store && iq->query_for_pside_glue 3123ae8c6e27Sflorian && !iq->pside_glue) { 3124ae8c6e27Sflorian iq->pside_glue = reply_find_rrset(iq->response->rep, 3125ae8c6e27Sflorian iq->qchase.qname, iq->qchase.qname_len, 3126ae8c6e27Sflorian iq->qchase.qtype, iq->qchase.qclass); 3127ae8c6e27Sflorian if(iq->pside_glue) { 3128ae8c6e27Sflorian log_rrset_key(VERB_ALGO, "found parent-side " 3129ae8c6e27Sflorian "glue", iq->pside_glue); 3130ae8c6e27Sflorian iter_store_parentside_rrset(qstate->env, 3131ae8c6e27Sflorian iq->pside_glue); 3132ae8c6e27Sflorian } 3133ae8c6e27Sflorian } 3134ae8c6e27Sflorian 3135ae8c6e27Sflorian /* Reset the event state, setting the current delegation 3136ae8c6e27Sflorian * point to the referral. */ 3137ae8c6e27Sflorian iq->deleg_msg = iq->response; 3138ae8c6e27Sflorian iq->dp = delegpt_from_message(iq->response, qstate->region); 3139ae8c6e27Sflorian if (qstate->env->cfg->qname_minimisation) 3140ae8c6e27Sflorian iq->minimisation_state = INIT_MINIMISE_STATE; 3141ae8c6e27Sflorian if(!iq->dp) { 3142ae8c6e27Sflorian errinf(qstate, "malloc failure, for delegation point"); 3143ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3144ae8c6e27Sflorian } 3145ae8c6e27Sflorian if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 3146ae8c6e27Sflorian qstate->region, iq->dp)) { 3147ae8c6e27Sflorian errinf(qstate, "malloc failure, copy extra info into delegation point"); 3148ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3149ae8c6e27Sflorian } 3150ae8c6e27Sflorian if(iq->store_parent_NS && query_dname_compare(iq->dp->name, 3151ae8c6e27Sflorian iq->store_parent_NS->name) == 0) 3152a1a7ba80Sflorian iter_merge_retry_counts(iq->dp, iq->store_parent_NS, 3153a1a7ba80Sflorian ie->outbound_msg_retry); 3154ae8c6e27Sflorian delegpt_log(VERB_ALGO, iq->dp); 3155ae8c6e27Sflorian /* Count this as a referral. */ 3156ae8c6e27Sflorian iq->referral_count++; 3157ae8c6e27Sflorian iq->sent_count = 0; 31585a7d75e6Ssthen iq->dp_target_count = 0; 3159ae8c6e27Sflorian /* see if the next dp is a trust anchor, or a DS was sent 3160ae8c6e27Sflorian * along, indicating dnssec is expected for next zone */ 3161ae8c6e27Sflorian iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 3162ae8c6e27Sflorian iq->dp, iq->response, iq->qchase.qclass); 3163ae8c6e27Sflorian /* if dnssec, validating then also fetch the key for the DS */ 3164ae8c6e27Sflorian if(iq->dnssec_expected && qstate->env->cfg->prefetch_key && 3165ae8c6e27Sflorian !(qstate->query_flags&BIT_CD)) 3166ae8c6e27Sflorian generate_dnskey_prefetch(qstate, iq, id); 3167ae8c6e27Sflorian 3168ae8c6e27Sflorian /* spawn off NS and addr to auth servers for the NS we just 3169ae8c6e27Sflorian * got in the referral. This gets authoritative answer 3170ae8c6e27Sflorian * (answer section trust level) rrset. 3171ae8c6e27Sflorian * right after, we detach the subs, answer goes to cache. */ 3172ae8c6e27Sflorian if(qstate->env->cfg->harden_referral_path) 3173ae8c6e27Sflorian generate_ns_check(qstate, iq, id); 3174ae8c6e27Sflorian 3175ae8c6e27Sflorian /* stop current outstanding queries. 3176ae8c6e27Sflorian * FIXME: should the outstanding queries be waited for and 3177ae8c6e27Sflorian * handled? Say by a subquery that inherits the outbound_entry. 3178ae8c6e27Sflorian */ 3179ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 3180ae8c6e27Sflorian iq->num_current_queries = 0; 3181ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 3182ae8c6e27Sflorian qstate->env->detach_subs)); 3183ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 3184ae8c6e27Sflorian iq->num_target_queries = 0; 3185411c5950Sflorian iq->response = NULL; 3186411c5950Sflorian iq->fail_reply = NULL; 3187ae8c6e27Sflorian verbose(VERB_ALGO, "cleared outbound list for next round"); 3188ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 3189ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_CNAME) { 3190ae8c6e27Sflorian uint8_t* sname = NULL; 3191ae8c6e27Sflorian size_t snamelen = 0; 3192ae8c6e27Sflorian /* CNAME type responses get a query restart (i.e., get a 3193ae8c6e27Sflorian * reset of the query state and go back to INIT_REQUEST_STATE). 3194ae8c6e27Sflorian */ 3195ae8c6e27Sflorian verbose(VERB_DETAIL, "query response was CNAME"); 3196ae8c6e27Sflorian if(verbosity >= VERB_ALGO) 3197ae8c6e27Sflorian log_dns_msg("cname msg", &iq->response->qinfo, 3198ae8c6e27Sflorian iq->response->rep); 3199ae8c6e27Sflorian /* if qtype is DS, check we have the right level of answer, 3200ae8c6e27Sflorian * like grandchild answer but we need the middle, reject it */ 3201ae8c6e27Sflorian if(iq->qchase.qtype == LDNS_RR_TYPE_DS && !iq->dsns_point 3202ae8c6e27Sflorian && !(iq->chase_flags&BIT_RD) 3203ae8c6e27Sflorian && iter_ds_toolow(iq->response, iq->dp) 3204ae8c6e27Sflorian && iter_dp_cangodown(&iq->qchase, iq->dp)) { 3205ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 3206ae8c6e27Sflorian iq->num_current_queries = 0; 3207ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 3208ae8c6e27Sflorian qstate->env->detach_subs)); 3209ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 3210ae8c6e27Sflorian iq->num_target_queries = 0; 3211ae8c6e27Sflorian return processDSNSFind(qstate, iq, id); 3212ae8c6e27Sflorian } 3213ae8c6e27Sflorian /* Process the CNAME response. */ 3214ae8c6e27Sflorian if(!handle_cname_response(qstate, iq, iq->response, 3215ae8c6e27Sflorian &sname, &snamelen)) { 3216ae8c6e27Sflorian errinf(qstate, "malloc failure, CNAME info"); 3217ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3218ae8c6e27Sflorian } 3219ae8c6e27Sflorian /* cache the CNAME response under the current query */ 3220ae8c6e27Sflorian /* NOTE : set referral=1, so that rrsets get stored but not 3221ae8c6e27Sflorian * the partial query answer (CNAME only). */ 3222ae8c6e27Sflorian /* prefetchleeway applied because this updates answer parts */ 3223ae8c6e27Sflorian if(!qstate->no_cache_store) 3224ae8c6e27Sflorian iter_dns_store(qstate->env, &iq->response->qinfo, 3225ae8c6e27Sflorian iq->response->rep, 1, qstate->prefetch_leeway, 3226ae8c6e27Sflorian iq->dp&&iq->dp->has_parent_side_NS, NULL, 32276d08cb1bSflorian qstate->query_flags, qstate->qstarttime); 3228ae8c6e27Sflorian /* set the current request's qname to the new value. */ 3229ae8c6e27Sflorian iq->qchase.qname = sname; 3230ae8c6e27Sflorian iq->qchase.qname_len = snamelen; 3231a1a7ba80Sflorian if(qstate->env->auth_zones) { 3232a1a7ba80Sflorian /* apply rpz qname triggers after cname */ 3233a1a7ba80Sflorian struct dns_msg* forged_response = 3234a1a7ba80Sflorian rpz_callback_from_iterator_cname(qstate, iq); 3235a1a7ba80Sflorian while(forged_response && reply_find_rrset_section_an( 3236a1a7ba80Sflorian forged_response->rep, iq->qchase.qname, 3237a1a7ba80Sflorian iq->qchase.qname_len, LDNS_RR_TYPE_CNAME, 3238a1a7ba80Sflorian iq->qchase.qclass)) { 3239a1a7ba80Sflorian /* another cname to follow */ 3240a1a7ba80Sflorian if(!handle_cname_response(qstate, iq, forged_response, 3241a1a7ba80Sflorian &sname, &snamelen)) { 3242a1a7ba80Sflorian errinf(qstate, "malloc failure, CNAME info"); 3243a1a7ba80Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3244a1a7ba80Sflorian } 3245a1a7ba80Sflorian iq->qchase.qname = sname; 3246a1a7ba80Sflorian iq->qchase.qname_len = snamelen; 3247a1a7ba80Sflorian forged_response = 3248a1a7ba80Sflorian rpz_callback_from_iterator_cname(qstate, iq); 3249a1a7ba80Sflorian } 3250a1a7ba80Sflorian if(forged_response != NULL) { 3251a1a7ba80Sflorian qstate->ext_state[id] = module_finished; 3252a1a7ba80Sflorian qstate->return_rcode = LDNS_RCODE_NOERROR; 3253a1a7ba80Sflorian qstate->return_msg = forged_response; 3254a1a7ba80Sflorian iq->response = forged_response; 3255a1a7ba80Sflorian next_state(iq, FINISHED_STATE); 3256a1a7ba80Sflorian if(!iter_prepend(iq, qstate->return_msg, qstate->region)) { 32577a05b9dfSflorian log_err("rpz: after cname, prepend rrsets: out of memory"); 3258a1a7ba80Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3259a1a7ba80Sflorian } 3260a1a7ba80Sflorian qstate->return_msg->qinfo = qstate->qinfo; 3261a1a7ba80Sflorian return 0; 3262a1a7ba80Sflorian } 3263a1a7ba80Sflorian } 3264ae8c6e27Sflorian /* Clear the query state, since this is a query restart. */ 3265ae8c6e27Sflorian iq->deleg_msg = NULL; 3266ae8c6e27Sflorian iq->dp = NULL; 3267ae8c6e27Sflorian iq->dsns_point = NULL; 3268ae8c6e27Sflorian iq->auth_zone_response = 0; 3269ae8c6e27Sflorian iq->sent_count = 0; 32705a7d75e6Ssthen iq->dp_target_count = 0; 3271ae8c6e27Sflorian if(iq->minimisation_state != MINIMISE_STATE) 3272ae8c6e27Sflorian /* Only count as query restart when it is not an extra 3273ae8c6e27Sflorian * query as result of qname minimisation. */ 3274ae8c6e27Sflorian iq->query_restart_count++; 3275ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation) 3276ae8c6e27Sflorian iq->minimisation_state = INIT_MINIMISE_STATE; 3277ae8c6e27Sflorian 3278ae8c6e27Sflorian /* stop current outstanding queries. 3279ae8c6e27Sflorian * FIXME: should the outstanding queries be waited for and 3280ae8c6e27Sflorian * handled? Say by a subquery that inherits the outbound_entry. 3281ae8c6e27Sflorian */ 3282ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 3283ae8c6e27Sflorian iq->num_current_queries = 0; 3284ae8c6e27Sflorian fptr_ok(fptr_whitelist_modenv_detach_subs( 3285ae8c6e27Sflorian qstate->env->detach_subs)); 3286ae8c6e27Sflorian (*qstate->env->detach_subs)(qstate); 3287ae8c6e27Sflorian iq->num_target_queries = 0; 3288ae8c6e27Sflorian if(qstate->reply) 3289ae8c6e27Sflorian sock_list_insert(&qstate->reply_origin, 3290*5c45b740Sflorian &qstate->reply->remote_addr, 3291*5c45b740Sflorian qstate->reply->remote_addrlen, qstate->region); 3292ae8c6e27Sflorian verbose(VERB_ALGO, "cleared outbound list for query restart"); 3293ae8c6e27Sflorian /* go to INIT_REQUEST_STATE for new qname. */ 3294ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_STATE); 3295ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_LAME) { 3296ae8c6e27Sflorian /* Cache the LAMEness. */ 3297ae8c6e27Sflorian verbose(VERB_DETAIL, "query response was %sLAME", 3298ae8c6e27Sflorian dnsseclame?"DNSSEC ":""); 3299ae8c6e27Sflorian if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) { 3300ae8c6e27Sflorian log_err("mark lame: mismatch in qname and dpname"); 3301ae8c6e27Sflorian /* throwaway this reply below */ 3302ae8c6e27Sflorian } else if(qstate->reply) { 3303ae8c6e27Sflorian /* need addr for lameness cache, but we may have 3304ae8c6e27Sflorian * gotten this from cache, so test to be sure */ 3305ae8c6e27Sflorian if(!infra_set_lame(qstate->env->infra_cache, 3306*5c45b740Sflorian &qstate->reply->remote_addr, 3307*5c45b740Sflorian qstate->reply->remote_addrlen, 3308ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, 3309ae8c6e27Sflorian *qstate->env->now, dnsseclame, 0, 3310ae8c6e27Sflorian iq->qchase.qtype)) 3311ae8c6e27Sflorian log_err("mark host lame: out of memory"); 3312ae8c6e27Sflorian } 3313ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_REC_LAME) { 3314ae8c6e27Sflorian /* Cache the LAMEness. */ 3315ae8c6e27Sflorian verbose(VERB_DETAIL, "query response REC_LAME: " 3316ae8c6e27Sflorian "recursive but not authoritative server"); 3317ae8c6e27Sflorian if(!dname_subdomain_c(iq->qchase.qname, iq->dp->name)) { 3318ae8c6e27Sflorian log_err("mark rec_lame: mismatch in qname and dpname"); 3319ae8c6e27Sflorian /* throwaway this reply below */ 3320ae8c6e27Sflorian } else if(qstate->reply) { 3321ae8c6e27Sflorian /* need addr for lameness cache, but we may have 3322ae8c6e27Sflorian * gotten this from cache, so test to be sure */ 3323ae8c6e27Sflorian verbose(VERB_DETAIL, "mark as REC_LAME"); 3324ae8c6e27Sflorian if(!infra_set_lame(qstate->env->infra_cache, 3325*5c45b740Sflorian &qstate->reply->remote_addr, 3326*5c45b740Sflorian qstate->reply->remote_addrlen, 3327ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, 3328ae8c6e27Sflorian *qstate->env->now, 0, 1, iq->qchase.qtype)) 3329ae8c6e27Sflorian log_err("mark host lame: out of memory"); 3330ae8c6e27Sflorian } 3331ae8c6e27Sflorian } else if(type == RESPONSE_TYPE_THROWAWAY) { 3332ae8c6e27Sflorian /* LAME and THROWAWAY responses are handled the same way. 3333ae8c6e27Sflorian * In this case, the event is just sent directly back to 3334ae8c6e27Sflorian * the QUERYTARGETS_STATE without resetting anything, 3335ae8c6e27Sflorian * because, clearly, the next target must be tried. */ 3336ae8c6e27Sflorian verbose(VERB_DETAIL, "query response was THROWAWAY"); 3337ae8c6e27Sflorian } else { 3338ae8c6e27Sflorian log_warn("A query response came back with an unknown type: %d", 3339ae8c6e27Sflorian (int)type); 3340ae8c6e27Sflorian } 3341ae8c6e27Sflorian 3342ae8c6e27Sflorian /* LAME, THROWAWAY and "unknown" all end up here. 3343ae8c6e27Sflorian * Recycle to the QUERYTARGETS state to hopefully try a 3344ae8c6e27Sflorian * different target. */ 3345ae8c6e27Sflorian if (qstate->env->cfg->qname_minimisation && 3346ae8c6e27Sflorian !qstate->env->cfg->qname_minimisation_strict) 3347ae8c6e27Sflorian iq->minimisation_state = DONOT_MINIMISE_STATE; 3348ae8c6e27Sflorian if(iq->auth_zone_response) { 3349ae8c6e27Sflorian /* can we fallback? */ 3350ae8c6e27Sflorian iq->auth_zone_response = 0; 3351ae8c6e27Sflorian if(!auth_zones_can_fallback(qstate->env->auth_zones, 3352ae8c6e27Sflorian iq->dp->name, iq->dp->namelen, qstate->qinfo.qclass)) { 3353ae8c6e27Sflorian verbose(VERB_ALGO, "auth zone response bad, and no" 3354ae8c6e27Sflorian " fallback possible, servfail"); 3355ae8c6e27Sflorian errinf_dname(qstate, "response is bad, no fallback, " 3356ae8c6e27Sflorian "for auth zone", iq->dp->name); 3357ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3358ae8c6e27Sflorian } 3359ae8c6e27Sflorian verbose(VERB_ALGO, "auth zone response was bad, " 3360ae8c6e27Sflorian "fallback enabled"); 3361ae8c6e27Sflorian iq->auth_zone_avoid = 1; 3362ae8c6e27Sflorian if(iq->dp->auth_dp) { 3363ae8c6e27Sflorian /* we are using a dp for the auth zone, with no 3364ae8c6e27Sflorian * nameservers, get one first */ 3365ae8c6e27Sflorian iq->dp = NULL; 3366ae8c6e27Sflorian return next_state(iq, INIT_REQUEST_STATE); 3367ae8c6e27Sflorian } 3368ae8c6e27Sflorian } 3369ae8c6e27Sflorian return next_state(iq, QUERYTARGETS_STATE); 3370ae8c6e27Sflorian } 3371ae8c6e27Sflorian 3372ae8c6e27Sflorian /** 3373ae8c6e27Sflorian * Return priming query results to interested super querystates. 3374ae8c6e27Sflorian * 3375ae8c6e27Sflorian * Sets the delegation point and delegation message (not nonRD queries). 3376ae8c6e27Sflorian * This is a callback from walk_supers. 3377ae8c6e27Sflorian * 3378ae8c6e27Sflorian * @param qstate: priming query state that finished. 3379ae8c6e27Sflorian * @param id: module id. 3380ae8c6e27Sflorian * @param forq: the qstate for which priming has been done. 3381ae8c6e27Sflorian */ 3382ae8c6e27Sflorian static void 3383ae8c6e27Sflorian prime_supers(struct module_qstate* qstate, int id, struct module_qstate* forq) 3384ae8c6e27Sflorian { 3385ae8c6e27Sflorian struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 3386ae8c6e27Sflorian struct delegpt* dp = NULL; 3387ae8c6e27Sflorian 3388ae8c6e27Sflorian log_assert(qstate->is_priming || foriq->wait_priming_stub); 3389ae8c6e27Sflorian log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR); 3390ae8c6e27Sflorian /* Convert our response to a delegation point */ 3391ae8c6e27Sflorian dp = delegpt_from_message(qstate->return_msg, forq->region); 3392ae8c6e27Sflorian if(!dp) { 3393a1a7ba80Sflorian /* if there is no convertible delegation point, then 3394ae8c6e27Sflorian * the ANSWER type was (presumably) a negative answer. */ 3395ae8c6e27Sflorian verbose(VERB_ALGO, "prime response was not a positive " 3396ae8c6e27Sflorian "ANSWER; failing"); 3397ae8c6e27Sflorian foriq->dp = NULL; 3398ae8c6e27Sflorian foriq->state = QUERYTARGETS_STATE; 3399ae8c6e27Sflorian return; 3400ae8c6e27Sflorian } 3401ae8c6e27Sflorian 3402ae8c6e27Sflorian log_query_info(VERB_DETAIL, "priming successful for", &qstate->qinfo); 3403ae8c6e27Sflorian delegpt_log(VERB_ALGO, dp); 3404ae8c6e27Sflorian foriq->dp = dp; 3405ae8c6e27Sflorian foriq->deleg_msg = dns_copy_msg(qstate->return_msg, forq->region); 3406ae8c6e27Sflorian if(!foriq->deleg_msg) { 3407ae8c6e27Sflorian log_err("copy prime response: out of memory"); 3408ae8c6e27Sflorian foriq->dp = NULL; 3409ae8c6e27Sflorian foriq->state = QUERYTARGETS_STATE; 3410ae8c6e27Sflorian return; 3411ae8c6e27Sflorian } 3412ae8c6e27Sflorian 3413ae8c6e27Sflorian /* root priming responses go to init stage 2, priming stub 3414ae8c6e27Sflorian * responses to to stage 3. */ 3415ae8c6e27Sflorian if(foriq->wait_priming_stub) { 3416ae8c6e27Sflorian foriq->state = INIT_REQUEST_3_STATE; 3417ae8c6e27Sflorian foriq->wait_priming_stub = 0; 3418ae8c6e27Sflorian } else foriq->state = INIT_REQUEST_2_STATE; 3419ae8c6e27Sflorian /* because we are finished, the parent will be reactivated */ 3420ae8c6e27Sflorian } 3421ae8c6e27Sflorian 3422ae8c6e27Sflorian /** 3423ae8c6e27Sflorian * This handles the response to a priming query. This is used to handle both 3424ae8c6e27Sflorian * root and stub priming responses. This is basically the equivalent of the 3425ae8c6e27Sflorian * QUERY_RESP_STATE, but will not handle CNAME responses and will treat 3426ae8c6e27Sflorian * REFERRALs as ANSWERS. It will also update and reactivate the originating 3427ae8c6e27Sflorian * event. 3428ae8c6e27Sflorian * 3429ae8c6e27Sflorian * @param qstate: query state. 3430ae8c6e27Sflorian * @param id: module id. 3431ae8c6e27Sflorian * @return true if the event needs more immediate processing, false if not. 3432ae8c6e27Sflorian * This state always returns false. 3433ae8c6e27Sflorian */ 3434ae8c6e27Sflorian static int 3435ae8c6e27Sflorian processPrimeResponse(struct module_qstate* qstate, int id) 3436ae8c6e27Sflorian { 3437ae8c6e27Sflorian struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 3438ae8c6e27Sflorian enum response_type type; 3439ae8c6e27Sflorian iq->response->rep->flags &= ~(BIT_RD|BIT_RA); /* ignore rec-lame */ 3440ae8c6e27Sflorian type = response_type_from_server( 3441ae8c6e27Sflorian (int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 3442ae8c6e27Sflorian iq->response, &iq->qchase, iq->dp); 3443ae8c6e27Sflorian if(type == RESPONSE_TYPE_ANSWER) { 3444ae8c6e27Sflorian qstate->return_rcode = LDNS_RCODE_NOERROR; 3445ae8c6e27Sflorian qstate->return_msg = iq->response; 3446ae8c6e27Sflorian } else { 3447ae8c6e27Sflorian errinf(qstate, "prime response did not get an answer"); 3448ae8c6e27Sflorian errinf_dname(qstate, "for", qstate->qinfo.qname); 3449ae8c6e27Sflorian qstate->return_rcode = LDNS_RCODE_SERVFAIL; 3450ae8c6e27Sflorian qstate->return_msg = NULL; 3451ae8c6e27Sflorian } 3452ae8c6e27Sflorian 3453ae8c6e27Sflorian /* validate the root or stub after priming (if enabled). 3454ae8c6e27Sflorian * This is the same query as the prime query, but with validation. 3455ae8c6e27Sflorian * Now that we are primed, the additional queries that validation 3456f4f0f0ceSflorian * may need can be resolved. */ 3457ae8c6e27Sflorian if(qstate->env->cfg->harden_referral_path) { 3458ae8c6e27Sflorian struct module_qstate* subq = NULL; 3459ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "schedule prime validation", 3460ae8c6e27Sflorian qstate->qinfo.qname, qstate->qinfo.qtype, 3461ae8c6e27Sflorian qstate->qinfo.qclass); 3462ae8c6e27Sflorian if(!generate_sub_request(qstate->qinfo.qname, 3463ae8c6e27Sflorian qstate->qinfo.qname_len, qstate->qinfo.qtype, 3464ae8c6e27Sflorian qstate->qinfo.qclass, qstate, id, iq, 34655a7d75e6Ssthen INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) { 3466ae8c6e27Sflorian verbose(VERB_ALGO, "could not generate prime check"); 3467ae8c6e27Sflorian } 3468ae8c6e27Sflorian generate_a_aaaa_check(qstate, iq, id); 3469ae8c6e27Sflorian } 3470ae8c6e27Sflorian 3471ae8c6e27Sflorian /* This event is finished. */ 3472ae8c6e27Sflorian qstate->ext_state[id] = module_finished; 3473ae8c6e27Sflorian return 0; 3474ae8c6e27Sflorian } 3475ae8c6e27Sflorian 3476ae8c6e27Sflorian /** 3477ae8c6e27Sflorian * Do final processing on responses to target queries. Events reach this 3478ae8c6e27Sflorian * state after the iterative resolution algorithm terminates. This state is 3479ae8c6e27Sflorian * responsible for reactivating the original event, and housekeeping related 3480ae8c6e27Sflorian * to received target responses (caching, updating the current delegation 3481ae8c6e27Sflorian * point, etc). 3482ae8c6e27Sflorian * Callback from walk_supers for every super state that is interested in 3483ae8c6e27Sflorian * the results from this query. 3484ae8c6e27Sflorian * 3485ae8c6e27Sflorian * @param qstate: query state. 3486ae8c6e27Sflorian * @param id: module id. 3487ae8c6e27Sflorian * @param forq: super query state. 3488ae8c6e27Sflorian */ 3489ae8c6e27Sflorian static void 3490ae8c6e27Sflorian processTargetResponse(struct module_qstate* qstate, int id, 3491ae8c6e27Sflorian struct module_qstate* forq) 3492ae8c6e27Sflorian { 34935a7d75e6Ssthen struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 3494ae8c6e27Sflorian struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 3495ae8c6e27Sflorian struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 3496ae8c6e27Sflorian struct ub_packed_rrset_key* rrset; 3497ae8c6e27Sflorian struct delegpt_ns* dpns; 3498ae8c6e27Sflorian log_assert(qstate->return_rcode == LDNS_RCODE_NOERROR); 3499ae8c6e27Sflorian 3500ae8c6e27Sflorian foriq->state = QUERYTARGETS_STATE; 3501ae8c6e27Sflorian log_query_info(VERB_ALGO, "processTargetResponse", &qstate->qinfo); 3502ae8c6e27Sflorian log_query_info(VERB_ALGO, "processTargetResponse super", &forq->qinfo); 3503ae8c6e27Sflorian 3504ae8c6e27Sflorian /* Tell the originating event that this target query has finished 3505ae8c6e27Sflorian * (regardless if it succeeded or not). */ 3506ae8c6e27Sflorian foriq->num_target_queries--; 3507ae8c6e27Sflorian 3508ae8c6e27Sflorian /* check to see if parent event is still interested (in orig name). */ 3509ae8c6e27Sflorian if(!foriq->dp) { 3510ae8c6e27Sflorian verbose(VERB_ALGO, "subq: parent not interested, was reset"); 3511ae8c6e27Sflorian return; /* not interested anymore */ 3512ae8c6e27Sflorian } 3513ae8c6e27Sflorian dpns = delegpt_find_ns(foriq->dp, qstate->qinfo.qname, 3514ae8c6e27Sflorian qstate->qinfo.qname_len); 3515ae8c6e27Sflorian if(!dpns) { 3516ae8c6e27Sflorian /* If not interested, just stop processing this event */ 3517ae8c6e27Sflorian verbose(VERB_ALGO, "subq: parent not interested anymore"); 3518ae8c6e27Sflorian /* could be because parent was jostled out of the cache, 3519ae8c6e27Sflorian and a new identical query arrived, that does not want it*/ 3520ae8c6e27Sflorian return; 3521ae8c6e27Sflorian } 3522ae8c6e27Sflorian 3523ae8c6e27Sflorian /* if iq->query_for_pside_glue then add the pside_glue (marked lame) */ 3524ae8c6e27Sflorian if(iq->pside_glue) { 3525ae8c6e27Sflorian /* if the pside_glue is NULL, then it could not be found, 3526ae8c6e27Sflorian * the done_pside is already set when created and a cache 3527ae8c6e27Sflorian * entry created in processFinished so nothing to do here */ 3528ae8c6e27Sflorian log_rrset_key(VERB_ALGO, "add parentside glue to dp", 3529ae8c6e27Sflorian iq->pside_glue); 3530ae8c6e27Sflorian if(!delegpt_add_rrset(foriq->dp, forq->region, 35315a7d75e6Ssthen iq->pside_glue, 1, NULL)) 3532ae8c6e27Sflorian log_err("out of memory adding pside glue"); 3533ae8c6e27Sflorian } 3534ae8c6e27Sflorian 3535ae8c6e27Sflorian /* This response is relevant to the current query, so we 3536ae8c6e27Sflorian * add (attempt to add, anyway) this target(s) and reactivate 3537ae8c6e27Sflorian * the original event. 3538ae8c6e27Sflorian * NOTE: we could only look for the AnswerRRset if the 3539ae8c6e27Sflorian * response type was ANSWER. */ 3540ae8c6e27Sflorian rrset = reply_find_answer_rrset(&iq->qchase, qstate->return_msg->rep); 3541ae8c6e27Sflorian if(rrset) { 35425a7d75e6Ssthen int additions = 0; 3543ae8c6e27Sflorian /* if CNAMEs have been followed - add new NS to delegpt. */ 3544ae8c6e27Sflorian /* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */ 3545ae8c6e27Sflorian if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 3546ae8c6e27Sflorian rrset->rk.dname_len)) { 3547ae8c6e27Sflorian /* if dpns->lame then set newcname ns lame too */ 3548ae8c6e27Sflorian if(!delegpt_add_ns(foriq->dp, forq->region, 3549a1a7ba80Sflorian rrset->rk.dname, dpns->lame, dpns->tls_auth_name, 3550a1a7ba80Sflorian dpns->port)) 3551ae8c6e27Sflorian log_err("out of memory adding cnamed-ns"); 3552ae8c6e27Sflorian } 3553ae8c6e27Sflorian /* if dpns->lame then set the address(es) lame too */ 3554ae8c6e27Sflorian if(!delegpt_add_rrset(foriq->dp, forq->region, rrset, 35555a7d75e6Ssthen dpns->lame, &additions)) 3556ae8c6e27Sflorian log_err("out of memory adding targets"); 35575a7d75e6Ssthen if(!additions) { 35585a7d75e6Ssthen /* no new addresses, increase the nxns counter, like 35595a7d75e6Ssthen * this could be a list of wildcards with no new 35605a7d75e6Ssthen * addresses */ 35615a7d75e6Ssthen target_count_increase_nx(foriq, 1); 35625a7d75e6Ssthen } 3563ae8c6e27Sflorian verbose(VERB_ALGO, "added target response"); 3564ae8c6e27Sflorian delegpt_log(VERB_ALGO, foriq->dp); 3565ae8c6e27Sflorian } else { 3566ae8c6e27Sflorian verbose(VERB_ALGO, "iterator TargetResponse failed"); 35675a7d75e6Ssthen delegpt_mark_neg(dpns, qstate->qinfo.qtype); 35685a7d75e6Ssthen if((dpns->got4 == 2 || !ie->supports_ipv4) && 3569*5c45b740Sflorian (dpns->got6 == 2 || !ie->supports_ipv6)) { 3570*5c45b740Sflorian dpns->resolved = 1; /* fail the target */ 35716d08cb1bSflorian /* do not count cached answers */ 3572*5c45b740Sflorian if(qstate->reply_origin && qstate->reply_origin->len != 0) { 35735a7d75e6Ssthen target_count_increase_nx(foriq, 1); 3574ae8c6e27Sflorian } 3575ae8c6e27Sflorian } 35766d08cb1bSflorian } 3577*5c45b740Sflorian } 3578ae8c6e27Sflorian 3579ae8c6e27Sflorian /** 3580ae8c6e27Sflorian * Process response for DS NS Find queries, that attempt to find the delegation 3581ae8c6e27Sflorian * point where we ask the DS query from. 3582ae8c6e27Sflorian * 3583ae8c6e27Sflorian * @param qstate: query state. 3584ae8c6e27Sflorian * @param id: module id. 3585ae8c6e27Sflorian * @param forq: super query state. 3586ae8c6e27Sflorian */ 3587ae8c6e27Sflorian static void 3588ae8c6e27Sflorian processDSNSResponse(struct module_qstate* qstate, int id, 3589ae8c6e27Sflorian struct module_qstate* forq) 3590ae8c6e27Sflorian { 3591ae8c6e27Sflorian struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 3592ae8c6e27Sflorian 3593ae8c6e27Sflorian /* if the finished (iq->response) query has no NS set: continue 3594ae8c6e27Sflorian * up to look for the right dp; nothing to change, do DPNSstate */ 3595ae8c6e27Sflorian if(qstate->return_rcode != LDNS_RCODE_NOERROR) 3596ae8c6e27Sflorian return; /* seek further */ 3597ae8c6e27Sflorian /* find the NS RRset (without allowing CNAMEs) */ 3598ae8c6e27Sflorian if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname, 3599ae8c6e27Sflorian qstate->qinfo.qname_len, LDNS_RR_TYPE_NS, 3600ae8c6e27Sflorian qstate->qinfo.qclass)){ 3601ae8c6e27Sflorian return; /* seek further */ 3602ae8c6e27Sflorian } 3603ae8c6e27Sflorian 3604ae8c6e27Sflorian /* else, store as DP and continue at querytargets */ 3605ae8c6e27Sflorian foriq->state = QUERYTARGETS_STATE; 3606ae8c6e27Sflorian foriq->dp = delegpt_from_message(qstate->return_msg, forq->region); 3607ae8c6e27Sflorian if(!foriq->dp) { 3608ae8c6e27Sflorian log_err("out of memory in dsns dp alloc"); 3609ae8c6e27Sflorian errinf(qstate, "malloc failure, in DS search"); 3610ae8c6e27Sflorian return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */ 3611ae8c6e27Sflorian } 3612ae8c6e27Sflorian /* success, go query the querytargets in the new dp (and go down) */ 3613ae8c6e27Sflorian } 3614ae8c6e27Sflorian 3615ae8c6e27Sflorian /** 3616ae8c6e27Sflorian * Process response for qclass=ANY queries for a particular class. 3617ae8c6e27Sflorian * Append to result or error-exit. 3618ae8c6e27Sflorian * 3619ae8c6e27Sflorian * @param qstate: query state. 3620ae8c6e27Sflorian * @param id: module id. 3621ae8c6e27Sflorian * @param forq: super query state. 3622ae8c6e27Sflorian */ 3623ae8c6e27Sflorian static void 3624ae8c6e27Sflorian processClassResponse(struct module_qstate* qstate, int id, 3625ae8c6e27Sflorian struct module_qstate* forq) 3626ae8c6e27Sflorian { 3627ae8c6e27Sflorian struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id]; 3628ae8c6e27Sflorian struct dns_msg* from = qstate->return_msg; 3629ae8c6e27Sflorian log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo); 3630ae8c6e27Sflorian log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo); 3631ae8c6e27Sflorian if(qstate->return_rcode != LDNS_RCODE_NOERROR) { 3632ae8c6e27Sflorian /* cause servfail for qclass ANY query */ 3633ae8c6e27Sflorian foriq->response = NULL; 3634ae8c6e27Sflorian foriq->state = FINISHED_STATE; 3635ae8c6e27Sflorian return; 3636ae8c6e27Sflorian } 3637ae8c6e27Sflorian /* append result */ 3638ae8c6e27Sflorian if(!foriq->response) { 3639ae8c6e27Sflorian /* allocate the response: copy RCODE, sec_state */ 3640ae8c6e27Sflorian foriq->response = dns_copy_msg(from, forq->region); 3641ae8c6e27Sflorian if(!foriq->response) { 3642ae8c6e27Sflorian log_err("malloc failed for qclass ANY response"); 3643ae8c6e27Sflorian foriq->state = FINISHED_STATE; 3644ae8c6e27Sflorian return; 3645ae8c6e27Sflorian } 3646ae8c6e27Sflorian foriq->response->qinfo.qclass = forq->qinfo.qclass; 3647ae8c6e27Sflorian /* qclass ANY does not receive the AA flag on replies */ 3648ae8c6e27Sflorian foriq->response->rep->authoritative = 0; 3649ae8c6e27Sflorian } else { 3650ae8c6e27Sflorian struct dns_msg* to = foriq->response; 3651ae8c6e27Sflorian /* add _from_ this response _to_ existing collection */ 3652ae8c6e27Sflorian /* if there are records, copy RCODE */ 3653ae8c6e27Sflorian /* lower sec_state if this message is lower */ 3654ae8c6e27Sflorian if(from->rep->rrset_count != 0) { 3655ae8c6e27Sflorian size_t n = from->rep->rrset_count+to->rep->rrset_count; 3656ae8c6e27Sflorian struct ub_packed_rrset_key** dest, **d; 3657ae8c6e27Sflorian /* copy appropriate rcode */ 3658ae8c6e27Sflorian to->rep->flags = from->rep->flags; 3659ae8c6e27Sflorian /* copy rrsets */ 3660ae8c6e27Sflorian if(from->rep->rrset_count > RR_COUNT_MAX || 3661ae8c6e27Sflorian to->rep->rrset_count > RR_COUNT_MAX) { 3662ae8c6e27Sflorian log_err("malloc failed (too many rrsets) in collect ANY"); 3663ae8c6e27Sflorian foriq->state = FINISHED_STATE; 3664ae8c6e27Sflorian return; /* integer overflow protection */ 3665ae8c6e27Sflorian } 3666ae8c6e27Sflorian dest = regional_alloc(forq->region, sizeof(dest[0])*n); 3667ae8c6e27Sflorian if(!dest) { 3668ae8c6e27Sflorian log_err("malloc failed in collect ANY"); 3669ae8c6e27Sflorian foriq->state = FINISHED_STATE; 3670ae8c6e27Sflorian return; 3671ae8c6e27Sflorian } 3672ae8c6e27Sflorian d = dest; 3673ae8c6e27Sflorian /* copy AN */ 3674ae8c6e27Sflorian memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets 3675ae8c6e27Sflorian * sizeof(dest[0])); 3676ae8c6e27Sflorian dest += to->rep->an_numrrsets; 3677ae8c6e27Sflorian memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets 3678ae8c6e27Sflorian * sizeof(dest[0])); 3679ae8c6e27Sflorian dest += from->rep->an_numrrsets; 3680ae8c6e27Sflorian /* copy NS */ 3681ae8c6e27Sflorian memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets, 3682ae8c6e27Sflorian to->rep->ns_numrrsets * sizeof(dest[0])); 3683ae8c6e27Sflorian dest += to->rep->ns_numrrsets; 3684ae8c6e27Sflorian memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets, 3685ae8c6e27Sflorian from->rep->ns_numrrsets * sizeof(dest[0])); 3686ae8c6e27Sflorian dest += from->rep->ns_numrrsets; 3687ae8c6e27Sflorian /* copy AR */ 3688ae8c6e27Sflorian memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+ 3689ae8c6e27Sflorian to->rep->ns_numrrsets, 3690ae8c6e27Sflorian to->rep->ar_numrrsets * sizeof(dest[0])); 3691ae8c6e27Sflorian dest += to->rep->ar_numrrsets; 3692ae8c6e27Sflorian memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+ 3693ae8c6e27Sflorian from->rep->ns_numrrsets, 3694ae8c6e27Sflorian from->rep->ar_numrrsets * sizeof(dest[0])); 3695ae8c6e27Sflorian /* update counts */ 3696ae8c6e27Sflorian to->rep->rrsets = d; 3697ae8c6e27Sflorian to->rep->an_numrrsets += from->rep->an_numrrsets; 3698ae8c6e27Sflorian to->rep->ns_numrrsets += from->rep->ns_numrrsets; 3699ae8c6e27Sflorian to->rep->ar_numrrsets += from->rep->ar_numrrsets; 3700ae8c6e27Sflorian to->rep->rrset_count = n; 3701ae8c6e27Sflorian } 3702ae8c6e27Sflorian if(from->rep->security < to->rep->security) /* lowest sec */ 3703ae8c6e27Sflorian to->rep->security = from->rep->security; 3704ae8c6e27Sflorian if(from->rep->qdcount != 0) /* insert qd if appropriate */ 3705ae8c6e27Sflorian to->rep->qdcount = from->rep->qdcount; 3706ae8c6e27Sflorian if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */ 3707ae8c6e27Sflorian to->rep->ttl = from->rep->ttl; 3708ae8c6e27Sflorian if(from->rep->prefetch_ttl < to->rep->prefetch_ttl) 3709ae8c6e27Sflorian to->rep->prefetch_ttl = from->rep->prefetch_ttl; 3710ae8c6e27Sflorian if(from->rep->serve_expired_ttl < to->rep->serve_expired_ttl) 3711ae8c6e27Sflorian to->rep->serve_expired_ttl = from->rep->serve_expired_ttl; 3712ae8c6e27Sflorian } 3713ae8c6e27Sflorian /* are we done? */ 3714ae8c6e27Sflorian foriq->num_current_queries --; 3715ae8c6e27Sflorian if(foriq->num_current_queries == 0) 3716ae8c6e27Sflorian foriq->state = FINISHED_STATE; 3717ae8c6e27Sflorian } 3718ae8c6e27Sflorian 3719ae8c6e27Sflorian /** 3720ae8c6e27Sflorian * Collect class ANY responses and make them into one response. This 3721ae8c6e27Sflorian * state is started and it creates queries for all classes (that have 3722ae8c6e27Sflorian * root hints). The answers are then collected. 3723ae8c6e27Sflorian * 3724ae8c6e27Sflorian * @param qstate: query state. 3725ae8c6e27Sflorian * @param id: module id. 3726ae8c6e27Sflorian * @return true if the event needs more immediate processing, false if not. 3727ae8c6e27Sflorian */ 3728ae8c6e27Sflorian static int 3729ae8c6e27Sflorian processCollectClass(struct module_qstate* qstate, int id) 3730ae8c6e27Sflorian { 3731ae8c6e27Sflorian struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 3732ae8c6e27Sflorian struct module_qstate* subq; 3733ae8c6e27Sflorian /* If qchase.qclass == 0 then send out queries for all classes. 3734ae8c6e27Sflorian * Otherwise, do nothing (wait for all answers to arrive and the 3735ae8c6e27Sflorian * processClassResponse to put them together, and that moves us 3736ae8c6e27Sflorian * towards the Finished state when done. */ 3737ae8c6e27Sflorian if(iq->qchase.qclass == 0) { 3738ae8c6e27Sflorian uint16_t c = 0; 3739ae8c6e27Sflorian iq->qchase.qclass = LDNS_RR_CLASS_ANY; 3740ae8c6e27Sflorian while(iter_get_next_root(qstate->env->hints, 3741ae8c6e27Sflorian qstate->env->fwds, &c)) { 3742ae8c6e27Sflorian /* generate query for this class */ 3743ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "spawn collect query", 3744ae8c6e27Sflorian qstate->qinfo.qname, qstate->qinfo.qtype, c); 3745ae8c6e27Sflorian if(!generate_sub_request(qstate->qinfo.qname, 3746ae8c6e27Sflorian qstate->qinfo.qname_len, qstate->qinfo.qtype, 3747ae8c6e27Sflorian c, qstate, id, iq, INIT_REQUEST_STATE, 3748ae8c6e27Sflorian FINISHED_STATE, &subq, 37495a7d75e6Ssthen (int)!(qstate->query_flags&BIT_CD), 0)) { 3750ae8c6e27Sflorian errinf(qstate, "could not generate class ANY" 3751ae8c6e27Sflorian " lookup query"); 3752ae8c6e27Sflorian return error_response(qstate, id, 3753ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 3754ae8c6e27Sflorian } 3755ae8c6e27Sflorian /* ignore subq, no special init required */ 3756ae8c6e27Sflorian iq->num_current_queries ++; 3757ae8c6e27Sflorian if(c == 0xffff) 3758ae8c6e27Sflorian break; 3759ae8c6e27Sflorian else c++; 3760ae8c6e27Sflorian } 3761ae8c6e27Sflorian /* if no roots are configured at all, return */ 3762ae8c6e27Sflorian if(iq->num_current_queries == 0) { 3763ae8c6e27Sflorian verbose(VERB_ALGO, "No root hints or fwds, giving up " 3764ae8c6e27Sflorian "on qclass ANY"); 3765ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_REFUSED); 3766ae8c6e27Sflorian } 3767ae8c6e27Sflorian /* return false, wait for queries to return */ 3768ae8c6e27Sflorian } 3769ae8c6e27Sflorian /* if woke up here because of an answer, wait for more answers */ 3770ae8c6e27Sflorian return 0; 3771ae8c6e27Sflorian } 3772ae8c6e27Sflorian 3773ae8c6e27Sflorian /** 3774ae8c6e27Sflorian * This handles the final state for first-tier responses (i.e., responses to 3775ae8c6e27Sflorian * externally generated queries). 3776ae8c6e27Sflorian * 3777ae8c6e27Sflorian * @param qstate: query state. 3778ae8c6e27Sflorian * @param iq: iterator query state. 3779ae8c6e27Sflorian * @param id: module id. 3780ae8c6e27Sflorian * @return true if the event needs more processing, false if not. Since this 3781ae8c6e27Sflorian * is the final state for an event, it always returns false. 3782ae8c6e27Sflorian */ 3783ae8c6e27Sflorian static int 3784ae8c6e27Sflorian processFinished(struct module_qstate* qstate, struct iter_qstate* iq, 3785ae8c6e27Sflorian int id) 3786ae8c6e27Sflorian { 3787ae8c6e27Sflorian log_query_info(VERB_QUERY, "finishing processing for", 3788ae8c6e27Sflorian &qstate->qinfo); 3789ae8c6e27Sflorian 3790ae8c6e27Sflorian /* store negative cache element for parent side glue. */ 3791ae8c6e27Sflorian if(!qstate->no_cache_store && iq->query_for_pside_glue 3792ae8c6e27Sflorian && !iq->pside_glue) 3793ae8c6e27Sflorian iter_store_parentside_neg(qstate->env, &qstate->qinfo, 3794ae8c6e27Sflorian iq->deleg_msg?iq->deleg_msg->rep: 3795ae8c6e27Sflorian (iq->response?iq->response->rep:NULL)); 3796ae8c6e27Sflorian if(!iq->response) { 3797ae8c6e27Sflorian verbose(VERB_ALGO, "No response is set, servfail"); 3798ae8c6e27Sflorian errinf(qstate, "(no response found at query finish)"); 3799ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3800ae8c6e27Sflorian } 3801ae8c6e27Sflorian 3802ae8c6e27Sflorian /* Make sure that the RA flag is set (since the presence of 3803ae8c6e27Sflorian * this module means that recursion is available) */ 3804ae8c6e27Sflorian iq->response->rep->flags |= BIT_RA; 3805ae8c6e27Sflorian 3806ae8c6e27Sflorian /* Clear the AA flag */ 3807ae8c6e27Sflorian /* FIXME: does this action go here or in some other module? */ 3808ae8c6e27Sflorian iq->response->rep->flags &= ~BIT_AA; 3809ae8c6e27Sflorian 3810ae8c6e27Sflorian /* make sure QR flag is on */ 3811ae8c6e27Sflorian iq->response->rep->flags |= BIT_QR; 3812ae8c6e27Sflorian 3813ae8c6e27Sflorian /* we have finished processing this query */ 3814ae8c6e27Sflorian qstate->ext_state[id] = module_finished; 3815ae8c6e27Sflorian 3816ae8c6e27Sflorian /* TODO: we are using a private TTL, trim the response. */ 3817ae8c6e27Sflorian /* if (mPrivateTTL > 0){IterUtils.setPrivateTTL(resp, mPrivateTTL); } */ 3818ae8c6e27Sflorian 3819ae8c6e27Sflorian /* prepend any items we have accumulated */ 3820ae8c6e27Sflorian if(iq->an_prepend_list || iq->ns_prepend_list) { 3821ae8c6e27Sflorian if(!iter_prepend(iq, iq->response, qstate->region)) { 3822ae8c6e27Sflorian log_err("prepend rrsets: out of memory"); 3823ae8c6e27Sflorian return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3824ae8c6e27Sflorian } 3825ae8c6e27Sflorian /* reset the query name back */ 3826ae8c6e27Sflorian iq->response->qinfo = qstate->qinfo; 3827ae8c6e27Sflorian /* the security state depends on the combination */ 3828ae8c6e27Sflorian iq->response->rep->security = sec_status_unchecked; 3829ae8c6e27Sflorian /* store message with the finished prepended items, 3830ae8c6e27Sflorian * but only if we did recursion. The nonrecursion referral 3831ae8c6e27Sflorian * from cache does not need to be stored in the msg cache. */ 3832ae8c6e27Sflorian if(!qstate->no_cache_store && qstate->query_flags&BIT_RD) { 3833ae8c6e27Sflorian iter_dns_store(qstate->env, &qstate->qinfo, 3834ae8c6e27Sflorian iq->response->rep, 0, qstate->prefetch_leeway, 3835ae8c6e27Sflorian iq->dp&&iq->dp->has_parent_side_NS, 38366d08cb1bSflorian qstate->region, qstate->query_flags, 38376d08cb1bSflorian qstate->qstarttime); 3838ae8c6e27Sflorian } 3839ae8c6e27Sflorian } 3840ae8c6e27Sflorian qstate->return_rcode = LDNS_RCODE_NOERROR; 3841ae8c6e27Sflorian qstate->return_msg = iq->response; 3842ae8c6e27Sflorian return 0; 3843ae8c6e27Sflorian } 3844ae8c6e27Sflorian 3845ae8c6e27Sflorian /* 3846ae8c6e27Sflorian * Return priming query results to interested super querystates. 3847ae8c6e27Sflorian * 3848ae8c6e27Sflorian * Sets the delegation point and delegation message (not nonRD queries). 3849ae8c6e27Sflorian * This is a callback from walk_supers. 3850ae8c6e27Sflorian * 3851ae8c6e27Sflorian * @param qstate: query state that finished. 3852ae8c6e27Sflorian * @param id: module id. 3853ae8c6e27Sflorian * @param super: the qstate to inform. 3854ae8c6e27Sflorian */ 3855ae8c6e27Sflorian void 3856ae8c6e27Sflorian iter_inform_super(struct module_qstate* qstate, int id, 3857ae8c6e27Sflorian struct module_qstate* super) 3858ae8c6e27Sflorian { 3859ae8c6e27Sflorian if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY) 3860ae8c6e27Sflorian processClassResponse(qstate, id, super); 3861ae8c6e27Sflorian else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*) 3862ae8c6e27Sflorian super->minfo[id])->state == DSNS_FIND_STATE) 3863ae8c6e27Sflorian processDSNSResponse(qstate, id, super); 3864ae8c6e27Sflorian else if(qstate->return_rcode != LDNS_RCODE_NOERROR) 3865ae8c6e27Sflorian error_supers(qstate, id, super); 3866ae8c6e27Sflorian else if(qstate->is_priming) 3867ae8c6e27Sflorian prime_supers(qstate, id, super); 3868ae8c6e27Sflorian else processTargetResponse(qstate, id, super); 3869ae8c6e27Sflorian } 3870ae8c6e27Sflorian 3871ae8c6e27Sflorian /** 3872ae8c6e27Sflorian * Handle iterator state. 3873ae8c6e27Sflorian * Handle events. This is the real processing loop for events, responsible 3874ae8c6e27Sflorian * for moving events through the various states. If a processing method 3875ae8c6e27Sflorian * returns true, then it will be advanced to the next state. If false, then 3876ae8c6e27Sflorian * processing will stop. 3877ae8c6e27Sflorian * 3878ae8c6e27Sflorian * @param qstate: query state. 3879ae8c6e27Sflorian * @param ie: iterator shared global environment. 3880ae8c6e27Sflorian * @param iq: iterator query state. 3881ae8c6e27Sflorian * @param id: module id. 3882ae8c6e27Sflorian */ 3883ae8c6e27Sflorian static void 3884ae8c6e27Sflorian iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, 3885ae8c6e27Sflorian struct iter_env* ie, int id) 3886ae8c6e27Sflorian { 3887ae8c6e27Sflorian int cont = 1; 3888ae8c6e27Sflorian while(cont) { 3889ae8c6e27Sflorian verbose(VERB_ALGO, "iter_handle processing q with state %s", 3890ae8c6e27Sflorian iter_state_to_string(iq->state)); 3891ae8c6e27Sflorian switch(iq->state) { 3892ae8c6e27Sflorian case INIT_REQUEST_STATE: 3893ae8c6e27Sflorian cont = processInitRequest(qstate, iq, ie, id); 3894ae8c6e27Sflorian break; 3895ae8c6e27Sflorian case INIT_REQUEST_2_STATE: 3896ae8c6e27Sflorian cont = processInitRequest2(qstate, iq, id); 3897ae8c6e27Sflorian break; 3898ae8c6e27Sflorian case INIT_REQUEST_3_STATE: 3899ae8c6e27Sflorian cont = processInitRequest3(qstate, iq, id); 3900ae8c6e27Sflorian break; 3901ae8c6e27Sflorian case QUERYTARGETS_STATE: 3902ae8c6e27Sflorian cont = processQueryTargets(qstate, iq, ie, id); 3903ae8c6e27Sflorian break; 3904ae8c6e27Sflorian case QUERY_RESP_STATE: 3905a1a7ba80Sflorian cont = processQueryResponse(qstate, iq, ie, id); 3906ae8c6e27Sflorian break; 3907ae8c6e27Sflorian case PRIME_RESP_STATE: 3908ae8c6e27Sflorian cont = processPrimeResponse(qstate, id); 3909ae8c6e27Sflorian break; 3910ae8c6e27Sflorian case COLLECT_CLASS_STATE: 3911ae8c6e27Sflorian cont = processCollectClass(qstate, id); 3912ae8c6e27Sflorian break; 3913ae8c6e27Sflorian case DSNS_FIND_STATE: 3914ae8c6e27Sflorian cont = processDSNSFind(qstate, iq, id); 3915ae8c6e27Sflorian break; 3916ae8c6e27Sflorian case FINISHED_STATE: 3917ae8c6e27Sflorian cont = processFinished(qstate, iq, id); 3918ae8c6e27Sflorian break; 3919ae8c6e27Sflorian default: 3920ae8c6e27Sflorian log_warn("iterator: invalid state: %d", 3921ae8c6e27Sflorian iq->state); 3922ae8c6e27Sflorian cont = 0; 3923ae8c6e27Sflorian break; 3924ae8c6e27Sflorian } 3925ae8c6e27Sflorian } 3926ae8c6e27Sflorian } 3927ae8c6e27Sflorian 3928ae8c6e27Sflorian /** 3929ae8c6e27Sflorian * This is the primary entry point for processing request events. Note that 3930ae8c6e27Sflorian * this method should only be used by external modules. 3931ae8c6e27Sflorian * @param qstate: query state. 3932ae8c6e27Sflorian * @param ie: iterator shared global environment. 3933ae8c6e27Sflorian * @param iq: iterator query state. 3934ae8c6e27Sflorian * @param id: module id. 3935ae8c6e27Sflorian */ 3936ae8c6e27Sflorian static void 3937ae8c6e27Sflorian process_request(struct module_qstate* qstate, struct iter_qstate* iq, 3938ae8c6e27Sflorian struct iter_env* ie, int id) 3939ae8c6e27Sflorian { 3940ae8c6e27Sflorian /* external requests start in the INIT state, and finish using the 3941ae8c6e27Sflorian * FINISHED state. */ 3942ae8c6e27Sflorian iq->state = INIT_REQUEST_STATE; 3943ae8c6e27Sflorian iq->final_state = FINISHED_STATE; 3944ae8c6e27Sflorian verbose(VERB_ALGO, "process_request: new external request event"); 3945ae8c6e27Sflorian iter_handle(qstate, iq, ie, id); 3946ae8c6e27Sflorian } 3947ae8c6e27Sflorian 3948ae8c6e27Sflorian /** process authoritative server reply */ 3949ae8c6e27Sflorian static void 3950ae8c6e27Sflorian process_response(struct module_qstate* qstate, struct iter_qstate* iq, 3951ae8c6e27Sflorian struct iter_env* ie, int id, struct outbound_entry* outbound, 3952ae8c6e27Sflorian enum module_ev event) 3953ae8c6e27Sflorian { 3954ae8c6e27Sflorian struct msg_parse* prs; 3955ae8c6e27Sflorian struct edns_data edns; 3956ae8c6e27Sflorian sldns_buffer* pkt; 3957ae8c6e27Sflorian 3958ae8c6e27Sflorian verbose(VERB_ALGO, "process_response: new external response event"); 3959ae8c6e27Sflorian iq->response = NULL; 3960ae8c6e27Sflorian iq->state = QUERY_RESP_STATE; 3961ae8c6e27Sflorian if(event == module_event_noreply || event == module_event_error) { 3962e47fef9eSflorian if(event == module_event_noreply && iq->timeout_count >= 3 && 3963ae8c6e27Sflorian qstate->env->cfg->use_caps_bits_for_id && 3964e97c6e54Ssthen !iq->caps_fallback && !is_caps_whitelisted(ie, iq)) { 3965ae8c6e27Sflorian /* start fallback */ 3966ae8c6e27Sflorian iq->caps_fallback = 1; 3967ae8c6e27Sflorian iq->caps_server = 0; 3968ae8c6e27Sflorian iq->caps_reply = NULL; 3969ae8c6e27Sflorian iq->caps_response = NULL; 3970ae8c6e27Sflorian iq->caps_minimisation_state = DONOT_MINIMISE_STATE; 3971ae8c6e27Sflorian iq->state = QUERYTARGETS_STATE; 3972ae8c6e27Sflorian iq->num_current_queries--; 3973ae8c6e27Sflorian /* need fresh attempts for the 0x20 fallback, if 3974ae8c6e27Sflorian * that was the cause for the failure */ 3975a1a7ba80Sflorian iter_dec_attempts(iq->dp, 3, ie->outbound_msg_retry); 3976ae8c6e27Sflorian verbose(VERB_DETAIL, "Capsforid: timeouts, starting fallback"); 3977ae8c6e27Sflorian goto handle_it; 3978ae8c6e27Sflorian } 3979ae8c6e27Sflorian goto handle_it; 3980ae8c6e27Sflorian } 3981ae8c6e27Sflorian if( (event != module_event_reply && event != module_event_capsfail) 3982ae8c6e27Sflorian || !qstate->reply) { 3983ae8c6e27Sflorian log_err("Bad event combined with response"); 3984ae8c6e27Sflorian outbound_list_remove(&iq->outlist, outbound); 3985ae8c6e27Sflorian errinf(qstate, "module iterator received wrong internal event with a response message"); 3986ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 3987ae8c6e27Sflorian return; 3988ae8c6e27Sflorian } 3989ae8c6e27Sflorian 3990ae8c6e27Sflorian /* parse message */ 3991411c5950Sflorian iq->fail_reply = qstate->reply; 3992ae8c6e27Sflorian prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, 3993ae8c6e27Sflorian sizeof(struct msg_parse)); 3994ae8c6e27Sflorian if(!prs) { 3995ae8c6e27Sflorian log_err("out of memory on incoming message"); 3996ae8c6e27Sflorian /* like packet got dropped */ 3997ae8c6e27Sflorian goto handle_it; 3998ae8c6e27Sflorian } 3999ae8c6e27Sflorian memset(prs, 0, sizeof(*prs)); 4000ae8c6e27Sflorian memset(&edns, 0, sizeof(edns)); 4001ae8c6e27Sflorian pkt = qstate->reply->c->buffer; 4002ae8c6e27Sflorian sldns_buffer_set_position(pkt, 0); 4003ae8c6e27Sflorian if(parse_packet(pkt, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) { 4004ae8c6e27Sflorian verbose(VERB_ALGO, "parse error on reply packet"); 4005411c5950Sflorian iq->parse_failures++; 4006ae8c6e27Sflorian goto handle_it; 4007ae8c6e27Sflorian } 4008ae8c6e27Sflorian /* edns is not examined, but removed from message to help cache */ 4009a1a7ba80Sflorian if(parse_extract_edns_from_response_msg(prs, &edns, qstate->env->scratch) != 4010411c5950Sflorian LDNS_RCODE_NOERROR) { 4011411c5950Sflorian iq->parse_failures++; 4012ae8c6e27Sflorian goto handle_it; 4013411c5950Sflorian } 4014ae8c6e27Sflorian 4015ae8c6e27Sflorian /* Copy the edns options we may got from the back end */ 4016a1a7ba80Sflorian if(edns.opt_list_in) { 4017a1a7ba80Sflorian qstate->edns_opts_back_in = edns_opt_copy_region(edns.opt_list_in, 4018ae8c6e27Sflorian qstate->region); 4019ae8c6e27Sflorian if(!qstate->edns_opts_back_in) { 4020ae8c6e27Sflorian log_err("out of memory on incoming message"); 4021ae8c6e27Sflorian /* like packet got dropped */ 4022ae8c6e27Sflorian goto handle_it; 4023ae8c6e27Sflorian } 4024ae8c6e27Sflorian if(!inplace_cb_edns_back_parsed_call(qstate->env, qstate)) { 4025ae8c6e27Sflorian log_err("unable to call edns_back_parsed callback"); 4026ae8c6e27Sflorian goto handle_it; 4027ae8c6e27Sflorian } 4028ae8c6e27Sflorian } 4029ae8c6e27Sflorian 4030ae8c6e27Sflorian /* remove CD-bit, we asked for in case we handle validation ourself */ 4031ae8c6e27Sflorian prs->flags &= ~BIT_CD; 4032ae8c6e27Sflorian 4033ae8c6e27Sflorian /* normalize and sanitize: easy to delete items from linked lists */ 4034ae8c6e27Sflorian if(!scrub_message(pkt, prs, &iq->qinfo_out, iq->dp->name, 4035ae8c6e27Sflorian qstate->env->scratch, qstate->env, ie)) { 4036ae8c6e27Sflorian /* if 0x20 enabled, start fallback, but we have no message */ 4037ae8c6e27Sflorian if(event == module_event_capsfail && !iq->caps_fallback) { 4038ae8c6e27Sflorian iq->caps_fallback = 1; 4039ae8c6e27Sflorian iq->caps_server = 0; 4040ae8c6e27Sflorian iq->caps_reply = NULL; 4041ae8c6e27Sflorian iq->caps_response = NULL; 4042ae8c6e27Sflorian iq->caps_minimisation_state = DONOT_MINIMISE_STATE; 4043ae8c6e27Sflorian iq->state = QUERYTARGETS_STATE; 4044ae8c6e27Sflorian iq->num_current_queries--; 4045ae8c6e27Sflorian verbose(VERB_DETAIL, "Capsforid: scrub failed, starting fallback with no response"); 4046ae8c6e27Sflorian } 4047411c5950Sflorian iq->scrub_failures++; 4048ae8c6e27Sflorian goto handle_it; 4049ae8c6e27Sflorian } 4050ae8c6e27Sflorian 4051ae8c6e27Sflorian /* allocate response dns_msg in region */ 4052ae8c6e27Sflorian iq->response = dns_alloc_msg(pkt, prs, qstate->region); 4053ae8c6e27Sflorian if(!iq->response) 4054ae8c6e27Sflorian goto handle_it; 4055ae8c6e27Sflorian log_query_info(VERB_DETAIL, "response for", &qstate->qinfo); 4056ae8c6e27Sflorian log_name_addr(VERB_DETAIL, "reply from", iq->dp->name, 4057*5c45b740Sflorian &qstate->reply->remote_addr, qstate->reply->remote_addrlen); 4058ae8c6e27Sflorian if(verbosity >= VERB_ALGO) 4059ae8c6e27Sflorian log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 4060ae8c6e27Sflorian iq->response->rep); 4061ae8c6e27Sflorian 4062ae8c6e27Sflorian if(event == module_event_capsfail || iq->caps_fallback) { 4063ae8c6e27Sflorian if(qstate->env->cfg->qname_minimisation && 4064ae8c6e27Sflorian iq->minimisation_state != DONOT_MINIMISE_STATE) { 4065ae8c6e27Sflorian /* Skip QNAME minimisation for next query, since that 4066ae8c6e27Sflorian * one has to match the current query. */ 4067ae8c6e27Sflorian iq->minimisation_state = SKIP_MINIMISE_STATE; 4068ae8c6e27Sflorian } 4069ae8c6e27Sflorian /* for fallback we care about main answer, not additionals */ 4070ae8c6e27Sflorian /* removing that makes comparison more likely to succeed */ 4071ae8c6e27Sflorian caps_strip_reply(iq->response->rep); 4072ae8c6e27Sflorian 4073ae8c6e27Sflorian if(iq->caps_fallback && 4074ae8c6e27Sflorian iq->caps_minimisation_state != iq->minimisation_state) { 4075ae8c6e27Sflorian /* QNAME minimisation state has changed, restart caps 4076ae8c6e27Sflorian * fallback. */ 4077ae8c6e27Sflorian iq->caps_fallback = 0; 4078ae8c6e27Sflorian } 4079ae8c6e27Sflorian 4080ae8c6e27Sflorian if(!iq->caps_fallback) { 4081ae8c6e27Sflorian /* start fallback */ 4082ae8c6e27Sflorian iq->caps_fallback = 1; 4083ae8c6e27Sflorian iq->caps_server = 0; 4084ae8c6e27Sflorian iq->caps_reply = iq->response->rep; 4085ae8c6e27Sflorian iq->caps_response = iq->response; 4086ae8c6e27Sflorian iq->caps_minimisation_state = iq->minimisation_state; 4087ae8c6e27Sflorian iq->state = QUERYTARGETS_STATE; 4088ae8c6e27Sflorian iq->num_current_queries--; 4089ae8c6e27Sflorian verbose(VERB_DETAIL, "Capsforid: starting fallback"); 4090ae8c6e27Sflorian goto handle_it; 4091ae8c6e27Sflorian } else { 4092ae8c6e27Sflorian /* check if reply is the same, otherwise, fail */ 4093ae8c6e27Sflorian if(!iq->caps_reply) { 4094ae8c6e27Sflorian iq->caps_reply = iq->response->rep; 4095ae8c6e27Sflorian iq->caps_response = iq->response; 4096ae8c6e27Sflorian iq->caps_server = -1; /*become zero at ++, 4097ae8c6e27Sflorian so that we start the full set of trials */ 4098ae8c6e27Sflorian } else if(caps_failed_rcode(iq->caps_reply) && 4099ae8c6e27Sflorian !caps_failed_rcode(iq->response->rep)) { 4100ae8c6e27Sflorian /* prefer to upgrade to non-SERVFAIL */ 4101ae8c6e27Sflorian iq->caps_reply = iq->response->rep; 4102ae8c6e27Sflorian iq->caps_response = iq->response; 4103ae8c6e27Sflorian } else if(!caps_failed_rcode(iq->caps_reply) && 4104ae8c6e27Sflorian caps_failed_rcode(iq->response->rep)) { 4105ae8c6e27Sflorian /* if we have non-SERVFAIL as answer then 4106ae8c6e27Sflorian * we can ignore SERVFAILs for the equality 4107ae8c6e27Sflorian * comparison */ 4108ae8c6e27Sflorian /* no instructions here, skip other else */ 4109ae8c6e27Sflorian } else if(caps_failed_rcode(iq->caps_reply) && 4110ae8c6e27Sflorian caps_failed_rcode(iq->response->rep)) { 4111ae8c6e27Sflorian /* failure is same as other failure in fallbk*/ 4112ae8c6e27Sflorian /* no instructions here, skip other else */ 4113ae8c6e27Sflorian } else if(!reply_equal(iq->response->rep, iq->caps_reply, 4114ae8c6e27Sflorian qstate->env->scratch)) { 4115ae8c6e27Sflorian verbose(VERB_DETAIL, "Capsforid fallback: " 4116ae8c6e27Sflorian "getting different replies, failed"); 4117ae8c6e27Sflorian outbound_list_remove(&iq->outlist, outbound); 4118ae8c6e27Sflorian errinf(qstate, "0x20 failed, then got different replies in fallback"); 4119ae8c6e27Sflorian (void)error_response(qstate, id, 4120ae8c6e27Sflorian LDNS_RCODE_SERVFAIL); 4121ae8c6e27Sflorian return; 4122ae8c6e27Sflorian } 4123ae8c6e27Sflorian /* continue the fallback procedure at next server */ 4124ae8c6e27Sflorian iq->caps_server++; 4125ae8c6e27Sflorian iq->state = QUERYTARGETS_STATE; 4126ae8c6e27Sflorian iq->num_current_queries--; 4127ae8c6e27Sflorian verbose(VERB_DETAIL, "Capsforid: reply is equal. " 4128ae8c6e27Sflorian "go to next fallback"); 4129ae8c6e27Sflorian goto handle_it; 4130ae8c6e27Sflorian } 4131ae8c6e27Sflorian } 4132ae8c6e27Sflorian iq->caps_fallback = 0; /* if we were in fallback, 0x20 is OK now */ 4133ae8c6e27Sflorian 4134ae8c6e27Sflorian handle_it: 4135ae8c6e27Sflorian outbound_list_remove(&iq->outlist, outbound); 4136ae8c6e27Sflorian iter_handle(qstate, iq, ie, id); 4137ae8c6e27Sflorian } 4138ae8c6e27Sflorian 4139ae8c6e27Sflorian void 4140ae8c6e27Sflorian iter_operate(struct module_qstate* qstate, enum module_ev event, int id, 4141ae8c6e27Sflorian struct outbound_entry* outbound) 4142ae8c6e27Sflorian { 4143ae8c6e27Sflorian struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id]; 4144ae8c6e27Sflorian struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; 4145ae8c6e27Sflorian verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s", 4146ae8c6e27Sflorian id, strextstate(qstate->ext_state[id]), strmodulevent(event)); 4147ae8c6e27Sflorian if(iq) log_query_info(VERB_QUERY, "iterator operate: query", 4148ae8c6e27Sflorian &qstate->qinfo); 4149ae8c6e27Sflorian if(iq && qstate->qinfo.qname != iq->qchase.qname) 4150ae8c6e27Sflorian log_query_info(VERB_QUERY, "iterator operate: chased to", 4151ae8c6e27Sflorian &iq->qchase); 4152ae8c6e27Sflorian 4153ae8c6e27Sflorian /* perform iterator state machine */ 4154ae8c6e27Sflorian if((event == module_event_new || event == module_event_pass) && 4155ae8c6e27Sflorian iq == NULL) { 4156ae8c6e27Sflorian if(!iter_new(qstate, id)) { 4157ae8c6e27Sflorian errinf(qstate, "malloc failure, new iterator module allocation"); 4158ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 4159ae8c6e27Sflorian return; 4160ae8c6e27Sflorian } 4161ae8c6e27Sflorian iq = (struct iter_qstate*)qstate->minfo[id]; 4162ae8c6e27Sflorian process_request(qstate, iq, ie, id); 4163ae8c6e27Sflorian return; 4164ae8c6e27Sflorian } 4165ae8c6e27Sflorian if(iq && event == module_event_pass) { 4166ae8c6e27Sflorian iter_handle(qstate, iq, ie, id); 4167ae8c6e27Sflorian return; 4168ae8c6e27Sflorian } 4169ae8c6e27Sflorian if(iq && outbound) { 4170ae8c6e27Sflorian process_response(qstate, iq, ie, id, outbound, event); 4171ae8c6e27Sflorian return; 4172ae8c6e27Sflorian } 4173ae8c6e27Sflorian if(event == module_event_error) { 4174ae8c6e27Sflorian verbose(VERB_ALGO, "got called with event error, giving up"); 4175ae8c6e27Sflorian errinf(qstate, "iterator module got the error event"); 4176ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 4177ae8c6e27Sflorian return; 4178ae8c6e27Sflorian } 4179ae8c6e27Sflorian 4180ae8c6e27Sflorian log_err("bad event for iterator"); 4181ae8c6e27Sflorian errinf(qstate, "iterator module received wrong event"); 4182ae8c6e27Sflorian (void)error_response(qstate, id, LDNS_RCODE_SERVFAIL); 4183ae8c6e27Sflorian } 4184ae8c6e27Sflorian 4185ae8c6e27Sflorian void 4186ae8c6e27Sflorian iter_clear(struct module_qstate* qstate, int id) 4187ae8c6e27Sflorian { 4188ae8c6e27Sflorian struct iter_qstate* iq; 4189ae8c6e27Sflorian if(!qstate) 4190ae8c6e27Sflorian return; 4191ae8c6e27Sflorian iq = (struct iter_qstate*)qstate->minfo[id]; 4192ae8c6e27Sflorian if(iq) { 4193ae8c6e27Sflorian outbound_list_clear(&iq->outlist); 41946d08cb1bSflorian if(iq->target_count && --iq->target_count[TARGET_COUNT_REF] == 0) { 4195ae8c6e27Sflorian free(iq->target_count); 41966d08cb1bSflorian if(*iq->nxns_dp) free(*iq->nxns_dp); 41976d08cb1bSflorian free(iq->nxns_dp); 41986d08cb1bSflorian } 4199ae8c6e27Sflorian iq->num_current_queries = 0; 4200ae8c6e27Sflorian } 4201ae8c6e27Sflorian qstate->minfo[id] = NULL; 4202ae8c6e27Sflorian } 4203ae8c6e27Sflorian 4204ae8c6e27Sflorian size_t 4205ae8c6e27Sflorian iter_get_mem(struct module_env* env, int id) 4206ae8c6e27Sflorian { 4207ae8c6e27Sflorian struct iter_env* ie = (struct iter_env*)env->modinfo[id]; 4208ae8c6e27Sflorian if(!ie) 4209ae8c6e27Sflorian return 0; 4210ae8c6e27Sflorian return sizeof(*ie) + sizeof(int)*((size_t)ie->max_dependency_depth+1) 4211ae8c6e27Sflorian + donotq_get_mem(ie->donotq) + priv_get_mem(ie->priv); 4212ae8c6e27Sflorian } 4213ae8c6e27Sflorian 4214ae8c6e27Sflorian /** 4215ae8c6e27Sflorian * The iterator function block 4216ae8c6e27Sflorian */ 4217ae8c6e27Sflorian static struct module_func_block iter_block = { 4218ae8c6e27Sflorian "iterator", 4219ae8c6e27Sflorian &iter_init, &iter_deinit, &iter_operate, &iter_inform_super, 4220ae8c6e27Sflorian &iter_clear, &iter_get_mem 4221ae8c6e27Sflorian }; 4222ae8c6e27Sflorian 4223ae8c6e27Sflorian struct module_func_block* 4224ae8c6e27Sflorian iter_get_funcblock(void) 4225ae8c6e27Sflorian { 4226ae8c6e27Sflorian return &iter_block; 4227ae8c6e27Sflorian } 4228ae8c6e27Sflorian 4229ae8c6e27Sflorian const char* 4230ae8c6e27Sflorian iter_state_to_string(enum iter_state state) 4231ae8c6e27Sflorian { 4232ae8c6e27Sflorian switch (state) 4233ae8c6e27Sflorian { 4234ae8c6e27Sflorian case INIT_REQUEST_STATE : 4235ae8c6e27Sflorian return "INIT REQUEST STATE"; 4236ae8c6e27Sflorian case INIT_REQUEST_2_STATE : 4237ae8c6e27Sflorian return "INIT REQUEST STATE (stage 2)"; 4238ae8c6e27Sflorian case INIT_REQUEST_3_STATE: 4239ae8c6e27Sflorian return "INIT REQUEST STATE (stage 3)"; 4240ae8c6e27Sflorian case QUERYTARGETS_STATE : 4241ae8c6e27Sflorian return "QUERY TARGETS STATE"; 4242ae8c6e27Sflorian case PRIME_RESP_STATE : 4243ae8c6e27Sflorian return "PRIME RESPONSE STATE"; 4244ae8c6e27Sflorian case COLLECT_CLASS_STATE : 4245ae8c6e27Sflorian return "COLLECT CLASS STATE"; 4246ae8c6e27Sflorian case DSNS_FIND_STATE : 4247ae8c6e27Sflorian return "DSNS FIND STATE"; 4248ae8c6e27Sflorian case QUERY_RESP_STATE : 4249ae8c6e27Sflorian return "QUERY RESPONSE STATE"; 4250ae8c6e27Sflorian case FINISHED_STATE : 4251ae8c6e27Sflorian return "FINISHED RESPONSE STATE"; 4252ae8c6e27Sflorian default : 4253ae8c6e27Sflorian return "UNKNOWN ITER STATE"; 4254ae8c6e27Sflorian } 4255ae8c6e27Sflorian } 4256ae8c6e27Sflorian 4257ae8c6e27Sflorian int 4258ae8c6e27Sflorian iter_state_is_responsestate(enum iter_state s) 4259ae8c6e27Sflorian { 4260ae8c6e27Sflorian switch(s) { 4261ae8c6e27Sflorian case INIT_REQUEST_STATE : 4262ae8c6e27Sflorian case INIT_REQUEST_2_STATE : 4263ae8c6e27Sflorian case INIT_REQUEST_3_STATE : 4264ae8c6e27Sflorian case QUERYTARGETS_STATE : 4265ae8c6e27Sflorian case COLLECT_CLASS_STATE : 4266ae8c6e27Sflorian return 0; 4267ae8c6e27Sflorian default: 4268ae8c6e27Sflorian break; 4269ae8c6e27Sflorian } 4270ae8c6e27Sflorian return 1; 4271ae8c6e27Sflorian } 4272