1ae8c6e27Sflorian /*
2ae8c6e27Sflorian * services/cache/dns.c - Cache services for DNS using msg and rrset caches.
3ae8c6e27Sflorian *
4ae8c6e27Sflorian * Copyright (c) 2007, NLnet Labs. All rights reserved.
5ae8c6e27Sflorian *
6ae8c6e27Sflorian * This software is open source.
7ae8c6e27Sflorian *
8ae8c6e27Sflorian * Redistribution and use in source and binary forms, with or without
9ae8c6e27Sflorian * modification, are permitted provided that the following conditions
10ae8c6e27Sflorian * are met:
11ae8c6e27Sflorian *
12ae8c6e27Sflorian * Redistributions of source code must retain the above copyright notice,
13ae8c6e27Sflorian * this list of conditions and the following disclaimer.
14ae8c6e27Sflorian *
15ae8c6e27Sflorian * Redistributions in binary form must reproduce the above copyright notice,
16ae8c6e27Sflorian * this list of conditions and the following disclaimer in the documentation
17ae8c6e27Sflorian * and/or other materials provided with the distribution.
18ae8c6e27Sflorian *
19ae8c6e27Sflorian * Neither the name of the NLNET LABS nor the names of its contributors may
20ae8c6e27Sflorian * be used to endorse or promote products derived from this software without
21ae8c6e27Sflorian * specific prior written permission.
22ae8c6e27Sflorian *
23ae8c6e27Sflorian * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24ae8c6e27Sflorian * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25ae8c6e27Sflorian * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26ae8c6e27Sflorian * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27ae8c6e27Sflorian * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28ae8c6e27Sflorian * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29ae8c6e27Sflorian * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30ae8c6e27Sflorian * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31ae8c6e27Sflorian * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32ae8c6e27Sflorian * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33ae8c6e27Sflorian * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34ae8c6e27Sflorian */
35ae8c6e27Sflorian
36ae8c6e27Sflorian /**
37ae8c6e27Sflorian * \file
38ae8c6e27Sflorian *
39ae8c6e27Sflorian * This file contains the DNS cache.
40ae8c6e27Sflorian */
41ae8c6e27Sflorian #include "config.h"
42ae8c6e27Sflorian #include "iterator/iter_delegpt.h"
439b465e50Sflorian #include "iterator/iter_utils.h"
44ae8c6e27Sflorian #include "validator/val_nsec.h"
45ae8c6e27Sflorian #include "validator/val_utils.h"
46ae8c6e27Sflorian #include "services/cache/dns.h"
47ae8c6e27Sflorian #include "services/cache/rrset.h"
48d32eb43cSflorian #include "util/data/msgparse.h"
49ae8c6e27Sflorian #include "util/data/msgreply.h"
50ae8c6e27Sflorian #include "util/data/packed_rrset.h"
51ae8c6e27Sflorian #include "util/data/dname.h"
52ae8c6e27Sflorian #include "util/module.h"
53ae8c6e27Sflorian #include "util/net_help.h"
54ae8c6e27Sflorian #include "util/regional.h"
55ae8c6e27Sflorian #include "util/config_file.h"
56ae8c6e27Sflorian #include "sldns/sbuffer.h"
57ae8c6e27Sflorian
58ae8c6e27Sflorian /** store rrsets in the rrset cache.
59ae8c6e27Sflorian * @param env: module environment with caches.
60ae8c6e27Sflorian * @param rep: contains list of rrsets to store.
61ae8c6e27Sflorian * @param now: current time.
62ae8c6e27Sflorian * @param leeway: during prefetch how much leeway to update TTLs.
63ae8c6e27Sflorian * This makes rrsets (other than type NS) timeout sooner so they get
64ae8c6e27Sflorian * updated with a new full TTL.
65ae8c6e27Sflorian * Type NS does not get this, because it must not be refreshed from the
66ae8c6e27Sflorian * child domain, but keep counting down properly.
67ae8c6e27Sflorian * @param pside: if from parentside discovered NS, so that its NS is okay
68ae8c6e27Sflorian * in a prefetch situation to be updated (without becoming sticky).
69ae8c6e27Sflorian * @param qrep: update rrsets here if cache is better
70ae8c6e27Sflorian * @param region: for qrep allocs.
716d08cb1bSflorian * @param qstarttime: time when delegations were looked up, this is perhaps
726d08cb1bSflorian * earlier than the time in now. The time is used to determine if RRsets
736d08cb1bSflorian * of type NS have expired, so that they can only be updated using
746d08cb1bSflorian * lookups of delegation points that did not use them, since they had
756d08cb1bSflorian * expired then.
76ae8c6e27Sflorian */
77ae8c6e27Sflorian static void
store_rrsets(struct module_env * env,struct reply_info * rep,time_t now,time_t leeway,int pside,struct reply_info * qrep,struct regional * region,time_t qstarttime)78ae8c6e27Sflorian store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
79ae8c6e27Sflorian time_t leeway, int pside, struct reply_info* qrep,
806d08cb1bSflorian struct regional* region, time_t qstarttime)
81ae8c6e27Sflorian {
82ae8c6e27Sflorian size_t i;
83*54cc57acSflorian time_t ttl, min_ttl = rep->ttl;
84ae8c6e27Sflorian /* see if rrset already exists in cache, if not insert it. */
85ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) {
86ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i];
87ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id;
88ae8c6e27Sflorian /* update ref if it was in the cache */
89ae8c6e27Sflorian switch(rrset_cache_update(env->rrset_cache, &rep->ref[i],
906d08cb1bSflorian env->alloc, ((ntohs(rep->ref[i].key->rk.type)==
916d08cb1bSflorian LDNS_RR_TYPE_NS && !pside)?qstarttime:now + leeway))) {
92ae8c6e27Sflorian case 0: /* ref unchanged, item inserted */
93ae8c6e27Sflorian break;
94ae8c6e27Sflorian case 2: /* ref updated, cache is superior */
95ae8c6e27Sflorian if(region) {
96ae8c6e27Sflorian struct ub_packed_rrset_key* ck;
97ae8c6e27Sflorian lock_rw_rdlock(&rep->ref[i].key->entry.lock);
98ae8c6e27Sflorian /* if deleted rrset, do not copy it */
99ae8c6e27Sflorian if(rep->ref[i].key->id == 0)
100ae8c6e27Sflorian ck = NULL;
101ae8c6e27Sflorian else ck = packed_rrset_copy_region(
102ae8c6e27Sflorian rep->ref[i].key, region, now);
103ae8c6e27Sflorian lock_rw_unlock(&rep->ref[i].key->entry.lock);
104ae8c6e27Sflorian if(ck) {
105ae8c6e27Sflorian /* use cached copy if memory allows */
106ae8c6e27Sflorian qrep->rrsets[i] = ck;
107ae8c6e27Sflorian }
108ae8c6e27Sflorian }
109ae8c6e27Sflorian /* no break: also copy key item */
110ae8c6e27Sflorian /* the line below is matched by gcc regex and silences
111ae8c6e27Sflorian * the fallthrough warning */
112ae8c6e27Sflorian /* fallthrough */
113ae8c6e27Sflorian case 1: /* ref updated, item inserted */
114ae8c6e27Sflorian rep->rrsets[i] = rep->ref[i].key;
115ae8c6e27Sflorian }
116*54cc57acSflorian /* if ref was updated make sure the message ttl is updated to
117*54cc57acSflorian * the minimum of the current rrsets. */
118*54cc57acSflorian ttl = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)->ttl;
119*54cc57acSflorian if(ttl < min_ttl) min_ttl = ttl;
120*54cc57acSflorian }
121*54cc57acSflorian if(min_ttl < rep->ttl) {
122*54cc57acSflorian rep->ttl = min_ttl;
123*54cc57acSflorian rep->prefetch_ttl = PREFETCH_TTL_CALC(rep->ttl);
124*54cc57acSflorian rep->serve_expired_ttl = rep->ttl + SERVE_EXPIRED_TTL;
125ae8c6e27Sflorian }
126ae8c6e27Sflorian }
127ae8c6e27Sflorian
128ae8c6e27Sflorian /** delete message from message cache */
129ae8c6e27Sflorian void
msg_cache_remove(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,uint16_t flags)130ae8c6e27Sflorian msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen,
131ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags)
132ae8c6e27Sflorian {
133ae8c6e27Sflorian struct query_info k;
134ae8c6e27Sflorian hashvalue_type h;
135ae8c6e27Sflorian
136ae8c6e27Sflorian k.qname = qname;
137ae8c6e27Sflorian k.qname_len = qnamelen;
138ae8c6e27Sflorian k.qtype = qtype;
139ae8c6e27Sflorian k.qclass = qclass;
140ae8c6e27Sflorian k.local_alias = NULL;
141ae8c6e27Sflorian h = query_info_hash(&k, flags);
142ae8c6e27Sflorian slabhash_remove(env->msg_cache, h, &k);
143ae8c6e27Sflorian }
144ae8c6e27Sflorian
145ae8c6e27Sflorian void
dns_cache_store_msg(struct module_env * env,struct query_info * qinfo,hashvalue_type hash,struct reply_info * rep,time_t leeway,int pside,struct reply_info * qrep,uint32_t flags,struct regional * region,time_t qstarttime)146ae8c6e27Sflorian dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
147ae8c6e27Sflorian hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,
1486d08cb1bSflorian struct reply_info* qrep, uint32_t flags, struct regional* region,
1496d08cb1bSflorian time_t qstarttime)
150ae8c6e27Sflorian {
151ae8c6e27Sflorian struct msgreply_entry* e;
152ae8c6e27Sflorian time_t ttl = rep->ttl;
153ae8c6e27Sflorian size_t i;
154ae8c6e27Sflorian
155ae8c6e27Sflorian /* store RRsets */
156ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) {
157ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i];
158ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id;
159ae8c6e27Sflorian }
160ae8c6e27Sflorian
161ae8c6e27Sflorian /* there was a reply_info_sortref(rep) here but it seems to be
162ae8c6e27Sflorian * unnecessary, because the cache gets locked per rrset. */
163ae8c6e27Sflorian reply_info_set_ttls(rep, *env->now);
1646d08cb1bSflorian store_rrsets(env, rep, *env->now, leeway, pside, qrep, region,
1656d08cb1bSflorian qstarttime);
166ae8c6e27Sflorian if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) {
167ae8c6e27Sflorian /* we do not store the message, but we did store the RRs,
168ae8c6e27Sflorian * which could be useful for delegation information */
169ae8c6e27Sflorian verbose(VERB_ALGO, "TTL 0: dropped msg from cache");
170d500c338Sflorian reply_info_delete(rep, NULL);
171d500c338Sflorian /* if the message is in the cache, remove that msg,
172ae8c6e27Sflorian * so that the TTL 0 response can be returned for future
173d500c338Sflorian * responses (i.e. don't get answered from
174ae8c6e27Sflorian * cache, but instead go to recursion to get this TTL0
175d500c338Sflorian * response).
176d500c338Sflorian * Possible messages that could be in the cache:
177d500c338Sflorian * - SERVFAIL
178d500c338Sflorian * - NXDOMAIN
179d500c338Sflorian * - NODATA
180d500c338Sflorian * - an older record that is expired
181d500c338Sflorian * - an older record that did not yet expire */
182d500c338Sflorian msg_cache_remove(env, qinfo->qname, qinfo->qname_len,
183d500c338Sflorian qinfo->qtype, qinfo->qclass, flags);
184ae8c6e27Sflorian return;
185ae8c6e27Sflorian }
186ae8c6e27Sflorian
187ae8c6e27Sflorian /* store msg in the cache */
188ae8c6e27Sflorian reply_info_sortref(rep);
189ae8c6e27Sflorian if(!(e = query_info_entrysetup(qinfo, rep, hash))) {
190ae8c6e27Sflorian log_err("store_msg: malloc failed");
191ae8c6e27Sflorian return;
192ae8c6e27Sflorian }
193ae8c6e27Sflorian slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc);
194ae8c6e27Sflorian }
195ae8c6e27Sflorian
1966d08cb1bSflorian /** see if an rrset is expired above the qname, return upper qname. */
1976d08cb1bSflorian static int
rrset_expired_above(struct module_env * env,uint8_t ** qname,size_t * qnamelen,uint16_t searchtype,uint16_t qclass,time_t now,uint8_t * expiretop,size_t expiretoplen)1986d08cb1bSflorian rrset_expired_above(struct module_env* env, uint8_t** qname, size_t* qnamelen,
1996d08cb1bSflorian uint16_t searchtype, uint16_t qclass, time_t now, uint8_t* expiretop,
2006d08cb1bSflorian size_t expiretoplen)
2016d08cb1bSflorian {
2026d08cb1bSflorian struct ub_packed_rrset_key *rrset;
2036d08cb1bSflorian uint8_t lablen;
2046d08cb1bSflorian
2056d08cb1bSflorian while(*qnamelen > 0) {
2066d08cb1bSflorian /* look one label higher */
2076d08cb1bSflorian lablen = **qname;
2086d08cb1bSflorian *qname += lablen + 1;
2096d08cb1bSflorian *qnamelen -= lablen + 1;
2106d08cb1bSflorian if(*qnamelen <= 0)
2116d08cb1bSflorian break;
2126d08cb1bSflorian
2136d08cb1bSflorian /* looks up with a time of 0, to see expired entries */
2146d08cb1bSflorian if((rrset = rrset_cache_lookup(env->rrset_cache, *qname,
2156d08cb1bSflorian *qnamelen, searchtype, qclass, 0, 0, 0))) {
2166d08cb1bSflorian struct packed_rrset_data* data =
2176d08cb1bSflorian (struct packed_rrset_data*)rrset->entry.data;
2186d08cb1bSflorian if(now > data->ttl) {
2196d08cb1bSflorian /* it is expired, this is not wanted */
2206d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock);
2216d08cb1bSflorian log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass);
2226d08cb1bSflorian return 1;
2236d08cb1bSflorian }
2246d08cb1bSflorian /* it is not expired, continue looking */
2256d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock);
2266d08cb1bSflorian }
2276d08cb1bSflorian
2286d08cb1bSflorian /* do not look above the expiretop. */
2296d08cb1bSflorian if(expiretop && *qnamelen == expiretoplen &&
2306d08cb1bSflorian query_dname_compare(*qname, expiretop)==0)
2316d08cb1bSflorian break;
2326d08cb1bSflorian }
2336d08cb1bSflorian return 0;
2346d08cb1bSflorian }
2356d08cb1bSflorian
236ae8c6e27Sflorian /** find closest NS or DNAME and returns the rrset (locked) */
237ae8c6e27Sflorian static struct ub_packed_rrset_key*
find_closest_of_type(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qclass,time_t now,uint16_t searchtype,int stripfront,int noexpiredabove,uint8_t * expiretop,size_t expiretoplen)238ae8c6e27Sflorian find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
2396d08cb1bSflorian uint16_t qclass, time_t now, uint16_t searchtype, int stripfront,
2406d08cb1bSflorian int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
241ae8c6e27Sflorian {
242ae8c6e27Sflorian struct ub_packed_rrset_key *rrset;
243ae8c6e27Sflorian uint8_t lablen;
244ae8c6e27Sflorian
245ae8c6e27Sflorian if(stripfront) {
246ae8c6e27Sflorian /* strip off so that DNAMEs have strict subdomain match */
247ae8c6e27Sflorian lablen = *qname;
248ae8c6e27Sflorian qname += lablen + 1;
249ae8c6e27Sflorian qnamelen -= lablen + 1;
250ae8c6e27Sflorian }
251ae8c6e27Sflorian
252ae8c6e27Sflorian /* snip off front part of qname until the type is found */
253ae8c6e27Sflorian while(qnamelen > 0) {
254ae8c6e27Sflorian if((rrset = rrset_cache_lookup(env->rrset_cache, qname,
2556d08cb1bSflorian qnamelen, searchtype, qclass, 0, now, 0))) {
2566d08cb1bSflorian uint8_t* origqname = qname;
2576d08cb1bSflorian size_t origqnamelen = qnamelen;
2586d08cb1bSflorian if(!noexpiredabove)
259ae8c6e27Sflorian return rrset;
2606d08cb1bSflorian /* if expiretop set, do not look above it, but
2616d08cb1bSflorian * qname is equal, so the just found result is also
2626d08cb1bSflorian * the nonexpired above part. */
2636d08cb1bSflorian if(expiretop && qnamelen == expiretoplen &&
2646d08cb1bSflorian query_dname_compare(qname, expiretop)==0)
2656d08cb1bSflorian return rrset;
2666d08cb1bSflorian /* check for expiry, but we have to let go of the rrset
2676d08cb1bSflorian * for the lock ordering */
2686d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock);
2696d08cb1bSflorian /* the expired_above function always takes off one
2706d08cb1bSflorian * label (if qnamelen>0) and returns the final qname
2716d08cb1bSflorian * where it searched, so we can continue from there
2726d08cb1bSflorian * turning the O N*N search into O N. */
2736d08cb1bSflorian if(!rrset_expired_above(env, &qname, &qnamelen,
2746d08cb1bSflorian searchtype, qclass, now, expiretop,
2756d08cb1bSflorian expiretoplen)) {
2766d08cb1bSflorian /* we want to return rrset, but it may be
2776d08cb1bSflorian * gone from cache, if so, just loop like
2786d08cb1bSflorian * it was not in the cache in the first place.
2796d08cb1bSflorian */
2806d08cb1bSflorian if((rrset = rrset_cache_lookup(env->
2816d08cb1bSflorian rrset_cache, origqname, origqnamelen,
2826d08cb1bSflorian searchtype, qclass, 0, now, 0))) {
2836d08cb1bSflorian return rrset;
2846d08cb1bSflorian }
2856d08cb1bSflorian }
2866d08cb1bSflorian log_nametypeclass(VERB_ALGO, "ignoring rrset because expired rrsets exist above it", origqname, searchtype, qclass);
2876d08cb1bSflorian continue;
2886d08cb1bSflorian }
289ae8c6e27Sflorian
290ae8c6e27Sflorian /* snip off front label */
291ae8c6e27Sflorian lablen = *qname;
292ae8c6e27Sflorian qname += lablen + 1;
293ae8c6e27Sflorian qnamelen -= lablen + 1;
294ae8c6e27Sflorian }
295ae8c6e27Sflorian return NULL;
296ae8c6e27Sflorian }
297ae8c6e27Sflorian
298ae8c6e27Sflorian /** add addr to additional section */
299ae8c6e27Sflorian static void
addr_to_additional(struct ub_packed_rrset_key * rrset,struct regional * region,struct dns_msg * msg,time_t now)300ae8c6e27Sflorian addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region,
301ae8c6e27Sflorian struct dns_msg* msg, time_t now)
302ae8c6e27Sflorian {
303ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] =
304ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) {
305ae8c6e27Sflorian msg->rep->ar_numrrsets++;
306ae8c6e27Sflorian msg->rep->rrset_count++;
307ae8c6e27Sflorian }
308ae8c6e27Sflorian }
309ae8c6e27Sflorian
310ae8c6e27Sflorian /** lookup message in message cache */
311ae8c6e27Sflorian struct msgreply_entry*
msg_cache_lookup(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,uint16_t flags,time_t now,int wr)312ae8c6e27Sflorian msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen,
313ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr)
314ae8c6e27Sflorian {
315ae8c6e27Sflorian struct lruhash_entry* e;
316ae8c6e27Sflorian struct query_info k;
317ae8c6e27Sflorian hashvalue_type h;
318ae8c6e27Sflorian
319ae8c6e27Sflorian k.qname = qname;
320ae8c6e27Sflorian k.qname_len = qnamelen;
321ae8c6e27Sflorian k.qtype = qtype;
322ae8c6e27Sflorian k.qclass = qclass;
323ae8c6e27Sflorian k.local_alias = NULL;
324ae8c6e27Sflorian h = query_info_hash(&k, flags);
325ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, wr);
326ae8c6e27Sflorian
327ae8c6e27Sflorian if(!e) return NULL;
328ae8c6e27Sflorian if( now > ((struct reply_info*)e->data)->ttl ) {
329ae8c6e27Sflorian lock_rw_unlock(&e->lock);
330ae8c6e27Sflorian return NULL;
331ae8c6e27Sflorian }
332ae8c6e27Sflorian return (struct msgreply_entry*)e->key;
333ae8c6e27Sflorian }
334ae8c6e27Sflorian
335ae8c6e27Sflorian /** find and add A and AAAA records for nameservers in delegpt */
336ae8c6e27Sflorian static int
find_add_addrs(struct module_env * env,uint16_t qclass,struct regional * region,struct delegpt * dp,time_t now,struct dns_msg ** msg)337ae8c6e27Sflorian find_add_addrs(struct module_env* env, uint16_t qclass,
338ae8c6e27Sflorian struct regional* region, struct delegpt* dp, time_t now,
339ae8c6e27Sflorian struct dns_msg** msg)
340ae8c6e27Sflorian {
341ae8c6e27Sflorian struct delegpt_ns* ns;
342ae8c6e27Sflorian struct msgreply_entry* neg;
343ae8c6e27Sflorian struct ub_packed_rrset_key* akey;
344ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) {
345ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name,
346ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
347ae8c6e27Sflorian if(akey) {
3485a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) {
349ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
350ae8c6e27Sflorian return 0;
351ae8c6e27Sflorian }
352ae8c6e27Sflorian if(msg)
353ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now);
354ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
355ae8c6e27Sflorian } else {
356ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does
357ae8c6e27Sflorian * not use dns64 translation */
358ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen,
359ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0);
360ae8c6e27Sflorian if(neg) {
361ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg);
362ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock);
363ae8c6e27Sflorian }
364ae8c6e27Sflorian }
365ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name,
366ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
367ae8c6e27Sflorian if(akey) {
3685a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) {
369ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
370ae8c6e27Sflorian return 0;
371ae8c6e27Sflorian }
372ae8c6e27Sflorian if(msg)
373ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now);
374ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
375ae8c6e27Sflorian } else {
376ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does
377ae8c6e27Sflorian * not use dns64 translation */
378ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen,
379ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
380ae8c6e27Sflorian if(neg) {
381ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg);
382ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock);
383ae8c6e27Sflorian }
384ae8c6e27Sflorian }
385ae8c6e27Sflorian }
386ae8c6e27Sflorian return 1;
387ae8c6e27Sflorian }
388ae8c6e27Sflorian
389ae8c6e27Sflorian /** find and add A and AAAA records for missing nameservers in delegpt */
390ae8c6e27Sflorian int
cache_fill_missing(struct module_env * env,uint16_t qclass,struct regional * region,struct delegpt * dp)391ae8c6e27Sflorian cache_fill_missing(struct module_env* env, uint16_t qclass,
392ae8c6e27Sflorian struct regional* region, struct delegpt* dp)
393ae8c6e27Sflorian {
394ae8c6e27Sflorian struct delegpt_ns* ns;
395ae8c6e27Sflorian struct msgreply_entry* neg;
396ae8c6e27Sflorian struct ub_packed_rrset_key* akey;
397ae8c6e27Sflorian time_t now = *env->now;
398ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) {
399ab256815Sflorian if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX)
400ab256815Sflorian continue;
401ab256815Sflorian ns->cache_lookup_count++;
402ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name,
403ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
404ae8c6e27Sflorian if(akey) {
4055a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, ns->lame,
4065a7d75e6Ssthen NULL)) {
407ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
408ae8c6e27Sflorian return 0;
409ae8c6e27Sflorian }
410ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache",
411ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_A, qclass);
412ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
413ae8c6e27Sflorian } else {
414ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does
415ae8c6e27Sflorian * not use dns64 translation */
416ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen,
417ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0);
418ae8c6e27Sflorian if(neg) {
419ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg);
420ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock);
421ae8c6e27Sflorian }
422ae8c6e27Sflorian }
423ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name,
424ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
425ae8c6e27Sflorian if(akey) {
4265a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame,
4275a7d75e6Ssthen NULL)) {
428ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
429ae8c6e27Sflorian return 0;
430ae8c6e27Sflorian }
431ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache",
432ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_AAAA, qclass);
433ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock);
434ae8c6e27Sflorian } else {
435ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does
436ae8c6e27Sflorian * not use dns64 translation */
437ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen,
438ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
439ae8c6e27Sflorian if(neg) {
440ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg);
441ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock);
442ae8c6e27Sflorian }
443ae8c6e27Sflorian }
444ae8c6e27Sflorian }
445ae8c6e27Sflorian return 1;
446ae8c6e27Sflorian }
447ae8c6e27Sflorian
448ae8c6e27Sflorian /** find and add DS or NSEC to delegation msg */
449ae8c6e27Sflorian static void
find_add_ds(struct module_env * env,struct regional * region,struct dns_msg * msg,struct delegpt * dp,time_t now)450ae8c6e27Sflorian find_add_ds(struct module_env* env, struct regional* region,
451ae8c6e27Sflorian struct dns_msg* msg, struct delegpt* dp, time_t now)
452ae8c6e27Sflorian {
453ae8c6e27Sflorian /* Lookup the DS or NSEC at the delegation point. */
454ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
455ae8c6e27Sflorian env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS,
456ae8c6e27Sflorian msg->qinfo.qclass, 0, now, 0);
457ae8c6e27Sflorian if(!rrset) {
458ae8c6e27Sflorian /* NOTE: this won't work for alternate NSEC schemes
459ae8c6e27Sflorian * (opt-in, NSEC3) */
460ae8c6e27Sflorian rrset = rrset_cache_lookup(env->rrset_cache, dp->name,
461ae8c6e27Sflorian dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass,
462ae8c6e27Sflorian 0, now, 0);
463ae8c6e27Sflorian /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
464ae8c6e27Sflorian * since this is a referral, we need the NSEC at the parent
465ae8c6e27Sflorian * side of the zone cut, not the NSEC at apex side. */
466ae8c6e27Sflorian if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
467ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
468ae8c6e27Sflorian rrset = NULL; /* discard wrong NSEC */
469ae8c6e27Sflorian }
470ae8c6e27Sflorian }
471ae8c6e27Sflorian if(rrset) {
472ae8c6e27Sflorian /* add it to auth section. This is the second rrset. */
473ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] =
474ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) {
475ae8c6e27Sflorian msg->rep->ns_numrrsets++;
476ae8c6e27Sflorian msg->rep->rrset_count++;
477ae8c6e27Sflorian }
478ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
479ae8c6e27Sflorian }
480ae8c6e27Sflorian }
481ae8c6e27Sflorian
482ae8c6e27Sflorian struct dns_msg*
dns_msg_create(uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,struct regional * region,size_t capacity)483ae8c6e27Sflorian dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype,
484ae8c6e27Sflorian uint16_t qclass, struct regional* region, size_t capacity)
485ae8c6e27Sflorian {
486ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
487ae8c6e27Sflorian sizeof(struct dns_msg));
488ae8c6e27Sflorian if(!msg)
489ae8c6e27Sflorian return NULL;
490ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen);
491ae8c6e27Sflorian if(!msg->qinfo.qname)
492ae8c6e27Sflorian return NULL;
493ae8c6e27Sflorian msg->qinfo.qname_len = qnamelen;
494ae8c6e27Sflorian msg->qinfo.qtype = qtype;
495ae8c6e27Sflorian msg->qinfo.qclass = qclass;
496ae8c6e27Sflorian msg->qinfo.local_alias = NULL;
497ae8c6e27Sflorian /* non-packed reply_info, because it needs to grow the array */
498ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc_zero(region,
499ae8c6e27Sflorian sizeof(struct reply_info)-sizeof(struct rrset_ref));
500ae8c6e27Sflorian if(!msg->rep)
501ae8c6e27Sflorian return NULL;
502ae8c6e27Sflorian if(capacity > RR_COUNT_MAX)
503ae8c6e27Sflorian return NULL; /* integer overflow protection */
504ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* with QR, no AA */
505ae8c6e27Sflorian msg->rep->qdcount = 1;
5067a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE;
507ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**)
508ae8c6e27Sflorian regional_alloc(region,
509ae8c6e27Sflorian capacity*sizeof(struct ub_packed_rrset_key*));
510ae8c6e27Sflorian if(!msg->rep->rrsets)
511ae8c6e27Sflorian return NULL;
512ae8c6e27Sflorian return msg;
513ae8c6e27Sflorian }
514ae8c6e27Sflorian
515ae8c6e27Sflorian int
dns_msg_authadd(struct dns_msg * msg,struct regional * region,struct ub_packed_rrset_key * rrset,time_t now)516ae8c6e27Sflorian dns_msg_authadd(struct dns_msg* msg, struct regional* region,
517ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now)
518ae8c6e27Sflorian {
519ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
520ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now)))
521ae8c6e27Sflorian return 0;
522ae8c6e27Sflorian msg->rep->ns_numrrsets++;
523ae8c6e27Sflorian return 1;
524ae8c6e27Sflorian }
525ae8c6e27Sflorian
526ae8c6e27Sflorian int
dns_msg_ansadd(struct dns_msg * msg,struct regional * region,struct ub_packed_rrset_key * rrset,time_t now)527ae8c6e27Sflorian dns_msg_ansadd(struct dns_msg* msg, struct regional* region,
528ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now)
529ae8c6e27Sflorian {
530ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] =
531ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now)))
532ae8c6e27Sflorian return 0;
533ae8c6e27Sflorian msg->rep->an_numrrsets++;
534ae8c6e27Sflorian return 1;
535ae8c6e27Sflorian }
536ae8c6e27Sflorian
537ae8c6e27Sflorian struct delegpt*
dns_cache_find_delegation(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,struct regional * region,struct dns_msg ** msg,time_t now,int noexpiredabove,uint8_t * expiretop,size_t expiretoplen)538ae8c6e27Sflorian dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
539ae8c6e27Sflorian size_t qnamelen, uint16_t qtype, uint16_t qclass,
5406d08cb1bSflorian struct regional* region, struct dns_msg** msg, time_t now,
5416d08cb1bSflorian int noexpiredabove, uint8_t* expiretop, size_t expiretoplen)
542ae8c6e27Sflorian {
543ae8c6e27Sflorian /* try to find closest NS rrset */
544ae8c6e27Sflorian struct ub_packed_rrset_key* nskey;
545ae8c6e27Sflorian struct packed_rrset_data* nsdata;
546ae8c6e27Sflorian struct delegpt* dp;
547ae8c6e27Sflorian
548ae8c6e27Sflorian nskey = find_closest_of_type(env, qname, qnamelen, qclass, now,
5496d08cb1bSflorian LDNS_RR_TYPE_NS, 0, noexpiredabove, expiretop, expiretoplen);
550ae8c6e27Sflorian if(!nskey) /* hope the caller has hints to prime or something */
551ae8c6e27Sflorian return NULL;
552ae8c6e27Sflorian nsdata = (struct packed_rrset_data*)nskey->entry.data;
553ae8c6e27Sflorian /* got the NS key, create delegation point */
554ae8c6e27Sflorian dp = delegpt_create(region);
555ae8c6e27Sflorian if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) {
556ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock);
557ae8c6e27Sflorian log_err("find_delegation: out of memory");
558ae8c6e27Sflorian return NULL;
559ae8c6e27Sflorian }
560ae8c6e27Sflorian /* create referral message */
561ae8c6e27Sflorian if(msg) {
562ae8c6e27Sflorian /* allocate the array to as much as we could need:
563ae8c6e27Sflorian * NS rrset + DS/NSEC rrset +
564ae8c6e27Sflorian * A rrset for every NS RR
565ae8c6e27Sflorian * AAAA rrset for every NS RR
566ae8c6e27Sflorian */
567ae8c6e27Sflorian *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region,
568ae8c6e27Sflorian 2 + nsdata->count*2);
569ae8c6e27Sflorian if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) {
570ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock);
571ae8c6e27Sflorian log_err("find_delegation: out of memory");
572ae8c6e27Sflorian return NULL;
573ae8c6e27Sflorian }
574ae8c6e27Sflorian }
575ae8c6e27Sflorian if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
576ae8c6e27Sflorian log_err("find_delegation: addns out of memory");
577ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
578ae8c6e27Sflorian /* find and add DS/NSEC (if any) */
579ae8c6e27Sflorian if(msg)
580ae8c6e27Sflorian find_add_ds(env, region, *msg, dp, now);
581ae8c6e27Sflorian /* find and add A entries */
582ae8c6e27Sflorian if(!find_add_addrs(env, qclass, region, dp, now, msg))
583ae8c6e27Sflorian log_err("find_delegation: addrs out of memory");
584ae8c6e27Sflorian return dp;
585ae8c6e27Sflorian }
586ae8c6e27Sflorian
587ae8c6e27Sflorian /** allocate dns_msg from query_info and reply_info */
588ae8c6e27Sflorian static struct dns_msg*
gen_dns_msg(struct regional * region,struct query_info * q,size_t num)589ae8c6e27Sflorian gen_dns_msg(struct regional* region, struct query_info* q, size_t num)
590ae8c6e27Sflorian {
591ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region,
592ae8c6e27Sflorian sizeof(struct dns_msg));
593ae8c6e27Sflorian if(!msg)
594ae8c6e27Sflorian return NULL;
595ae8c6e27Sflorian memcpy(&msg->qinfo, q, sizeof(struct query_info));
596ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len);
597ae8c6e27Sflorian if(!msg->qinfo.qname)
598ae8c6e27Sflorian return NULL;
599ae8c6e27Sflorian /* allocate replyinfo struct and rrset key array separately */
600ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc(region,
601ae8c6e27Sflorian sizeof(struct reply_info) - sizeof(struct rrset_ref));
602ae8c6e27Sflorian if(!msg->rep)
603ae8c6e27Sflorian return NULL;
6047a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE;
605d500c338Sflorian msg->rep->reason_bogus_str = NULL;
606ae8c6e27Sflorian if(num > RR_COUNT_MAX)
607ae8c6e27Sflorian return NULL; /* integer overflow protection */
608ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**)
609ae8c6e27Sflorian regional_alloc(region,
610ae8c6e27Sflorian num * sizeof(struct ub_packed_rrset_key*));
611ae8c6e27Sflorian if(!msg->rep->rrsets)
612ae8c6e27Sflorian return NULL;
613ae8c6e27Sflorian return msg;
614ae8c6e27Sflorian }
615ae8c6e27Sflorian
616ae8c6e27Sflorian struct dns_msg*
tomsg(struct module_env * env,struct query_info * q,struct reply_info * r,struct regional * region,time_t now,int allow_expired,struct regional * scratch)617ae8c6e27Sflorian tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
618d32eb43cSflorian struct regional* region, time_t now, int allow_expired,
619d32eb43cSflorian struct regional* scratch)
620ae8c6e27Sflorian {
621ae8c6e27Sflorian struct dns_msg* msg;
622ae8c6e27Sflorian size_t i;
623d32eb43cSflorian int is_expired = 0;
624d32eb43cSflorian time_t now_control = now;
625d32eb43cSflorian if(now > r->ttl) {
626d32eb43cSflorian /* Check if we are allowed to serve expired */
627d32eb43cSflorian if(allow_expired) {
628d32eb43cSflorian if(env->cfg->serve_expired_ttl &&
629d32eb43cSflorian r->serve_expired_ttl < now) {
630ae8c6e27Sflorian return NULL;
631d32eb43cSflorian }
632d500c338Sflorian /* Ignore expired failure answers */
633d500c338Sflorian if(FLAGS_GET_RCODE(r->flags) !=
634d500c338Sflorian LDNS_RCODE_NOERROR &&
635d500c338Sflorian FLAGS_GET_RCODE(r->flags) !=
636d500c338Sflorian LDNS_RCODE_NXDOMAIN &&
637d500c338Sflorian FLAGS_GET_RCODE(r->flags) !=
638d500c338Sflorian LDNS_RCODE_YXDOMAIN)
639d500c338Sflorian return 0;
640d32eb43cSflorian } else {
641d32eb43cSflorian return NULL;
642d32eb43cSflorian }
643d32eb43cSflorian /* Change the current time so we can pass the below TTL checks when
644d32eb43cSflorian * serving expired data. */
645d32eb43cSflorian now_control = r->ttl - env->cfg->serve_expired_reply_ttl;
646d32eb43cSflorian is_expired = 1;
647d32eb43cSflorian }
648d32eb43cSflorian
649ae8c6e27Sflorian msg = gen_dns_msg(region, q, r->rrset_count);
650d32eb43cSflorian if(!msg) return NULL;
651ae8c6e27Sflorian msg->rep->flags = r->flags;
652ae8c6e27Sflorian msg->rep->qdcount = r->qdcount;
653d32eb43cSflorian msg->rep->ttl = is_expired
654d32eb43cSflorian ?SERVE_EXPIRED_REPLY_TTL
655d32eb43cSflorian :r->ttl - now;
656ae8c6e27Sflorian if(r->prefetch_ttl > now)
657ae8c6e27Sflorian msg->rep->prefetch_ttl = r->prefetch_ttl - now;
658d32eb43cSflorian else
659d32eb43cSflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
660ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
661ae8c6e27Sflorian msg->rep->security = r->security;
662ae8c6e27Sflorian msg->rep->an_numrrsets = r->an_numrrsets;
663ae8c6e27Sflorian msg->rep->ns_numrrsets = r->ns_numrrsets;
664ae8c6e27Sflorian msg->rep->ar_numrrsets = r->ar_numrrsets;
665ae8c6e27Sflorian msg->rep->rrset_count = r->rrset_count;
666ae8c6e27Sflorian msg->rep->authoritative = r->authoritative;
6677a05b9dfSflorian msg->rep->reason_bogus = r->reason_bogus;
668d500c338Sflorian if(r->reason_bogus_str) {
669d500c338Sflorian msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str);
670d500c338Sflorian }
671d500c338Sflorian
672d32eb43cSflorian if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {
673ae8c6e27Sflorian return NULL;
674d32eb43cSflorian }
675ae8c6e27Sflorian if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
676ae8c6e27Sflorian LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
677ae8c6e27Sflorian LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) {
678ae8c6e27Sflorian /* cname chain is now invalid, reconstruct msg */
679ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count);
680ae8c6e27Sflorian return NULL;
681ae8c6e27Sflorian }
682ae8c6e27Sflorian if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
683ae8c6e27Sflorian /* message rrsets have changed status, revalidate */
684ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count);
685ae8c6e27Sflorian return NULL;
686ae8c6e27Sflorian }
687ae8c6e27Sflorian for(i=0; i<msg->rep->rrset_count; i++) {
688ae8c6e27Sflorian msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i],
689ae8c6e27Sflorian region, now);
690ae8c6e27Sflorian if(!msg->rep->rrsets[i]) {
691ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count);
692ae8c6e27Sflorian return NULL;
693ae8c6e27Sflorian }
694ae8c6e27Sflorian }
695ae8c6e27Sflorian if(env)
696ae8c6e27Sflorian rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref,
697ae8c6e27Sflorian r->rrset_count);
698ae8c6e27Sflorian else
699ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count);
700ae8c6e27Sflorian return msg;
701ae8c6e27Sflorian }
702ae8c6e27Sflorian
703fed3efa7Sflorian struct dns_msg*
dns_msg_deepcopy_region(struct dns_msg * origin,struct regional * region)704fed3efa7Sflorian dns_msg_deepcopy_region(struct dns_msg* origin, struct regional* region)
705fed3efa7Sflorian {
706fed3efa7Sflorian size_t i;
707fed3efa7Sflorian struct dns_msg* res = NULL;
708fed3efa7Sflorian res = gen_dns_msg(region, &origin->qinfo, origin->rep->rrset_count);
709fed3efa7Sflorian if(!res) return NULL;
710fed3efa7Sflorian *res->rep = *origin->rep;
711fed3efa7Sflorian if(origin->rep->reason_bogus_str) {
712fed3efa7Sflorian res->rep->reason_bogus_str = regional_strdup(region,
713fed3efa7Sflorian origin->rep->reason_bogus_str);
714fed3efa7Sflorian }
715fed3efa7Sflorian for(i=0; i<res->rep->rrset_count; i++) {
716fed3efa7Sflorian res->rep->rrsets[i] = packed_rrset_copy_region(
717fed3efa7Sflorian origin->rep->rrsets[i], region, 0);
718fed3efa7Sflorian if(!res->rep->rrsets[i]) {
719fed3efa7Sflorian return NULL;
720fed3efa7Sflorian }
721fed3efa7Sflorian }
722fed3efa7Sflorian return res;
723fed3efa7Sflorian }
724fed3efa7Sflorian
725ae8c6e27Sflorian /** synthesize RRset-only response from cached RRset item */
726ae8c6e27Sflorian static struct dns_msg*
rrset_msg(struct ub_packed_rrset_key * rrset,struct regional * region,time_t now,struct query_info * q)727ae8c6e27Sflorian rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
728ae8c6e27Sflorian time_t now, struct query_info* q)
729ae8c6e27Sflorian {
730ae8c6e27Sflorian struct dns_msg* msg;
731ae8c6e27Sflorian struct packed_rrset_data* d = (struct packed_rrset_data*)
732ae8c6e27Sflorian rrset->entry.data;
733ae8c6e27Sflorian if(now > d->ttl)
734ae8c6e27Sflorian return NULL;
735ae8c6e27Sflorian msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */
736ae8c6e27Sflorian if(!msg)
737ae8c6e27Sflorian return NULL;
738ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */
739ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
740ae8c6e27Sflorian msg->rep->qdcount = 1;
741ae8c6e27Sflorian msg->rep->ttl = d->ttl - now;
742ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
743ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
744ae8c6e27Sflorian msg->rep->security = sec_status_unchecked;
745ae8c6e27Sflorian msg->rep->an_numrrsets = 1;
746ae8c6e27Sflorian msg->rep->ns_numrrsets = 0;
747ae8c6e27Sflorian msg->rep->ar_numrrsets = 0;
748ae8c6e27Sflorian msg->rep->rrset_count = 1;
7497a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE;
750ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
751ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy CNAME */
752ae8c6e27Sflorian return NULL;
753ae8c6e27Sflorian return msg;
754ae8c6e27Sflorian }
755ae8c6e27Sflorian
756ae8c6e27Sflorian /** synthesize DNAME+CNAME response from cached DNAME item */
757ae8c6e27Sflorian static struct dns_msg*
synth_dname_msg(struct ub_packed_rrset_key * rrset,struct regional * region,time_t now,struct query_info * q,enum sec_status * sec_status)758ae8c6e27Sflorian synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
759ae8c6e27Sflorian time_t now, struct query_info* q, enum sec_status* sec_status)
760ae8c6e27Sflorian {
761ae8c6e27Sflorian struct dns_msg* msg;
762ae8c6e27Sflorian struct ub_packed_rrset_key* ck;
763ae8c6e27Sflorian struct packed_rrset_data* newd, *d = (struct packed_rrset_data*)
764ae8c6e27Sflorian rrset->entry.data;
765ae8c6e27Sflorian uint8_t* newname, *dtarg = NULL;
766ae8c6e27Sflorian size_t newlen, dtarglen;
767ae8c6e27Sflorian if(now > d->ttl)
768ae8c6e27Sflorian return NULL;
769ae8c6e27Sflorian /* only allow validated (with DNSSEC) DNAMEs used from cache
770ae8c6e27Sflorian * for insecure DNAMEs, query again. */
771ae8c6e27Sflorian *sec_status = d->security;
772ae8c6e27Sflorian /* return sec status, so the status of the CNAME can be checked
773ae8c6e27Sflorian * by the calling routine. */
774ae8c6e27Sflorian msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
775ae8c6e27Sflorian if(!msg)
776ae8c6e27Sflorian return NULL;
777ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */
778ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
779ae8c6e27Sflorian msg->rep->qdcount = 1;
780ae8c6e27Sflorian msg->rep->ttl = d->ttl - now;
781ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
782ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
783ae8c6e27Sflorian msg->rep->security = sec_status_unchecked;
784ae8c6e27Sflorian msg->rep->an_numrrsets = 1;
785ae8c6e27Sflorian msg->rep->ns_numrrsets = 0;
786ae8c6e27Sflorian msg->rep->ar_numrrsets = 0;
787ae8c6e27Sflorian msg->rep->rrset_count = 1;
7887a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE;
789ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now);
790ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy DNAME */
791ae8c6e27Sflorian return NULL;
792ae8c6e27Sflorian /* synth CNAME rrset */
793ae8c6e27Sflorian get_cname_target(rrset, &dtarg, &dtarglen);
794ae8c6e27Sflorian if(!dtarg)
795ae8c6e27Sflorian return NULL;
796ae8c6e27Sflorian newlen = q->qname_len + dtarglen - rrset->rk.dname_len;
797ae8c6e27Sflorian if(newlen > LDNS_MAX_DOMAINLEN) {
798ae8c6e27Sflorian msg->rep->flags |= LDNS_RCODE_YXDOMAIN;
799ae8c6e27Sflorian return msg;
800ae8c6e27Sflorian }
801ae8c6e27Sflorian newname = (uint8_t*)regional_alloc(region, newlen);
802ae8c6e27Sflorian if(!newname)
803ae8c6e27Sflorian return NULL;
804ae8c6e27Sflorian /* new name is concatenation of qname front (without DNAME owner)
805ae8c6e27Sflorian * and DNAME target name */
806ae8c6e27Sflorian memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len);
807ae8c6e27Sflorian memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen);
808ae8c6e27Sflorian /* create rest of CNAME rrset */
809ae8c6e27Sflorian ck = (struct ub_packed_rrset_key*)regional_alloc(region,
810ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key));
811ae8c6e27Sflorian if(!ck)
812ae8c6e27Sflorian return NULL;
813ae8c6e27Sflorian memset(&ck->entry, 0, sizeof(ck->entry));
814ae8c6e27Sflorian msg->rep->rrsets[1] = ck;
815ae8c6e27Sflorian ck->entry.key = ck;
816ae8c6e27Sflorian ck->rk.type = htons(LDNS_RR_TYPE_CNAME);
817ae8c6e27Sflorian ck->rk.rrset_class = rrset->rk.rrset_class;
818ae8c6e27Sflorian ck->rk.flags = 0;
819ae8c6e27Sflorian ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len);
820ae8c6e27Sflorian if(!ck->rk.dname)
821ae8c6e27Sflorian return NULL;
822ae8c6e27Sflorian ck->rk.dname_len = q->qname_len;
823ae8c6e27Sflorian ck->entry.hash = rrset_key_hash(&ck->rk);
824ae8c6e27Sflorian newd = (struct packed_rrset_data*)regional_alloc_zero(region,
825ae8c6e27Sflorian sizeof(struct packed_rrset_data) + sizeof(size_t) +
826ae8c6e27Sflorian sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
827ae8c6e27Sflorian + newlen);
828ae8c6e27Sflorian if(!newd)
829ae8c6e27Sflorian return NULL;
830ae8c6e27Sflorian ck->entry.data = newd;
831*54cc57acSflorian newd->ttl = d->ttl - now; /* RFC6672: synth CNAME TTL == DNAME TTL */
832ae8c6e27Sflorian newd->count = 1;
833ae8c6e27Sflorian newd->rrsig_count = 0;
834ae8c6e27Sflorian newd->trust = rrset_trust_ans_noAA;
835ae8c6e27Sflorian newd->rr_len = (size_t*)((uint8_t*)newd +
836ae8c6e27Sflorian sizeof(struct packed_rrset_data));
837ae8c6e27Sflorian newd->rr_len[0] = newlen + sizeof(uint16_t);
838ae8c6e27Sflorian packed_rrset_ptr_fixup(newd);
839ae8c6e27Sflorian newd->rr_ttl[0] = newd->ttl;
840ae8c6e27Sflorian msg->rep->ttl = newd->ttl;
841ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
842ae8c6e27Sflorian msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL;
843ae8c6e27Sflorian sldns_write_uint16(newd->rr_data[0], newlen);
844ae8c6e27Sflorian memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
845ae8c6e27Sflorian msg->rep->an_numrrsets ++;
846ae8c6e27Sflorian msg->rep->rrset_count ++;
847ae8c6e27Sflorian return msg;
848ae8c6e27Sflorian }
849ae8c6e27Sflorian
850ae8c6e27Sflorian /** Fill TYPE_ANY response with some data from cache */
851ae8c6e27Sflorian static struct dns_msg*
fill_any(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,struct regional * region)852ae8c6e27Sflorian fill_any(struct module_env* env,
853ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
854ae8c6e27Sflorian struct regional* region)
855ae8c6e27Sflorian {
856ae8c6e27Sflorian time_t now = *env->now;
857ae8c6e27Sflorian struct dns_msg* msg = NULL;
858ae8c6e27Sflorian uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA,
859ae8c6e27Sflorian LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS,
860ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 0};
861ae8c6e27Sflorian int i, num=6; /* number of RR types to look up */
862ae8c6e27Sflorian log_assert(lookup[num] == 0);
863ae8c6e27Sflorian
864ae8c6e27Sflorian if(env->cfg->deny_any) {
865ae8c6e27Sflorian /* return empty message */
866ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass,
867ae8c6e27Sflorian region, 0);
868ae8c6e27Sflorian if(!msg) {
869ae8c6e27Sflorian return NULL;
870ae8c6e27Sflorian }
8719b465e50Sflorian /* set NOTIMPL for RFC 8482 */
8729b465e50Sflorian msg->rep->flags |= LDNS_RCODE_NOTIMPL;
873ae8c6e27Sflorian msg->rep->security = sec_status_indeterminate;
874ae8c6e27Sflorian return msg;
875ae8c6e27Sflorian }
876ae8c6e27Sflorian
877ae8c6e27Sflorian for(i=0; i<num; i++) {
878ae8c6e27Sflorian /* look up this RR for inclusion in type ANY response */
879ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup(
880ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, lookup[i],
881ae8c6e27Sflorian qclass, 0, now, 0);
882ae8c6e27Sflorian struct packed_rrset_data *d;
883ae8c6e27Sflorian if(!rrset)
884ae8c6e27Sflorian continue;
885ae8c6e27Sflorian
886ae8c6e27Sflorian /* only if rrset from answer section */
887ae8c6e27Sflorian d = (struct packed_rrset_data*)rrset->entry.data;
888ae8c6e27Sflorian if(d->trust == rrset_trust_add_noAA ||
889ae8c6e27Sflorian d->trust == rrset_trust_auth_noAA ||
890ae8c6e27Sflorian d->trust == rrset_trust_add_AA ||
891ae8c6e27Sflorian d->trust == rrset_trust_auth_AA) {
892ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
893ae8c6e27Sflorian continue;
894ae8c6e27Sflorian }
895ae8c6e27Sflorian
896ae8c6e27Sflorian /* create msg if none */
897ae8c6e27Sflorian if(!msg) {
898ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass,
899ae8c6e27Sflorian region, (size_t)(num-i));
900ae8c6e27Sflorian if(!msg) {
901ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
902ae8c6e27Sflorian return NULL;
903ae8c6e27Sflorian }
904ae8c6e27Sflorian }
905ae8c6e27Sflorian
906ae8c6e27Sflorian /* add RRset to response */
907ae8c6e27Sflorian if(!dns_msg_ansadd(msg, region, rrset, now)) {
908ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
909ae8c6e27Sflorian return NULL;
910ae8c6e27Sflorian }
911ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
912ae8c6e27Sflorian }
913ae8c6e27Sflorian return msg;
914ae8c6e27Sflorian }
915ae8c6e27Sflorian
916ae8c6e27Sflorian struct dns_msg*
dns_cache_lookup(struct module_env * env,uint8_t * qname,size_t qnamelen,uint16_t qtype,uint16_t qclass,uint16_t flags,struct regional * region,struct regional * scratch,int no_partial,uint8_t * dpname,size_t dpnamelen)917ae8c6e27Sflorian dns_cache_lookup(struct module_env* env,
918ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
919ae8c6e27Sflorian uint16_t flags, struct regional* region, struct regional* scratch,
920411c5950Sflorian int no_partial, uint8_t* dpname, size_t dpnamelen)
921ae8c6e27Sflorian {
922ae8c6e27Sflorian struct lruhash_entry* e;
923ae8c6e27Sflorian struct query_info k;
924ae8c6e27Sflorian hashvalue_type h;
925ae8c6e27Sflorian time_t now = *env->now;
926ae8c6e27Sflorian struct ub_packed_rrset_key* rrset;
927ae8c6e27Sflorian
928ae8c6e27Sflorian /* lookup first, this has both NXdomains and ANSWER responses */
929ae8c6e27Sflorian k.qname = qname;
930ae8c6e27Sflorian k.qname_len = qnamelen;
931ae8c6e27Sflorian k.qtype = qtype;
932ae8c6e27Sflorian k.qclass = qclass;
933ae8c6e27Sflorian k.local_alias = NULL;
934ae8c6e27Sflorian h = query_info_hash(&k, flags);
935ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0);
936ae8c6e27Sflorian if(e) {
937ae8c6e27Sflorian struct msgreply_entry* key = (struct msgreply_entry*)e->key;
938ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data;
939d32eb43cSflorian struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0,
940ae8c6e27Sflorian scratch);
941ae8c6e27Sflorian if(msg) {
942ae8c6e27Sflorian lock_rw_unlock(&e->lock);
943ae8c6e27Sflorian return msg;
944ae8c6e27Sflorian }
945ae8c6e27Sflorian /* could be msg==NULL; due to TTL or not all rrsets available */
946ae8c6e27Sflorian lock_rw_unlock(&e->lock);
947ae8c6e27Sflorian }
948ae8c6e27Sflorian
949ae8c6e27Sflorian /* see if a DNAME exists. Checked for first, to enforce that DNAMEs
950ae8c6e27Sflorian * are more important, the CNAME is resynthesized and thus
951ae8c6e27Sflorian * consistent with the DNAME */
952ae8c6e27Sflorian if(!no_partial &&
953ae8c6e27Sflorian (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now,
9546d08cb1bSflorian LDNS_RR_TYPE_DNAME, 1, 0, NULL, 0))) {
955ae8c6e27Sflorian /* synthesize a DNAME+CNAME message based on this */
956ae8c6e27Sflorian enum sec_status sec_status = sec_status_unchecked;
957ae8c6e27Sflorian struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k,
958ae8c6e27Sflorian &sec_status);
959ae8c6e27Sflorian if(msg) {
960ae8c6e27Sflorian struct ub_packed_rrset_key* cname_rrset;
961ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
962ae8c6e27Sflorian /* now, after unlocking the DNAME rrset lock,
963ae8c6e27Sflorian * check the sec_status, and see if we need to look
964ae8c6e27Sflorian * up the CNAME record associated before it can
965ae8c6e27Sflorian * be used */
966ae8c6e27Sflorian /* normally, only secure DNAMEs allowed from cache*/
967ae8c6e27Sflorian if(sec_status == sec_status_secure)
968ae8c6e27Sflorian return msg;
969ae8c6e27Sflorian /* but if we have a CNAME cached with this name, then we
970ae8c6e27Sflorian * have previously already allowed this name to pass.
971ae8c6e27Sflorian * the next cache lookup is going to fetch that CNAME itself,
972ae8c6e27Sflorian * but it is better to have the (unsigned)DNAME + CNAME in
973ae8c6e27Sflorian * that case */
974ae8c6e27Sflorian cname_rrset = rrset_cache_lookup(
975ae8c6e27Sflorian env->rrset_cache, qname, qnamelen,
976ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0);
977ae8c6e27Sflorian if(cname_rrset) {
978ae8c6e27Sflorian /* CNAME already synthesized by
979ae8c6e27Sflorian * synth_dname_msg routine, so we can
980ae8c6e27Sflorian * straight up return the msg */
981ae8c6e27Sflorian lock_rw_unlock(&cname_rrset->entry.lock);
982ae8c6e27Sflorian return msg;
983ae8c6e27Sflorian }
984ae8c6e27Sflorian } else {
985ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
986ae8c6e27Sflorian }
987ae8c6e27Sflorian }
988ae8c6e27Sflorian
989ae8c6e27Sflorian /* see if we have CNAME for this domain,
990ae8c6e27Sflorian * but not for DS records (which are part of the parent) */
991ae8c6e27Sflorian if(!no_partial && qtype != LDNS_RR_TYPE_DS &&
992ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
993ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) {
994ae8c6e27Sflorian uint8_t* wc = NULL;
995ae8c6e27Sflorian size_t wl;
996ae8c6e27Sflorian /* if the rrset is not a wildcard expansion, with wcname */
997ae8c6e27Sflorian /* because, if we return that CNAME rrset on its own, it is
998ae8c6e27Sflorian * missing the NSEC or NSEC3 proof */
999ae8c6e27Sflorian if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) {
1000ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
1001ae8c6e27Sflorian if(msg) {
1002ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
1003ae8c6e27Sflorian return msg;
1004ae8c6e27Sflorian }
1005ae8c6e27Sflorian }
1006ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
1007ae8c6e27Sflorian }
1008ae8c6e27Sflorian
1009f4f0f0ceSflorian /* construct DS, DNSKEY messages from rrset cache. */
1010f4f0f0ceSflorian if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) &&
1011ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen,
1012ae8c6e27Sflorian qtype, qclass, 0, now, 0))) {
1013ae8c6e27Sflorian /* if the rrset is from the additional section, and the
1014ae8c6e27Sflorian * signatures have fallen off, then do not synthesize a msg
1015ae8c6e27Sflorian * instead, allow a full query for signed results to happen.
1016ae8c6e27Sflorian * Forego all rrset data from additional section, because
1017ae8c6e27Sflorian * some signatures may not be present and cause validation
1018ae8c6e27Sflorian * failure.
1019ae8c6e27Sflorian */
1020ae8c6e27Sflorian struct packed_rrset_data *d = (struct packed_rrset_data*)
1021ae8c6e27Sflorian rrset->entry.data;
1022ae8c6e27Sflorian if(d->trust != rrset_trust_add_noAA &&
1023ae8c6e27Sflorian d->trust != rrset_trust_add_AA &&
1024ae8c6e27Sflorian (qtype == LDNS_RR_TYPE_DS ||
1025ae8c6e27Sflorian (d->trust != rrset_trust_auth_noAA
1026ae8c6e27Sflorian && d->trust != rrset_trust_auth_AA) )) {
1027ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
1028ae8c6e27Sflorian if(msg) {
1029ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
1030ae8c6e27Sflorian return msg;
1031ae8c6e27Sflorian }
1032ae8c6e27Sflorian }
1033ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock);
1034ae8c6e27Sflorian }
1035ae8c6e27Sflorian
1036ae8c6e27Sflorian /* stop downwards cache search on NXDOMAIN.
1037ae8c6e27Sflorian * Empty nonterminals are NOERROR, so an NXDOMAIN for foo
1038ae8c6e27Sflorian * means bla.foo also does not exist. The DNSSEC proofs are
1039ae8c6e27Sflorian * the same. We search upwards for NXDOMAINs. */
1040d32eb43cSflorian if(env->cfg->harden_below_nxdomain) {
1041ae8c6e27Sflorian while(!dname_is_root(k.qname)) {
1042411c5950Sflorian if(dpname && dpnamelen
1043411c5950Sflorian && !dname_subdomain_c(k.qname, dpname))
1044411c5950Sflorian break; /* no synth nxdomain above the stub */
1045ae8c6e27Sflorian dname_remove_label(&k.qname, &k.qname_len);
1046ae8c6e27Sflorian h = query_info_hash(&k, flags);
1047ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0);
1048ae8c6e27Sflorian if(!e && k.qtype != LDNS_RR_TYPE_A &&
1049ae8c6e27Sflorian env->cfg->qname_minimisation) {
1050ae8c6e27Sflorian k.qtype = LDNS_RR_TYPE_A;
1051ae8c6e27Sflorian h = query_info_hash(&k, flags);
1052ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0);
1053ae8c6e27Sflorian }
1054ae8c6e27Sflorian if(e) {
1055ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data;
1056ae8c6e27Sflorian struct dns_msg* msg;
1057ae8c6e27Sflorian if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN
1058ae8c6e27Sflorian && data->security == sec_status_secure
10599b465e50Sflorian && (data->an_numrrsets == 0 ||
10609b465e50Sflorian ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME)
1061d32eb43cSflorian && (msg=tomsg(env, &k, data, region, now, 0, scratch))) {
1062ae8c6e27Sflorian lock_rw_unlock(&e->lock);
1063ae8c6e27Sflorian msg->qinfo.qname=qname;
1064ae8c6e27Sflorian msg->qinfo.qname_len=qnamelen;
1065ae8c6e27Sflorian /* check that DNSSEC really works out */
1066ae8c6e27Sflorian msg->rep->security = sec_status_unchecked;
10679b465e50Sflorian iter_scrub_nxdomain(msg);
1068ae8c6e27Sflorian return msg;
1069ae8c6e27Sflorian }
1070ae8c6e27Sflorian lock_rw_unlock(&e->lock);
1071ae8c6e27Sflorian }
1072ae8c6e27Sflorian k.qtype = qtype;
1073ae8c6e27Sflorian }
1074d32eb43cSflorian }
1075ae8c6e27Sflorian
1076ae8c6e27Sflorian /* fill common RR types for ANY response to avoid requery */
1077ae8c6e27Sflorian if(qtype == LDNS_RR_TYPE_ANY) {
1078ae8c6e27Sflorian return fill_any(env, qname, qnamelen, qtype, qclass, region);
1079ae8c6e27Sflorian }
1080ae8c6e27Sflorian
1081ae8c6e27Sflorian return NULL;
1082ae8c6e27Sflorian }
1083ae8c6e27Sflorian
1084ae8c6e27Sflorian int
dns_cache_store(struct module_env * env,struct query_info * msgqinf,struct reply_info * msgrep,int is_referral,time_t leeway,int pside,struct regional * region,uint32_t flags,time_t qstarttime)1085ae8c6e27Sflorian dns_cache_store(struct module_env* env, struct query_info* msgqinf,
1086ae8c6e27Sflorian struct reply_info* msgrep, int is_referral, time_t leeway, int pside,
10876d08cb1bSflorian struct regional* region, uint32_t flags, time_t qstarttime)
1088ae8c6e27Sflorian {
1089ae8c6e27Sflorian struct reply_info* rep = NULL;
1090ae8c6e27Sflorian /* alloc, malloc properly (not in region, like msg is) */
1091ae8c6e27Sflorian rep = reply_info_copy(msgrep, env->alloc, NULL);
1092ae8c6e27Sflorian if(!rep)
1093ae8c6e27Sflorian return 0;
1094ae8c6e27Sflorian /* ttl must be relative ;i.e. 0..86400 not time(0)+86400.
1095ae8c6e27Sflorian * the env->now is added to message and RRsets in this routine. */
1096ae8c6e27Sflorian /* the leeway is used to invalidate other rrsets earlier */
1097ae8c6e27Sflorian if(is_referral) {
1098ae8c6e27Sflorian /* store rrsets */
1099ae8c6e27Sflorian struct rrset_ref ref;
1100ae8c6e27Sflorian size_t i;
1101ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) {
1102ae8c6e27Sflorian packed_rrset_ttl_add((struct packed_rrset_data*)
1103ae8c6e27Sflorian rep->rrsets[i]->entry.data, *env->now);
1104ae8c6e27Sflorian ref.key = rep->rrsets[i];
1105ae8c6e27Sflorian ref.id = rep->rrsets[i]->id;
1106ae8c6e27Sflorian /*ignore ret: it was in the cache, ref updated */
1107ae8c6e27Sflorian /* no leeway for typeNS */
1108ae8c6e27Sflorian (void)rrset_cache_update(env->rrset_cache, &ref,
11096d08cb1bSflorian env->alloc,
1110ae8c6e27Sflorian ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
11116d08cb1bSflorian && !pside) ? qstarttime:*env->now + leeway));
1112ae8c6e27Sflorian }
1113d500c338Sflorian reply_info_delete(rep, NULL);
1114ae8c6e27Sflorian return 1;
1115ae8c6e27Sflorian } else {
1116ae8c6e27Sflorian /* store msg, and rrsets */
1117ae8c6e27Sflorian struct query_info qinf;
1118ae8c6e27Sflorian hashvalue_type h;
1119ae8c6e27Sflorian
1120ae8c6e27Sflorian qinf = *msgqinf;
1121ae8c6e27Sflorian qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len);
1122ae8c6e27Sflorian if(!qinf.qname) {
1123ae8c6e27Sflorian reply_info_parsedelete(rep, env->alloc);
1124ae8c6e27Sflorian return 0;
1125ae8c6e27Sflorian }
1126ae8c6e27Sflorian /* fixup flags to be sensible for a reply based on the cache */
1127ae8c6e27Sflorian /* this module means that RA is available. It is an answer QR.
1128ae8c6e27Sflorian * Not AA from cache. Not CD in cache (depends on client bit). */
1129ae8c6e27Sflorian rep->flags |= (BIT_RA | BIT_QR);
1130ae8c6e27Sflorian rep->flags &= ~(BIT_AA | BIT_CD);
1131ae8c6e27Sflorian h = query_info_hash(&qinf, (uint16_t)flags);
1132ae8c6e27Sflorian dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep,
11336d08cb1bSflorian flags, region, qstarttime);
1134ae8c6e27Sflorian /* qname is used inside query_info_entrysetup, and set to
1135ae8c6e27Sflorian * NULL. If it has not been used, free it. free(0) is safe. */
1136ae8c6e27Sflorian free(qinf.qname);
1137ae8c6e27Sflorian }
1138ae8c6e27Sflorian return 1;
1139ae8c6e27Sflorian }
1140ae8c6e27Sflorian
1141ae8c6e27Sflorian int
dns_cache_prefetch_adjust(struct module_env * env,struct query_info * qinfo,time_t adjust,uint16_t flags)1142ae8c6e27Sflorian dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo,
1143ae8c6e27Sflorian time_t adjust, uint16_t flags)
1144ae8c6e27Sflorian {
1145ae8c6e27Sflorian struct msgreply_entry* msg;
1146ae8c6e27Sflorian msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len,
1147ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, *env->now, 1);
1148ae8c6e27Sflorian if(msg) {
1149ae8c6e27Sflorian struct reply_info* rep = (struct reply_info*)msg->entry.data;
1150ae8c6e27Sflorian if(rep) {
1151ae8c6e27Sflorian rep->prefetch_ttl += adjust;
1152ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock);
1153ae8c6e27Sflorian return 1;
1154ae8c6e27Sflorian }
1155ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock);
1156ae8c6e27Sflorian }
1157ae8c6e27Sflorian return 0;
1158ae8c6e27Sflorian }
1159