1ae8c6e27Sflorian /* 2ae8c6e27Sflorian * services/cache/dns.c - Cache services for DNS using msg and rrset caches. 3ae8c6e27Sflorian * 4ae8c6e27Sflorian * Copyright (c) 2007, NLnet Labs. All rights reserved. 5ae8c6e27Sflorian * 6ae8c6e27Sflorian * This software is open source. 7ae8c6e27Sflorian * 8ae8c6e27Sflorian * Redistribution and use in source and binary forms, with or without 9ae8c6e27Sflorian * modification, are permitted provided that the following conditions 10ae8c6e27Sflorian * are met: 11ae8c6e27Sflorian * 12ae8c6e27Sflorian * Redistributions of source code must retain the above copyright notice, 13ae8c6e27Sflorian * this list of conditions and the following disclaimer. 14ae8c6e27Sflorian * 15ae8c6e27Sflorian * Redistributions in binary form must reproduce the above copyright notice, 16ae8c6e27Sflorian * this list of conditions and the following disclaimer in the documentation 17ae8c6e27Sflorian * and/or other materials provided with the distribution. 18ae8c6e27Sflorian * 19ae8c6e27Sflorian * Neither the name of the NLNET LABS nor the names of its contributors may 20ae8c6e27Sflorian * be used to endorse or promote products derived from this software without 21ae8c6e27Sflorian * specific prior written permission. 22ae8c6e27Sflorian * 23ae8c6e27Sflorian * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24ae8c6e27Sflorian * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25ae8c6e27Sflorian * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26ae8c6e27Sflorian * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27ae8c6e27Sflorian * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28ae8c6e27Sflorian * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29ae8c6e27Sflorian * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30ae8c6e27Sflorian * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31ae8c6e27Sflorian * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32ae8c6e27Sflorian * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33ae8c6e27Sflorian * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34ae8c6e27Sflorian */ 35ae8c6e27Sflorian 36ae8c6e27Sflorian /** 37ae8c6e27Sflorian * \file 38ae8c6e27Sflorian * 39ae8c6e27Sflorian * This file contains the DNS cache. 40ae8c6e27Sflorian */ 41ae8c6e27Sflorian #include "config.h" 42ae8c6e27Sflorian #include "iterator/iter_delegpt.h" 439b465e50Sflorian #include "iterator/iter_utils.h" 44ae8c6e27Sflorian #include "validator/val_nsec.h" 45ae8c6e27Sflorian #include "validator/val_utils.h" 46ae8c6e27Sflorian #include "services/cache/dns.h" 47ae8c6e27Sflorian #include "services/cache/rrset.h" 48d32eb43cSflorian #include "util/data/msgparse.h" 49ae8c6e27Sflorian #include "util/data/msgreply.h" 50ae8c6e27Sflorian #include "util/data/packed_rrset.h" 51ae8c6e27Sflorian #include "util/data/dname.h" 52ae8c6e27Sflorian #include "util/module.h" 53ae8c6e27Sflorian #include "util/net_help.h" 54ae8c6e27Sflorian #include "util/regional.h" 55ae8c6e27Sflorian #include "util/config_file.h" 56ae8c6e27Sflorian #include "sldns/sbuffer.h" 57ae8c6e27Sflorian 58ae8c6e27Sflorian /** store rrsets in the rrset cache. 59ae8c6e27Sflorian * @param env: module environment with caches. 60ae8c6e27Sflorian * @param rep: contains list of rrsets to store. 61ae8c6e27Sflorian * @param now: current time. 62ae8c6e27Sflorian * @param leeway: during prefetch how much leeway to update TTLs. 63ae8c6e27Sflorian * This makes rrsets (other than type NS) timeout sooner so they get 64ae8c6e27Sflorian * updated with a new full TTL. 65ae8c6e27Sflorian * Type NS does not get this, because it must not be refreshed from the 66ae8c6e27Sflorian * child domain, but keep counting down properly. 67ae8c6e27Sflorian * @param pside: if from parentside discovered NS, so that its NS is okay 68ae8c6e27Sflorian * in a prefetch situation to be updated (without becoming sticky). 69ae8c6e27Sflorian * @param qrep: update rrsets here if cache is better 70ae8c6e27Sflorian * @param region: for qrep allocs. 71ae8c6e27Sflorian */ 72ae8c6e27Sflorian static void 73ae8c6e27Sflorian store_rrsets(struct module_env* env, struct reply_info* rep, time_t now, 74ae8c6e27Sflorian time_t leeway, int pside, struct reply_info* qrep, 75ae8c6e27Sflorian struct regional* region) 76ae8c6e27Sflorian { 77ae8c6e27Sflorian size_t i; 78ae8c6e27Sflorian /* see if rrset already exists in cache, if not insert it. */ 79ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 80ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 81ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 82ae8c6e27Sflorian /* update ref if it was in the cache */ 83ae8c6e27Sflorian switch(rrset_cache_update(env->rrset_cache, &rep->ref[i], 84ae8c6e27Sflorian env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)== 85ae8c6e27Sflorian LDNS_RR_TYPE_NS && !pside)?0:leeway))) { 86ae8c6e27Sflorian case 0: /* ref unchanged, item inserted */ 87ae8c6e27Sflorian break; 88ae8c6e27Sflorian case 2: /* ref updated, cache is superior */ 89ae8c6e27Sflorian if(region) { 90ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 91ae8c6e27Sflorian lock_rw_rdlock(&rep->ref[i].key->entry.lock); 92ae8c6e27Sflorian /* if deleted rrset, do not copy it */ 93ae8c6e27Sflorian if(rep->ref[i].key->id == 0) 94ae8c6e27Sflorian ck = NULL; 95ae8c6e27Sflorian else ck = packed_rrset_copy_region( 96ae8c6e27Sflorian rep->ref[i].key, region, now); 97ae8c6e27Sflorian lock_rw_unlock(&rep->ref[i].key->entry.lock); 98ae8c6e27Sflorian if(ck) { 99ae8c6e27Sflorian /* use cached copy if memory allows */ 100ae8c6e27Sflorian qrep->rrsets[i] = ck; 101ae8c6e27Sflorian } 102ae8c6e27Sflorian } 103ae8c6e27Sflorian /* no break: also copy key item */ 104ae8c6e27Sflorian /* the line below is matched by gcc regex and silences 105ae8c6e27Sflorian * the fallthrough warning */ 106ae8c6e27Sflorian /* fallthrough */ 107ae8c6e27Sflorian case 1: /* ref updated, item inserted */ 108ae8c6e27Sflorian rep->rrsets[i] = rep->ref[i].key; 109ae8c6e27Sflorian } 110ae8c6e27Sflorian } 111ae8c6e27Sflorian } 112ae8c6e27Sflorian 113ae8c6e27Sflorian /** delete message from message cache */ 114ae8c6e27Sflorian void 115ae8c6e27Sflorian msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 116ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags) 117ae8c6e27Sflorian { 118ae8c6e27Sflorian struct query_info k; 119ae8c6e27Sflorian hashvalue_type h; 120ae8c6e27Sflorian 121ae8c6e27Sflorian k.qname = qname; 122ae8c6e27Sflorian k.qname_len = qnamelen; 123ae8c6e27Sflorian k.qtype = qtype; 124ae8c6e27Sflorian k.qclass = qclass; 125ae8c6e27Sflorian k.local_alias = NULL; 126ae8c6e27Sflorian h = query_info_hash(&k, flags); 127ae8c6e27Sflorian slabhash_remove(env->msg_cache, h, &k); 128ae8c6e27Sflorian } 129ae8c6e27Sflorian 130ae8c6e27Sflorian /** remove servfail msg cache entry */ 131ae8c6e27Sflorian static void 132ae8c6e27Sflorian msg_del_servfail(struct module_env* env, struct query_info* qinfo, 133ae8c6e27Sflorian uint32_t flags) 134ae8c6e27Sflorian { 135ae8c6e27Sflorian struct msgreply_entry* e; 136ae8c6e27Sflorian /* see if the entry is servfail, and then remove it, so that 137ae8c6e27Sflorian * lookups move from the cacheresponse stage to the recursionresponse 138ae8c6e27Sflorian * stage */ 139ae8c6e27Sflorian e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 140ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, 0, 0); 141ae8c6e27Sflorian if(!e) return; 142ae8c6e27Sflorian /* we don't check for the ttl here, also expired servfail entries 143ae8c6e27Sflorian * are removed. If the user uses serve-expired, they would still be 144ae8c6e27Sflorian * used to answer from cache */ 145ae8c6e27Sflorian if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags) 146ae8c6e27Sflorian != LDNS_RCODE_SERVFAIL) { 147ae8c6e27Sflorian lock_rw_unlock(&e->entry.lock); 148ae8c6e27Sflorian return; 149ae8c6e27Sflorian } 150ae8c6e27Sflorian lock_rw_unlock(&e->entry.lock); 151ae8c6e27Sflorian msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype, 152ae8c6e27Sflorian qinfo->qclass, flags); 153ae8c6e27Sflorian } 154ae8c6e27Sflorian 155ae8c6e27Sflorian void 156ae8c6e27Sflorian dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, 157ae8c6e27Sflorian hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, 158ae8c6e27Sflorian struct reply_info* qrep, uint32_t flags, struct regional* region) 159ae8c6e27Sflorian { 160ae8c6e27Sflorian struct msgreply_entry* e; 161ae8c6e27Sflorian time_t ttl = rep->ttl; 162ae8c6e27Sflorian size_t i; 163ae8c6e27Sflorian 164ae8c6e27Sflorian /* store RRsets */ 165ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 166ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 167ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 168ae8c6e27Sflorian } 169ae8c6e27Sflorian 170ae8c6e27Sflorian /* there was a reply_info_sortref(rep) here but it seems to be 171ae8c6e27Sflorian * unnecessary, because the cache gets locked per rrset. */ 172ae8c6e27Sflorian reply_info_set_ttls(rep, *env->now); 173ae8c6e27Sflorian store_rrsets(env, rep, *env->now, leeway, pside, qrep, region); 174ae8c6e27Sflorian if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) { 175ae8c6e27Sflorian /* we do not store the message, but we did store the RRs, 176ae8c6e27Sflorian * which could be useful for delegation information */ 177ae8c6e27Sflorian verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); 178ae8c6e27Sflorian free(rep); 179ae8c6e27Sflorian /* if the message is SERVFAIL in cache, remove that SERVFAIL, 180ae8c6e27Sflorian * so that the TTL 0 response can be returned for future 181ae8c6e27Sflorian * responses (i.e. don't get answered by the servfail from 182ae8c6e27Sflorian * cache, but instead go to recursion to get this TTL0 183ae8c6e27Sflorian * response). */ 184ae8c6e27Sflorian msg_del_servfail(env, qinfo, flags); 185ae8c6e27Sflorian return; 186ae8c6e27Sflorian } 187ae8c6e27Sflorian 188ae8c6e27Sflorian /* store msg in the cache */ 189ae8c6e27Sflorian reply_info_sortref(rep); 190ae8c6e27Sflorian if(!(e = query_info_entrysetup(qinfo, rep, hash))) { 191ae8c6e27Sflorian log_err("store_msg: malloc failed"); 192ae8c6e27Sflorian return; 193ae8c6e27Sflorian } 194ae8c6e27Sflorian slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc); 195ae8c6e27Sflorian } 196ae8c6e27Sflorian 197ae8c6e27Sflorian /** find closest NS or DNAME and returns the rrset (locked) */ 198ae8c6e27Sflorian static struct ub_packed_rrset_key* 199ae8c6e27Sflorian find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 200ae8c6e27Sflorian uint16_t qclass, time_t now, uint16_t searchtype, int stripfront) 201ae8c6e27Sflorian { 202ae8c6e27Sflorian struct ub_packed_rrset_key *rrset; 203ae8c6e27Sflorian uint8_t lablen; 204ae8c6e27Sflorian 205ae8c6e27Sflorian if(stripfront) { 206ae8c6e27Sflorian /* strip off so that DNAMEs have strict subdomain match */ 207ae8c6e27Sflorian lablen = *qname; 208ae8c6e27Sflorian qname += lablen + 1; 209ae8c6e27Sflorian qnamelen -= lablen + 1; 210ae8c6e27Sflorian } 211ae8c6e27Sflorian 212ae8c6e27Sflorian /* snip off front part of qname until the type is found */ 213ae8c6e27Sflorian while(qnamelen > 0) { 214ae8c6e27Sflorian if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 215ae8c6e27Sflorian qnamelen, searchtype, qclass, 0, now, 0))) 216ae8c6e27Sflorian return rrset; 217ae8c6e27Sflorian 218ae8c6e27Sflorian /* snip off front label */ 219ae8c6e27Sflorian lablen = *qname; 220ae8c6e27Sflorian qname += lablen + 1; 221ae8c6e27Sflorian qnamelen -= lablen + 1; 222ae8c6e27Sflorian } 223ae8c6e27Sflorian return NULL; 224ae8c6e27Sflorian } 225ae8c6e27Sflorian 226ae8c6e27Sflorian /** add addr to additional section */ 227ae8c6e27Sflorian static void 228ae8c6e27Sflorian addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region, 229ae8c6e27Sflorian struct dns_msg* msg, time_t now) 230ae8c6e27Sflorian { 231ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 232ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 233ae8c6e27Sflorian msg->rep->ar_numrrsets++; 234ae8c6e27Sflorian msg->rep->rrset_count++; 235ae8c6e27Sflorian } 236ae8c6e27Sflorian } 237ae8c6e27Sflorian 238ae8c6e27Sflorian /** lookup message in message cache */ 239ae8c6e27Sflorian struct msgreply_entry* 240ae8c6e27Sflorian msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 241ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr) 242ae8c6e27Sflorian { 243ae8c6e27Sflorian struct lruhash_entry* e; 244ae8c6e27Sflorian struct query_info k; 245ae8c6e27Sflorian hashvalue_type h; 246ae8c6e27Sflorian 247ae8c6e27Sflorian k.qname = qname; 248ae8c6e27Sflorian k.qname_len = qnamelen; 249ae8c6e27Sflorian k.qtype = qtype; 250ae8c6e27Sflorian k.qclass = qclass; 251ae8c6e27Sflorian k.local_alias = NULL; 252ae8c6e27Sflorian h = query_info_hash(&k, flags); 253ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, wr); 254ae8c6e27Sflorian 255ae8c6e27Sflorian if(!e) return NULL; 256ae8c6e27Sflorian if( now > ((struct reply_info*)e->data)->ttl ) { 257ae8c6e27Sflorian lock_rw_unlock(&e->lock); 258ae8c6e27Sflorian return NULL; 259ae8c6e27Sflorian } 260ae8c6e27Sflorian return (struct msgreply_entry*)e->key; 261ae8c6e27Sflorian } 262ae8c6e27Sflorian 263ae8c6e27Sflorian /** find and add A and AAAA records for nameservers in delegpt */ 264ae8c6e27Sflorian static int 265ae8c6e27Sflorian find_add_addrs(struct module_env* env, uint16_t qclass, 266ae8c6e27Sflorian struct regional* region, struct delegpt* dp, time_t now, 267ae8c6e27Sflorian struct dns_msg** msg) 268ae8c6e27Sflorian { 269ae8c6e27Sflorian struct delegpt_ns* ns; 270ae8c6e27Sflorian struct msgreply_entry* neg; 271ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 272ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 273ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 274ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 275ae8c6e27Sflorian if(akey) { 2765a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) { 277ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 278ae8c6e27Sflorian return 0; 279ae8c6e27Sflorian } 280ae8c6e27Sflorian if(msg) 281ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 282ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 283ae8c6e27Sflorian } else { 284ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 285ae8c6e27Sflorian * not use dns64 translation */ 286ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 287ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 288ae8c6e27Sflorian if(neg) { 289ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 290ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 291ae8c6e27Sflorian } 292ae8c6e27Sflorian } 293ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 294ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 295ae8c6e27Sflorian if(akey) { 2965a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) { 297ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 298ae8c6e27Sflorian return 0; 299ae8c6e27Sflorian } 300ae8c6e27Sflorian if(msg) 301ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 302ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 303ae8c6e27Sflorian } else { 304ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 305ae8c6e27Sflorian * not use dns64 translation */ 306ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 307ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 308ae8c6e27Sflorian if(neg) { 309ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 310ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 311ae8c6e27Sflorian } 312ae8c6e27Sflorian } 313ae8c6e27Sflorian } 314ae8c6e27Sflorian return 1; 315ae8c6e27Sflorian } 316ae8c6e27Sflorian 317ae8c6e27Sflorian /** find and add A and AAAA records for missing nameservers in delegpt */ 318ae8c6e27Sflorian int 319ae8c6e27Sflorian cache_fill_missing(struct module_env* env, uint16_t qclass, 320ae8c6e27Sflorian struct regional* region, struct delegpt* dp) 321ae8c6e27Sflorian { 322ae8c6e27Sflorian struct delegpt_ns* ns; 323ae8c6e27Sflorian struct msgreply_entry* neg; 324ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 325ae8c6e27Sflorian time_t now = *env->now; 326ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 327ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 328ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 329ae8c6e27Sflorian if(akey) { 3305a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, ns->lame, 3315a7d75e6Ssthen NULL)) { 332ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 333ae8c6e27Sflorian return 0; 334ae8c6e27Sflorian } 335ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 336ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_A, qclass); 337ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 338ae8c6e27Sflorian } else { 339ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 340ae8c6e27Sflorian * not use dns64 translation */ 341ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 342ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 343ae8c6e27Sflorian if(neg) { 344ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 345ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 346ae8c6e27Sflorian } 347ae8c6e27Sflorian } 348ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 349ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 350ae8c6e27Sflorian if(akey) { 3515a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame, 3525a7d75e6Ssthen NULL)) { 353ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 354ae8c6e27Sflorian return 0; 355ae8c6e27Sflorian } 356ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 357ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_AAAA, qclass); 358ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 359ae8c6e27Sflorian } else { 360ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 361ae8c6e27Sflorian * not use dns64 translation */ 362ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 363ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 364ae8c6e27Sflorian if(neg) { 365ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 366ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 367ae8c6e27Sflorian } 368ae8c6e27Sflorian } 369ae8c6e27Sflorian } 370ae8c6e27Sflorian return 1; 371ae8c6e27Sflorian } 372ae8c6e27Sflorian 373ae8c6e27Sflorian /** find and add DS or NSEC to delegation msg */ 374ae8c6e27Sflorian static void 375ae8c6e27Sflorian find_add_ds(struct module_env* env, struct regional* region, 376ae8c6e27Sflorian struct dns_msg* msg, struct delegpt* dp, time_t now) 377ae8c6e27Sflorian { 378ae8c6e27Sflorian /* Lookup the DS or NSEC at the delegation point. */ 379ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 380ae8c6e27Sflorian env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 381ae8c6e27Sflorian msg->qinfo.qclass, 0, now, 0); 382ae8c6e27Sflorian if(!rrset) { 383ae8c6e27Sflorian /* NOTE: this won't work for alternate NSEC schemes 384ae8c6e27Sflorian * (opt-in, NSEC3) */ 385ae8c6e27Sflorian rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 386ae8c6e27Sflorian dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 387ae8c6e27Sflorian 0, now, 0); 388ae8c6e27Sflorian /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used. 389ae8c6e27Sflorian * since this is a referral, we need the NSEC at the parent 390ae8c6e27Sflorian * side of the zone cut, not the NSEC at apex side. */ 391ae8c6e27Sflorian if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) { 392ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 393ae8c6e27Sflorian rrset = NULL; /* discard wrong NSEC */ 394ae8c6e27Sflorian } 395ae8c6e27Sflorian } 396ae8c6e27Sflorian if(rrset) { 397ae8c6e27Sflorian /* add it to auth section. This is the second rrset. */ 398ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 399ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 400ae8c6e27Sflorian msg->rep->ns_numrrsets++; 401ae8c6e27Sflorian msg->rep->rrset_count++; 402ae8c6e27Sflorian } 403ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 404ae8c6e27Sflorian } 405ae8c6e27Sflorian } 406ae8c6e27Sflorian 407ae8c6e27Sflorian struct dns_msg* 408ae8c6e27Sflorian dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 409ae8c6e27Sflorian uint16_t qclass, struct regional* region, size_t capacity) 410ae8c6e27Sflorian { 411ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 412ae8c6e27Sflorian sizeof(struct dns_msg)); 413ae8c6e27Sflorian if(!msg) 414ae8c6e27Sflorian return NULL; 415ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen); 416ae8c6e27Sflorian if(!msg->qinfo.qname) 417ae8c6e27Sflorian return NULL; 418ae8c6e27Sflorian msg->qinfo.qname_len = qnamelen; 419ae8c6e27Sflorian msg->qinfo.qtype = qtype; 420ae8c6e27Sflorian msg->qinfo.qclass = qclass; 421ae8c6e27Sflorian msg->qinfo.local_alias = NULL; 422ae8c6e27Sflorian /* non-packed reply_info, because it needs to grow the array */ 423ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc_zero(region, 424ae8c6e27Sflorian sizeof(struct reply_info)-sizeof(struct rrset_ref)); 425ae8c6e27Sflorian if(!msg->rep) 426ae8c6e27Sflorian return NULL; 427ae8c6e27Sflorian if(capacity > RR_COUNT_MAX) 428ae8c6e27Sflorian return NULL; /* integer overflow protection */ 429ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* with QR, no AA */ 430ae8c6e27Sflorian msg->rep->qdcount = 1; 431ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 432ae8c6e27Sflorian regional_alloc(region, 433ae8c6e27Sflorian capacity*sizeof(struct ub_packed_rrset_key*)); 434ae8c6e27Sflorian if(!msg->rep->rrsets) 435ae8c6e27Sflorian return NULL; 436ae8c6e27Sflorian return msg; 437ae8c6e27Sflorian } 438ae8c6e27Sflorian 439ae8c6e27Sflorian int 440ae8c6e27Sflorian dns_msg_authadd(struct dns_msg* msg, struct regional* region, 441ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 442ae8c6e27Sflorian { 443ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 444ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 445ae8c6e27Sflorian return 0; 446ae8c6e27Sflorian msg->rep->ns_numrrsets++; 447ae8c6e27Sflorian return 1; 448ae8c6e27Sflorian } 449ae8c6e27Sflorian 450ae8c6e27Sflorian int 451ae8c6e27Sflorian dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 452ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 453ae8c6e27Sflorian { 454ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 455ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 456ae8c6e27Sflorian return 0; 457ae8c6e27Sflorian msg->rep->an_numrrsets++; 458ae8c6e27Sflorian return 1; 459ae8c6e27Sflorian } 460ae8c6e27Sflorian 461ae8c6e27Sflorian struct delegpt* 462ae8c6e27Sflorian dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 463ae8c6e27Sflorian size_t qnamelen, uint16_t qtype, uint16_t qclass, 464ae8c6e27Sflorian struct regional* region, struct dns_msg** msg, time_t now) 465ae8c6e27Sflorian { 466ae8c6e27Sflorian /* try to find closest NS rrset */ 467ae8c6e27Sflorian struct ub_packed_rrset_key* nskey; 468ae8c6e27Sflorian struct packed_rrset_data* nsdata; 469ae8c6e27Sflorian struct delegpt* dp; 470ae8c6e27Sflorian 471ae8c6e27Sflorian nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, 472ae8c6e27Sflorian LDNS_RR_TYPE_NS, 0); 473ae8c6e27Sflorian if(!nskey) /* hope the caller has hints to prime or something */ 474ae8c6e27Sflorian return NULL; 475ae8c6e27Sflorian nsdata = (struct packed_rrset_data*)nskey->entry.data; 476ae8c6e27Sflorian /* got the NS key, create delegation point */ 477ae8c6e27Sflorian dp = delegpt_create(region); 478ae8c6e27Sflorian if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) { 479ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 480ae8c6e27Sflorian log_err("find_delegation: out of memory"); 481ae8c6e27Sflorian return NULL; 482ae8c6e27Sflorian } 483ae8c6e27Sflorian /* create referral message */ 484ae8c6e27Sflorian if(msg) { 485ae8c6e27Sflorian /* allocate the array to as much as we could need: 486ae8c6e27Sflorian * NS rrset + DS/NSEC rrset + 487ae8c6e27Sflorian * A rrset for every NS RR 488ae8c6e27Sflorian * AAAA rrset for every NS RR 489ae8c6e27Sflorian */ 490ae8c6e27Sflorian *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 491ae8c6e27Sflorian 2 + nsdata->count*2); 492ae8c6e27Sflorian if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) { 493ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 494ae8c6e27Sflorian log_err("find_delegation: out of memory"); 495ae8c6e27Sflorian return NULL; 496ae8c6e27Sflorian } 497ae8c6e27Sflorian } 498ae8c6e27Sflorian if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) 499ae8c6e27Sflorian log_err("find_delegation: addns out of memory"); 500ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/ 501ae8c6e27Sflorian /* find and add DS/NSEC (if any) */ 502ae8c6e27Sflorian if(msg) 503ae8c6e27Sflorian find_add_ds(env, region, *msg, dp, now); 504ae8c6e27Sflorian /* find and add A entries */ 505ae8c6e27Sflorian if(!find_add_addrs(env, qclass, region, dp, now, msg)) 506ae8c6e27Sflorian log_err("find_delegation: addrs out of memory"); 507ae8c6e27Sflorian return dp; 508ae8c6e27Sflorian } 509ae8c6e27Sflorian 510ae8c6e27Sflorian /** allocate dns_msg from query_info and reply_info */ 511ae8c6e27Sflorian static struct dns_msg* 512ae8c6e27Sflorian gen_dns_msg(struct regional* region, struct query_info* q, size_t num) 513ae8c6e27Sflorian { 514ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 515ae8c6e27Sflorian sizeof(struct dns_msg)); 516ae8c6e27Sflorian if(!msg) 517ae8c6e27Sflorian return NULL; 518ae8c6e27Sflorian memcpy(&msg->qinfo, q, sizeof(struct query_info)); 519ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len); 520ae8c6e27Sflorian if(!msg->qinfo.qname) 521ae8c6e27Sflorian return NULL; 522ae8c6e27Sflorian /* allocate replyinfo struct and rrset key array separately */ 523ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc(region, 524ae8c6e27Sflorian sizeof(struct reply_info) - sizeof(struct rrset_ref)); 525ae8c6e27Sflorian if(!msg->rep) 526ae8c6e27Sflorian return NULL; 527ae8c6e27Sflorian if(num > RR_COUNT_MAX) 528ae8c6e27Sflorian return NULL; /* integer overflow protection */ 529ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 530ae8c6e27Sflorian regional_alloc(region, 531ae8c6e27Sflorian num * sizeof(struct ub_packed_rrset_key*)); 532ae8c6e27Sflorian if(!msg->rep->rrsets) 533ae8c6e27Sflorian return NULL; 534ae8c6e27Sflorian return msg; 535ae8c6e27Sflorian } 536ae8c6e27Sflorian 537ae8c6e27Sflorian struct dns_msg* 538ae8c6e27Sflorian tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 539d32eb43cSflorian struct regional* region, time_t now, int allow_expired, 540d32eb43cSflorian struct regional* scratch) 541ae8c6e27Sflorian { 542ae8c6e27Sflorian struct dns_msg* msg; 543ae8c6e27Sflorian size_t i; 544d32eb43cSflorian int is_expired = 0; 545d32eb43cSflorian time_t now_control = now; 546d32eb43cSflorian if(now > r->ttl) { 547d32eb43cSflorian /* Check if we are allowed to serve expired */ 548d32eb43cSflorian if(allow_expired) { 549d32eb43cSflorian if(env->cfg->serve_expired_ttl && 550d32eb43cSflorian r->serve_expired_ttl < now) { 551ae8c6e27Sflorian return NULL; 552d32eb43cSflorian } 553d32eb43cSflorian } else { 554d32eb43cSflorian return NULL; 555d32eb43cSflorian } 556d32eb43cSflorian /* Change the current time so we can pass the below TTL checks when 557d32eb43cSflorian * serving expired data. */ 558d32eb43cSflorian now_control = r->ttl - env->cfg->serve_expired_reply_ttl; 559d32eb43cSflorian is_expired = 1; 560d32eb43cSflorian } 561d32eb43cSflorian 562ae8c6e27Sflorian msg = gen_dns_msg(region, q, r->rrset_count); 563d32eb43cSflorian if(!msg) return NULL; 564ae8c6e27Sflorian msg->rep->flags = r->flags; 565ae8c6e27Sflorian msg->rep->qdcount = r->qdcount; 566d32eb43cSflorian msg->rep->ttl = is_expired 567d32eb43cSflorian ?SERVE_EXPIRED_REPLY_TTL 568d32eb43cSflorian :r->ttl - now; 569ae8c6e27Sflorian if(r->prefetch_ttl > now) 570ae8c6e27Sflorian msg->rep->prefetch_ttl = r->prefetch_ttl - now; 571d32eb43cSflorian else 572d32eb43cSflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 573ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 574ae8c6e27Sflorian msg->rep->security = r->security; 575ae8c6e27Sflorian msg->rep->an_numrrsets = r->an_numrrsets; 576ae8c6e27Sflorian msg->rep->ns_numrrsets = r->ns_numrrsets; 577ae8c6e27Sflorian msg->rep->ar_numrrsets = r->ar_numrrsets; 578ae8c6e27Sflorian msg->rep->rrset_count = r->rrset_count; 579ae8c6e27Sflorian msg->rep->authoritative = r->authoritative; 580d32eb43cSflorian if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { 581ae8c6e27Sflorian return NULL; 582d32eb43cSflorian } 583ae8c6e27Sflorian if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons( 584ae8c6e27Sflorian LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons( 585ae8c6e27Sflorian LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) { 586ae8c6e27Sflorian /* cname chain is now invalid, reconstruct msg */ 587ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 588ae8c6e27Sflorian return NULL; 589ae8c6e27Sflorian } 590ae8c6e27Sflorian if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) { 591ae8c6e27Sflorian /* message rrsets have changed status, revalidate */ 592ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 593ae8c6e27Sflorian return NULL; 594ae8c6e27Sflorian } 595ae8c6e27Sflorian for(i=0; i<msg->rep->rrset_count; i++) { 596ae8c6e27Sflorian msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 597ae8c6e27Sflorian region, now); 598ae8c6e27Sflorian if(!msg->rep->rrsets[i]) { 599ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 600ae8c6e27Sflorian return NULL; 601ae8c6e27Sflorian } 602ae8c6e27Sflorian } 603ae8c6e27Sflorian if(env) 604ae8c6e27Sflorian rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 605ae8c6e27Sflorian r->rrset_count); 606ae8c6e27Sflorian else 607ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 608ae8c6e27Sflorian return msg; 609ae8c6e27Sflorian } 610ae8c6e27Sflorian 611ae8c6e27Sflorian /** synthesize RRset-only response from cached RRset item */ 612ae8c6e27Sflorian static struct dns_msg* 613ae8c6e27Sflorian rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 614ae8c6e27Sflorian time_t now, struct query_info* q) 615ae8c6e27Sflorian { 616ae8c6e27Sflorian struct dns_msg* msg; 617ae8c6e27Sflorian struct packed_rrset_data* d = (struct packed_rrset_data*) 618ae8c6e27Sflorian rrset->entry.data; 619ae8c6e27Sflorian if(now > d->ttl) 620ae8c6e27Sflorian return NULL; 621ae8c6e27Sflorian msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */ 622ae8c6e27Sflorian if(!msg) 623ae8c6e27Sflorian return NULL; 624ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 625ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 626ae8c6e27Sflorian msg->rep->qdcount = 1; 627ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 628ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 629ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 630ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 631ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 632ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 633ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 634ae8c6e27Sflorian msg->rep->rrset_count = 1; 635ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 636ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy CNAME */ 637ae8c6e27Sflorian return NULL; 638ae8c6e27Sflorian return msg; 639ae8c6e27Sflorian } 640ae8c6e27Sflorian 641ae8c6e27Sflorian /** synthesize DNAME+CNAME response from cached DNAME item */ 642ae8c6e27Sflorian static struct dns_msg* 643ae8c6e27Sflorian synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 644ae8c6e27Sflorian time_t now, struct query_info* q, enum sec_status* sec_status) 645ae8c6e27Sflorian { 646ae8c6e27Sflorian struct dns_msg* msg; 647ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 648ae8c6e27Sflorian struct packed_rrset_data* newd, *d = (struct packed_rrset_data*) 649ae8c6e27Sflorian rrset->entry.data; 650ae8c6e27Sflorian uint8_t* newname, *dtarg = NULL; 651ae8c6e27Sflorian size_t newlen, dtarglen; 652ae8c6e27Sflorian if(now > d->ttl) 653ae8c6e27Sflorian return NULL; 654ae8c6e27Sflorian /* only allow validated (with DNSSEC) DNAMEs used from cache 655ae8c6e27Sflorian * for insecure DNAMEs, query again. */ 656ae8c6e27Sflorian *sec_status = d->security; 657ae8c6e27Sflorian /* return sec status, so the status of the CNAME can be checked 658ae8c6e27Sflorian * by the calling routine. */ 659ae8c6e27Sflorian msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */ 660ae8c6e27Sflorian if(!msg) 661ae8c6e27Sflorian return NULL; 662ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 663ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 664ae8c6e27Sflorian msg->rep->qdcount = 1; 665ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 666ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 667ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 668ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 669ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 670ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 671ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 672ae8c6e27Sflorian msg->rep->rrset_count = 1; 673ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 674ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy DNAME */ 675ae8c6e27Sflorian return NULL; 676ae8c6e27Sflorian /* synth CNAME rrset */ 677ae8c6e27Sflorian get_cname_target(rrset, &dtarg, &dtarglen); 678ae8c6e27Sflorian if(!dtarg) 679ae8c6e27Sflorian return NULL; 680ae8c6e27Sflorian newlen = q->qname_len + dtarglen - rrset->rk.dname_len; 681ae8c6e27Sflorian if(newlen > LDNS_MAX_DOMAINLEN) { 682ae8c6e27Sflorian msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 683ae8c6e27Sflorian return msg; 684ae8c6e27Sflorian } 685ae8c6e27Sflorian newname = (uint8_t*)regional_alloc(region, newlen); 686ae8c6e27Sflorian if(!newname) 687ae8c6e27Sflorian return NULL; 688ae8c6e27Sflorian /* new name is concatenation of qname front (without DNAME owner) 689ae8c6e27Sflorian * and DNAME target name */ 690ae8c6e27Sflorian memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len); 691ae8c6e27Sflorian memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen); 692ae8c6e27Sflorian /* create rest of CNAME rrset */ 693ae8c6e27Sflorian ck = (struct ub_packed_rrset_key*)regional_alloc(region, 694ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key)); 695ae8c6e27Sflorian if(!ck) 696ae8c6e27Sflorian return NULL; 697ae8c6e27Sflorian memset(&ck->entry, 0, sizeof(ck->entry)); 698ae8c6e27Sflorian msg->rep->rrsets[1] = ck; 699ae8c6e27Sflorian ck->entry.key = ck; 700ae8c6e27Sflorian ck->rk.type = htons(LDNS_RR_TYPE_CNAME); 701ae8c6e27Sflorian ck->rk.rrset_class = rrset->rk.rrset_class; 702ae8c6e27Sflorian ck->rk.flags = 0; 703ae8c6e27Sflorian ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len); 704ae8c6e27Sflorian if(!ck->rk.dname) 705ae8c6e27Sflorian return NULL; 706ae8c6e27Sflorian ck->rk.dname_len = q->qname_len; 707ae8c6e27Sflorian ck->entry.hash = rrset_key_hash(&ck->rk); 708ae8c6e27Sflorian newd = (struct packed_rrset_data*)regional_alloc_zero(region, 709ae8c6e27Sflorian sizeof(struct packed_rrset_data) + sizeof(size_t) + 710ae8c6e27Sflorian sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 711ae8c6e27Sflorian + newlen); 712ae8c6e27Sflorian if(!newd) 713ae8c6e27Sflorian return NULL; 714ae8c6e27Sflorian ck->entry.data = newd; 715ae8c6e27Sflorian newd->ttl = 0; /* 0 for synthesized CNAME TTL */ 716ae8c6e27Sflorian newd->count = 1; 717ae8c6e27Sflorian newd->rrsig_count = 0; 718ae8c6e27Sflorian newd->trust = rrset_trust_ans_noAA; 719ae8c6e27Sflorian newd->rr_len = (size_t*)((uint8_t*)newd + 720ae8c6e27Sflorian sizeof(struct packed_rrset_data)); 721ae8c6e27Sflorian newd->rr_len[0] = newlen + sizeof(uint16_t); 722ae8c6e27Sflorian packed_rrset_ptr_fixup(newd); 723ae8c6e27Sflorian newd->rr_ttl[0] = newd->ttl; 724ae8c6e27Sflorian msg->rep->ttl = newd->ttl; 725ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl); 726ae8c6e27Sflorian msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL; 727ae8c6e27Sflorian sldns_write_uint16(newd->rr_data[0], newlen); 728ae8c6e27Sflorian memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen); 729ae8c6e27Sflorian msg->rep->an_numrrsets ++; 730ae8c6e27Sflorian msg->rep->rrset_count ++; 731ae8c6e27Sflorian return msg; 732ae8c6e27Sflorian } 733ae8c6e27Sflorian 734ae8c6e27Sflorian /** Fill TYPE_ANY response with some data from cache */ 735ae8c6e27Sflorian static struct dns_msg* 736ae8c6e27Sflorian fill_any(struct module_env* env, 737ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 738ae8c6e27Sflorian struct regional* region) 739ae8c6e27Sflorian { 740ae8c6e27Sflorian time_t now = *env->now; 741ae8c6e27Sflorian struct dns_msg* msg = NULL; 742ae8c6e27Sflorian uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, 743ae8c6e27Sflorian LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 744ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 0}; 745ae8c6e27Sflorian int i, num=6; /* number of RR types to look up */ 746ae8c6e27Sflorian log_assert(lookup[num] == 0); 747ae8c6e27Sflorian 748ae8c6e27Sflorian if(env->cfg->deny_any) { 749ae8c6e27Sflorian /* return empty message */ 750ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 751ae8c6e27Sflorian region, 0); 752ae8c6e27Sflorian if(!msg) { 753ae8c6e27Sflorian return NULL; 754ae8c6e27Sflorian } 7559b465e50Sflorian /* set NOTIMPL for RFC 8482 */ 7569b465e50Sflorian msg->rep->flags |= LDNS_RCODE_NOTIMPL; 757ae8c6e27Sflorian msg->rep->security = sec_status_indeterminate; 758ae8c6e27Sflorian return msg; 759ae8c6e27Sflorian } 760ae8c6e27Sflorian 761ae8c6e27Sflorian for(i=0; i<num; i++) { 762ae8c6e27Sflorian /* look up this RR for inclusion in type ANY response */ 763ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 764ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, lookup[i], 765ae8c6e27Sflorian qclass, 0, now, 0); 766ae8c6e27Sflorian struct packed_rrset_data *d; 767ae8c6e27Sflorian if(!rrset) 768ae8c6e27Sflorian continue; 769ae8c6e27Sflorian 770ae8c6e27Sflorian /* only if rrset from answer section */ 771ae8c6e27Sflorian d = (struct packed_rrset_data*)rrset->entry.data; 772ae8c6e27Sflorian if(d->trust == rrset_trust_add_noAA || 773ae8c6e27Sflorian d->trust == rrset_trust_auth_noAA || 774ae8c6e27Sflorian d->trust == rrset_trust_add_AA || 775ae8c6e27Sflorian d->trust == rrset_trust_auth_AA) { 776ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 777ae8c6e27Sflorian continue; 778ae8c6e27Sflorian } 779ae8c6e27Sflorian 780ae8c6e27Sflorian /* create msg if none */ 781ae8c6e27Sflorian if(!msg) { 782ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 783ae8c6e27Sflorian region, (size_t)(num-i)); 784ae8c6e27Sflorian if(!msg) { 785ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 786ae8c6e27Sflorian return NULL; 787ae8c6e27Sflorian } 788ae8c6e27Sflorian } 789ae8c6e27Sflorian 790ae8c6e27Sflorian /* add RRset to response */ 791ae8c6e27Sflorian if(!dns_msg_ansadd(msg, region, rrset, now)) { 792ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 793ae8c6e27Sflorian return NULL; 794ae8c6e27Sflorian } 795ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 796ae8c6e27Sflorian } 797ae8c6e27Sflorian return msg; 798ae8c6e27Sflorian } 799ae8c6e27Sflorian 800ae8c6e27Sflorian struct dns_msg* 801ae8c6e27Sflorian dns_cache_lookup(struct module_env* env, 802ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 803ae8c6e27Sflorian uint16_t flags, struct regional* region, struct regional* scratch, 804*411c5950Sflorian int no_partial, uint8_t* dpname, size_t dpnamelen) 805ae8c6e27Sflorian { 806ae8c6e27Sflorian struct lruhash_entry* e; 807ae8c6e27Sflorian struct query_info k; 808ae8c6e27Sflorian hashvalue_type h; 809ae8c6e27Sflorian time_t now = *env->now; 810ae8c6e27Sflorian struct ub_packed_rrset_key* rrset; 811ae8c6e27Sflorian 812ae8c6e27Sflorian /* lookup first, this has both NXdomains and ANSWER responses */ 813ae8c6e27Sflorian k.qname = qname; 814ae8c6e27Sflorian k.qname_len = qnamelen; 815ae8c6e27Sflorian k.qtype = qtype; 816ae8c6e27Sflorian k.qclass = qclass; 817ae8c6e27Sflorian k.local_alias = NULL; 818ae8c6e27Sflorian h = query_info_hash(&k, flags); 819ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 820ae8c6e27Sflorian if(e) { 821ae8c6e27Sflorian struct msgreply_entry* key = (struct msgreply_entry*)e->key; 822ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 823d32eb43cSflorian struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0, 824ae8c6e27Sflorian scratch); 825ae8c6e27Sflorian if(msg) { 826ae8c6e27Sflorian lock_rw_unlock(&e->lock); 827ae8c6e27Sflorian return msg; 828ae8c6e27Sflorian } 829ae8c6e27Sflorian /* could be msg==NULL; due to TTL or not all rrsets available */ 830ae8c6e27Sflorian lock_rw_unlock(&e->lock); 831ae8c6e27Sflorian } 832ae8c6e27Sflorian 833ae8c6e27Sflorian /* see if a DNAME exists. Checked for first, to enforce that DNAMEs 834ae8c6e27Sflorian * are more important, the CNAME is resynthesized and thus 835ae8c6e27Sflorian * consistent with the DNAME */ 836ae8c6e27Sflorian if(!no_partial && 837ae8c6e27Sflorian (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, 838ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 1))) { 839ae8c6e27Sflorian /* synthesize a DNAME+CNAME message based on this */ 840ae8c6e27Sflorian enum sec_status sec_status = sec_status_unchecked; 841ae8c6e27Sflorian struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k, 842ae8c6e27Sflorian &sec_status); 843ae8c6e27Sflorian if(msg) { 844ae8c6e27Sflorian struct ub_packed_rrset_key* cname_rrset; 845ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 846ae8c6e27Sflorian /* now, after unlocking the DNAME rrset lock, 847ae8c6e27Sflorian * check the sec_status, and see if we need to look 848ae8c6e27Sflorian * up the CNAME record associated before it can 849ae8c6e27Sflorian * be used */ 850ae8c6e27Sflorian /* normally, only secure DNAMEs allowed from cache*/ 851ae8c6e27Sflorian if(sec_status == sec_status_secure) 852ae8c6e27Sflorian return msg; 853ae8c6e27Sflorian /* but if we have a CNAME cached with this name, then we 854ae8c6e27Sflorian * have previously already allowed this name to pass. 855ae8c6e27Sflorian * the next cache lookup is going to fetch that CNAME itself, 856ae8c6e27Sflorian * but it is better to have the (unsigned)DNAME + CNAME in 857ae8c6e27Sflorian * that case */ 858ae8c6e27Sflorian cname_rrset = rrset_cache_lookup( 859ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, 860ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0); 861ae8c6e27Sflorian if(cname_rrset) { 862ae8c6e27Sflorian /* CNAME already synthesized by 863ae8c6e27Sflorian * synth_dname_msg routine, so we can 864ae8c6e27Sflorian * straight up return the msg */ 865ae8c6e27Sflorian lock_rw_unlock(&cname_rrset->entry.lock); 866ae8c6e27Sflorian return msg; 867ae8c6e27Sflorian } 868ae8c6e27Sflorian } else { 869ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 870ae8c6e27Sflorian } 871ae8c6e27Sflorian } 872ae8c6e27Sflorian 873ae8c6e27Sflorian /* see if we have CNAME for this domain, 874ae8c6e27Sflorian * but not for DS records (which are part of the parent) */ 875ae8c6e27Sflorian if(!no_partial && qtype != LDNS_RR_TYPE_DS && 876ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 877ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) { 878ae8c6e27Sflorian uint8_t* wc = NULL; 879ae8c6e27Sflorian size_t wl; 880ae8c6e27Sflorian /* if the rrset is not a wildcard expansion, with wcname */ 881ae8c6e27Sflorian /* because, if we return that CNAME rrset on its own, it is 882ae8c6e27Sflorian * missing the NSEC or NSEC3 proof */ 883ae8c6e27Sflorian if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) { 884ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 885ae8c6e27Sflorian if(msg) { 886ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 887ae8c6e27Sflorian return msg; 888ae8c6e27Sflorian } 889ae8c6e27Sflorian } 890ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 891ae8c6e27Sflorian } 892ae8c6e27Sflorian 893f4f0f0ceSflorian /* construct DS, DNSKEY messages from rrset cache. */ 894f4f0f0ceSflorian if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) && 895ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 896ae8c6e27Sflorian qtype, qclass, 0, now, 0))) { 897ae8c6e27Sflorian /* if the rrset is from the additional section, and the 898ae8c6e27Sflorian * signatures have fallen off, then do not synthesize a msg 899ae8c6e27Sflorian * instead, allow a full query for signed results to happen. 900ae8c6e27Sflorian * Forego all rrset data from additional section, because 901ae8c6e27Sflorian * some signatures may not be present and cause validation 902ae8c6e27Sflorian * failure. 903ae8c6e27Sflorian */ 904ae8c6e27Sflorian struct packed_rrset_data *d = (struct packed_rrset_data*) 905ae8c6e27Sflorian rrset->entry.data; 906ae8c6e27Sflorian if(d->trust != rrset_trust_add_noAA && 907ae8c6e27Sflorian d->trust != rrset_trust_add_AA && 908ae8c6e27Sflorian (qtype == LDNS_RR_TYPE_DS || 909ae8c6e27Sflorian (d->trust != rrset_trust_auth_noAA 910ae8c6e27Sflorian && d->trust != rrset_trust_auth_AA) )) { 911ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 912ae8c6e27Sflorian if(msg) { 913ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 914ae8c6e27Sflorian return msg; 915ae8c6e27Sflorian } 916ae8c6e27Sflorian } 917ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 918ae8c6e27Sflorian } 919ae8c6e27Sflorian 920ae8c6e27Sflorian /* stop downwards cache search on NXDOMAIN. 921ae8c6e27Sflorian * Empty nonterminals are NOERROR, so an NXDOMAIN for foo 922ae8c6e27Sflorian * means bla.foo also does not exist. The DNSSEC proofs are 923ae8c6e27Sflorian * the same. We search upwards for NXDOMAINs. */ 924d32eb43cSflorian if(env->cfg->harden_below_nxdomain) { 925ae8c6e27Sflorian while(!dname_is_root(k.qname)) { 926*411c5950Sflorian if(dpname && dpnamelen 927*411c5950Sflorian && !dname_subdomain_c(k.qname, dpname)) 928*411c5950Sflorian break; /* no synth nxdomain above the stub */ 929ae8c6e27Sflorian dname_remove_label(&k.qname, &k.qname_len); 930ae8c6e27Sflorian h = query_info_hash(&k, flags); 931ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 932ae8c6e27Sflorian if(!e && k.qtype != LDNS_RR_TYPE_A && 933ae8c6e27Sflorian env->cfg->qname_minimisation) { 934ae8c6e27Sflorian k.qtype = LDNS_RR_TYPE_A; 935ae8c6e27Sflorian h = query_info_hash(&k, flags); 936ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 937ae8c6e27Sflorian } 938ae8c6e27Sflorian if(e) { 939ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 940ae8c6e27Sflorian struct dns_msg* msg; 941ae8c6e27Sflorian if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN 942ae8c6e27Sflorian && data->security == sec_status_secure 9439b465e50Sflorian && (data->an_numrrsets == 0 || 9449b465e50Sflorian ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME) 945d32eb43cSflorian && (msg=tomsg(env, &k, data, region, now, 0, scratch))) { 946ae8c6e27Sflorian lock_rw_unlock(&e->lock); 947ae8c6e27Sflorian msg->qinfo.qname=qname; 948ae8c6e27Sflorian msg->qinfo.qname_len=qnamelen; 949ae8c6e27Sflorian /* check that DNSSEC really works out */ 950ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 9519b465e50Sflorian iter_scrub_nxdomain(msg); 952ae8c6e27Sflorian return msg; 953ae8c6e27Sflorian } 954ae8c6e27Sflorian lock_rw_unlock(&e->lock); 955ae8c6e27Sflorian } 956ae8c6e27Sflorian k.qtype = qtype; 957ae8c6e27Sflorian } 958d32eb43cSflorian } 959ae8c6e27Sflorian 960ae8c6e27Sflorian /* fill common RR types for ANY response to avoid requery */ 961ae8c6e27Sflorian if(qtype == LDNS_RR_TYPE_ANY) { 962ae8c6e27Sflorian return fill_any(env, qname, qnamelen, qtype, qclass, region); 963ae8c6e27Sflorian } 964ae8c6e27Sflorian 965ae8c6e27Sflorian return NULL; 966ae8c6e27Sflorian } 967ae8c6e27Sflorian 968ae8c6e27Sflorian int 969ae8c6e27Sflorian dns_cache_store(struct module_env* env, struct query_info* msgqinf, 970ae8c6e27Sflorian struct reply_info* msgrep, int is_referral, time_t leeway, int pside, 971ae8c6e27Sflorian struct regional* region, uint32_t flags) 972ae8c6e27Sflorian { 973ae8c6e27Sflorian struct reply_info* rep = NULL; 974ae8c6e27Sflorian /* alloc, malloc properly (not in region, like msg is) */ 975ae8c6e27Sflorian rep = reply_info_copy(msgrep, env->alloc, NULL); 976ae8c6e27Sflorian if(!rep) 977ae8c6e27Sflorian return 0; 978ae8c6e27Sflorian /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. 979ae8c6e27Sflorian * the env->now is added to message and RRsets in this routine. */ 980ae8c6e27Sflorian /* the leeway is used to invalidate other rrsets earlier */ 981ae8c6e27Sflorian 982ae8c6e27Sflorian if(is_referral) { 983ae8c6e27Sflorian /* store rrsets */ 984ae8c6e27Sflorian struct rrset_ref ref; 985ae8c6e27Sflorian size_t i; 986ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 987ae8c6e27Sflorian packed_rrset_ttl_add((struct packed_rrset_data*) 988ae8c6e27Sflorian rep->rrsets[i]->entry.data, *env->now); 989ae8c6e27Sflorian ref.key = rep->rrsets[i]; 990ae8c6e27Sflorian ref.id = rep->rrsets[i]->id; 991ae8c6e27Sflorian /*ignore ret: it was in the cache, ref updated */ 992ae8c6e27Sflorian /* no leeway for typeNS */ 993ae8c6e27Sflorian (void)rrset_cache_update(env->rrset_cache, &ref, 994ae8c6e27Sflorian env->alloc, *env->now + 995ae8c6e27Sflorian ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS 996ae8c6e27Sflorian && !pside) ? 0:leeway)); 997ae8c6e27Sflorian } 998ae8c6e27Sflorian free(rep); 999ae8c6e27Sflorian return 1; 1000ae8c6e27Sflorian } else { 1001ae8c6e27Sflorian /* store msg, and rrsets */ 1002ae8c6e27Sflorian struct query_info qinf; 1003ae8c6e27Sflorian hashvalue_type h; 1004ae8c6e27Sflorian 1005ae8c6e27Sflorian qinf = *msgqinf; 1006ae8c6e27Sflorian qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len); 1007ae8c6e27Sflorian if(!qinf.qname) { 1008ae8c6e27Sflorian reply_info_parsedelete(rep, env->alloc); 1009ae8c6e27Sflorian return 0; 1010ae8c6e27Sflorian } 1011ae8c6e27Sflorian /* fixup flags to be sensible for a reply based on the cache */ 1012ae8c6e27Sflorian /* this module means that RA is available. It is an answer QR. 1013ae8c6e27Sflorian * Not AA from cache. Not CD in cache (depends on client bit). */ 1014ae8c6e27Sflorian rep->flags |= (BIT_RA | BIT_QR); 1015ae8c6e27Sflorian rep->flags &= ~(BIT_AA | BIT_CD); 1016ae8c6e27Sflorian h = query_info_hash(&qinf, (uint16_t)flags); 1017ae8c6e27Sflorian dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep, 1018ae8c6e27Sflorian flags, region); 1019ae8c6e27Sflorian /* qname is used inside query_info_entrysetup, and set to 1020ae8c6e27Sflorian * NULL. If it has not been used, free it. free(0) is safe. */ 1021ae8c6e27Sflorian free(qinf.qname); 1022ae8c6e27Sflorian } 1023ae8c6e27Sflorian return 1; 1024ae8c6e27Sflorian } 1025ae8c6e27Sflorian 1026ae8c6e27Sflorian int 1027ae8c6e27Sflorian dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo, 1028ae8c6e27Sflorian time_t adjust, uint16_t flags) 1029ae8c6e27Sflorian { 1030ae8c6e27Sflorian struct msgreply_entry* msg; 1031ae8c6e27Sflorian msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 1032ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, *env->now, 1); 1033ae8c6e27Sflorian if(msg) { 1034ae8c6e27Sflorian struct reply_info* rep = (struct reply_info*)msg->entry.data; 1035ae8c6e27Sflorian if(rep) { 1036ae8c6e27Sflorian rep->prefetch_ttl += adjust; 1037ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1038ae8c6e27Sflorian return 1; 1039ae8c6e27Sflorian } 1040ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1041ae8c6e27Sflorian } 1042ae8c6e27Sflorian return 0; 1043ae8c6e27Sflorian } 1044