1*ae8c6e27Sflorian /* 2*ae8c6e27Sflorian * services/cache/dns.c - Cache services for DNS using msg and rrset caches. 3*ae8c6e27Sflorian * 4*ae8c6e27Sflorian * Copyright (c) 2007, NLnet Labs. All rights reserved. 5*ae8c6e27Sflorian * 6*ae8c6e27Sflorian * This software is open source. 7*ae8c6e27Sflorian * 8*ae8c6e27Sflorian * Redistribution and use in source and binary forms, with or without 9*ae8c6e27Sflorian * modification, are permitted provided that the following conditions 10*ae8c6e27Sflorian * are met: 11*ae8c6e27Sflorian * 12*ae8c6e27Sflorian * Redistributions of source code must retain the above copyright notice, 13*ae8c6e27Sflorian * this list of conditions and the following disclaimer. 14*ae8c6e27Sflorian * 15*ae8c6e27Sflorian * Redistributions in binary form must reproduce the above copyright notice, 16*ae8c6e27Sflorian * this list of conditions and the following disclaimer in the documentation 17*ae8c6e27Sflorian * and/or other materials provided with the distribution. 18*ae8c6e27Sflorian * 19*ae8c6e27Sflorian * Neither the name of the NLNET LABS nor the names of its contributors may 20*ae8c6e27Sflorian * be used to endorse or promote products derived from this software without 21*ae8c6e27Sflorian * specific prior written permission. 22*ae8c6e27Sflorian * 23*ae8c6e27Sflorian * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24*ae8c6e27Sflorian * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25*ae8c6e27Sflorian * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26*ae8c6e27Sflorian * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27*ae8c6e27Sflorian * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28*ae8c6e27Sflorian * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29*ae8c6e27Sflorian * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30*ae8c6e27Sflorian * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31*ae8c6e27Sflorian * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32*ae8c6e27Sflorian * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33*ae8c6e27Sflorian * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34*ae8c6e27Sflorian */ 35*ae8c6e27Sflorian 36*ae8c6e27Sflorian /** 37*ae8c6e27Sflorian * \file 38*ae8c6e27Sflorian * 39*ae8c6e27Sflorian * This file contains the DNS cache. 40*ae8c6e27Sflorian */ 41*ae8c6e27Sflorian #include "config.h" 42*ae8c6e27Sflorian #include "iterator/iter_delegpt.h" 43*ae8c6e27Sflorian #include "validator/val_nsec.h" 44*ae8c6e27Sflorian #include "validator/val_utils.h" 45*ae8c6e27Sflorian #include "services/cache/dns.h" 46*ae8c6e27Sflorian #include "services/cache/rrset.h" 47*ae8c6e27Sflorian #include "util/data/msgreply.h" 48*ae8c6e27Sflorian #include "util/data/packed_rrset.h" 49*ae8c6e27Sflorian #include "util/data/dname.h" 50*ae8c6e27Sflorian #include "util/module.h" 51*ae8c6e27Sflorian #include "util/net_help.h" 52*ae8c6e27Sflorian #include "util/regional.h" 53*ae8c6e27Sflorian #include "util/config_file.h" 54*ae8c6e27Sflorian #include "sldns/sbuffer.h" 55*ae8c6e27Sflorian 56*ae8c6e27Sflorian /** store rrsets in the rrset cache. 57*ae8c6e27Sflorian * @param env: module environment with caches. 58*ae8c6e27Sflorian * @param rep: contains list of rrsets to store. 59*ae8c6e27Sflorian * @param now: current time. 60*ae8c6e27Sflorian * @param leeway: during prefetch how much leeway to update TTLs. 61*ae8c6e27Sflorian * This makes rrsets (other than type NS) timeout sooner so they get 62*ae8c6e27Sflorian * updated with a new full TTL. 63*ae8c6e27Sflorian * Type NS does not get this, because it must not be refreshed from the 64*ae8c6e27Sflorian * child domain, but keep counting down properly. 65*ae8c6e27Sflorian * @param pside: if from parentside discovered NS, so that its NS is okay 66*ae8c6e27Sflorian * in a prefetch situation to be updated (without becoming sticky). 67*ae8c6e27Sflorian * @param qrep: update rrsets here if cache is better 68*ae8c6e27Sflorian * @param region: for qrep allocs. 69*ae8c6e27Sflorian */ 70*ae8c6e27Sflorian static void 71*ae8c6e27Sflorian store_rrsets(struct module_env* env, struct reply_info* rep, time_t now, 72*ae8c6e27Sflorian time_t leeway, int pside, struct reply_info* qrep, 73*ae8c6e27Sflorian struct regional* region) 74*ae8c6e27Sflorian { 75*ae8c6e27Sflorian size_t i; 76*ae8c6e27Sflorian /* see if rrset already exists in cache, if not insert it. */ 77*ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 78*ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 79*ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 80*ae8c6e27Sflorian /* update ref if it was in the cache */ 81*ae8c6e27Sflorian switch(rrset_cache_update(env->rrset_cache, &rep->ref[i], 82*ae8c6e27Sflorian env->alloc, now + ((ntohs(rep->ref[i].key->rk.type)== 83*ae8c6e27Sflorian LDNS_RR_TYPE_NS && !pside)?0:leeway))) { 84*ae8c6e27Sflorian case 0: /* ref unchanged, item inserted */ 85*ae8c6e27Sflorian break; 86*ae8c6e27Sflorian case 2: /* ref updated, cache is superior */ 87*ae8c6e27Sflorian if(region) { 88*ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 89*ae8c6e27Sflorian lock_rw_rdlock(&rep->ref[i].key->entry.lock); 90*ae8c6e27Sflorian /* if deleted rrset, do not copy it */ 91*ae8c6e27Sflorian if(rep->ref[i].key->id == 0) 92*ae8c6e27Sflorian ck = NULL; 93*ae8c6e27Sflorian else ck = packed_rrset_copy_region( 94*ae8c6e27Sflorian rep->ref[i].key, region, now); 95*ae8c6e27Sflorian lock_rw_unlock(&rep->ref[i].key->entry.lock); 96*ae8c6e27Sflorian if(ck) { 97*ae8c6e27Sflorian /* use cached copy if memory allows */ 98*ae8c6e27Sflorian qrep->rrsets[i] = ck; 99*ae8c6e27Sflorian } 100*ae8c6e27Sflorian } 101*ae8c6e27Sflorian /* no break: also copy key item */ 102*ae8c6e27Sflorian /* the line below is matched by gcc regex and silences 103*ae8c6e27Sflorian * the fallthrough warning */ 104*ae8c6e27Sflorian /* fallthrough */ 105*ae8c6e27Sflorian case 1: /* ref updated, item inserted */ 106*ae8c6e27Sflorian rep->rrsets[i] = rep->ref[i].key; 107*ae8c6e27Sflorian } 108*ae8c6e27Sflorian } 109*ae8c6e27Sflorian } 110*ae8c6e27Sflorian 111*ae8c6e27Sflorian /** delete message from message cache */ 112*ae8c6e27Sflorian void 113*ae8c6e27Sflorian msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 114*ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags) 115*ae8c6e27Sflorian { 116*ae8c6e27Sflorian struct query_info k; 117*ae8c6e27Sflorian hashvalue_type h; 118*ae8c6e27Sflorian 119*ae8c6e27Sflorian k.qname = qname; 120*ae8c6e27Sflorian k.qname_len = qnamelen; 121*ae8c6e27Sflorian k.qtype = qtype; 122*ae8c6e27Sflorian k.qclass = qclass; 123*ae8c6e27Sflorian k.local_alias = NULL; 124*ae8c6e27Sflorian h = query_info_hash(&k, flags); 125*ae8c6e27Sflorian slabhash_remove(env->msg_cache, h, &k); 126*ae8c6e27Sflorian } 127*ae8c6e27Sflorian 128*ae8c6e27Sflorian /** remove servfail msg cache entry */ 129*ae8c6e27Sflorian static void 130*ae8c6e27Sflorian msg_del_servfail(struct module_env* env, struct query_info* qinfo, 131*ae8c6e27Sflorian uint32_t flags) 132*ae8c6e27Sflorian { 133*ae8c6e27Sflorian struct msgreply_entry* e; 134*ae8c6e27Sflorian /* see if the entry is servfail, and then remove it, so that 135*ae8c6e27Sflorian * lookups move from the cacheresponse stage to the recursionresponse 136*ae8c6e27Sflorian * stage */ 137*ae8c6e27Sflorian e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 138*ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, 0, 0); 139*ae8c6e27Sflorian if(!e) return; 140*ae8c6e27Sflorian /* we don't check for the ttl here, also expired servfail entries 141*ae8c6e27Sflorian * are removed. If the user uses serve-expired, they would still be 142*ae8c6e27Sflorian * used to answer from cache */ 143*ae8c6e27Sflorian if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags) 144*ae8c6e27Sflorian != LDNS_RCODE_SERVFAIL) { 145*ae8c6e27Sflorian lock_rw_unlock(&e->entry.lock); 146*ae8c6e27Sflorian return; 147*ae8c6e27Sflorian } 148*ae8c6e27Sflorian lock_rw_unlock(&e->entry.lock); 149*ae8c6e27Sflorian msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype, 150*ae8c6e27Sflorian qinfo->qclass, flags); 151*ae8c6e27Sflorian } 152*ae8c6e27Sflorian 153*ae8c6e27Sflorian void 154*ae8c6e27Sflorian dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, 155*ae8c6e27Sflorian hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, 156*ae8c6e27Sflorian struct reply_info* qrep, uint32_t flags, struct regional* region) 157*ae8c6e27Sflorian { 158*ae8c6e27Sflorian struct msgreply_entry* e; 159*ae8c6e27Sflorian time_t ttl = rep->ttl; 160*ae8c6e27Sflorian size_t i; 161*ae8c6e27Sflorian 162*ae8c6e27Sflorian /* store RRsets */ 163*ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 164*ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 165*ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 166*ae8c6e27Sflorian } 167*ae8c6e27Sflorian 168*ae8c6e27Sflorian /* there was a reply_info_sortref(rep) here but it seems to be 169*ae8c6e27Sflorian * unnecessary, because the cache gets locked per rrset. */ 170*ae8c6e27Sflorian reply_info_set_ttls(rep, *env->now); 171*ae8c6e27Sflorian store_rrsets(env, rep, *env->now, leeway, pside, qrep, region); 172*ae8c6e27Sflorian if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) { 173*ae8c6e27Sflorian /* we do not store the message, but we did store the RRs, 174*ae8c6e27Sflorian * which could be useful for delegation information */ 175*ae8c6e27Sflorian verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); 176*ae8c6e27Sflorian free(rep); 177*ae8c6e27Sflorian /* if the message is SERVFAIL in cache, remove that SERVFAIL, 178*ae8c6e27Sflorian * so that the TTL 0 response can be returned for future 179*ae8c6e27Sflorian * responses (i.e. don't get answered by the servfail from 180*ae8c6e27Sflorian * cache, but instead go to recursion to get this TTL0 181*ae8c6e27Sflorian * response). */ 182*ae8c6e27Sflorian msg_del_servfail(env, qinfo, flags); 183*ae8c6e27Sflorian return; 184*ae8c6e27Sflorian } 185*ae8c6e27Sflorian 186*ae8c6e27Sflorian /* store msg in the cache */ 187*ae8c6e27Sflorian reply_info_sortref(rep); 188*ae8c6e27Sflorian if(!(e = query_info_entrysetup(qinfo, rep, hash))) { 189*ae8c6e27Sflorian log_err("store_msg: malloc failed"); 190*ae8c6e27Sflorian return; 191*ae8c6e27Sflorian } 192*ae8c6e27Sflorian slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc); 193*ae8c6e27Sflorian } 194*ae8c6e27Sflorian 195*ae8c6e27Sflorian /** find closest NS or DNAME and returns the rrset (locked) */ 196*ae8c6e27Sflorian static struct ub_packed_rrset_key* 197*ae8c6e27Sflorian find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 198*ae8c6e27Sflorian uint16_t qclass, time_t now, uint16_t searchtype, int stripfront) 199*ae8c6e27Sflorian { 200*ae8c6e27Sflorian struct ub_packed_rrset_key *rrset; 201*ae8c6e27Sflorian uint8_t lablen; 202*ae8c6e27Sflorian 203*ae8c6e27Sflorian if(stripfront) { 204*ae8c6e27Sflorian /* strip off so that DNAMEs have strict subdomain match */ 205*ae8c6e27Sflorian lablen = *qname; 206*ae8c6e27Sflorian qname += lablen + 1; 207*ae8c6e27Sflorian qnamelen -= lablen + 1; 208*ae8c6e27Sflorian } 209*ae8c6e27Sflorian 210*ae8c6e27Sflorian /* snip off front part of qname until the type is found */ 211*ae8c6e27Sflorian while(qnamelen > 0) { 212*ae8c6e27Sflorian if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 213*ae8c6e27Sflorian qnamelen, searchtype, qclass, 0, now, 0))) 214*ae8c6e27Sflorian return rrset; 215*ae8c6e27Sflorian 216*ae8c6e27Sflorian /* snip off front label */ 217*ae8c6e27Sflorian lablen = *qname; 218*ae8c6e27Sflorian qname += lablen + 1; 219*ae8c6e27Sflorian qnamelen -= lablen + 1; 220*ae8c6e27Sflorian } 221*ae8c6e27Sflorian return NULL; 222*ae8c6e27Sflorian } 223*ae8c6e27Sflorian 224*ae8c6e27Sflorian /** add addr to additional section */ 225*ae8c6e27Sflorian static void 226*ae8c6e27Sflorian addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region, 227*ae8c6e27Sflorian struct dns_msg* msg, time_t now) 228*ae8c6e27Sflorian { 229*ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 230*ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 231*ae8c6e27Sflorian msg->rep->ar_numrrsets++; 232*ae8c6e27Sflorian msg->rep->rrset_count++; 233*ae8c6e27Sflorian } 234*ae8c6e27Sflorian } 235*ae8c6e27Sflorian 236*ae8c6e27Sflorian /** lookup message in message cache */ 237*ae8c6e27Sflorian struct msgreply_entry* 238*ae8c6e27Sflorian msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 239*ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr) 240*ae8c6e27Sflorian { 241*ae8c6e27Sflorian struct lruhash_entry* e; 242*ae8c6e27Sflorian struct query_info k; 243*ae8c6e27Sflorian hashvalue_type h; 244*ae8c6e27Sflorian 245*ae8c6e27Sflorian k.qname = qname; 246*ae8c6e27Sflorian k.qname_len = qnamelen; 247*ae8c6e27Sflorian k.qtype = qtype; 248*ae8c6e27Sflorian k.qclass = qclass; 249*ae8c6e27Sflorian k.local_alias = NULL; 250*ae8c6e27Sflorian h = query_info_hash(&k, flags); 251*ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, wr); 252*ae8c6e27Sflorian 253*ae8c6e27Sflorian if(!e) return NULL; 254*ae8c6e27Sflorian if( now > ((struct reply_info*)e->data)->ttl ) { 255*ae8c6e27Sflorian lock_rw_unlock(&e->lock); 256*ae8c6e27Sflorian return NULL; 257*ae8c6e27Sflorian } 258*ae8c6e27Sflorian return (struct msgreply_entry*)e->key; 259*ae8c6e27Sflorian } 260*ae8c6e27Sflorian 261*ae8c6e27Sflorian /** find and add A and AAAA records for nameservers in delegpt */ 262*ae8c6e27Sflorian static int 263*ae8c6e27Sflorian find_add_addrs(struct module_env* env, uint16_t qclass, 264*ae8c6e27Sflorian struct regional* region, struct delegpt* dp, time_t now, 265*ae8c6e27Sflorian struct dns_msg** msg) 266*ae8c6e27Sflorian { 267*ae8c6e27Sflorian struct delegpt_ns* ns; 268*ae8c6e27Sflorian struct msgreply_entry* neg; 269*ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 270*ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 271*ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 272*ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 273*ae8c6e27Sflorian if(akey) { 274*ae8c6e27Sflorian if(!delegpt_add_rrset_A(dp, region, akey, 0)) { 275*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 276*ae8c6e27Sflorian return 0; 277*ae8c6e27Sflorian } 278*ae8c6e27Sflorian if(msg) 279*ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 280*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 281*ae8c6e27Sflorian } else { 282*ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 283*ae8c6e27Sflorian * not use dns64 translation */ 284*ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 285*ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 286*ae8c6e27Sflorian if(neg) { 287*ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 288*ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 289*ae8c6e27Sflorian } 290*ae8c6e27Sflorian } 291*ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 292*ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 293*ae8c6e27Sflorian if(akey) { 294*ae8c6e27Sflorian if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) { 295*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 296*ae8c6e27Sflorian return 0; 297*ae8c6e27Sflorian } 298*ae8c6e27Sflorian if(msg) 299*ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 300*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 301*ae8c6e27Sflorian } else { 302*ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 303*ae8c6e27Sflorian * not use dns64 translation */ 304*ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 305*ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 306*ae8c6e27Sflorian if(neg) { 307*ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 308*ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 309*ae8c6e27Sflorian } 310*ae8c6e27Sflorian } 311*ae8c6e27Sflorian } 312*ae8c6e27Sflorian return 1; 313*ae8c6e27Sflorian } 314*ae8c6e27Sflorian 315*ae8c6e27Sflorian /** find and add A and AAAA records for missing nameservers in delegpt */ 316*ae8c6e27Sflorian int 317*ae8c6e27Sflorian cache_fill_missing(struct module_env* env, uint16_t qclass, 318*ae8c6e27Sflorian struct regional* region, struct delegpt* dp) 319*ae8c6e27Sflorian { 320*ae8c6e27Sflorian struct delegpt_ns* ns; 321*ae8c6e27Sflorian struct msgreply_entry* neg; 322*ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 323*ae8c6e27Sflorian time_t now = *env->now; 324*ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 325*ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 326*ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 327*ae8c6e27Sflorian if(akey) { 328*ae8c6e27Sflorian if(!delegpt_add_rrset_A(dp, region, akey, ns->lame)) { 329*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 330*ae8c6e27Sflorian return 0; 331*ae8c6e27Sflorian } 332*ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 333*ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_A, qclass); 334*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 335*ae8c6e27Sflorian } else { 336*ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 337*ae8c6e27Sflorian * not use dns64 translation */ 338*ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 339*ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 340*ae8c6e27Sflorian if(neg) { 341*ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 342*ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 343*ae8c6e27Sflorian } 344*ae8c6e27Sflorian } 345*ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 346*ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 347*ae8c6e27Sflorian if(akey) { 348*ae8c6e27Sflorian if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame)) { 349*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 350*ae8c6e27Sflorian return 0; 351*ae8c6e27Sflorian } 352*ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 353*ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_AAAA, qclass); 354*ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 355*ae8c6e27Sflorian } else { 356*ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 357*ae8c6e27Sflorian * not use dns64 translation */ 358*ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 359*ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 360*ae8c6e27Sflorian if(neg) { 361*ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 362*ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 363*ae8c6e27Sflorian } 364*ae8c6e27Sflorian } 365*ae8c6e27Sflorian } 366*ae8c6e27Sflorian return 1; 367*ae8c6e27Sflorian } 368*ae8c6e27Sflorian 369*ae8c6e27Sflorian /** find and add DS or NSEC to delegation msg */ 370*ae8c6e27Sflorian static void 371*ae8c6e27Sflorian find_add_ds(struct module_env* env, struct regional* region, 372*ae8c6e27Sflorian struct dns_msg* msg, struct delegpt* dp, time_t now) 373*ae8c6e27Sflorian { 374*ae8c6e27Sflorian /* Lookup the DS or NSEC at the delegation point. */ 375*ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 376*ae8c6e27Sflorian env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 377*ae8c6e27Sflorian msg->qinfo.qclass, 0, now, 0); 378*ae8c6e27Sflorian if(!rrset) { 379*ae8c6e27Sflorian /* NOTE: this won't work for alternate NSEC schemes 380*ae8c6e27Sflorian * (opt-in, NSEC3) */ 381*ae8c6e27Sflorian rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 382*ae8c6e27Sflorian dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 383*ae8c6e27Sflorian 0, now, 0); 384*ae8c6e27Sflorian /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used. 385*ae8c6e27Sflorian * since this is a referral, we need the NSEC at the parent 386*ae8c6e27Sflorian * side of the zone cut, not the NSEC at apex side. */ 387*ae8c6e27Sflorian if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) { 388*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 389*ae8c6e27Sflorian rrset = NULL; /* discard wrong NSEC */ 390*ae8c6e27Sflorian } 391*ae8c6e27Sflorian } 392*ae8c6e27Sflorian if(rrset) { 393*ae8c6e27Sflorian /* add it to auth section. This is the second rrset. */ 394*ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 395*ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 396*ae8c6e27Sflorian msg->rep->ns_numrrsets++; 397*ae8c6e27Sflorian msg->rep->rrset_count++; 398*ae8c6e27Sflorian } 399*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 400*ae8c6e27Sflorian } 401*ae8c6e27Sflorian } 402*ae8c6e27Sflorian 403*ae8c6e27Sflorian struct dns_msg* 404*ae8c6e27Sflorian dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 405*ae8c6e27Sflorian uint16_t qclass, struct regional* region, size_t capacity) 406*ae8c6e27Sflorian { 407*ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 408*ae8c6e27Sflorian sizeof(struct dns_msg)); 409*ae8c6e27Sflorian if(!msg) 410*ae8c6e27Sflorian return NULL; 411*ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen); 412*ae8c6e27Sflorian if(!msg->qinfo.qname) 413*ae8c6e27Sflorian return NULL; 414*ae8c6e27Sflorian msg->qinfo.qname_len = qnamelen; 415*ae8c6e27Sflorian msg->qinfo.qtype = qtype; 416*ae8c6e27Sflorian msg->qinfo.qclass = qclass; 417*ae8c6e27Sflorian msg->qinfo.local_alias = NULL; 418*ae8c6e27Sflorian /* non-packed reply_info, because it needs to grow the array */ 419*ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc_zero(region, 420*ae8c6e27Sflorian sizeof(struct reply_info)-sizeof(struct rrset_ref)); 421*ae8c6e27Sflorian if(!msg->rep) 422*ae8c6e27Sflorian return NULL; 423*ae8c6e27Sflorian if(capacity > RR_COUNT_MAX) 424*ae8c6e27Sflorian return NULL; /* integer overflow protection */ 425*ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* with QR, no AA */ 426*ae8c6e27Sflorian msg->rep->qdcount = 1; 427*ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 428*ae8c6e27Sflorian regional_alloc(region, 429*ae8c6e27Sflorian capacity*sizeof(struct ub_packed_rrset_key*)); 430*ae8c6e27Sflorian if(!msg->rep->rrsets) 431*ae8c6e27Sflorian return NULL; 432*ae8c6e27Sflorian return msg; 433*ae8c6e27Sflorian } 434*ae8c6e27Sflorian 435*ae8c6e27Sflorian int 436*ae8c6e27Sflorian dns_msg_authadd(struct dns_msg* msg, struct regional* region, 437*ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 438*ae8c6e27Sflorian { 439*ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 440*ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 441*ae8c6e27Sflorian return 0; 442*ae8c6e27Sflorian msg->rep->ns_numrrsets++; 443*ae8c6e27Sflorian return 1; 444*ae8c6e27Sflorian } 445*ae8c6e27Sflorian 446*ae8c6e27Sflorian int 447*ae8c6e27Sflorian dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 448*ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 449*ae8c6e27Sflorian { 450*ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 451*ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 452*ae8c6e27Sflorian return 0; 453*ae8c6e27Sflorian msg->rep->an_numrrsets++; 454*ae8c6e27Sflorian return 1; 455*ae8c6e27Sflorian } 456*ae8c6e27Sflorian 457*ae8c6e27Sflorian struct delegpt* 458*ae8c6e27Sflorian dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 459*ae8c6e27Sflorian size_t qnamelen, uint16_t qtype, uint16_t qclass, 460*ae8c6e27Sflorian struct regional* region, struct dns_msg** msg, time_t now) 461*ae8c6e27Sflorian { 462*ae8c6e27Sflorian /* try to find closest NS rrset */ 463*ae8c6e27Sflorian struct ub_packed_rrset_key* nskey; 464*ae8c6e27Sflorian struct packed_rrset_data* nsdata; 465*ae8c6e27Sflorian struct delegpt* dp; 466*ae8c6e27Sflorian 467*ae8c6e27Sflorian nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, 468*ae8c6e27Sflorian LDNS_RR_TYPE_NS, 0); 469*ae8c6e27Sflorian if(!nskey) /* hope the caller has hints to prime or something */ 470*ae8c6e27Sflorian return NULL; 471*ae8c6e27Sflorian nsdata = (struct packed_rrset_data*)nskey->entry.data; 472*ae8c6e27Sflorian /* got the NS key, create delegation point */ 473*ae8c6e27Sflorian dp = delegpt_create(region); 474*ae8c6e27Sflorian if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) { 475*ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 476*ae8c6e27Sflorian log_err("find_delegation: out of memory"); 477*ae8c6e27Sflorian return NULL; 478*ae8c6e27Sflorian } 479*ae8c6e27Sflorian /* create referral message */ 480*ae8c6e27Sflorian if(msg) { 481*ae8c6e27Sflorian /* allocate the array to as much as we could need: 482*ae8c6e27Sflorian * NS rrset + DS/NSEC rrset + 483*ae8c6e27Sflorian * A rrset for every NS RR 484*ae8c6e27Sflorian * AAAA rrset for every NS RR 485*ae8c6e27Sflorian */ 486*ae8c6e27Sflorian *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 487*ae8c6e27Sflorian 2 + nsdata->count*2); 488*ae8c6e27Sflorian if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) { 489*ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 490*ae8c6e27Sflorian log_err("find_delegation: out of memory"); 491*ae8c6e27Sflorian return NULL; 492*ae8c6e27Sflorian } 493*ae8c6e27Sflorian } 494*ae8c6e27Sflorian if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) 495*ae8c6e27Sflorian log_err("find_delegation: addns out of memory"); 496*ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/ 497*ae8c6e27Sflorian /* find and add DS/NSEC (if any) */ 498*ae8c6e27Sflorian if(msg) 499*ae8c6e27Sflorian find_add_ds(env, region, *msg, dp, now); 500*ae8c6e27Sflorian /* find and add A entries */ 501*ae8c6e27Sflorian if(!find_add_addrs(env, qclass, region, dp, now, msg)) 502*ae8c6e27Sflorian log_err("find_delegation: addrs out of memory"); 503*ae8c6e27Sflorian return dp; 504*ae8c6e27Sflorian } 505*ae8c6e27Sflorian 506*ae8c6e27Sflorian /** allocate dns_msg from query_info and reply_info */ 507*ae8c6e27Sflorian static struct dns_msg* 508*ae8c6e27Sflorian gen_dns_msg(struct regional* region, struct query_info* q, size_t num) 509*ae8c6e27Sflorian { 510*ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 511*ae8c6e27Sflorian sizeof(struct dns_msg)); 512*ae8c6e27Sflorian if(!msg) 513*ae8c6e27Sflorian return NULL; 514*ae8c6e27Sflorian memcpy(&msg->qinfo, q, sizeof(struct query_info)); 515*ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len); 516*ae8c6e27Sflorian if(!msg->qinfo.qname) 517*ae8c6e27Sflorian return NULL; 518*ae8c6e27Sflorian /* allocate replyinfo struct and rrset key array separately */ 519*ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc(region, 520*ae8c6e27Sflorian sizeof(struct reply_info) - sizeof(struct rrset_ref)); 521*ae8c6e27Sflorian if(!msg->rep) 522*ae8c6e27Sflorian return NULL; 523*ae8c6e27Sflorian if(num > RR_COUNT_MAX) 524*ae8c6e27Sflorian return NULL; /* integer overflow protection */ 525*ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 526*ae8c6e27Sflorian regional_alloc(region, 527*ae8c6e27Sflorian num * sizeof(struct ub_packed_rrset_key*)); 528*ae8c6e27Sflorian if(!msg->rep->rrsets) 529*ae8c6e27Sflorian return NULL; 530*ae8c6e27Sflorian return msg; 531*ae8c6e27Sflorian } 532*ae8c6e27Sflorian 533*ae8c6e27Sflorian struct dns_msg* 534*ae8c6e27Sflorian tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 535*ae8c6e27Sflorian struct regional* region, time_t now, struct regional* scratch) 536*ae8c6e27Sflorian { 537*ae8c6e27Sflorian struct dns_msg* msg; 538*ae8c6e27Sflorian size_t i; 539*ae8c6e27Sflorian if(now > r->ttl) 540*ae8c6e27Sflorian return NULL; 541*ae8c6e27Sflorian msg = gen_dns_msg(region, q, r->rrset_count); 542*ae8c6e27Sflorian if(!msg) 543*ae8c6e27Sflorian return NULL; 544*ae8c6e27Sflorian msg->rep->flags = r->flags; 545*ae8c6e27Sflorian msg->rep->qdcount = r->qdcount; 546*ae8c6e27Sflorian msg->rep->ttl = r->ttl - now; 547*ae8c6e27Sflorian if(r->prefetch_ttl > now) 548*ae8c6e27Sflorian msg->rep->prefetch_ttl = r->prefetch_ttl - now; 549*ae8c6e27Sflorian else msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 550*ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 551*ae8c6e27Sflorian msg->rep->security = r->security; 552*ae8c6e27Sflorian msg->rep->an_numrrsets = r->an_numrrsets; 553*ae8c6e27Sflorian msg->rep->ns_numrrsets = r->ns_numrrsets; 554*ae8c6e27Sflorian msg->rep->ar_numrrsets = r->ar_numrrsets; 555*ae8c6e27Sflorian msg->rep->rrset_count = r->rrset_count; 556*ae8c6e27Sflorian msg->rep->authoritative = r->authoritative; 557*ae8c6e27Sflorian if(!rrset_array_lock(r->ref, r->rrset_count, now)) 558*ae8c6e27Sflorian return NULL; 559*ae8c6e27Sflorian if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons( 560*ae8c6e27Sflorian LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons( 561*ae8c6e27Sflorian LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) { 562*ae8c6e27Sflorian /* cname chain is now invalid, reconstruct msg */ 563*ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 564*ae8c6e27Sflorian return NULL; 565*ae8c6e27Sflorian } 566*ae8c6e27Sflorian if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) { 567*ae8c6e27Sflorian /* message rrsets have changed status, revalidate */ 568*ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 569*ae8c6e27Sflorian return NULL; 570*ae8c6e27Sflorian } 571*ae8c6e27Sflorian for(i=0; i<msg->rep->rrset_count; i++) { 572*ae8c6e27Sflorian msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 573*ae8c6e27Sflorian region, now); 574*ae8c6e27Sflorian if(!msg->rep->rrsets[i]) { 575*ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 576*ae8c6e27Sflorian return NULL; 577*ae8c6e27Sflorian } 578*ae8c6e27Sflorian } 579*ae8c6e27Sflorian if(env) 580*ae8c6e27Sflorian rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 581*ae8c6e27Sflorian r->rrset_count); 582*ae8c6e27Sflorian else 583*ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 584*ae8c6e27Sflorian return msg; 585*ae8c6e27Sflorian } 586*ae8c6e27Sflorian 587*ae8c6e27Sflorian /** synthesize RRset-only response from cached RRset item */ 588*ae8c6e27Sflorian static struct dns_msg* 589*ae8c6e27Sflorian rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 590*ae8c6e27Sflorian time_t now, struct query_info* q) 591*ae8c6e27Sflorian { 592*ae8c6e27Sflorian struct dns_msg* msg; 593*ae8c6e27Sflorian struct packed_rrset_data* d = (struct packed_rrset_data*) 594*ae8c6e27Sflorian rrset->entry.data; 595*ae8c6e27Sflorian if(now > d->ttl) 596*ae8c6e27Sflorian return NULL; 597*ae8c6e27Sflorian msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */ 598*ae8c6e27Sflorian if(!msg) 599*ae8c6e27Sflorian return NULL; 600*ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 601*ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 602*ae8c6e27Sflorian msg->rep->qdcount = 1; 603*ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 604*ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 605*ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 606*ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 607*ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 608*ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 609*ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 610*ae8c6e27Sflorian msg->rep->rrset_count = 1; 611*ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 612*ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy CNAME */ 613*ae8c6e27Sflorian return NULL; 614*ae8c6e27Sflorian return msg; 615*ae8c6e27Sflorian } 616*ae8c6e27Sflorian 617*ae8c6e27Sflorian /** synthesize DNAME+CNAME response from cached DNAME item */ 618*ae8c6e27Sflorian static struct dns_msg* 619*ae8c6e27Sflorian synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 620*ae8c6e27Sflorian time_t now, struct query_info* q, enum sec_status* sec_status) 621*ae8c6e27Sflorian { 622*ae8c6e27Sflorian struct dns_msg* msg; 623*ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 624*ae8c6e27Sflorian struct packed_rrset_data* newd, *d = (struct packed_rrset_data*) 625*ae8c6e27Sflorian rrset->entry.data; 626*ae8c6e27Sflorian uint8_t* newname, *dtarg = NULL; 627*ae8c6e27Sflorian size_t newlen, dtarglen; 628*ae8c6e27Sflorian if(now > d->ttl) 629*ae8c6e27Sflorian return NULL; 630*ae8c6e27Sflorian /* only allow validated (with DNSSEC) DNAMEs used from cache 631*ae8c6e27Sflorian * for insecure DNAMEs, query again. */ 632*ae8c6e27Sflorian *sec_status = d->security; 633*ae8c6e27Sflorian /* return sec status, so the status of the CNAME can be checked 634*ae8c6e27Sflorian * by the calling routine. */ 635*ae8c6e27Sflorian msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */ 636*ae8c6e27Sflorian if(!msg) 637*ae8c6e27Sflorian return NULL; 638*ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 639*ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 640*ae8c6e27Sflorian msg->rep->qdcount = 1; 641*ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 642*ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 643*ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 644*ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 645*ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 646*ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 647*ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 648*ae8c6e27Sflorian msg->rep->rrset_count = 1; 649*ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 650*ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy DNAME */ 651*ae8c6e27Sflorian return NULL; 652*ae8c6e27Sflorian /* synth CNAME rrset */ 653*ae8c6e27Sflorian get_cname_target(rrset, &dtarg, &dtarglen); 654*ae8c6e27Sflorian if(!dtarg) 655*ae8c6e27Sflorian return NULL; 656*ae8c6e27Sflorian newlen = q->qname_len + dtarglen - rrset->rk.dname_len; 657*ae8c6e27Sflorian if(newlen > LDNS_MAX_DOMAINLEN) { 658*ae8c6e27Sflorian msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 659*ae8c6e27Sflorian return msg; 660*ae8c6e27Sflorian } 661*ae8c6e27Sflorian newname = (uint8_t*)regional_alloc(region, newlen); 662*ae8c6e27Sflorian if(!newname) 663*ae8c6e27Sflorian return NULL; 664*ae8c6e27Sflorian /* new name is concatenation of qname front (without DNAME owner) 665*ae8c6e27Sflorian * and DNAME target name */ 666*ae8c6e27Sflorian memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len); 667*ae8c6e27Sflorian memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen); 668*ae8c6e27Sflorian /* create rest of CNAME rrset */ 669*ae8c6e27Sflorian ck = (struct ub_packed_rrset_key*)regional_alloc(region, 670*ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key)); 671*ae8c6e27Sflorian if(!ck) 672*ae8c6e27Sflorian return NULL; 673*ae8c6e27Sflorian memset(&ck->entry, 0, sizeof(ck->entry)); 674*ae8c6e27Sflorian msg->rep->rrsets[1] = ck; 675*ae8c6e27Sflorian ck->entry.key = ck; 676*ae8c6e27Sflorian ck->rk.type = htons(LDNS_RR_TYPE_CNAME); 677*ae8c6e27Sflorian ck->rk.rrset_class = rrset->rk.rrset_class; 678*ae8c6e27Sflorian ck->rk.flags = 0; 679*ae8c6e27Sflorian ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len); 680*ae8c6e27Sflorian if(!ck->rk.dname) 681*ae8c6e27Sflorian return NULL; 682*ae8c6e27Sflorian ck->rk.dname_len = q->qname_len; 683*ae8c6e27Sflorian ck->entry.hash = rrset_key_hash(&ck->rk); 684*ae8c6e27Sflorian newd = (struct packed_rrset_data*)regional_alloc_zero(region, 685*ae8c6e27Sflorian sizeof(struct packed_rrset_data) + sizeof(size_t) + 686*ae8c6e27Sflorian sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 687*ae8c6e27Sflorian + newlen); 688*ae8c6e27Sflorian if(!newd) 689*ae8c6e27Sflorian return NULL; 690*ae8c6e27Sflorian ck->entry.data = newd; 691*ae8c6e27Sflorian newd->ttl = 0; /* 0 for synthesized CNAME TTL */ 692*ae8c6e27Sflorian newd->count = 1; 693*ae8c6e27Sflorian newd->rrsig_count = 0; 694*ae8c6e27Sflorian newd->trust = rrset_trust_ans_noAA; 695*ae8c6e27Sflorian newd->rr_len = (size_t*)((uint8_t*)newd + 696*ae8c6e27Sflorian sizeof(struct packed_rrset_data)); 697*ae8c6e27Sflorian newd->rr_len[0] = newlen + sizeof(uint16_t); 698*ae8c6e27Sflorian packed_rrset_ptr_fixup(newd); 699*ae8c6e27Sflorian newd->rr_ttl[0] = newd->ttl; 700*ae8c6e27Sflorian msg->rep->ttl = newd->ttl; 701*ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl); 702*ae8c6e27Sflorian msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL; 703*ae8c6e27Sflorian sldns_write_uint16(newd->rr_data[0], newlen); 704*ae8c6e27Sflorian memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen); 705*ae8c6e27Sflorian msg->rep->an_numrrsets ++; 706*ae8c6e27Sflorian msg->rep->rrset_count ++; 707*ae8c6e27Sflorian return msg; 708*ae8c6e27Sflorian } 709*ae8c6e27Sflorian 710*ae8c6e27Sflorian /** Fill TYPE_ANY response with some data from cache */ 711*ae8c6e27Sflorian static struct dns_msg* 712*ae8c6e27Sflorian fill_any(struct module_env* env, 713*ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 714*ae8c6e27Sflorian struct regional* region) 715*ae8c6e27Sflorian { 716*ae8c6e27Sflorian time_t now = *env->now; 717*ae8c6e27Sflorian struct dns_msg* msg = NULL; 718*ae8c6e27Sflorian uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, 719*ae8c6e27Sflorian LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 720*ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 0}; 721*ae8c6e27Sflorian int i, num=6; /* number of RR types to look up */ 722*ae8c6e27Sflorian log_assert(lookup[num] == 0); 723*ae8c6e27Sflorian 724*ae8c6e27Sflorian if(env->cfg->deny_any) { 725*ae8c6e27Sflorian /* return empty message */ 726*ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 727*ae8c6e27Sflorian region, 0); 728*ae8c6e27Sflorian if(!msg) { 729*ae8c6e27Sflorian return NULL; 730*ae8c6e27Sflorian } 731*ae8c6e27Sflorian msg->rep->security = sec_status_indeterminate; 732*ae8c6e27Sflorian return msg; 733*ae8c6e27Sflorian } 734*ae8c6e27Sflorian 735*ae8c6e27Sflorian for(i=0; i<num; i++) { 736*ae8c6e27Sflorian /* look up this RR for inclusion in type ANY response */ 737*ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 738*ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, lookup[i], 739*ae8c6e27Sflorian qclass, 0, now, 0); 740*ae8c6e27Sflorian struct packed_rrset_data *d; 741*ae8c6e27Sflorian if(!rrset) 742*ae8c6e27Sflorian continue; 743*ae8c6e27Sflorian 744*ae8c6e27Sflorian /* only if rrset from answer section */ 745*ae8c6e27Sflorian d = (struct packed_rrset_data*)rrset->entry.data; 746*ae8c6e27Sflorian if(d->trust == rrset_trust_add_noAA || 747*ae8c6e27Sflorian d->trust == rrset_trust_auth_noAA || 748*ae8c6e27Sflorian d->trust == rrset_trust_add_AA || 749*ae8c6e27Sflorian d->trust == rrset_trust_auth_AA) { 750*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 751*ae8c6e27Sflorian continue; 752*ae8c6e27Sflorian } 753*ae8c6e27Sflorian 754*ae8c6e27Sflorian /* create msg if none */ 755*ae8c6e27Sflorian if(!msg) { 756*ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 757*ae8c6e27Sflorian region, (size_t)(num-i)); 758*ae8c6e27Sflorian if(!msg) { 759*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 760*ae8c6e27Sflorian return NULL; 761*ae8c6e27Sflorian } 762*ae8c6e27Sflorian } 763*ae8c6e27Sflorian 764*ae8c6e27Sflorian /* add RRset to response */ 765*ae8c6e27Sflorian if(!dns_msg_ansadd(msg, region, rrset, now)) { 766*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 767*ae8c6e27Sflorian return NULL; 768*ae8c6e27Sflorian } 769*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 770*ae8c6e27Sflorian } 771*ae8c6e27Sflorian return msg; 772*ae8c6e27Sflorian } 773*ae8c6e27Sflorian 774*ae8c6e27Sflorian struct dns_msg* 775*ae8c6e27Sflorian dns_cache_lookup(struct module_env* env, 776*ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 777*ae8c6e27Sflorian uint16_t flags, struct regional* region, struct regional* scratch, 778*ae8c6e27Sflorian int no_partial) 779*ae8c6e27Sflorian { 780*ae8c6e27Sflorian struct lruhash_entry* e; 781*ae8c6e27Sflorian struct query_info k; 782*ae8c6e27Sflorian hashvalue_type h; 783*ae8c6e27Sflorian time_t now = *env->now; 784*ae8c6e27Sflorian struct ub_packed_rrset_key* rrset; 785*ae8c6e27Sflorian 786*ae8c6e27Sflorian /* lookup first, this has both NXdomains and ANSWER responses */ 787*ae8c6e27Sflorian k.qname = qname; 788*ae8c6e27Sflorian k.qname_len = qnamelen; 789*ae8c6e27Sflorian k.qtype = qtype; 790*ae8c6e27Sflorian k.qclass = qclass; 791*ae8c6e27Sflorian k.local_alias = NULL; 792*ae8c6e27Sflorian h = query_info_hash(&k, flags); 793*ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 794*ae8c6e27Sflorian if(e) { 795*ae8c6e27Sflorian struct msgreply_entry* key = (struct msgreply_entry*)e->key; 796*ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 797*ae8c6e27Sflorian struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 798*ae8c6e27Sflorian scratch); 799*ae8c6e27Sflorian if(msg) { 800*ae8c6e27Sflorian lock_rw_unlock(&e->lock); 801*ae8c6e27Sflorian return msg; 802*ae8c6e27Sflorian } 803*ae8c6e27Sflorian /* could be msg==NULL; due to TTL or not all rrsets available */ 804*ae8c6e27Sflorian lock_rw_unlock(&e->lock); 805*ae8c6e27Sflorian } 806*ae8c6e27Sflorian 807*ae8c6e27Sflorian /* see if a DNAME exists. Checked for first, to enforce that DNAMEs 808*ae8c6e27Sflorian * are more important, the CNAME is resynthesized and thus 809*ae8c6e27Sflorian * consistent with the DNAME */ 810*ae8c6e27Sflorian if(!no_partial && 811*ae8c6e27Sflorian (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, 812*ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 1))) { 813*ae8c6e27Sflorian /* synthesize a DNAME+CNAME message based on this */ 814*ae8c6e27Sflorian enum sec_status sec_status = sec_status_unchecked; 815*ae8c6e27Sflorian struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k, 816*ae8c6e27Sflorian &sec_status); 817*ae8c6e27Sflorian if(msg) { 818*ae8c6e27Sflorian struct ub_packed_rrset_key* cname_rrset; 819*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 820*ae8c6e27Sflorian /* now, after unlocking the DNAME rrset lock, 821*ae8c6e27Sflorian * check the sec_status, and see if we need to look 822*ae8c6e27Sflorian * up the CNAME record associated before it can 823*ae8c6e27Sflorian * be used */ 824*ae8c6e27Sflorian /* normally, only secure DNAMEs allowed from cache*/ 825*ae8c6e27Sflorian if(sec_status == sec_status_secure) 826*ae8c6e27Sflorian return msg; 827*ae8c6e27Sflorian /* but if we have a CNAME cached with this name, then we 828*ae8c6e27Sflorian * have previously already allowed this name to pass. 829*ae8c6e27Sflorian * the next cache lookup is going to fetch that CNAME itself, 830*ae8c6e27Sflorian * but it is better to have the (unsigned)DNAME + CNAME in 831*ae8c6e27Sflorian * that case */ 832*ae8c6e27Sflorian cname_rrset = rrset_cache_lookup( 833*ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, 834*ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0); 835*ae8c6e27Sflorian if(cname_rrset) { 836*ae8c6e27Sflorian /* CNAME already synthesized by 837*ae8c6e27Sflorian * synth_dname_msg routine, so we can 838*ae8c6e27Sflorian * straight up return the msg */ 839*ae8c6e27Sflorian lock_rw_unlock(&cname_rrset->entry.lock); 840*ae8c6e27Sflorian return msg; 841*ae8c6e27Sflorian } 842*ae8c6e27Sflorian } else { 843*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 844*ae8c6e27Sflorian } 845*ae8c6e27Sflorian } 846*ae8c6e27Sflorian 847*ae8c6e27Sflorian /* see if we have CNAME for this domain, 848*ae8c6e27Sflorian * but not for DS records (which are part of the parent) */ 849*ae8c6e27Sflorian if(!no_partial && qtype != LDNS_RR_TYPE_DS && 850*ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 851*ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) { 852*ae8c6e27Sflorian uint8_t* wc = NULL; 853*ae8c6e27Sflorian size_t wl; 854*ae8c6e27Sflorian /* if the rrset is not a wildcard expansion, with wcname */ 855*ae8c6e27Sflorian /* because, if we return that CNAME rrset on its own, it is 856*ae8c6e27Sflorian * missing the NSEC or NSEC3 proof */ 857*ae8c6e27Sflorian if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) { 858*ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 859*ae8c6e27Sflorian if(msg) { 860*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 861*ae8c6e27Sflorian return msg; 862*ae8c6e27Sflorian } 863*ae8c6e27Sflorian } 864*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 865*ae8c6e27Sflorian } 866*ae8c6e27Sflorian 867*ae8c6e27Sflorian /* construct DS, DNSKEY, DLV messages from rrset cache. */ 868*ae8c6e27Sflorian if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY || 869*ae8c6e27Sflorian qtype == LDNS_RR_TYPE_DLV) && 870*ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 871*ae8c6e27Sflorian qtype, qclass, 0, now, 0))) { 872*ae8c6e27Sflorian /* if the rrset is from the additional section, and the 873*ae8c6e27Sflorian * signatures have fallen off, then do not synthesize a msg 874*ae8c6e27Sflorian * instead, allow a full query for signed results to happen. 875*ae8c6e27Sflorian * Forego all rrset data from additional section, because 876*ae8c6e27Sflorian * some signatures may not be present and cause validation 877*ae8c6e27Sflorian * failure. 878*ae8c6e27Sflorian */ 879*ae8c6e27Sflorian struct packed_rrset_data *d = (struct packed_rrset_data*) 880*ae8c6e27Sflorian rrset->entry.data; 881*ae8c6e27Sflorian if(d->trust != rrset_trust_add_noAA && 882*ae8c6e27Sflorian d->trust != rrset_trust_add_AA && 883*ae8c6e27Sflorian (qtype == LDNS_RR_TYPE_DS || 884*ae8c6e27Sflorian (d->trust != rrset_trust_auth_noAA 885*ae8c6e27Sflorian && d->trust != rrset_trust_auth_AA) )) { 886*ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 887*ae8c6e27Sflorian if(msg) { 888*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 889*ae8c6e27Sflorian return msg; 890*ae8c6e27Sflorian } 891*ae8c6e27Sflorian } 892*ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 893*ae8c6e27Sflorian } 894*ae8c6e27Sflorian 895*ae8c6e27Sflorian /* stop downwards cache search on NXDOMAIN. 896*ae8c6e27Sflorian * Empty nonterminals are NOERROR, so an NXDOMAIN for foo 897*ae8c6e27Sflorian * means bla.foo also does not exist. The DNSSEC proofs are 898*ae8c6e27Sflorian * the same. We search upwards for NXDOMAINs. */ 899*ae8c6e27Sflorian if(env->cfg->harden_below_nxdomain) 900*ae8c6e27Sflorian while(!dname_is_root(k.qname)) { 901*ae8c6e27Sflorian dname_remove_label(&k.qname, &k.qname_len); 902*ae8c6e27Sflorian h = query_info_hash(&k, flags); 903*ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 904*ae8c6e27Sflorian if(!e && k.qtype != LDNS_RR_TYPE_A && 905*ae8c6e27Sflorian env->cfg->qname_minimisation) { 906*ae8c6e27Sflorian k.qtype = LDNS_RR_TYPE_A; 907*ae8c6e27Sflorian h = query_info_hash(&k, flags); 908*ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 909*ae8c6e27Sflorian } 910*ae8c6e27Sflorian if(e) { 911*ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 912*ae8c6e27Sflorian struct dns_msg* msg; 913*ae8c6e27Sflorian if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN 914*ae8c6e27Sflorian && data->security == sec_status_secure 915*ae8c6e27Sflorian && (msg=tomsg(env, &k, data, region, now, scratch))){ 916*ae8c6e27Sflorian lock_rw_unlock(&e->lock); 917*ae8c6e27Sflorian msg->qinfo.qname=qname; 918*ae8c6e27Sflorian msg->qinfo.qname_len=qnamelen; 919*ae8c6e27Sflorian /* check that DNSSEC really works out */ 920*ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 921*ae8c6e27Sflorian return msg; 922*ae8c6e27Sflorian } 923*ae8c6e27Sflorian lock_rw_unlock(&e->lock); 924*ae8c6e27Sflorian } 925*ae8c6e27Sflorian k.qtype = qtype; 926*ae8c6e27Sflorian } 927*ae8c6e27Sflorian 928*ae8c6e27Sflorian /* fill common RR types for ANY response to avoid requery */ 929*ae8c6e27Sflorian if(qtype == LDNS_RR_TYPE_ANY) { 930*ae8c6e27Sflorian return fill_any(env, qname, qnamelen, qtype, qclass, region); 931*ae8c6e27Sflorian } 932*ae8c6e27Sflorian 933*ae8c6e27Sflorian return NULL; 934*ae8c6e27Sflorian } 935*ae8c6e27Sflorian 936*ae8c6e27Sflorian int 937*ae8c6e27Sflorian dns_cache_store(struct module_env* env, struct query_info* msgqinf, 938*ae8c6e27Sflorian struct reply_info* msgrep, int is_referral, time_t leeway, int pside, 939*ae8c6e27Sflorian struct regional* region, uint32_t flags) 940*ae8c6e27Sflorian { 941*ae8c6e27Sflorian struct reply_info* rep = NULL; 942*ae8c6e27Sflorian /* alloc, malloc properly (not in region, like msg is) */ 943*ae8c6e27Sflorian rep = reply_info_copy(msgrep, env->alloc, NULL); 944*ae8c6e27Sflorian if(!rep) 945*ae8c6e27Sflorian return 0; 946*ae8c6e27Sflorian /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. 947*ae8c6e27Sflorian * the env->now is added to message and RRsets in this routine. */ 948*ae8c6e27Sflorian /* the leeway is used to invalidate other rrsets earlier */ 949*ae8c6e27Sflorian 950*ae8c6e27Sflorian if(is_referral) { 951*ae8c6e27Sflorian /* store rrsets */ 952*ae8c6e27Sflorian struct rrset_ref ref; 953*ae8c6e27Sflorian size_t i; 954*ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 955*ae8c6e27Sflorian packed_rrset_ttl_add((struct packed_rrset_data*) 956*ae8c6e27Sflorian rep->rrsets[i]->entry.data, *env->now); 957*ae8c6e27Sflorian ref.key = rep->rrsets[i]; 958*ae8c6e27Sflorian ref.id = rep->rrsets[i]->id; 959*ae8c6e27Sflorian /*ignore ret: it was in the cache, ref updated */ 960*ae8c6e27Sflorian /* no leeway for typeNS */ 961*ae8c6e27Sflorian (void)rrset_cache_update(env->rrset_cache, &ref, 962*ae8c6e27Sflorian env->alloc, *env->now + 963*ae8c6e27Sflorian ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS 964*ae8c6e27Sflorian && !pside) ? 0:leeway)); 965*ae8c6e27Sflorian } 966*ae8c6e27Sflorian free(rep); 967*ae8c6e27Sflorian return 1; 968*ae8c6e27Sflorian } else { 969*ae8c6e27Sflorian /* store msg, and rrsets */ 970*ae8c6e27Sflorian struct query_info qinf; 971*ae8c6e27Sflorian hashvalue_type h; 972*ae8c6e27Sflorian 973*ae8c6e27Sflorian qinf = *msgqinf; 974*ae8c6e27Sflorian qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len); 975*ae8c6e27Sflorian if(!qinf.qname) { 976*ae8c6e27Sflorian reply_info_parsedelete(rep, env->alloc); 977*ae8c6e27Sflorian return 0; 978*ae8c6e27Sflorian } 979*ae8c6e27Sflorian /* fixup flags to be sensible for a reply based on the cache */ 980*ae8c6e27Sflorian /* this module means that RA is available. It is an answer QR. 981*ae8c6e27Sflorian * Not AA from cache. Not CD in cache (depends on client bit). */ 982*ae8c6e27Sflorian rep->flags |= (BIT_RA | BIT_QR); 983*ae8c6e27Sflorian rep->flags &= ~(BIT_AA | BIT_CD); 984*ae8c6e27Sflorian h = query_info_hash(&qinf, (uint16_t)flags); 985*ae8c6e27Sflorian dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep, 986*ae8c6e27Sflorian flags, region); 987*ae8c6e27Sflorian /* qname is used inside query_info_entrysetup, and set to 988*ae8c6e27Sflorian * NULL. If it has not been used, free it. free(0) is safe. */ 989*ae8c6e27Sflorian free(qinf.qname); 990*ae8c6e27Sflorian } 991*ae8c6e27Sflorian return 1; 992*ae8c6e27Sflorian } 993*ae8c6e27Sflorian 994*ae8c6e27Sflorian int 995*ae8c6e27Sflorian dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo, 996*ae8c6e27Sflorian time_t adjust, uint16_t flags) 997*ae8c6e27Sflorian { 998*ae8c6e27Sflorian struct msgreply_entry* msg; 999*ae8c6e27Sflorian msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 1000*ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, *env->now, 1); 1001*ae8c6e27Sflorian if(msg) { 1002*ae8c6e27Sflorian struct reply_info* rep = (struct reply_info*)msg->entry.data; 1003*ae8c6e27Sflorian if(rep) { 1004*ae8c6e27Sflorian rep->prefetch_ttl += adjust; 1005*ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1006*ae8c6e27Sflorian return 1; 1007*ae8c6e27Sflorian } 1008*ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1009*ae8c6e27Sflorian } 1010*ae8c6e27Sflorian return 0; 1011*ae8c6e27Sflorian } 1012