1ae8c6e27Sflorian /* 2ae8c6e27Sflorian * services/cache/dns.c - Cache services for DNS using msg and rrset caches. 3ae8c6e27Sflorian * 4ae8c6e27Sflorian * Copyright (c) 2007, NLnet Labs. All rights reserved. 5ae8c6e27Sflorian * 6ae8c6e27Sflorian * This software is open source. 7ae8c6e27Sflorian * 8ae8c6e27Sflorian * Redistribution and use in source and binary forms, with or without 9ae8c6e27Sflorian * modification, are permitted provided that the following conditions 10ae8c6e27Sflorian * are met: 11ae8c6e27Sflorian * 12ae8c6e27Sflorian * Redistributions of source code must retain the above copyright notice, 13ae8c6e27Sflorian * this list of conditions and the following disclaimer. 14ae8c6e27Sflorian * 15ae8c6e27Sflorian * Redistributions in binary form must reproduce the above copyright notice, 16ae8c6e27Sflorian * this list of conditions and the following disclaimer in the documentation 17ae8c6e27Sflorian * and/or other materials provided with the distribution. 18ae8c6e27Sflorian * 19ae8c6e27Sflorian * Neither the name of the NLNET LABS nor the names of its contributors may 20ae8c6e27Sflorian * be used to endorse or promote products derived from this software without 21ae8c6e27Sflorian * specific prior written permission. 22ae8c6e27Sflorian * 23ae8c6e27Sflorian * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24ae8c6e27Sflorian * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25ae8c6e27Sflorian * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26ae8c6e27Sflorian * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27ae8c6e27Sflorian * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28ae8c6e27Sflorian * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29ae8c6e27Sflorian * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30ae8c6e27Sflorian * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31ae8c6e27Sflorian * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32ae8c6e27Sflorian * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33ae8c6e27Sflorian * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34ae8c6e27Sflorian */ 35ae8c6e27Sflorian 36ae8c6e27Sflorian /** 37ae8c6e27Sflorian * \file 38ae8c6e27Sflorian * 39ae8c6e27Sflorian * This file contains the DNS cache. 40ae8c6e27Sflorian */ 41ae8c6e27Sflorian #include "config.h" 42ae8c6e27Sflorian #include "iterator/iter_delegpt.h" 439b465e50Sflorian #include "iterator/iter_utils.h" 44ae8c6e27Sflorian #include "validator/val_nsec.h" 45ae8c6e27Sflorian #include "validator/val_utils.h" 46ae8c6e27Sflorian #include "services/cache/dns.h" 47ae8c6e27Sflorian #include "services/cache/rrset.h" 48d32eb43cSflorian #include "util/data/msgparse.h" 49ae8c6e27Sflorian #include "util/data/msgreply.h" 50ae8c6e27Sflorian #include "util/data/packed_rrset.h" 51ae8c6e27Sflorian #include "util/data/dname.h" 52ae8c6e27Sflorian #include "util/module.h" 53ae8c6e27Sflorian #include "util/net_help.h" 54ae8c6e27Sflorian #include "util/regional.h" 55ae8c6e27Sflorian #include "util/config_file.h" 56ae8c6e27Sflorian #include "sldns/sbuffer.h" 57ae8c6e27Sflorian 58ae8c6e27Sflorian /** store rrsets in the rrset cache. 59ae8c6e27Sflorian * @param env: module environment with caches. 60ae8c6e27Sflorian * @param rep: contains list of rrsets to store. 61ae8c6e27Sflorian * @param now: current time. 62ae8c6e27Sflorian * @param leeway: during prefetch how much leeway to update TTLs. 63ae8c6e27Sflorian * This makes rrsets (other than type NS) timeout sooner so they get 64ae8c6e27Sflorian * updated with a new full TTL. 65ae8c6e27Sflorian * Type NS does not get this, because it must not be refreshed from the 66ae8c6e27Sflorian * child domain, but keep counting down properly. 67ae8c6e27Sflorian * @param pside: if from parentside discovered NS, so that its NS is okay 68ae8c6e27Sflorian * in a prefetch situation to be updated (without becoming sticky). 69ae8c6e27Sflorian * @param qrep: update rrsets here if cache is better 70ae8c6e27Sflorian * @param region: for qrep allocs. 716d08cb1bSflorian * @param qstarttime: time when delegations were looked up, this is perhaps 726d08cb1bSflorian * earlier than the time in now. The time is used to determine if RRsets 736d08cb1bSflorian * of type NS have expired, so that they can only be updated using 746d08cb1bSflorian * lookups of delegation points that did not use them, since they had 756d08cb1bSflorian * expired then. 76ae8c6e27Sflorian */ 77ae8c6e27Sflorian static void 78ae8c6e27Sflorian store_rrsets(struct module_env* env, struct reply_info* rep, time_t now, 79ae8c6e27Sflorian time_t leeway, int pside, struct reply_info* qrep, 806d08cb1bSflorian struct regional* region, time_t qstarttime) 81ae8c6e27Sflorian { 82ae8c6e27Sflorian size_t i; 83ae8c6e27Sflorian /* see if rrset already exists in cache, if not insert it. */ 84ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 85ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 86ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 87ae8c6e27Sflorian /* update ref if it was in the cache */ 88ae8c6e27Sflorian switch(rrset_cache_update(env->rrset_cache, &rep->ref[i], 896d08cb1bSflorian env->alloc, ((ntohs(rep->ref[i].key->rk.type)== 906d08cb1bSflorian LDNS_RR_TYPE_NS && !pside)?qstarttime:now + leeway))) { 91ae8c6e27Sflorian case 0: /* ref unchanged, item inserted */ 92ae8c6e27Sflorian break; 93ae8c6e27Sflorian case 2: /* ref updated, cache is superior */ 94ae8c6e27Sflorian if(region) { 95ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 96ae8c6e27Sflorian lock_rw_rdlock(&rep->ref[i].key->entry.lock); 97ae8c6e27Sflorian /* if deleted rrset, do not copy it */ 98ae8c6e27Sflorian if(rep->ref[i].key->id == 0) 99ae8c6e27Sflorian ck = NULL; 100ae8c6e27Sflorian else ck = packed_rrset_copy_region( 101ae8c6e27Sflorian rep->ref[i].key, region, now); 102ae8c6e27Sflorian lock_rw_unlock(&rep->ref[i].key->entry.lock); 103ae8c6e27Sflorian if(ck) { 104ae8c6e27Sflorian /* use cached copy if memory allows */ 105ae8c6e27Sflorian qrep->rrsets[i] = ck; 106ae8c6e27Sflorian } 107ae8c6e27Sflorian } 108ae8c6e27Sflorian /* no break: also copy key item */ 109ae8c6e27Sflorian /* the line below is matched by gcc regex and silences 110ae8c6e27Sflorian * the fallthrough warning */ 111ae8c6e27Sflorian /* fallthrough */ 112ae8c6e27Sflorian case 1: /* ref updated, item inserted */ 113ae8c6e27Sflorian rep->rrsets[i] = rep->ref[i].key; 114ae8c6e27Sflorian } 115ae8c6e27Sflorian } 116ae8c6e27Sflorian } 117ae8c6e27Sflorian 118ae8c6e27Sflorian /** delete message from message cache */ 119ae8c6e27Sflorian void 120ae8c6e27Sflorian msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, 121ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags) 122ae8c6e27Sflorian { 123ae8c6e27Sflorian struct query_info k; 124ae8c6e27Sflorian hashvalue_type h; 125ae8c6e27Sflorian 126ae8c6e27Sflorian k.qname = qname; 127ae8c6e27Sflorian k.qname_len = qnamelen; 128ae8c6e27Sflorian k.qtype = qtype; 129ae8c6e27Sflorian k.qclass = qclass; 130ae8c6e27Sflorian k.local_alias = NULL; 131ae8c6e27Sflorian h = query_info_hash(&k, flags); 132ae8c6e27Sflorian slabhash_remove(env->msg_cache, h, &k); 133ae8c6e27Sflorian } 134ae8c6e27Sflorian 135ae8c6e27Sflorian void 136ae8c6e27Sflorian dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, 137ae8c6e27Sflorian hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, 1386d08cb1bSflorian struct reply_info* qrep, uint32_t flags, struct regional* region, 1396d08cb1bSflorian time_t qstarttime) 140ae8c6e27Sflorian { 141ae8c6e27Sflorian struct msgreply_entry* e; 142ae8c6e27Sflorian time_t ttl = rep->ttl; 143ae8c6e27Sflorian size_t i; 144ae8c6e27Sflorian 145ae8c6e27Sflorian /* store RRsets */ 146ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 147ae8c6e27Sflorian rep->ref[i].key = rep->rrsets[i]; 148ae8c6e27Sflorian rep->ref[i].id = rep->rrsets[i]->id; 149ae8c6e27Sflorian } 150ae8c6e27Sflorian 151ae8c6e27Sflorian /* there was a reply_info_sortref(rep) here but it seems to be 152ae8c6e27Sflorian * unnecessary, because the cache gets locked per rrset. */ 153ae8c6e27Sflorian reply_info_set_ttls(rep, *env->now); 1546d08cb1bSflorian store_rrsets(env, rep, *env->now, leeway, pside, qrep, region, 1556d08cb1bSflorian qstarttime); 156ae8c6e27Sflorian if(ttl == 0 && !(flags & DNSCACHE_STORE_ZEROTTL)) { 157ae8c6e27Sflorian /* we do not store the message, but we did store the RRs, 158ae8c6e27Sflorian * which could be useful for delegation information */ 159ae8c6e27Sflorian verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); 160*d500c338Sflorian reply_info_delete(rep, NULL); 161*d500c338Sflorian /* if the message is in the cache, remove that msg, 162ae8c6e27Sflorian * so that the TTL 0 response can be returned for future 163*d500c338Sflorian * responses (i.e. don't get answered from 164ae8c6e27Sflorian * cache, but instead go to recursion to get this TTL0 165*d500c338Sflorian * response). 166*d500c338Sflorian * Possible messages that could be in the cache: 167*d500c338Sflorian * - SERVFAIL 168*d500c338Sflorian * - NXDOMAIN 169*d500c338Sflorian * - NODATA 170*d500c338Sflorian * - an older record that is expired 171*d500c338Sflorian * - an older record that did not yet expire */ 172*d500c338Sflorian msg_cache_remove(env, qinfo->qname, qinfo->qname_len, 173*d500c338Sflorian qinfo->qtype, qinfo->qclass, flags); 174ae8c6e27Sflorian return; 175ae8c6e27Sflorian } 176ae8c6e27Sflorian 177ae8c6e27Sflorian /* store msg in the cache */ 178ae8c6e27Sflorian reply_info_sortref(rep); 179ae8c6e27Sflorian if(!(e = query_info_entrysetup(qinfo, rep, hash))) { 180ae8c6e27Sflorian log_err("store_msg: malloc failed"); 181ae8c6e27Sflorian return; 182ae8c6e27Sflorian } 183ae8c6e27Sflorian slabhash_insert(env->msg_cache, hash, &e->entry, rep, env->alloc); 184ae8c6e27Sflorian } 185ae8c6e27Sflorian 1866d08cb1bSflorian /** see if an rrset is expired above the qname, return upper qname. */ 1876d08cb1bSflorian static int 1886d08cb1bSflorian rrset_expired_above(struct module_env* env, uint8_t** qname, size_t* qnamelen, 1896d08cb1bSflorian uint16_t searchtype, uint16_t qclass, time_t now, uint8_t* expiretop, 1906d08cb1bSflorian size_t expiretoplen) 1916d08cb1bSflorian { 1926d08cb1bSflorian struct ub_packed_rrset_key *rrset; 1936d08cb1bSflorian uint8_t lablen; 1946d08cb1bSflorian 1956d08cb1bSflorian while(*qnamelen > 0) { 1966d08cb1bSflorian /* look one label higher */ 1976d08cb1bSflorian lablen = **qname; 1986d08cb1bSflorian *qname += lablen + 1; 1996d08cb1bSflorian *qnamelen -= lablen + 1; 2006d08cb1bSflorian if(*qnamelen <= 0) 2016d08cb1bSflorian break; 2026d08cb1bSflorian 2036d08cb1bSflorian /* looks up with a time of 0, to see expired entries */ 2046d08cb1bSflorian if((rrset = rrset_cache_lookup(env->rrset_cache, *qname, 2056d08cb1bSflorian *qnamelen, searchtype, qclass, 0, 0, 0))) { 2066d08cb1bSflorian struct packed_rrset_data* data = 2076d08cb1bSflorian (struct packed_rrset_data*)rrset->entry.data; 2086d08cb1bSflorian if(now > data->ttl) { 2096d08cb1bSflorian /* it is expired, this is not wanted */ 2106d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock); 2116d08cb1bSflorian log_nametypeclass(VERB_ALGO, "this rrset is expired", *qname, searchtype, qclass); 2126d08cb1bSflorian return 1; 2136d08cb1bSflorian } 2146d08cb1bSflorian /* it is not expired, continue looking */ 2156d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock); 2166d08cb1bSflorian } 2176d08cb1bSflorian 2186d08cb1bSflorian /* do not look above the expiretop. */ 2196d08cb1bSflorian if(expiretop && *qnamelen == expiretoplen && 2206d08cb1bSflorian query_dname_compare(*qname, expiretop)==0) 2216d08cb1bSflorian break; 2226d08cb1bSflorian } 2236d08cb1bSflorian return 0; 2246d08cb1bSflorian } 2256d08cb1bSflorian 226ae8c6e27Sflorian /** find closest NS or DNAME and returns the rrset (locked) */ 227ae8c6e27Sflorian static struct ub_packed_rrset_key* 228ae8c6e27Sflorian find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, 2296d08cb1bSflorian uint16_t qclass, time_t now, uint16_t searchtype, int stripfront, 2306d08cb1bSflorian int noexpiredabove, uint8_t* expiretop, size_t expiretoplen) 231ae8c6e27Sflorian { 232ae8c6e27Sflorian struct ub_packed_rrset_key *rrset; 233ae8c6e27Sflorian uint8_t lablen; 234ae8c6e27Sflorian 235ae8c6e27Sflorian if(stripfront) { 236ae8c6e27Sflorian /* strip off so that DNAMEs have strict subdomain match */ 237ae8c6e27Sflorian lablen = *qname; 238ae8c6e27Sflorian qname += lablen + 1; 239ae8c6e27Sflorian qnamelen -= lablen + 1; 240ae8c6e27Sflorian } 241ae8c6e27Sflorian 242ae8c6e27Sflorian /* snip off front part of qname until the type is found */ 243ae8c6e27Sflorian while(qnamelen > 0) { 244ae8c6e27Sflorian if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 2456d08cb1bSflorian qnamelen, searchtype, qclass, 0, now, 0))) { 2466d08cb1bSflorian uint8_t* origqname = qname; 2476d08cb1bSflorian size_t origqnamelen = qnamelen; 2486d08cb1bSflorian if(!noexpiredabove) 249ae8c6e27Sflorian return rrset; 2506d08cb1bSflorian /* if expiretop set, do not look above it, but 2516d08cb1bSflorian * qname is equal, so the just found result is also 2526d08cb1bSflorian * the nonexpired above part. */ 2536d08cb1bSflorian if(expiretop && qnamelen == expiretoplen && 2546d08cb1bSflorian query_dname_compare(qname, expiretop)==0) 2556d08cb1bSflorian return rrset; 2566d08cb1bSflorian /* check for expiry, but we have to let go of the rrset 2576d08cb1bSflorian * for the lock ordering */ 2586d08cb1bSflorian lock_rw_unlock(&rrset->entry.lock); 2596d08cb1bSflorian /* the expired_above function always takes off one 2606d08cb1bSflorian * label (if qnamelen>0) and returns the final qname 2616d08cb1bSflorian * where it searched, so we can continue from there 2626d08cb1bSflorian * turning the O N*N search into O N. */ 2636d08cb1bSflorian if(!rrset_expired_above(env, &qname, &qnamelen, 2646d08cb1bSflorian searchtype, qclass, now, expiretop, 2656d08cb1bSflorian expiretoplen)) { 2666d08cb1bSflorian /* we want to return rrset, but it may be 2676d08cb1bSflorian * gone from cache, if so, just loop like 2686d08cb1bSflorian * it was not in the cache in the first place. 2696d08cb1bSflorian */ 2706d08cb1bSflorian if((rrset = rrset_cache_lookup(env-> 2716d08cb1bSflorian rrset_cache, origqname, origqnamelen, 2726d08cb1bSflorian searchtype, qclass, 0, now, 0))) { 2736d08cb1bSflorian return rrset; 2746d08cb1bSflorian } 2756d08cb1bSflorian } 2766d08cb1bSflorian log_nametypeclass(VERB_ALGO, "ignoring rrset because expired rrsets exist above it", origqname, searchtype, qclass); 2776d08cb1bSflorian continue; 2786d08cb1bSflorian } 279ae8c6e27Sflorian 280ae8c6e27Sflorian /* snip off front label */ 281ae8c6e27Sflorian lablen = *qname; 282ae8c6e27Sflorian qname += lablen + 1; 283ae8c6e27Sflorian qnamelen -= lablen + 1; 284ae8c6e27Sflorian } 285ae8c6e27Sflorian return NULL; 286ae8c6e27Sflorian } 287ae8c6e27Sflorian 288ae8c6e27Sflorian /** add addr to additional section */ 289ae8c6e27Sflorian static void 290ae8c6e27Sflorian addr_to_additional(struct ub_packed_rrset_key* rrset, struct regional* region, 291ae8c6e27Sflorian struct dns_msg* msg, time_t now) 292ae8c6e27Sflorian { 293ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 294ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 295ae8c6e27Sflorian msg->rep->ar_numrrsets++; 296ae8c6e27Sflorian msg->rep->rrset_count++; 297ae8c6e27Sflorian } 298ae8c6e27Sflorian } 299ae8c6e27Sflorian 300ae8c6e27Sflorian /** lookup message in message cache */ 301ae8c6e27Sflorian struct msgreply_entry* 302ae8c6e27Sflorian msg_cache_lookup(struct module_env* env, uint8_t* qname, size_t qnamelen, 303ae8c6e27Sflorian uint16_t qtype, uint16_t qclass, uint16_t flags, time_t now, int wr) 304ae8c6e27Sflorian { 305ae8c6e27Sflorian struct lruhash_entry* e; 306ae8c6e27Sflorian struct query_info k; 307ae8c6e27Sflorian hashvalue_type h; 308ae8c6e27Sflorian 309ae8c6e27Sflorian k.qname = qname; 310ae8c6e27Sflorian k.qname_len = qnamelen; 311ae8c6e27Sflorian k.qtype = qtype; 312ae8c6e27Sflorian k.qclass = qclass; 313ae8c6e27Sflorian k.local_alias = NULL; 314ae8c6e27Sflorian h = query_info_hash(&k, flags); 315ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, wr); 316ae8c6e27Sflorian 317ae8c6e27Sflorian if(!e) return NULL; 318ae8c6e27Sflorian if( now > ((struct reply_info*)e->data)->ttl ) { 319ae8c6e27Sflorian lock_rw_unlock(&e->lock); 320ae8c6e27Sflorian return NULL; 321ae8c6e27Sflorian } 322ae8c6e27Sflorian return (struct msgreply_entry*)e->key; 323ae8c6e27Sflorian } 324ae8c6e27Sflorian 325ae8c6e27Sflorian /** find and add A and AAAA records for nameservers in delegpt */ 326ae8c6e27Sflorian static int 327ae8c6e27Sflorian find_add_addrs(struct module_env* env, uint16_t qclass, 328ae8c6e27Sflorian struct regional* region, struct delegpt* dp, time_t now, 329ae8c6e27Sflorian struct dns_msg** msg) 330ae8c6e27Sflorian { 331ae8c6e27Sflorian struct delegpt_ns* ns; 332ae8c6e27Sflorian struct msgreply_entry* neg; 333ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 334ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 335ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 336ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 337ae8c6e27Sflorian if(akey) { 3385a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, 0, NULL)) { 339ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 340ae8c6e27Sflorian return 0; 341ae8c6e27Sflorian } 342ae8c6e27Sflorian if(msg) 343ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 344ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 345ae8c6e27Sflorian } else { 346ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 347ae8c6e27Sflorian * not use dns64 translation */ 348ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 349ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 350ae8c6e27Sflorian if(neg) { 351ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 352ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 353ae8c6e27Sflorian } 354ae8c6e27Sflorian } 355ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 356ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 357ae8c6e27Sflorian if(akey) { 3585a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, NULL)) { 359ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 360ae8c6e27Sflorian return 0; 361ae8c6e27Sflorian } 362ae8c6e27Sflorian if(msg) 363ae8c6e27Sflorian addr_to_additional(akey, region, *msg, now); 364ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 365ae8c6e27Sflorian } else { 366ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 367ae8c6e27Sflorian * not use dns64 translation */ 368ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 369ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 370ae8c6e27Sflorian if(neg) { 371ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 372ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 373ae8c6e27Sflorian } 374ae8c6e27Sflorian } 375ae8c6e27Sflorian } 376ae8c6e27Sflorian return 1; 377ae8c6e27Sflorian } 378ae8c6e27Sflorian 379ae8c6e27Sflorian /** find and add A and AAAA records for missing nameservers in delegpt */ 380ae8c6e27Sflorian int 381ae8c6e27Sflorian cache_fill_missing(struct module_env* env, uint16_t qclass, 382ae8c6e27Sflorian struct regional* region, struct delegpt* dp) 383ae8c6e27Sflorian { 384ae8c6e27Sflorian struct delegpt_ns* ns; 385ae8c6e27Sflorian struct msgreply_entry* neg; 386ae8c6e27Sflorian struct ub_packed_rrset_key* akey; 387ae8c6e27Sflorian time_t now = *env->now; 388ae8c6e27Sflorian for(ns = dp->nslist; ns; ns = ns->next) { 389ab256815Sflorian if(ns->cache_lookup_count > ITERATOR_NAME_CACHELOOKUP_MAX) 390ab256815Sflorian continue; 391ab256815Sflorian ns->cache_lookup_count++; 392ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 393ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0); 394ae8c6e27Sflorian if(akey) { 3955a7d75e6Ssthen if(!delegpt_add_rrset_A(dp, region, akey, ns->lame, 3965a7d75e6Ssthen NULL)) { 397ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 398ae8c6e27Sflorian return 0; 399ae8c6e27Sflorian } 400ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 401ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_A, qclass); 402ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 403ae8c6e27Sflorian } else { 404ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 405ae8c6e27Sflorian * not use dns64 translation */ 406ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 407ae8c6e27Sflorian LDNS_RR_TYPE_A, qclass, 0, now, 0); 408ae8c6e27Sflorian if(neg) { 409ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 410ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 411ae8c6e27Sflorian } 412ae8c6e27Sflorian } 413ae8c6e27Sflorian akey = rrset_cache_lookup(env->rrset_cache, ns->name, 414ae8c6e27Sflorian ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 415ae8c6e27Sflorian if(akey) { 4165a7d75e6Ssthen if(!delegpt_add_rrset_AAAA(dp, region, akey, ns->lame, 4175a7d75e6Ssthen NULL)) { 418ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 419ae8c6e27Sflorian return 0; 420ae8c6e27Sflorian } 421ae8c6e27Sflorian log_nametypeclass(VERB_ALGO, "found in cache", 422ae8c6e27Sflorian ns->name, LDNS_RR_TYPE_AAAA, qclass); 423ae8c6e27Sflorian lock_rw_unlock(&akey->entry.lock); 424ae8c6e27Sflorian } else { 425ae8c6e27Sflorian /* BIT_CD on false because delegpt lookup does 426ae8c6e27Sflorian * not use dns64 translation */ 427ae8c6e27Sflorian neg = msg_cache_lookup(env, ns->name, ns->namelen, 428ae8c6e27Sflorian LDNS_RR_TYPE_AAAA, qclass, 0, now, 0); 429ae8c6e27Sflorian if(neg) { 430ae8c6e27Sflorian delegpt_add_neg_msg(dp, neg); 431ae8c6e27Sflorian lock_rw_unlock(&neg->entry.lock); 432ae8c6e27Sflorian } 433ae8c6e27Sflorian } 434ae8c6e27Sflorian } 435ae8c6e27Sflorian return 1; 436ae8c6e27Sflorian } 437ae8c6e27Sflorian 438ae8c6e27Sflorian /** find and add DS or NSEC to delegation msg */ 439ae8c6e27Sflorian static void 440ae8c6e27Sflorian find_add_ds(struct module_env* env, struct regional* region, 441ae8c6e27Sflorian struct dns_msg* msg, struct delegpt* dp, time_t now) 442ae8c6e27Sflorian { 443ae8c6e27Sflorian /* Lookup the DS or NSEC at the delegation point. */ 444ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 445ae8c6e27Sflorian env->rrset_cache, dp->name, dp->namelen, LDNS_RR_TYPE_DS, 446ae8c6e27Sflorian msg->qinfo.qclass, 0, now, 0); 447ae8c6e27Sflorian if(!rrset) { 448ae8c6e27Sflorian /* NOTE: this won't work for alternate NSEC schemes 449ae8c6e27Sflorian * (opt-in, NSEC3) */ 450ae8c6e27Sflorian rrset = rrset_cache_lookup(env->rrset_cache, dp->name, 451ae8c6e27Sflorian dp->namelen, LDNS_RR_TYPE_NSEC, msg->qinfo.qclass, 452ae8c6e27Sflorian 0, now, 0); 453ae8c6e27Sflorian /* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used. 454ae8c6e27Sflorian * since this is a referral, we need the NSEC at the parent 455ae8c6e27Sflorian * side of the zone cut, not the NSEC at apex side. */ 456ae8c6e27Sflorian if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) { 457ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 458ae8c6e27Sflorian rrset = NULL; /* discard wrong NSEC */ 459ae8c6e27Sflorian } 460ae8c6e27Sflorian } 461ae8c6e27Sflorian if(rrset) { 462ae8c6e27Sflorian /* add it to auth section. This is the second rrset. */ 463ae8c6e27Sflorian if((msg->rep->rrsets[msg->rep->rrset_count] = 464ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) { 465ae8c6e27Sflorian msg->rep->ns_numrrsets++; 466ae8c6e27Sflorian msg->rep->rrset_count++; 467ae8c6e27Sflorian } 468ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 469ae8c6e27Sflorian } 470ae8c6e27Sflorian } 471ae8c6e27Sflorian 472ae8c6e27Sflorian struct dns_msg* 473ae8c6e27Sflorian dns_msg_create(uint8_t* qname, size_t qnamelen, uint16_t qtype, 474ae8c6e27Sflorian uint16_t qclass, struct regional* region, size_t capacity) 475ae8c6e27Sflorian { 476ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 477ae8c6e27Sflorian sizeof(struct dns_msg)); 478ae8c6e27Sflorian if(!msg) 479ae8c6e27Sflorian return NULL; 480ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, qname, qnamelen); 481ae8c6e27Sflorian if(!msg->qinfo.qname) 482ae8c6e27Sflorian return NULL; 483ae8c6e27Sflorian msg->qinfo.qname_len = qnamelen; 484ae8c6e27Sflorian msg->qinfo.qtype = qtype; 485ae8c6e27Sflorian msg->qinfo.qclass = qclass; 486ae8c6e27Sflorian msg->qinfo.local_alias = NULL; 487ae8c6e27Sflorian /* non-packed reply_info, because it needs to grow the array */ 488ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc_zero(region, 489ae8c6e27Sflorian sizeof(struct reply_info)-sizeof(struct rrset_ref)); 490ae8c6e27Sflorian if(!msg->rep) 491ae8c6e27Sflorian return NULL; 492ae8c6e27Sflorian if(capacity > RR_COUNT_MAX) 493ae8c6e27Sflorian return NULL; /* integer overflow protection */ 494ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* with QR, no AA */ 495ae8c6e27Sflorian msg->rep->qdcount = 1; 4967a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE; 497ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 498ae8c6e27Sflorian regional_alloc(region, 499ae8c6e27Sflorian capacity*sizeof(struct ub_packed_rrset_key*)); 500ae8c6e27Sflorian if(!msg->rep->rrsets) 501ae8c6e27Sflorian return NULL; 502ae8c6e27Sflorian return msg; 503ae8c6e27Sflorian } 504ae8c6e27Sflorian 505ae8c6e27Sflorian int 506ae8c6e27Sflorian dns_msg_authadd(struct dns_msg* msg, struct regional* region, 507ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 508ae8c6e27Sflorian { 509ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 510ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 511ae8c6e27Sflorian return 0; 512ae8c6e27Sflorian msg->rep->ns_numrrsets++; 513ae8c6e27Sflorian return 1; 514ae8c6e27Sflorian } 515ae8c6e27Sflorian 516ae8c6e27Sflorian int 517ae8c6e27Sflorian dns_msg_ansadd(struct dns_msg* msg, struct regional* region, 518ae8c6e27Sflorian struct ub_packed_rrset_key* rrset, time_t now) 519ae8c6e27Sflorian { 520ae8c6e27Sflorian if(!(msg->rep->rrsets[msg->rep->rrset_count++] = 521ae8c6e27Sflorian packed_rrset_copy_region(rrset, region, now))) 522ae8c6e27Sflorian return 0; 523ae8c6e27Sflorian msg->rep->an_numrrsets++; 524ae8c6e27Sflorian return 1; 525ae8c6e27Sflorian } 526ae8c6e27Sflorian 527ae8c6e27Sflorian struct delegpt* 528ae8c6e27Sflorian dns_cache_find_delegation(struct module_env* env, uint8_t* qname, 529ae8c6e27Sflorian size_t qnamelen, uint16_t qtype, uint16_t qclass, 5306d08cb1bSflorian struct regional* region, struct dns_msg** msg, time_t now, 5316d08cb1bSflorian int noexpiredabove, uint8_t* expiretop, size_t expiretoplen) 532ae8c6e27Sflorian { 533ae8c6e27Sflorian /* try to find closest NS rrset */ 534ae8c6e27Sflorian struct ub_packed_rrset_key* nskey; 535ae8c6e27Sflorian struct packed_rrset_data* nsdata; 536ae8c6e27Sflorian struct delegpt* dp; 537ae8c6e27Sflorian 538ae8c6e27Sflorian nskey = find_closest_of_type(env, qname, qnamelen, qclass, now, 5396d08cb1bSflorian LDNS_RR_TYPE_NS, 0, noexpiredabove, expiretop, expiretoplen); 540ae8c6e27Sflorian if(!nskey) /* hope the caller has hints to prime or something */ 541ae8c6e27Sflorian return NULL; 542ae8c6e27Sflorian nsdata = (struct packed_rrset_data*)nskey->entry.data; 543ae8c6e27Sflorian /* got the NS key, create delegation point */ 544ae8c6e27Sflorian dp = delegpt_create(region); 545ae8c6e27Sflorian if(!dp || !delegpt_set_name(dp, region, nskey->rk.dname)) { 546ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 547ae8c6e27Sflorian log_err("find_delegation: out of memory"); 548ae8c6e27Sflorian return NULL; 549ae8c6e27Sflorian } 550ae8c6e27Sflorian /* create referral message */ 551ae8c6e27Sflorian if(msg) { 552ae8c6e27Sflorian /* allocate the array to as much as we could need: 553ae8c6e27Sflorian * NS rrset + DS/NSEC rrset + 554ae8c6e27Sflorian * A rrset for every NS RR 555ae8c6e27Sflorian * AAAA rrset for every NS RR 556ae8c6e27Sflorian */ 557ae8c6e27Sflorian *msg = dns_msg_create(qname, qnamelen, qtype, qclass, region, 558ae8c6e27Sflorian 2 + nsdata->count*2); 559ae8c6e27Sflorian if(!*msg || !dns_msg_authadd(*msg, region, nskey, now)) { 560ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); 561ae8c6e27Sflorian log_err("find_delegation: out of memory"); 562ae8c6e27Sflorian return NULL; 563ae8c6e27Sflorian } 564ae8c6e27Sflorian } 565ae8c6e27Sflorian if(!delegpt_rrset_add_ns(dp, region, nskey, 0)) 566ae8c6e27Sflorian log_err("find_delegation: addns out of memory"); 567ae8c6e27Sflorian lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/ 568ae8c6e27Sflorian /* find and add DS/NSEC (if any) */ 569ae8c6e27Sflorian if(msg) 570ae8c6e27Sflorian find_add_ds(env, region, *msg, dp, now); 571ae8c6e27Sflorian /* find and add A entries */ 572ae8c6e27Sflorian if(!find_add_addrs(env, qclass, region, dp, now, msg)) 573ae8c6e27Sflorian log_err("find_delegation: addrs out of memory"); 574ae8c6e27Sflorian return dp; 575ae8c6e27Sflorian } 576ae8c6e27Sflorian 577ae8c6e27Sflorian /** allocate dns_msg from query_info and reply_info */ 578ae8c6e27Sflorian static struct dns_msg* 579ae8c6e27Sflorian gen_dns_msg(struct regional* region, struct query_info* q, size_t num) 580ae8c6e27Sflorian { 581ae8c6e27Sflorian struct dns_msg* msg = (struct dns_msg*)regional_alloc(region, 582ae8c6e27Sflorian sizeof(struct dns_msg)); 583ae8c6e27Sflorian if(!msg) 584ae8c6e27Sflorian return NULL; 585ae8c6e27Sflorian memcpy(&msg->qinfo, q, sizeof(struct query_info)); 586ae8c6e27Sflorian msg->qinfo.qname = regional_alloc_init(region, q->qname, q->qname_len); 587ae8c6e27Sflorian if(!msg->qinfo.qname) 588ae8c6e27Sflorian return NULL; 589ae8c6e27Sflorian /* allocate replyinfo struct and rrset key array separately */ 590ae8c6e27Sflorian msg->rep = (struct reply_info*)regional_alloc(region, 591ae8c6e27Sflorian sizeof(struct reply_info) - sizeof(struct rrset_ref)); 592ae8c6e27Sflorian if(!msg->rep) 593ae8c6e27Sflorian return NULL; 5947a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE; 595*d500c338Sflorian msg->rep->reason_bogus_str = NULL; 596ae8c6e27Sflorian if(num > RR_COUNT_MAX) 597ae8c6e27Sflorian return NULL; /* integer overflow protection */ 598ae8c6e27Sflorian msg->rep->rrsets = (struct ub_packed_rrset_key**) 599ae8c6e27Sflorian regional_alloc(region, 600ae8c6e27Sflorian num * sizeof(struct ub_packed_rrset_key*)); 601ae8c6e27Sflorian if(!msg->rep->rrsets) 602ae8c6e27Sflorian return NULL; 603ae8c6e27Sflorian return msg; 604ae8c6e27Sflorian } 605ae8c6e27Sflorian 606ae8c6e27Sflorian struct dns_msg* 607ae8c6e27Sflorian tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, 608d32eb43cSflorian struct regional* region, time_t now, int allow_expired, 609d32eb43cSflorian struct regional* scratch) 610ae8c6e27Sflorian { 611ae8c6e27Sflorian struct dns_msg* msg; 612ae8c6e27Sflorian size_t i; 613d32eb43cSflorian int is_expired = 0; 614d32eb43cSflorian time_t now_control = now; 615d32eb43cSflorian if(now > r->ttl) { 616d32eb43cSflorian /* Check if we are allowed to serve expired */ 617d32eb43cSflorian if(allow_expired) { 618d32eb43cSflorian if(env->cfg->serve_expired_ttl && 619d32eb43cSflorian r->serve_expired_ttl < now) { 620ae8c6e27Sflorian return NULL; 621d32eb43cSflorian } 622*d500c338Sflorian /* Ignore expired failure answers */ 623*d500c338Sflorian if(FLAGS_GET_RCODE(r->flags) != 624*d500c338Sflorian LDNS_RCODE_NOERROR && 625*d500c338Sflorian FLAGS_GET_RCODE(r->flags) != 626*d500c338Sflorian LDNS_RCODE_NXDOMAIN && 627*d500c338Sflorian FLAGS_GET_RCODE(r->flags) != 628*d500c338Sflorian LDNS_RCODE_YXDOMAIN) 629*d500c338Sflorian return 0; 630d32eb43cSflorian } else { 631d32eb43cSflorian return NULL; 632d32eb43cSflorian } 633d32eb43cSflorian /* Change the current time so we can pass the below TTL checks when 634d32eb43cSflorian * serving expired data. */ 635d32eb43cSflorian now_control = r->ttl - env->cfg->serve_expired_reply_ttl; 636d32eb43cSflorian is_expired = 1; 637d32eb43cSflorian } 638d32eb43cSflorian 639ae8c6e27Sflorian msg = gen_dns_msg(region, q, r->rrset_count); 640d32eb43cSflorian if(!msg) return NULL; 641ae8c6e27Sflorian msg->rep->flags = r->flags; 642ae8c6e27Sflorian msg->rep->qdcount = r->qdcount; 643d32eb43cSflorian msg->rep->ttl = is_expired 644d32eb43cSflorian ?SERVE_EXPIRED_REPLY_TTL 645d32eb43cSflorian :r->ttl - now; 646ae8c6e27Sflorian if(r->prefetch_ttl > now) 647ae8c6e27Sflorian msg->rep->prefetch_ttl = r->prefetch_ttl - now; 648d32eb43cSflorian else 649d32eb43cSflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 650ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 651ae8c6e27Sflorian msg->rep->security = r->security; 652ae8c6e27Sflorian msg->rep->an_numrrsets = r->an_numrrsets; 653ae8c6e27Sflorian msg->rep->ns_numrrsets = r->ns_numrrsets; 654ae8c6e27Sflorian msg->rep->ar_numrrsets = r->ar_numrrsets; 655ae8c6e27Sflorian msg->rep->rrset_count = r->rrset_count; 656ae8c6e27Sflorian msg->rep->authoritative = r->authoritative; 6577a05b9dfSflorian msg->rep->reason_bogus = r->reason_bogus; 658*d500c338Sflorian if(r->reason_bogus_str) { 659*d500c338Sflorian msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str); 660*d500c338Sflorian } 661*d500c338Sflorian 662d32eb43cSflorian if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { 663ae8c6e27Sflorian return NULL; 664d32eb43cSflorian } 665ae8c6e27Sflorian if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons( 666ae8c6e27Sflorian LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons( 667ae8c6e27Sflorian LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(q, r)) { 668ae8c6e27Sflorian /* cname chain is now invalid, reconstruct msg */ 669ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 670ae8c6e27Sflorian return NULL; 671ae8c6e27Sflorian } 672ae8c6e27Sflorian if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) { 673ae8c6e27Sflorian /* message rrsets have changed status, revalidate */ 674ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 675ae8c6e27Sflorian return NULL; 676ae8c6e27Sflorian } 677ae8c6e27Sflorian for(i=0; i<msg->rep->rrset_count; i++) { 678ae8c6e27Sflorian msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 679ae8c6e27Sflorian region, now); 680ae8c6e27Sflorian if(!msg->rep->rrsets[i]) { 681ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 682ae8c6e27Sflorian return NULL; 683ae8c6e27Sflorian } 684ae8c6e27Sflorian } 685ae8c6e27Sflorian if(env) 686ae8c6e27Sflorian rrset_array_unlock_touch(env->rrset_cache, scratch, r->ref, 687ae8c6e27Sflorian r->rrset_count); 688ae8c6e27Sflorian else 689ae8c6e27Sflorian rrset_array_unlock(r->ref, r->rrset_count); 690ae8c6e27Sflorian return msg; 691ae8c6e27Sflorian } 692ae8c6e27Sflorian 693ae8c6e27Sflorian /** synthesize RRset-only response from cached RRset item */ 694ae8c6e27Sflorian static struct dns_msg* 695ae8c6e27Sflorian rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 696ae8c6e27Sflorian time_t now, struct query_info* q) 697ae8c6e27Sflorian { 698ae8c6e27Sflorian struct dns_msg* msg; 699ae8c6e27Sflorian struct packed_rrset_data* d = (struct packed_rrset_data*) 700ae8c6e27Sflorian rrset->entry.data; 701ae8c6e27Sflorian if(now > d->ttl) 702ae8c6e27Sflorian return NULL; 703ae8c6e27Sflorian msg = gen_dns_msg(region, q, 1); /* only the CNAME (or other) RRset */ 704ae8c6e27Sflorian if(!msg) 705ae8c6e27Sflorian return NULL; 706ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 707ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 708ae8c6e27Sflorian msg->rep->qdcount = 1; 709ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 710ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 711ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 712ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 713ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 714ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 715ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 716ae8c6e27Sflorian msg->rep->rrset_count = 1; 7177a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE; 718ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 719ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy CNAME */ 720ae8c6e27Sflorian return NULL; 721ae8c6e27Sflorian return msg; 722ae8c6e27Sflorian } 723ae8c6e27Sflorian 724ae8c6e27Sflorian /** synthesize DNAME+CNAME response from cached DNAME item */ 725ae8c6e27Sflorian static struct dns_msg* 726ae8c6e27Sflorian synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 727ae8c6e27Sflorian time_t now, struct query_info* q, enum sec_status* sec_status) 728ae8c6e27Sflorian { 729ae8c6e27Sflorian struct dns_msg* msg; 730ae8c6e27Sflorian struct ub_packed_rrset_key* ck; 731ae8c6e27Sflorian struct packed_rrset_data* newd, *d = (struct packed_rrset_data*) 732ae8c6e27Sflorian rrset->entry.data; 733ae8c6e27Sflorian uint8_t* newname, *dtarg = NULL; 734ae8c6e27Sflorian size_t newlen, dtarglen; 735ae8c6e27Sflorian if(now > d->ttl) 736ae8c6e27Sflorian return NULL; 737ae8c6e27Sflorian /* only allow validated (with DNSSEC) DNAMEs used from cache 738ae8c6e27Sflorian * for insecure DNAMEs, query again. */ 739ae8c6e27Sflorian *sec_status = d->security; 740ae8c6e27Sflorian /* return sec status, so the status of the CNAME can be checked 741ae8c6e27Sflorian * by the calling routine. */ 742ae8c6e27Sflorian msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */ 743ae8c6e27Sflorian if(!msg) 744ae8c6e27Sflorian return NULL; 745ae8c6e27Sflorian msg->rep->flags = BIT_QR; /* reply, no AA, no error */ 746ae8c6e27Sflorian msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */ 747ae8c6e27Sflorian msg->rep->qdcount = 1; 748ae8c6e27Sflorian msg->rep->ttl = d->ttl - now; 749ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl); 750ae8c6e27Sflorian msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL; 751ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 752ae8c6e27Sflorian msg->rep->an_numrrsets = 1; 753ae8c6e27Sflorian msg->rep->ns_numrrsets = 0; 754ae8c6e27Sflorian msg->rep->ar_numrrsets = 0; 755ae8c6e27Sflorian msg->rep->rrset_count = 1; 7567a05b9dfSflorian msg->rep->reason_bogus = LDNS_EDE_NONE; 757ae8c6e27Sflorian msg->rep->rrsets[0] = packed_rrset_copy_region(rrset, region, now); 758ae8c6e27Sflorian if(!msg->rep->rrsets[0]) /* copy DNAME */ 759ae8c6e27Sflorian return NULL; 760ae8c6e27Sflorian /* synth CNAME rrset */ 761ae8c6e27Sflorian get_cname_target(rrset, &dtarg, &dtarglen); 762ae8c6e27Sflorian if(!dtarg) 763ae8c6e27Sflorian return NULL; 764ae8c6e27Sflorian newlen = q->qname_len + dtarglen - rrset->rk.dname_len; 765ae8c6e27Sflorian if(newlen > LDNS_MAX_DOMAINLEN) { 766ae8c6e27Sflorian msg->rep->flags |= LDNS_RCODE_YXDOMAIN; 767ae8c6e27Sflorian return msg; 768ae8c6e27Sflorian } 769ae8c6e27Sflorian newname = (uint8_t*)regional_alloc(region, newlen); 770ae8c6e27Sflorian if(!newname) 771ae8c6e27Sflorian return NULL; 772ae8c6e27Sflorian /* new name is concatenation of qname front (without DNAME owner) 773ae8c6e27Sflorian * and DNAME target name */ 774ae8c6e27Sflorian memcpy(newname, q->qname, q->qname_len-rrset->rk.dname_len); 775ae8c6e27Sflorian memmove(newname+(q->qname_len-rrset->rk.dname_len), dtarg, dtarglen); 776ae8c6e27Sflorian /* create rest of CNAME rrset */ 777ae8c6e27Sflorian ck = (struct ub_packed_rrset_key*)regional_alloc(region, 778ae8c6e27Sflorian sizeof(struct ub_packed_rrset_key)); 779ae8c6e27Sflorian if(!ck) 780ae8c6e27Sflorian return NULL; 781ae8c6e27Sflorian memset(&ck->entry, 0, sizeof(ck->entry)); 782ae8c6e27Sflorian msg->rep->rrsets[1] = ck; 783ae8c6e27Sflorian ck->entry.key = ck; 784ae8c6e27Sflorian ck->rk.type = htons(LDNS_RR_TYPE_CNAME); 785ae8c6e27Sflorian ck->rk.rrset_class = rrset->rk.rrset_class; 786ae8c6e27Sflorian ck->rk.flags = 0; 787ae8c6e27Sflorian ck->rk.dname = regional_alloc_init(region, q->qname, q->qname_len); 788ae8c6e27Sflorian if(!ck->rk.dname) 789ae8c6e27Sflorian return NULL; 790ae8c6e27Sflorian ck->rk.dname_len = q->qname_len; 791ae8c6e27Sflorian ck->entry.hash = rrset_key_hash(&ck->rk); 792ae8c6e27Sflorian newd = (struct packed_rrset_data*)regional_alloc_zero(region, 793ae8c6e27Sflorian sizeof(struct packed_rrset_data) + sizeof(size_t) + 794ae8c6e27Sflorian sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t) 795ae8c6e27Sflorian + newlen); 796ae8c6e27Sflorian if(!newd) 797ae8c6e27Sflorian return NULL; 798ae8c6e27Sflorian ck->entry.data = newd; 799ae8c6e27Sflorian newd->ttl = 0; /* 0 for synthesized CNAME TTL */ 800ae8c6e27Sflorian newd->count = 1; 801ae8c6e27Sflorian newd->rrsig_count = 0; 802ae8c6e27Sflorian newd->trust = rrset_trust_ans_noAA; 803ae8c6e27Sflorian newd->rr_len = (size_t*)((uint8_t*)newd + 804ae8c6e27Sflorian sizeof(struct packed_rrset_data)); 805ae8c6e27Sflorian newd->rr_len[0] = newlen + sizeof(uint16_t); 806ae8c6e27Sflorian packed_rrset_ptr_fixup(newd); 807ae8c6e27Sflorian newd->rr_ttl[0] = newd->ttl; 808ae8c6e27Sflorian msg->rep->ttl = newd->ttl; 809ae8c6e27Sflorian msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl); 810ae8c6e27Sflorian msg->rep->serve_expired_ttl = newd->ttl + SERVE_EXPIRED_TTL; 811ae8c6e27Sflorian sldns_write_uint16(newd->rr_data[0], newlen); 812ae8c6e27Sflorian memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen); 813ae8c6e27Sflorian msg->rep->an_numrrsets ++; 814ae8c6e27Sflorian msg->rep->rrset_count ++; 815ae8c6e27Sflorian return msg; 816ae8c6e27Sflorian } 817ae8c6e27Sflorian 818ae8c6e27Sflorian /** Fill TYPE_ANY response with some data from cache */ 819ae8c6e27Sflorian static struct dns_msg* 820ae8c6e27Sflorian fill_any(struct module_env* env, 821ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 822ae8c6e27Sflorian struct regional* region) 823ae8c6e27Sflorian { 824ae8c6e27Sflorian time_t now = *env->now; 825ae8c6e27Sflorian struct dns_msg* msg = NULL; 826ae8c6e27Sflorian uint16_t lookup[] = {LDNS_RR_TYPE_A, LDNS_RR_TYPE_AAAA, 827ae8c6e27Sflorian LDNS_RR_TYPE_MX, LDNS_RR_TYPE_SOA, LDNS_RR_TYPE_NS, 828ae8c6e27Sflorian LDNS_RR_TYPE_DNAME, 0}; 829ae8c6e27Sflorian int i, num=6; /* number of RR types to look up */ 830ae8c6e27Sflorian log_assert(lookup[num] == 0); 831ae8c6e27Sflorian 832ae8c6e27Sflorian if(env->cfg->deny_any) { 833ae8c6e27Sflorian /* return empty message */ 834ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 835ae8c6e27Sflorian region, 0); 836ae8c6e27Sflorian if(!msg) { 837ae8c6e27Sflorian return NULL; 838ae8c6e27Sflorian } 8399b465e50Sflorian /* set NOTIMPL for RFC 8482 */ 8409b465e50Sflorian msg->rep->flags |= LDNS_RCODE_NOTIMPL; 841ae8c6e27Sflorian msg->rep->security = sec_status_indeterminate; 842ae8c6e27Sflorian return msg; 843ae8c6e27Sflorian } 844ae8c6e27Sflorian 845ae8c6e27Sflorian for(i=0; i<num; i++) { 846ae8c6e27Sflorian /* look up this RR for inclusion in type ANY response */ 847ae8c6e27Sflorian struct ub_packed_rrset_key* rrset = rrset_cache_lookup( 848ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, lookup[i], 849ae8c6e27Sflorian qclass, 0, now, 0); 850ae8c6e27Sflorian struct packed_rrset_data *d; 851ae8c6e27Sflorian if(!rrset) 852ae8c6e27Sflorian continue; 853ae8c6e27Sflorian 854ae8c6e27Sflorian /* only if rrset from answer section */ 855ae8c6e27Sflorian d = (struct packed_rrset_data*)rrset->entry.data; 856ae8c6e27Sflorian if(d->trust == rrset_trust_add_noAA || 857ae8c6e27Sflorian d->trust == rrset_trust_auth_noAA || 858ae8c6e27Sflorian d->trust == rrset_trust_add_AA || 859ae8c6e27Sflorian d->trust == rrset_trust_auth_AA) { 860ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 861ae8c6e27Sflorian continue; 862ae8c6e27Sflorian } 863ae8c6e27Sflorian 864ae8c6e27Sflorian /* create msg if none */ 865ae8c6e27Sflorian if(!msg) { 866ae8c6e27Sflorian msg = dns_msg_create(qname, qnamelen, qtype, qclass, 867ae8c6e27Sflorian region, (size_t)(num-i)); 868ae8c6e27Sflorian if(!msg) { 869ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 870ae8c6e27Sflorian return NULL; 871ae8c6e27Sflorian } 872ae8c6e27Sflorian } 873ae8c6e27Sflorian 874ae8c6e27Sflorian /* add RRset to response */ 875ae8c6e27Sflorian if(!dns_msg_ansadd(msg, region, rrset, now)) { 876ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 877ae8c6e27Sflorian return NULL; 878ae8c6e27Sflorian } 879ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 880ae8c6e27Sflorian } 881ae8c6e27Sflorian return msg; 882ae8c6e27Sflorian } 883ae8c6e27Sflorian 884ae8c6e27Sflorian struct dns_msg* 885ae8c6e27Sflorian dns_cache_lookup(struct module_env* env, 886ae8c6e27Sflorian uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 887ae8c6e27Sflorian uint16_t flags, struct regional* region, struct regional* scratch, 888411c5950Sflorian int no_partial, uint8_t* dpname, size_t dpnamelen) 889ae8c6e27Sflorian { 890ae8c6e27Sflorian struct lruhash_entry* e; 891ae8c6e27Sflorian struct query_info k; 892ae8c6e27Sflorian hashvalue_type h; 893ae8c6e27Sflorian time_t now = *env->now; 894ae8c6e27Sflorian struct ub_packed_rrset_key* rrset; 895ae8c6e27Sflorian 896ae8c6e27Sflorian /* lookup first, this has both NXdomains and ANSWER responses */ 897ae8c6e27Sflorian k.qname = qname; 898ae8c6e27Sflorian k.qname_len = qnamelen; 899ae8c6e27Sflorian k.qtype = qtype; 900ae8c6e27Sflorian k.qclass = qclass; 901ae8c6e27Sflorian k.local_alias = NULL; 902ae8c6e27Sflorian h = query_info_hash(&k, flags); 903ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 904ae8c6e27Sflorian if(e) { 905ae8c6e27Sflorian struct msgreply_entry* key = (struct msgreply_entry*)e->key; 906ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 907d32eb43cSflorian struct dns_msg* msg = tomsg(env, &key->key, data, region, now, 0, 908ae8c6e27Sflorian scratch); 909ae8c6e27Sflorian if(msg) { 910ae8c6e27Sflorian lock_rw_unlock(&e->lock); 911ae8c6e27Sflorian return msg; 912ae8c6e27Sflorian } 913ae8c6e27Sflorian /* could be msg==NULL; due to TTL or not all rrsets available */ 914ae8c6e27Sflorian lock_rw_unlock(&e->lock); 915ae8c6e27Sflorian } 916ae8c6e27Sflorian 917ae8c6e27Sflorian /* see if a DNAME exists. Checked for first, to enforce that DNAMEs 918ae8c6e27Sflorian * are more important, the CNAME is resynthesized and thus 919ae8c6e27Sflorian * consistent with the DNAME */ 920ae8c6e27Sflorian if(!no_partial && 921ae8c6e27Sflorian (rrset=find_closest_of_type(env, qname, qnamelen, qclass, now, 9226d08cb1bSflorian LDNS_RR_TYPE_DNAME, 1, 0, NULL, 0))) { 923ae8c6e27Sflorian /* synthesize a DNAME+CNAME message based on this */ 924ae8c6e27Sflorian enum sec_status sec_status = sec_status_unchecked; 925ae8c6e27Sflorian struct dns_msg* msg = synth_dname_msg(rrset, region, now, &k, 926ae8c6e27Sflorian &sec_status); 927ae8c6e27Sflorian if(msg) { 928ae8c6e27Sflorian struct ub_packed_rrset_key* cname_rrset; 929ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 930ae8c6e27Sflorian /* now, after unlocking the DNAME rrset lock, 931ae8c6e27Sflorian * check the sec_status, and see if we need to look 932ae8c6e27Sflorian * up the CNAME record associated before it can 933ae8c6e27Sflorian * be used */ 934ae8c6e27Sflorian /* normally, only secure DNAMEs allowed from cache*/ 935ae8c6e27Sflorian if(sec_status == sec_status_secure) 936ae8c6e27Sflorian return msg; 937ae8c6e27Sflorian /* but if we have a CNAME cached with this name, then we 938ae8c6e27Sflorian * have previously already allowed this name to pass. 939ae8c6e27Sflorian * the next cache lookup is going to fetch that CNAME itself, 940ae8c6e27Sflorian * but it is better to have the (unsigned)DNAME + CNAME in 941ae8c6e27Sflorian * that case */ 942ae8c6e27Sflorian cname_rrset = rrset_cache_lookup( 943ae8c6e27Sflorian env->rrset_cache, qname, qnamelen, 944ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0); 945ae8c6e27Sflorian if(cname_rrset) { 946ae8c6e27Sflorian /* CNAME already synthesized by 947ae8c6e27Sflorian * synth_dname_msg routine, so we can 948ae8c6e27Sflorian * straight up return the msg */ 949ae8c6e27Sflorian lock_rw_unlock(&cname_rrset->entry.lock); 950ae8c6e27Sflorian return msg; 951ae8c6e27Sflorian } 952ae8c6e27Sflorian } else { 953ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 954ae8c6e27Sflorian } 955ae8c6e27Sflorian } 956ae8c6e27Sflorian 957ae8c6e27Sflorian /* see if we have CNAME for this domain, 958ae8c6e27Sflorian * but not for DS records (which are part of the parent) */ 959ae8c6e27Sflorian if(!no_partial && qtype != LDNS_RR_TYPE_DS && 960ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 961ae8c6e27Sflorian LDNS_RR_TYPE_CNAME, qclass, 0, now, 0))) { 962ae8c6e27Sflorian uint8_t* wc = NULL; 963ae8c6e27Sflorian size_t wl; 964ae8c6e27Sflorian /* if the rrset is not a wildcard expansion, with wcname */ 965ae8c6e27Sflorian /* because, if we return that CNAME rrset on its own, it is 966ae8c6e27Sflorian * missing the NSEC or NSEC3 proof */ 967ae8c6e27Sflorian if(!(val_rrset_wildcard(rrset, &wc, &wl) && wc != NULL)) { 968ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 969ae8c6e27Sflorian if(msg) { 970ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 971ae8c6e27Sflorian return msg; 972ae8c6e27Sflorian } 973ae8c6e27Sflorian } 974ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 975ae8c6e27Sflorian } 976ae8c6e27Sflorian 977f4f0f0ceSflorian /* construct DS, DNSKEY messages from rrset cache. */ 978f4f0f0ceSflorian if((qtype == LDNS_RR_TYPE_DS || qtype == LDNS_RR_TYPE_DNSKEY) && 979ae8c6e27Sflorian (rrset=rrset_cache_lookup(env->rrset_cache, qname, qnamelen, 980ae8c6e27Sflorian qtype, qclass, 0, now, 0))) { 981ae8c6e27Sflorian /* if the rrset is from the additional section, and the 982ae8c6e27Sflorian * signatures have fallen off, then do not synthesize a msg 983ae8c6e27Sflorian * instead, allow a full query for signed results to happen. 984ae8c6e27Sflorian * Forego all rrset data from additional section, because 985ae8c6e27Sflorian * some signatures may not be present and cause validation 986ae8c6e27Sflorian * failure. 987ae8c6e27Sflorian */ 988ae8c6e27Sflorian struct packed_rrset_data *d = (struct packed_rrset_data*) 989ae8c6e27Sflorian rrset->entry.data; 990ae8c6e27Sflorian if(d->trust != rrset_trust_add_noAA && 991ae8c6e27Sflorian d->trust != rrset_trust_add_AA && 992ae8c6e27Sflorian (qtype == LDNS_RR_TYPE_DS || 993ae8c6e27Sflorian (d->trust != rrset_trust_auth_noAA 994ae8c6e27Sflorian && d->trust != rrset_trust_auth_AA) )) { 995ae8c6e27Sflorian struct dns_msg* msg = rrset_msg(rrset, region, now, &k); 996ae8c6e27Sflorian if(msg) { 997ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 998ae8c6e27Sflorian return msg; 999ae8c6e27Sflorian } 1000ae8c6e27Sflorian } 1001ae8c6e27Sflorian lock_rw_unlock(&rrset->entry.lock); 1002ae8c6e27Sflorian } 1003ae8c6e27Sflorian 1004ae8c6e27Sflorian /* stop downwards cache search on NXDOMAIN. 1005ae8c6e27Sflorian * Empty nonterminals are NOERROR, so an NXDOMAIN for foo 1006ae8c6e27Sflorian * means bla.foo also does not exist. The DNSSEC proofs are 1007ae8c6e27Sflorian * the same. We search upwards for NXDOMAINs. */ 1008d32eb43cSflorian if(env->cfg->harden_below_nxdomain) { 1009ae8c6e27Sflorian while(!dname_is_root(k.qname)) { 1010411c5950Sflorian if(dpname && dpnamelen 1011411c5950Sflorian && !dname_subdomain_c(k.qname, dpname)) 1012411c5950Sflorian break; /* no synth nxdomain above the stub */ 1013ae8c6e27Sflorian dname_remove_label(&k.qname, &k.qname_len); 1014ae8c6e27Sflorian h = query_info_hash(&k, flags); 1015ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 1016ae8c6e27Sflorian if(!e && k.qtype != LDNS_RR_TYPE_A && 1017ae8c6e27Sflorian env->cfg->qname_minimisation) { 1018ae8c6e27Sflorian k.qtype = LDNS_RR_TYPE_A; 1019ae8c6e27Sflorian h = query_info_hash(&k, flags); 1020ae8c6e27Sflorian e = slabhash_lookup(env->msg_cache, h, &k, 0); 1021ae8c6e27Sflorian } 1022ae8c6e27Sflorian if(e) { 1023ae8c6e27Sflorian struct reply_info* data = (struct reply_info*)e->data; 1024ae8c6e27Sflorian struct dns_msg* msg; 1025ae8c6e27Sflorian if(FLAGS_GET_RCODE(data->flags) == LDNS_RCODE_NXDOMAIN 1026ae8c6e27Sflorian && data->security == sec_status_secure 10279b465e50Sflorian && (data->an_numrrsets == 0 || 10289b465e50Sflorian ntohs(data->rrsets[0]->rk.type) != LDNS_RR_TYPE_CNAME) 1029d32eb43cSflorian && (msg=tomsg(env, &k, data, region, now, 0, scratch))) { 1030ae8c6e27Sflorian lock_rw_unlock(&e->lock); 1031ae8c6e27Sflorian msg->qinfo.qname=qname; 1032ae8c6e27Sflorian msg->qinfo.qname_len=qnamelen; 1033ae8c6e27Sflorian /* check that DNSSEC really works out */ 1034ae8c6e27Sflorian msg->rep->security = sec_status_unchecked; 10359b465e50Sflorian iter_scrub_nxdomain(msg); 1036ae8c6e27Sflorian return msg; 1037ae8c6e27Sflorian } 1038ae8c6e27Sflorian lock_rw_unlock(&e->lock); 1039ae8c6e27Sflorian } 1040ae8c6e27Sflorian k.qtype = qtype; 1041ae8c6e27Sflorian } 1042d32eb43cSflorian } 1043ae8c6e27Sflorian 1044ae8c6e27Sflorian /* fill common RR types for ANY response to avoid requery */ 1045ae8c6e27Sflorian if(qtype == LDNS_RR_TYPE_ANY) { 1046ae8c6e27Sflorian return fill_any(env, qname, qnamelen, qtype, qclass, region); 1047ae8c6e27Sflorian } 1048ae8c6e27Sflorian 1049ae8c6e27Sflorian return NULL; 1050ae8c6e27Sflorian } 1051ae8c6e27Sflorian 1052ae8c6e27Sflorian int 1053ae8c6e27Sflorian dns_cache_store(struct module_env* env, struct query_info* msgqinf, 1054ae8c6e27Sflorian struct reply_info* msgrep, int is_referral, time_t leeway, int pside, 10556d08cb1bSflorian struct regional* region, uint32_t flags, time_t qstarttime) 1056ae8c6e27Sflorian { 1057ae8c6e27Sflorian struct reply_info* rep = NULL; 1058ae8c6e27Sflorian /* alloc, malloc properly (not in region, like msg is) */ 1059ae8c6e27Sflorian rep = reply_info_copy(msgrep, env->alloc, NULL); 1060ae8c6e27Sflorian if(!rep) 1061ae8c6e27Sflorian return 0; 1062ae8c6e27Sflorian /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. 1063ae8c6e27Sflorian * the env->now is added to message and RRsets in this routine. */ 1064ae8c6e27Sflorian /* the leeway is used to invalidate other rrsets earlier */ 1065ae8c6e27Sflorian if(is_referral) { 1066ae8c6e27Sflorian /* store rrsets */ 1067ae8c6e27Sflorian struct rrset_ref ref; 1068ae8c6e27Sflorian size_t i; 1069ae8c6e27Sflorian for(i=0; i<rep->rrset_count; i++) { 1070ae8c6e27Sflorian packed_rrset_ttl_add((struct packed_rrset_data*) 1071ae8c6e27Sflorian rep->rrsets[i]->entry.data, *env->now); 1072ae8c6e27Sflorian ref.key = rep->rrsets[i]; 1073ae8c6e27Sflorian ref.id = rep->rrsets[i]->id; 1074ae8c6e27Sflorian /*ignore ret: it was in the cache, ref updated */ 1075ae8c6e27Sflorian /* no leeway for typeNS */ 1076ae8c6e27Sflorian (void)rrset_cache_update(env->rrset_cache, &ref, 10776d08cb1bSflorian env->alloc, 1078ae8c6e27Sflorian ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS 10796d08cb1bSflorian && !pside) ? qstarttime:*env->now + leeway)); 1080ae8c6e27Sflorian } 1081*d500c338Sflorian reply_info_delete(rep, NULL); 1082ae8c6e27Sflorian return 1; 1083ae8c6e27Sflorian } else { 1084ae8c6e27Sflorian /* store msg, and rrsets */ 1085ae8c6e27Sflorian struct query_info qinf; 1086ae8c6e27Sflorian hashvalue_type h; 1087ae8c6e27Sflorian 1088ae8c6e27Sflorian qinf = *msgqinf; 1089ae8c6e27Sflorian qinf.qname = memdup(msgqinf->qname, msgqinf->qname_len); 1090ae8c6e27Sflorian if(!qinf.qname) { 1091ae8c6e27Sflorian reply_info_parsedelete(rep, env->alloc); 1092ae8c6e27Sflorian return 0; 1093ae8c6e27Sflorian } 1094ae8c6e27Sflorian /* fixup flags to be sensible for a reply based on the cache */ 1095ae8c6e27Sflorian /* this module means that RA is available. It is an answer QR. 1096ae8c6e27Sflorian * Not AA from cache. Not CD in cache (depends on client bit). */ 1097ae8c6e27Sflorian rep->flags |= (BIT_RA | BIT_QR); 1098ae8c6e27Sflorian rep->flags &= ~(BIT_AA | BIT_CD); 1099ae8c6e27Sflorian h = query_info_hash(&qinf, (uint16_t)flags); 1100ae8c6e27Sflorian dns_cache_store_msg(env, &qinf, h, rep, leeway, pside, msgrep, 11016d08cb1bSflorian flags, region, qstarttime); 1102ae8c6e27Sflorian /* qname is used inside query_info_entrysetup, and set to 1103ae8c6e27Sflorian * NULL. If it has not been used, free it. free(0) is safe. */ 1104ae8c6e27Sflorian free(qinf.qname); 1105ae8c6e27Sflorian } 1106ae8c6e27Sflorian return 1; 1107ae8c6e27Sflorian } 1108ae8c6e27Sflorian 1109ae8c6e27Sflorian int 1110ae8c6e27Sflorian dns_cache_prefetch_adjust(struct module_env* env, struct query_info* qinfo, 1111ae8c6e27Sflorian time_t adjust, uint16_t flags) 1112ae8c6e27Sflorian { 1113ae8c6e27Sflorian struct msgreply_entry* msg; 1114ae8c6e27Sflorian msg = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, 1115ae8c6e27Sflorian qinfo->qtype, qinfo->qclass, flags, *env->now, 1); 1116ae8c6e27Sflorian if(msg) { 1117ae8c6e27Sflorian struct reply_info* rep = (struct reply_info*)msg->entry.data; 1118ae8c6e27Sflorian if(rep) { 1119ae8c6e27Sflorian rep->prefetch_ttl += adjust; 1120ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1121ae8c6e27Sflorian return 1; 1122ae8c6e27Sflorian } 1123ae8c6e27Sflorian lock_rw_unlock(&msg->entry.lock); 1124ae8c6e27Sflorian } 1125ae8c6e27Sflorian return 0; 1126ae8c6e27Sflorian } 1127